duplicate errors in an active directory setup
Hi all, I'm using FreeRadius 2.1.8 to authenticate wifi users againts an Active Directory. The setup consists on samba, kerberos and freeradius. All seem to be working well but FreeRadius logs are full of the following errors: Mon Mar 15 18:57:09 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 85 due to unfinished request 28810 Mon Mar 15 18:57:14 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 85 due to unfinished request 28810 Mon Mar 15 18:57:19 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 85 due to unfinished request 28810 Mon Mar 15 18:57:24 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 85 due to unfinished request 28810 Mon Mar 15 18:57:28 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 86 due to unfinished request 28823 Mon Mar 15 18:57:33 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 86 due to unfinished request 28823 I don't know if it is a common issue in a deployment based on active directory or if something could be wrong. Winbind also gives me a lot of warning/errors: Mar 16 16:20:24 radius01 winbindd[2640]: [2010/03/16 16:20:24, 0] libsmb/credentials.c:creds_client_check(324) Mar 16 16:20:24 radius01 winbindd[2640]: creds_client_check: credentials check failed. Mar 16 16:20:24 radius01 winbindd[2640]: [2010/03/16 16:20:24, 0] rpc_client/cli_netlogon.c:rpccli_netlogon_sam_network_logon(1019) Mar 16 16:20:24 radius01 winbindd[2640]: rpccli_netlogon_sam_network_logon: credentials chain check failed Mar 16 16:20:24 radius01 winbindd[2640]: [2010/03/16 16:20:24, 0] libsmb/cliconnect.c:cli_session_setup_spnego(859) Mar 16 16:20:24 radius01 winbindd[2640]: Kinit failed: KDC reply did not match expectations Mar 16 16:22:59 radius01 winbindd[19653]: [2010/03/16 16:22:59, 0] libsmb/cliconnect.c:cli_session_setup_spnego(859) Mar 16 16:22:59 radius01 winbindd[19653]: Kinit failed: KDC reply did not match expectations Mar 16 16:22:59 radius01 winbindd[2640]: [2010/03/16 16:22:59, 0] libsmb/credentials.c:creds_client_check(324) Mar 16 16:22:59 radius01 winbindd[2640]: creds_client_check: credentials check failed. Mar 16 16:22:59 radius01 winbindd[2640]: [2010/03/16 16:22:59, 0] rpc_client/cli_netlogon.c:rpccli_netlogon_sam_network_logon(1019) Mar 16 16:22:59 radius01 winbindd[2640]: rpccli_netlogon_sam_network_logon: credentials chain check failed Mar 16 16:22:59 radius01 winbindd[2640]: [2010/03/16 16:22:59, 0] libsmb/cliconnect.c:cli_session_setup_spnego(859) Mar 16 16:22:59 radius01 winbindd[2640]: Kinit failed: KDC reply did not match expectations Mar 16 16:27:59 radius01 winbindd[19665]: [2010/03/16 16:27:59, 0] libsmb/cliconnect.c:cli_session_setup_spnego(859) Mar 16 16:27:59 radius01 winbindd[19665]: Kinit failed: KDC reply did not match expectations Mar 16 16:33:00 radius01 winbindd[19731]: [2010/03/16 16:33:00, 0] libsmb/cliconnect.c:cli_session_setup_spnego(859) Mar 16 16:33:00 radius01 winbindd[19731]: Kinit failed: KDC reply did not match expectations Authentication is working but i don't know if i should be worried about these logs. Can you tell me? Thanks in advance, -- Christian Pinedo Zamalloa (zako) PGP keyID: 0x828D0C80 Fingerprint: 7BFF 4105 F46B 7977 BD96 348C 1007 4FF8 828D 0C80
Christian Pinedo Zamalloa wrote:
I'm using FreeRadius 2.1.8 to authenticate wifi users againts an Active Directory. The setup consists on samba, kerberos and freeradius. All seem to be working well but FreeRadius logs are full of the following errors:
Mon Mar 15 18:57:09 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 85 due to unfinished request 28810
Something is blocking the server. Find out what it is, and fix it.
I don't know if it is a common issue in a deployment based on active directory or if something could be wrong. Winbind also gives me a lot of warning/errors:
Mar 16 16:20:24 radius01 winbindd[2640]: [2010/03/16 16:20:24, 0] libsmb/credentials.c:creds_client_check(324) Mar 16 16:20:24 radius01 winbindd[2640]: creds_client_check: credentials check failed.
Does ntlm_auth work at *all*? Follow this guide: http://deployingradius.com/documents/configuration/active_directory.html Alan DeKok.
Hi,
Mon Mar 15 18:57:09 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 85 due to unfinished request 28810 Mon Mar 15 18:57:14 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 85 due to unfinished request 28810 Mon Mar 15 18:57:19 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 85 due to unfinished request 28810 Mon Mar 15 18:57:24 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 85 due to unfinished request 28810 Mon Mar 15 18:57:28 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 86 due to unfinished request 28823 Mon Mar 15 18:57:33 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 86 due to unfinished request 28823
something is blocking the threads.... you may ned to increase debugging to see what/where.
I don't know if it is a common issue in a deployment based on active directory or if something could be wrong. Winbind also gives me a lot of warning/errors:
i those are a ncie load of errors. does using 'kinit' work? does using ntlm_auth work? alan
It is strange because ntlm_auth is working, is the only method to authenticate users to access WiFi network and all the days are 20-30 users connected. I think that could be something related to a network issue or an active directory issue. 2010/3/16 Alan Buxey <A.L.M.Buxey@lboro.ac.uk>
Hi,
Mon Mar 15 18:57:09 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 85 due to unfinished request 28810 Mon Mar 15 18:57:14 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 85 due to unfinished request 28810 Mon Mar 15 18:57:19 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 85 due to unfinished request 28810 Mon Mar 15 18:57:24 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 85 due to unfinished request 28810 Mon Mar 15 18:57:28 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 86 due to unfinished request 28823 Mon Mar 15 18:57:33 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 86 due to unfinished request 28823
something is blocking the threads.... you may ned to increase debugging to see what/where.
I don't know if it is a common issue in a deployment based on active
directory or if something could be wrong. Winbind also gives me a lot of warning/errors: i
those are a ncie load of errors. does using 'kinit' work? does using ntlm_auth work?
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Christian Pinedo Zamalloa (zako) PGP keyID: 0x828D0C80 Fingerprint: 7BFF 4105 F46B 7977 BD96 348C 1007 4FF8 828D 0C80
After some debug I discovered that it was not an authentication problem but an accounting problem. I was doing a proxy to store accounting data in a remote radius server, but port 1813 of that radius server was shutdown and so my server tried to send accouting information without success until timeout. After several seconds without response the radius client sent again the same radius request to my server and it was discarded generating the errors logs because it was trying to proxy the request to the remote server. Thanks for your help, it has been very helpful 2010/3/17 Christian Pinedo Zamalloa <chr.pinedo@gmail.com>
It is strange because ntlm_auth is working, is the only method to authenticate users to access WiFi network and all the days are 20-30 users connected. I think that could be something related to a network issue or an active directory issue.
2010/3/16 Alan Buxey <A.L.M.Buxey@lboro.ac.uk>
Hi,
Mon Mar 15 18:57:09 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 85 due to unfinished request 28810 Mon Mar 15 18:57:14 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 85 due to unfinished request 28810 Mon Mar 15 18:57:19 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 85 due to unfinished request 28810 Mon Mar 15 18:57:24 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 85 due to unfinished request 28810 Mon Mar 15 18:57:28 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 86 due to unfinished request 28823 Mon Mar 15 18:57:33 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 86 due to unfinished request 28823
something is blocking the threads.... you may ned to increase debugging to see what/where.
I don't know if it is a common issue in a deployment based on active
directory or if something could be wrong. Winbind also gives me a lot of warning/errors: i
those are a ncie load of errors. does using 'kinit' work? does using ntlm_auth work?
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Christian Pinedo Zamalloa (zako) PGP keyID: 0x828D0C80 Fingerprint: 7BFF 4105 F46B 7977 BD96 348C 1007 4FF8 828D 0C80
-- Christian Pinedo Zamalloa (zako) PGP keyID: 0x828D0C80 Fingerprint: 7BFF 4105 F46B 7977 BD96 348C 1007 4FF8 828D 0C80
participants (3)
-
Alan Buxey -
Alan DeKok -
Christian Pinedo Zamalloa