<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Alan DeKok wrote:
<blockquote cite="mid20060929165418.6A71F16DDE@mail.nitros9.org"
type="cite">
<pre wrap="">Jason Wittlin-Cohen <a class="moz-txt-link-rfc2396E" href="mailto:jasonwc@brandeis.edu"><jasonwc@brandeis.edu></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Over the last few days I've been having a recurring problem. Whenever I
start Freeradius either with radiusd in a terminal or as a service in
Debian, I can not restart/kill radiusd properly if it's authenticated
any clients. Restarting the service says it's successful but the radius
log states that port 1812 is already in use. "top" shows 100% cpu usage
</pre>
</blockquote>
<pre wrap=""><!---->
It looks like <a class="moz-txt-link-freetext" href="http://bugs.freeradius.org/show_bug.cgi?id=365">http://bugs.freeradius.org/show_bug.cgi?id=365</a>
The solution is to not re-initialize the modules on HUP.
It works in *most* cases, because the code handling the HUP tries to
wait until all of the modules have stopped. But if your back-end DB's
are slow, it doesn't have much choice but to proceed with handling the
HUP.
Most people don't see it because the modules respond quickly. I'd
say the first step to a work-around is to make sure none of the
modules you're using are blocking the server.
</pre>
</blockquote>
<blockquote cite="mid20060929165418.6A71F16DDE@mail.nitros9.org"
type="cite">
<pre wrap="">
Alan DeKok.
--
<a class="moz-txt-link-freetext" href="http://deployingradius.com">http://deployingradius.com</a> - The web site of the book
<a class="moz-txt-link-freetext" href="http://deployingradius.com/blog/">http://deployingradius.com/blog/</a> - The blog
-
List info/subscribe/unsubscribe? See <a class="moz-txt-link-freetext" href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a>
</pre>
</blockquote>
I have discovered the root of the problem. When I enable the
"check_cert_cn = %{User-Name}" option in eap.conf and successfully
authenticate 1 user , a restart or stop of the radiusd service leads to
a zombie process which needs to be killed with "kill -9". If this
option is disabled, as is the default setting, radiusd can be restarted
normally without issue. This issue does not occur if either a) no users
have attempted to authenticate, or b) users have authenticated but were
rejected. Is this a known issue?<br>
<br>
Jason Wittlin-Cohen<br>
<br>
<br>
<br>
<br>
<br>
</body>
</html>