Hallo everybody, As far as i know, Freeradius only act as a AAA server. so do you guys have preference for which radius client that I can use? Or can I use freeradius also as Radius client also? Many thanks for your help san __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com
San wrote:
Hallo everybody,
As far as i know, Freeradius only act as a AAA server. so do you guys have preference for which radius client that I can use? Or can I use freeradius also as Radius client also?
FreeRADIUS ships with a radius client. If you want to do EAP testing, my preferred tool is eapol_test from wpa_supplicant. josh.
Hi Josh, Thanks a lot for quick reply. I have another question then, how do I invoke this client? I already install the freeradius in the other computer (acting as client) do I just use radclient command or? I want to see how they interact (server and client) What I got until now is the server succesfully authenticate the client by sending access_accept. And afterwards I still confused how to see the process. I want to extend the functionality of the client, so I need to know which file that i must extend. Many many thanks for the help San --- Josh Howlett <josh.howlett@bristol.ac.uk> wrote:
FreeRADIUS ships with a radius client.
If you want to do EAP testing, my preferred tool is eapol_test from wpa_supplicant.
josh.
__________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com
Hi,
I have another question then, how do I invoke this client? I already install the freeradius in the other computer (acting as client) do I just use radclient command or? I want to see how they interact (server and client) What I got until now is the server succesfully authenticate the client by sending access_accept. And afterwards I still confused how to see the process. I want to extend the functionality of the client, so I need to know which file that i must extend.
what exactly do you want the FreeRADIUS test client to do? as it comes, it will just take back an Accept or Reject response from the server... do you wish the client to actually do something like allow the system to be on the network? if so you need to wrap radclient into some script.... or use a proper dot1x client and set up the networking environment accordingly. to 'SEE' the process you should be looking at the logs on the server...or turn on the debugging ( eg radiusd -X ) on the server to see whats going on. alan
Hi Alan, Thanks for the help. Also, what I really want to do is that I want radclient to do calculation like in the prepaid billing. So, when the client receive access_accept from the server, then it start the calculation. and after sometime report the result to the server. And the server will respond according to the message. I think what i need to extend is the radclient file into some script right? or maybe other suggestion or other file? And for the process interaction that i want to see (between client and server) is for example the case of session timeout. How do i see if the client sending the message to the server.How do I make untill all of these information show in let say tcpdump. In the debug out (when i run radiusd -X) it only written "Nothing to do. Sleeping until we see a request." Am I do something wrong or miss some important thing? Fyi, I am using linux box for my client. Many thanks for your help san --- A.L.M.Buxey@lboro.ac.uk wrote:
what exactly do you want the FreeRADIUS test client to do? as it comes, it will just take back an Accept or Reject response from the server... do you wish the client to actually do something like allow the system to be on the network? if so you need to wrap radclient into some script.... or use a proper dot1x client and set up the networking environment accordingly. to 'SEE' the process you should be looking at the logs on the server...or turn on the debugging ( eg radiusd -X ) on the server to see whats going on.
alan
__________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com
Hi,
Also, what I really want to do is that I want radclient to do calculation like in the prepaid billing. So, when the client receive access_accept from the server, then it start the calculation. and after sometime report the result to the server. And the server will respond according to the message.
oh. generally you do all the accounting and pre-paid stuff and timing of sessions etc on the SERVER. all the required bits are already there. various rlm_* modules that can interface nicely to a database backend etc.
And for the process interaction that i want to see (between client and server) is for example the case of session timeout. How do i see if the client sending the message to the server.How do I make untill all of these information show in let say tcpdump.
you can see the stuff with tcpdump (in the usual way) but there are special filters for RADIUS in ethereal package - which some people prefer to use when looking at the network stuff. you could look at the server end still - since you can see all the into that the server sends and that the server receives. if you have a problem with the network so that packets dont arrive than thats another issue altogether.
In the debug out (when i run radiusd -X) it only written
"Nothing to do. Sleeping until we see a request."
ah. if you are ONLY seeing this and yet you are trying to run the radclient on another box...then the packets arent arriving to the server. in this case perhaps there is a firewall in the way (usual suspect and reason). if you have misconfigured the client/server relationship (wrong passphrase etc) then you would see info...and it would tell you! alan
Hi Alan, Thanks a lot for your help to explain this to me.
oh. generally you do all the accounting and pre-paid stuff and timing of sessions etc on the SERVER. all the required bits are already there. various rlm_* modules that can interface nicely to a database backend etc.
But I still have this puzzle inside my head :) My scenario is that the client will do some meassurement after it receive access_accept from server. I think I can trigger this by writing shell script when the packet access_accept received. (am i right?) Second question : How do I learn to use the command line to run client? I just using this command to send access_request for user name Maria, # echo "User-Name = Maria, User-Password = testing" | radclient 10.1.0.76 auth testing123 How do I find other command to start and stop accounting? I think I can use the same command like above just change the auth become acct. But the problem is how do i tell the server that I want to stop the acct session?
And for the process interaction that i want to see (between client and server) is for example the case of session timeout. How do i see if the client sending the message to the server.How do I make untill all of these information show in let say tcpdump.
you can see the stuff with tcpdump (in the usual way) but there are special filters for RADIUS in ethereal package - which some people prefer to use when looking at the network stuff. you could look at the server end still - since you can see all the into that the server sends and that the server receives. if you have a problem with the network so that packets dont arrive than thats another issue altogether.
In the debug out (when i run radiusd -X) it only written
"Nothing to do. Sleeping until we see a request."
ah. if you are ONLY seeing this and yet you are trying to run the radclient on another box...then the packets arent arriving to the server. in this case perhaps there is a firewall in the way (usual suspect and reason). if you have misconfigured the client/server relationship (wrong passphrase etc) then you would see info...and it would tell you!
alan
I finally make progres so the server send this access-Accept to the client. Sending Access-Accept of id 131 to 10.1.0.15:32768 Framed-Protocol = PPP Session-Timeout = 600 Login-Service = Telnet Idle-Timeout = 360 But why the session-TImeout is not working? I already set this attributes in users file. seems no sign that it works. How do I see if the time already passed, the client will be disconnected from server? Sorry for long questions. I really apreciate if you want to answer them. Have a great weekend San __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com
Hi,
server. I think I can trigger this by writing shell script when the packet access_accept received. (am i right?)
you can do. if the reply conatins whatever string you want...
Second question : How do I learn to use the command line to run client?
man radclient at the bottom of that man page is a trivial example much like what you are testing with
# echo "User-Name = Maria, User-Password = testing" | radclient 10.1.0.76 auth testing123
How do I find other command to start and stop accounting? I think I can use the same command like above just change the auth become acct. But the problem is how do i tell the server that I want to stop the acct session?
attribute types help here. I would recommend reading some detailed material on RADIUS. there are many online resources and FreeRADIUS itself has plentiful documentation
Sending Access-Accept of id 131 to 10.1.0.15:32768 Framed-Protocol = PPP Session-Timeout = 600 Login-Service = Telnet Idle-Timeout = 360
But why the session-TImeout is not working?
I would guess because you arent dealing with, for example, a NAS or checking the RADIUS status before denying/allowing actions.
How do I see if the time already passed, the client will be disconnected from server?
ideally you run a full AAA piece of software or control box. without a lot of external wrappers, radclient isnt the all-singing NAS tool that I believe you think it is. the man page also explains what radclient is. alan
participants (4)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Josh Howlett -
San