I am a newbie, running 3 (for redundancy) FreeRadius servers (1.1.7) on SUSE 10 SP1 (32-bit) to authenticate our wireless clients (PEAP MSCHAPv2) to our eDirectory via LDAP. We average 800-900 simultaneous wireless clients (need to support a potential 4K in the future). The setup works well and authenticates users very quickly, but every couple days, the radiusd process will either blow up and start consuming 99% of the CPU or die altogether. More often it blows up. We had stability problems initially, even when the process was running, so I took everything out of the config that we didn't need and that seemed to help. Can anyone comment on our configuration and tell me if I'm doing something wrong? This is my first FreeRadius deployment and I don't consider myself a Linux guru, let alone claim to know much about Radius. Thanks in advance, Nathan Hay Network Engineer Cedarville University prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 512000 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = yes log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = no $INCLUDE ${confdir}/clients.conf snmp = no thread pool { start_servers = 16 max_servers = 64 min_spare_servers = 8 max_spare_servers = 16 max_requests_per_server = 0 } modules { $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes } ldap { server = "XXX" identity = "cn=XXX,o=XXX" password = XXX basedn = "o=XXX" filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" start_tls = yes tls_cacertfile = /usr/local/etc/raddb/certs/ldap.cer tls_cacertdir = /usr/local/etc/raddb/certs/ tls_require_cert = "demand" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 10 password_attribute = nspmPassword edir_account_policy_check=no timeout = 4 timelimit = 3 net_timeout = 1 } } authorize { mschap eap ldap } authenticate { Auth-Type MS-CHAP { mschap } Auth-Type LDAP { ldap } eap } post-auth { ldap Post-Auth-Type REJECT { ldap } }
On Mon, 2007-09-24 at 15:39 -0400, Nathan Hay wrote:
I am a newbie, running 3 (for redundancy) FreeRadius servers (1.1.7) on SUSE 10 SP1 (32-bit) to authenticate our wireless clients (PEAP MSCHAPv2) to our eDirectory via LDAP. We average 800-900 simultaneous wireless clients (need to support a potential 4K in the future).
The setup works well and authenticates users very quickly, but every couple days, the radiusd process will either blow up and start consuming 99% of the CPU or die altogether. More often it blows up. We had stability problems initially, even when the process was running, so I took everything out of the config that we didn't need and that seemed to help.
First question; are you HUPing the daemon? If so, don't - it won't work well. Second question; if this happens reliably can you recompile from scratch: ./configure --enable-developer make make install ...and when it happens do this: gdb /usr/local/sbin/radiusd set pagination off set logging file /root/radiusd-wireless.txt set logging on attach $PID thread apply all bt full ...that'll give some details as to what the server is doing when it pegs the CPU. Other options are strace or (if your Linux system has it) SystemTap. The aim being to determine what it's doing when it goes wrong.
What kind of error messages are you getting in your log when it blows up? Quoting Phil Mayers <p.mayers@imperial.ac.uk>:
On Mon, 2007-09-24 at 15:39 -0400, Nathan Hay wrote:
I am a newbie, running 3 (for redundancy) FreeRadius servers (1.1.7) on SUSE 10 SP1 (32-bit) to authenticate our wireless clients (PEAP MSCHAPv2) to our eDirectory via LDAP. We average 800-900 simultaneous wireless clients (need to support a potential 4K in the future).
The setup works well and authenticates users very quickly, but every couple days, the radiusd process will either blow up and start consuming 99% of the CPU or die altogether. More often it blows up. We had stability problems initially, even when the process was running, so I took everything out of the config that we didn't need and that seemed to help.
First question; are you HUPing the daemon? If so, don't - it won't work well.
Second question; if this happens reliably can you recompile from scratch:
./configure --enable-developer make make install
...and when it happens do this:
gdb /usr/local/sbin/radiusd set pagination off set logging file /root/radiusd-wireless.txt set logging on attach $PID thread apply all bt full
...that'll give some details as to what the server is doing when it pegs the CPU. Other options are strace or (if your Linux system has it) SystemTap. The aim being to determine what it's doing when it goes wrong.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Mon, 2007-09-24 at 20:46 -0300, Matt Ashfield wrote:
What kind of error messages are you getting in your log when it blows up?
Since you put me in the To: field as well as the list (please don't do that, it breaks peoples list filtering and is annoying) it's not clear to me who you're talking to - the original poster or me. If the latter then you are confused; I'm not having problems.
participants (3)
-
Matt Ashfield -
Nathan Hay -
Phil Mayers