Hello all, I am using FreeRadius to authenticate my PPPoE clients. This is the version I am using: [root@ns2 radius]# radiusd -v radiusd: FreeRADIUS Version 1.1.0, for host , built on Feb 20 2006 at 08:14:50 Copyright (C) 2000-2003 The FreeRADIUS server project. My system uses the /etc/passwd and /etc/shadow to look for a login and them let that client connect to the PPPoE concentrator. I have 4 PPPoE concetrators and I am having a problem: sometimes my freeradius get a little crazy and close some connections and other times it just says that the client is still connected and block the client to use (becouse of max login set to 1) like in this two situatios: === NO LOGIN RECORD === Fri Oct 27 08:45:37 2006 : Auth: Login OK: [pauloperez] (from client ns3 port 2846 cli 00:4F:62:02:96:00) Fri Oct 27 08:47:09 2006 : Error: rlm_radutmp: Logout for NAS ns3 port 2827, but no Login record Fri Oct 27 08:47:23 2006 : Auth: Login OK: [maquiagro] (from client ns3 port 2847 cli 00:4F:62:09:E8:BB) Fri Oct 27 08:52:13 2006 : Auth: Login OK: [joilce] (from client ema port 14413 cli 00:4F:62:04:D9:5D) Fri Oct 27 08:52:15 2006 : Error: rlm_radutmp: Logout for NAS ns3 port 2698, but no Login record Fri Oct 27 08:52:29 2006 : Auth: Login OK: [paulogava] (from client ns3 port 2860 cli 00:4F:62:09:E7:8F) === MAX LOGIN=== Fri Oct 27 08:09:00 2006 : Auth: Multiple logins (max 1) : [carine] (from client ns3 port 2769 cli 00:06:F4:0A:D6:76) Fri Oct 27 08:09:06 2006 : Auth: rlm_unix: [carine]: invalid password Fri Oct 27 08:09:06 2006 : Auth: Login incorrect: [carine/] (from client ns3 port 2770 cli 00:06:F4:0A:D6:76) Fri Oct 27 08:09:19 2006 : Auth: rlm_unix: [carine]: invalid password What can I do to make my radius system more stable? Migrate it to a MySQL solution? I have about 200 login records in most usage time and a average of 80 all day. Att, Nataniel Klug .'.
Nataniel Klug <nata@cnett.psi.br> wrote:
I am having a problem: sometimes my freeradius get a little crazy and close some connections and other times it just says that the client is still connected and block the client to use (becouse of max login set to 1) like in this two situatios:
FreeRADIUS doesn't close connections. If it blocks users, it's because it thinks the user is still logged in.
What can I do to make my radius system more stable? Migrate it to a MySQL solution? I have about 200 login records in most usage time and a average of 80 all day.
It's stable. Migrating to MySQL won't help. A load of 80 logins per day is tiny, and isn't a problem. I think the problem is that you're not clear why the server is behaving the way it is. Please explain *why* you think it's "unstable" when someone tries to log in twice, and it rejects the second attempt. Why do you think the server "closes connections"? And the "no login record" issue is the fault of the NAS. FreeRADIUS is just logging what the NAS sends it. See the FAQ. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Hi Alan, Thank you again for helping me, I will try to explain myself bellow: Alan DeKok escreveu:
Nataniel Klug <nata@cnett.psi.br> wrote:
I am having a problem: sometimes my freeradius get a little crazy and close some connections and other times it just says that the client is still connected and block the client to use (becouse of max login set to 1) like in this two situatios:
FreeRADIUS doesn't close connections. If it blocks users, it's because it thinks the user is still logged in.
Sometimes my NAS send a disconnect for the radius (I have remote logging and I am monitoring every step of the NAS(es) and the radius) and, for some reason that I could not know, this request for disconect do not get into the FreeRadius. I really dont know if the radius is not receiving the message (for network reasons or something) or its is comming to the radius server but the program (radiusd) is not able to process this request. This way the client keep logged in and, if the same client, trys to connect it is rejected.
What can I do to make my radius system more stable? Migrate it to a MySQL solution? I have about 200 login records in most usage time and a average of 80 all day.
It's stable. Migrating to MySQL won't help. A load of 80 logins per day is tiny, and isn't a problem.
I know this is very low busy for freeradius... But the problem is killing me.
I think the problem is that you're not clear why the server is behaving the way it is. Please explain *why* you think it's "unstable" when someone tries to log in twice, and it rejects the second attempt. Why do you think the server "closes connections"?
I am not sure what is making the problem. Thats why I came here, I need to know what tools can I use to identify where is the problem. The request from NAS to Radius I know that is coming throw my netowork and it is registered in my logger server. This is my network topology: router - ns1 (logger/gw) --> nas1 (gw-int1) <--> nas2 ns2 (radius) nas3 All the nases are sending their logs to ns1 and it logs every single try to disconect a client that nas sends but some of them do not get into radius server.
And the "no login record" issue is the fault of the NAS. FreeRADIUS is just logging what the NAS sends it. See the FAQ.
No logging record does not mean that the NAS send a message to remove some client from the "connected" and the radius look for the client but, when it can not be found, the radius log this message? Thank you again.
Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Nataniel Klug <nata@cnett.psi.br> wrote:
Sometimes my NAS send a disconnect for the radius (I have remote logging and I am monitoring every step of the NAS(es) and the radius) and, for some reason that I could not know, this request for disconect do not get into the FreeRadius. I really dont know if the radius is not receiving the message (for network reasons or something) or its is comming to the radius server but the program (radiusd) is not able to process this request.
I would suggest finding out what is happening. You are trying to solve a problem, but you don't know what's going wrong. That means you probably won't be able to solve it until you *do* know what's going wrong.
All the nases are sending their logs to ns1 and it logs every single try to disconect a client that nas sends but some of them do not get into radius server.
Your network topology makes no sense to me. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
participants (2)
-
Alan DeKok -
Nataniel Klug