LDAP, old TCP connections, and retry
Hi Guys, A few quick questions on tweaking rlm_ldap for freeradius. Question 1: The LDAP server which the radius server attempts to connect to is located behind a firewall which kills TCP connections that have been idle for 30 minutes. FR then tries to do a lookup using a connection that has been open and idle for half an hour or more, and the firewall drops the now invalid connection. How can I force an idle timeout on LDAP connections in FR? Question 2:
From the information I have been given, it appears that if the connection times out, LDAP does not attempt to retry.
Is there a way to force FR to make 1 or 2 attempts at retrying the connection before giving up on LDAP? The current situation is causing many headaches trying to log in, and the client is reluctant to relax their firewall for a number of reasons. Many Thanks, Justin Steward
Justin Steward wrote:
Question 1: The LDAP server which the radius server attempts to connect to is located behind a firewall which kills TCP connections that have been idle for 30 minutes. FR then tries to do a lookup using a connection that has been open and idle for half an hour or more, and the firewall drops the now invalid connection.
I fail to understand why people do this. Firewall two critical components, and then *increase* failure by having the FW break TCP connections.
How can I force an idle timeout on LDAP connections in FR?
Change the source code in rlm_ldap.
Question 2:
From the information I have been given, it appears that if the connection times out, LDAP does not attempt to retry.
Is there a way to force FR to make 1 or 2 attempts at retrying the connection before giving up on LDAP?
Change the source code.
The current situation is causing many headaches trying to log in, and the client is reluctant to relax their firewall for a number of reasons.
<shrug> They chose to destroy their own network. I'm not surprised they're hesitant to fix it. Alan DeKok.
Hi Alan,
I fail to understand why people do this. Firewall two critical components, and then *increase* failure by having the FW break TCP connections.
Unfortunately I don't get to decide what the network looks like, I just have to find a way to work with what I'm given.
How can I force an idle timeout on LDAP connections in FR?
Change the source code in rlm_ldap.
I was hoping you wouldn't say that. Although I was more or less expecting it.
Question 2:
From the information I have been given, it appears that if the connection times out, LDAP does not attempt to retry.
Is there a way to force FR to make 1 or 2 attempts at retrying the connection before giving up on LDAP?
Change the source code.
The current situation is causing many headaches trying to log in, and the client is reluctant to relax their firewall for a number of reasons.
<shrug> They chose to destroy their own network. I'm not surprised they're hesitant to fix it.
I think the main problem is their firewall vendor thinks that's the right way to do it. Anyway, thanks for your response. I'll see what I can do with the source. Kind Regards, Justin Steward
On Wed, Mar 10, 2010 at 6:34 PM, Alan DeKok <aland@deployingradius.com> wrote:
Change the source code in rlm_ldap.
Unfortunately, the source code is far beyond my abilities to modify. Does the freeradius / rlm_ldap module send keepalives, and if not, would it be possible for someone to provide a simple patch that would enable keepalives? Many Thanks, Justin Steward
Please ignore previous email. Employer has decided best course of action is to pass on as much info as possible, and let client fix firewall. On Mon, Mar 15, 2010 at 12:06 PM, Justin Steward <althalus87@gmail.com> wrote:
On Wed, Mar 10, 2010 at 6:34 PM, Alan DeKok <aland@deployingradius.com> wrote:
Change the source code in rlm_ldap.
Unfortunately, the source code is far beyond my abilities to modify. Does the freeradius / rlm_ldap module send keepalives, and if not, would it be possible for someone to provide a simple patch that would enable keepalives?
Many Thanks, Justin Steward
participants (2)
-
Alan DeKok -
Justin Steward