- Freeradius-Users - lists.freeradius.org

FreeRADIUS performance Issue
by QASIM RAO 06 Feb '13

06 Feb '13

Hi, I am performing performance test on may RADIUS server and having a problem in result... i am using java code for sending 100 concrent requests on my RADIUS server in log i got some chunks taking so much time more than 3 seconds and remaing requests are tacking normal time les than 1 minut. i test after redusing no of request... over all time reduces but chucks are still there.. :( and also mysql is establishing too many connection arround 60 to 70 connections... :( Please help me in this.. Regards: Rao Qasim

2 1

Re: Degradation of service when authentication fails with Windows AD
by Antonio Alberola 06 Feb '13

06 Feb '13

Hi, >> I'm having random authentication failures and I think they are due to >> a Radius server internal failure. I use Radius for authenticating the >> email of users in Windows Active Directory via PAM. Before I used NTLM >> and Kerberos together, and now I use PAM. > > This is confusing. FreeRADIUS is calling the "pam" module, yes? So what is the PAM stack calling? That's correct. I need RADIUS for authenticating POSTFIX users because the authentication depends on the POSTFIX users, via PAM (WINDOWS AD) or UNIX account. I also have many WINDOWS Domain and we need send the credentials to the correct one. > In short: the problem you are experiencing with FreeRADIUS is because > your authentication mechanism (PAM) is taking too long to respond. > This is consuming all threads in the pool, which explains the log messages you see. > > Fix the PAM stack to fail over properly, and this problem will go away. I understand that the PAM mechanism is slow, some domains more than others. But, I don't understand why RADIUS doesn't clean this request with some timeout mechanisms. It's very simple to create a script for crashing the server with a DoS attack. I need a configuration parameter to deny the request if PAM module doesn't respond on time. Why es RADIUS server accepting duplicate requests for queries that have already been sent to it? This is the cause of all threads are busy, correct?

2 1

free radius output attributes configuration
by Lakshmi Narayana Baliah 06 Feb '13

06 Feb '13

Hi All, How can configure output attributes in free-radius? How do i do that ??? please help.... Thanks Lakshmi ============================================================================================================================ Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/tim/disclaimer.html">http://tim.techmahindra.com/tim/disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

3 2

PAM error on reboot of the RADIUS client
by Deepti kulkarni 06 Feb '13

06 Feb '13

Hello, I have a debian machine that acts as RADIUS client talking with the Freeradius server. I have configured PAM on the client, so made following changes. 1 - Added radiusd to /etc/pam.d which contains - @include common-auth @include common-account @include common-password @include common-session 2 - Added following line to /etc/pam.d/common_auth auth sufficient pam_radius_auth.so 3 - Added following line to /etc/pam.d/common_account account required pam_radius_auth.so 4- Added following line to /etc/pam.d/common_session session required pam_radius_auth.so 5 - Added server-ip and secret key to /etc/pam_radius_auth.conf Authentication and accounting works fine after I configure the above on the client. As soon as I reboot client, login fails with error - "cannot make/remove an entry for the specified session". Cannot login into the client. Thanks

2 4

Re: radiusd running config - is it possible to display
by Alan Buxey 05 Feb '13

05 Feb '13

? It's all on disk. And if that's changed since the server was run then radiusd -X won't help. You know you can run a check/verify instance...? And that using radmin you can check the configuration of particular modules in the current running instance? alan

1 0

radiusd running config - is it possible to display
by Bertalan Voros 05 Feb '13

05 Feb '13

Hello All, Is it possible to display the running config of freeradius without having to capture the output of radiusd -X? Best regards, Bertalan

1 0

Degradation of service when authentication fails with Windows AD
by Antonio Alberola 05 Feb '13

05 Feb '13

Dear All, I'm having random authentication failures and I think they are due to a Radius server internal failure. I use Radius for authenticating the email of users in Windows Active Directory via PAM. Before I used NTLM and Kerberos together, and now I use PAM. I use FreeRADIUS version 2.1.12 that includes CentOS 6 repositories. This is the description of the machine, host x86_64-redhat-linux-gnu 2.6.32-279.14.1.el6.x86_64 CentOS release 6.3 (Final) The problem is as follows. Users authenticate properly during the whole day, but suddenly authentication begins to fail and user authentication error appears even if the credentials are right. Since the failure, the service is exponentially degrade and it only validates 1 of every 20 requests. The onset of failure seems to coincide with one of these three messages: Tue Jan 30 08:27:38 2013 : Error: Received conflicting packet from client localhost port 14038 - ID: 194 due to unfinished request 161451. Giving up on old request. Tue Jan 30 08:27:52 2013 : Error: Request 161507 has been waiting in the processing queue for 11 seconds. Check that all databases are running properly! Fri Feb 1 14:55:15 2013 : Info: WARNING: Child is hung for request 3609 in component <core> module <queue>. The solution we are applying at the moment is restarting Radius. Sometimes restarting does not fix the problem and we have to set Radius for allowing all connections. Few minutes later, we turn it back to the current configuration and it works again. The biggest drawback, besides annoyance of users, is Windows AD accounts are blocked because of the failures. I need help to find the cause of the problem and fix it. I do not know yet if the problem is in the domain controllers, in the PAM module or in Radius. But everything seems to point to Radius. Thank you very much. Antonio Alberola.

4 3

user session & accounting mgmt
by Suresh Kumar Subramanian 05 Feb '13

05 Feb '13

Hi, I am newbie and I have couple of questions in the free radius. 1) How do we maintain the session time in free radius? For example, a given user the session time is configured for 1 hour. After 1 hour, radius server should initiate "Session disconnect message" for the user to the NAS. I understand that, Freeradius does support "session disconnect message", but we can achieve this with radclient utility. Ref: http://wiki.freeradius.org/protocol/Disconnect-Messages Here my problem is, how the session timeout is identified to trigger this disconnect message? Please help. 2) where freeradius logs the accounting information? I have not configured the mysql. Does freeradius supports flat file for storing accounting records.? Thanks Suresh.

2 1

stored procedure value for access-reject in free radius
by Lakshmi Narayana Baliah 05 Feb '13

05 Feb '13

Hi all, I want to configure the free radius to return access-reject based on the value in stored procedure in oracle database( i have configured oracle database to free radius) How do i do that ??? please help.... Lakshmi narayana | Prod Engineering | Tech Mahindra #9/7 Hosur Road,Bangalore-560029 /Office: +91 80 40243000, Extn: 3486 | Mobile: +91 9060867386 Email:lb0074453@techmahindra.com www.techmahindra.com ============================================================================================================================ Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/tim/disclaimer.html">http://tim.techmahindra.com/tim/disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

3 2

EAP-success Id mis-match?
by Cao,Zhen (cz) 05 Feb '13

05 Feb '13

Hi All, I am using freeradius-2.2.0 and configure it as EAP authentication server. I met some problem of the EAP authentication. Could you help take a look? Thanks in advance. The phenomenon I encounter in an EAP-SIM exchange is as below, peer denotes the client, and AAA denotes the freeradius. 1. peer-->AAA, with EAP-response (id=0) – in response to EAP-identity 2.AAA-->peer, with EAP-request (id=119) 3.peer-->AAA, with EAP-response(id=119) 4.AAA-->peer, with EAP-request (id=120) 5.peer-->AAA, with EAP-response(id=120) 6. AAA-->peer, Access-Accept, with EAP-success (id=121) EAP-success with id that is different from the one in message #5. Should the client regards the authentication as successful? I found some client did not do in this way and re-send the message 5 (and then AAA replies with access reject), and some client do regard it as success I test with some other AAA server and some indeed do not increase the message id in the EAP-success, and in this case the authentication passed. What’s the standard way then? Thanks very much for the kind help! Thanks and regards, Zhen

2 3