redundant load balancing and mschap
Grrr... This is probably a Samba issue - a known one? - but I can't seem to get AD authentications to hit multiple DCs. Everything goes to the one listed in /etc/samba/smb.conf (which may be a coincidence). I set up several mschap instances like so: mschap mschap1 { ... ntlm_auth -s /etc/samba/radius.smb1.conf } mschap mschap2 { ... ntlm_auth -s /etc/samba/radius.smb2.conf } mschap mschap3 { ... ntlm_auth -s /etc/samba/radius.smb3.conf } I also disabled all PAP, CHAP, and references to "mschap" in all virtual servers listed in sites-enabled. There is currently no "mschap { ... }" section in modules/mschap. Added this to sites-enabled/campus-inner-tunnel where "mschap" was before: redundant-load-balance { mschap1 mschap2 mschap3 } Authentication *works*, but all authentications go to the same DC (the one specified in "mschap2"). Running "radiusd -X" shows that all mschap1/2/3 instances are being called, and no authentication *attempts* are being sent to the other two domain controllers. (1 and 3 aren't failing. They just aren't *tried*.) Am I going about this all the wrong way? Is this a known limitation in Samba? Is there something about ntlm_auth that always references /etc/samba/smb.conf, regardless of the -s option? Comments and criticisms welcome. --J
McNutt, Justin M. wrote:
Grrr...
This is probably a Samba issue - a known one? - but I can't seem to get AD authentications to hit multiple DCs. Everything goes to the one listed in /etc/samba/smb.conf (which may be a coincidence).
That's how the NT protocols work, IIRC. You need to set up cross-domain trusts from on DC to another.
Am I going about this all the wrong way? Is this a known limitation in Samba? Is there something about ntlm_auth that always references /etc/samba/smb.conf, regardless of the -s option?
Ask the Samba people how Samba works. Alan DeKok.
Hi,
Authentication *works*, but all authentications go to the same DC (the one specified in "mschap2"). Running "radiusd -X" shows that all mschap1/2/3 instances are being called, and no authentication *attempts* are being sent to the other two domain controllers. (1 and 3 aren't failing. They just aren't *tried*.)
i would advise to increase debuggin in smbd/winbindd and for ntlm_auth also check your samba and kerberos configs to see how you are querying the KDC - are you specifying particular names? It could be that your client did a DNS lookup, cached that answer and doesnt want to use anything else - a few entries in /etc/hosts might be in order alan
Alan D. and Alan B. are correct. Whatever this is, it isn't FreeRADIUS that isn't behaving. Radiusd -XC shows that pretty conclusively. At this point, if any of you are using Samba/ntlm_auth to handle the back-end authentication for FreeRADIUS, your advice is welcome, but it's definitely a Samba issue at this point. (Possibly even a Kerberos issue, though the way Samba does Kerberos is a little... odd...) Fortunately, the only Samba-related daemons actually running on my FR host are the two instances of winbindd. Smbd and nmbd are not in the process list. (Actually, my server admins have been doing their jobs. There isn't much in the process list AT ALL. But I digress...) Attempts to use the -s option with ntlm_auth to force the "password server" option in smb.conf to vary have failed. Setting multiple servers in the main smb.conf is an option: password server = server1 server2 server3 ...however, ntlm_auth doesn't seem to use them. For whatever reason, it seems to always talk to server1, even when only server2 is listed in any config file I can find. Queries to domain controllers on port 3269 DO seem to round-robin, though I couldn't tell you why for sure. Any advice is welcome, though technically off-topic at this point. I'm going to have to hack on Samba until it gives me what I want. --J -----Original Message----- From: freeradius-users-bounces+mcnuttj=missouri.edu@lists.freeradius.org [mailto:freeradius-users-bounces+mcnuttj=missouri.edu@lists.freeradius.org] On Behalf Of alan buxey Sent: Friday, August 24, 2012 3:59 PM To: FreeRadius users mailing list Subject: Re: redundant load balancing and mschap Hi,
Authentication *works*, but all authentications go to the same DC (the one specified in "mschap2"). Running "radiusd -X" shows that all mschap1/2/3 instances are being called, and no authentication *attempts* are being sent to the other two domain controllers. (1 and 3 aren't failing. They just aren't *tried*.)
i would advise to increase debuggin in smbd/winbindd and for ntlm_auth also check your samba and kerberos configs to see how you are querying the KDC - are you specifying particular names? It could be that your client did a DNS lookup, cached that answer and doesnt want to use anything else - a few entries in /etc/hosts might be in order alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 08/24/2012 08:11 PM, McNutt, Justin M. wrote:
Grrr... This is probably a Samba issue - a known one? - but I can't seem to get AD authentications to hit multiple DCs. Everything goes to the one
This is indeed a Samba issue, and unfortunately a hard one to fix. ntlm_auth doesn't talk over the network - rather, it talks over a Unix socket to winbind. Winbind maintains a *single* open session to a DC, and sends all the domain RPCs down this pipe. Winbind discovers the DC from the AD subnet/site queries and builds an app-specific kerberos config that will show you this - see /var/lib/samba/smb_krb5/krb5.conf.<DOMNAME> If you want to force connections to separate domain controllers, you'll need separate smbd/winbindd instances running, with their own unix sockets and smb.conf setups. This will probably be hard, and fragile. My advice - don't, unless you really really need to.
The underlying problem is that I have four production RADIUS servers that all seem to choose the same domain controller, which is not only a lot of load, but it's a bad idea in terms of fault tolerance. I may try just making each server "choose" a separate DC as its default, for starters, which would get me most of the way there. The wireless controllers that authenticate against the RADIUS servers *themselves* round-robin among the RADIUS servers, so if one of them - or even two of them - were talking to a DC that is down, a given user's machine is likely to re-attempt authentication and succeed eventually. We'd hear a lot of complaints that "getting on wireless is slow" but things would *work*. Anyway, thanks for the insight. I'll keep banging on it. If I get an elegant - or at least *stable* - configuration, I'll post something about it here. --J -----Original Message----- From: freeradius-users-bounces+mcnuttj=missouri.edu@lists.freeradius.org [mailto:freeradius-users-bounces+mcnuttj=missouri.edu@lists.freeradius.org] On Behalf Of Phil Mayers Sent: Friday, August 24, 2012 4:23 PM To: freeradius-users@lists.freeradius.org Subject: Re: redundant load balancing and mschap On 08/24/2012 08:11 PM, McNutt, Justin M. wrote:
Grrr... This is probably a Samba issue - a known one? - but I can't seem to get AD authentications to hit multiple DCs. Everything goes to the one
This is indeed a Samba issue, and unfortunately a hard one to fix. ntlm_auth doesn't talk over the network - rather, it talks over a Unix socket to winbind. Winbind maintains a *single* open session to a DC, and sends all the domain RPCs down this pipe. Winbind discovers the DC from the AD subnet/site queries and builds an app-specific kerberos config that will show you this - see /var/lib/samba/smb_krb5/krb5.conf.<DOMNAME> If you want to force connections to separate domain controllers, you'll need separate smbd/winbindd instances running, with their own unix sockets and smb.conf setups. This will probably be hard, and fragile. My advice - don't, unless you really really need to. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 08/24/2012 11:53 PM, McNutt, Justin M. wrote:
The underlying problem is that I have four production RADIUS servers that all seem to choose the same domain controller, which is not only a lot of load, but it's a bad idea in terms of fault tolerance.
I agree about the fault tolerance. In my experience, winbind actually has pretty poor failure-mode characteristics. If the DC it has a connection to goes down, it can take a noticeable amount of time (in excess of a minute; I've seen over three) to detect and fail over to another DC. Re: load - well, that's site dependent I guess. FWIW the load from our FR servers is a tiny, tiny fraction of the total even at the very busiest times.
Anyway, thanks for the insight. I'll keep banging on it. If I get an elegant - or at least *stable* - configuration, I'll post something about it here.
To be honest, without some pretty major surgery to winbind, I think per-server "password_server" config is going to be the best you can do :o( I occasionally wonder about getting the Samba guys interested in improving this, but it's not something I really have the time to take up.
Because there are so many "files" (pipes, actual files, etc.) whose locations are hard-coded into winbind, the only way to even begin to try to run multiple instances of winbind would be through chroot-ed setups, which would probably mean that ntlm_auth would also have to run in the same chroot-ed environment in order to locate the correct pipe. Messy. And that's still assuming that I can force a given instance of winbind to talk to the DC I want. Need to start from that angle and see where I get. --J -----Original Message----- From: freeradius-users-bounces+mcnuttj=missouri.edu@lists.freeradius.org [mailto:freeradius-users-bounces+mcnuttj=missouri.edu@lists.freeradius.org] On Behalf Of Phil Mayers Sent: Friday, August 24, 2012 4:23 PM To: freeradius-users@lists.freeradius.org Subject: Re: redundant load balancing and mschap On 08/24/2012 08:11 PM, McNutt, Justin M. wrote:
Grrr... This is probably a Samba issue - a known one? - but I can't seem to get AD authentications to hit multiple DCs. Everything goes to the one
This is indeed a Samba issue, and unfortunately a hard one to fix. ntlm_auth doesn't talk over the network - rather, it talks over a Unix socket to winbind. Winbind maintains a *single* open session to a DC, and sends all the domain RPCs down this pipe. Winbind discovers the DC from the AD subnet/site queries and builds an app-specific kerberos config that will show you this - see /var/lib/samba/smb_krb5/krb5.conf.<DOMNAME> If you want to force connections to separate domain controllers, you'll need separate smbd/winbindd instances running, with their own unix sockets and smb.conf setups. This will probably be hard, and fragile. My advice - don't, unless you really really need to. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (4)
-
alan buxey -
Alan DeKok -
McNutt, Justin M. -
Phil Mayers