On Thu, Mar 19, 2015 at 09:27:12AM +0000, tom greisch wrote:
Yesterday i have compiled Freeradius 2.2.6 and configured for ntlm_auth against an Active Directory. Everything seems ok. After testing i have redirected our WLAN Controller (with thousands of Clients) to the new Radius Server and the Server was overloaded immediately.
We have thousands of clients - but that's not the issue; its the number of authentications per second that you need to watch. Current limit is more than around 30 auths/second and you'll probably hit issues.
So i activated the Logging for Samba an i got this: ---------------------------------------------------- [2015/03/18 16:59:50.848834, 0] ../source3/lib/util.c:896(log_stack_trace) BACKTRACE: 21 stack frames: #0 /usr/lib/x86_64-linux-gnu/libsmbconf.so.0(log_stack_trace+0x1a) [0x7f60a79bb2ca] ... smb_panic(): action returned status 0 [2015/03/18 16:59:50.860457, 0] ../source3/lib/dumpcore.c:317(dump_core) dumping core in /var/log/samba/cores/winbindd---------------------------------------------------------------------------------
At this Point its clear, that it is not a Freeradius Problem. Its a Samba Problem!
No, the usual case is a FreeRADIUS problem. At least, in the way people authenticate against Samba, not in the FreeRADIUS code itself. Looks to me like you may have hit a different bug in winbind. Try running ntlm_auth from the command line and see if it gives the same problem.
I am lucky because i found a BUG Report at the Samba Site released onyl few Days ago (2015-03-10). The Problem persists for more than one Year. The BUG is: https://bugzilla.samba.org/show_bug.cgi?id=11149
That is my bug report. It has nothing to do with the ntlm_auth binary.
The Bug Report says that you have to start Freeradius with the "-t" Option to disable Threads because Samba 4.1.X is not able to handle threads. So we have to hope that samba 4.2 will fix the Problem.
No, it doesn't say that, and you shouldn't do that. It will kill performance. Use ntlm_auth if you can't use the new patches (which aren't released yet anyway).
Until that, i decided to clone the Radius Server twice , start with "-t" Flag and set a "Freeradius Loadbalancer" bevor the "Worker Radius Server". Now i can handle the Load !
If you can run three separate FreeRADIUS instances in non-threaded mode, you should easily be able to run one in threaded mode with ntlm_auth. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>