Resolving Too many differnet filenames for detail log file
Hi FreeRadius experts, I would like to seek advice at configuring freeradius to overcome an issue that we had encountered recently. We noticed recently that login into our switches/routers took considerably longer than before. The VM (CentOS 7, with freeradius 3.04) didn't have much load at all: load average: 0.00, 0.01, 0.05 After some more trouble shooting, I realized that the problem was related to writing detail accounting files: Wed Sep 6 13:22:38 2017 : ERROR: (219185) ERROR: detail : Couldn't open file /var/log/radius/radacct/10.1.1.26/detail-20170906: Too many different filenames By searchin online, it appears that there is a hard coded limit of 64 files in log.c lf->max_entries = 64; When we hit that limit, login into our switches/routers become slow. Our normal work load usually does not trig this problem. A handful of network admins log into switches and routers when we need to until we examine switch issue by using a script via cron (with ~40 parallel login into different switches at a time every 10 minutes), then we started to encounter slow login while these jobs were busy. Now that we know the root cause of the problem, we could mitigate the problem by 1. recompile the code with high max_entries number. 2. add more radius servers and randomize switch radius server configuration. 3. optizime freeradius configuration. Our current setup is very basic, unix (nis) authentication, detail file accounting. I would like to hear recommendations of resolving \ this accounting issue, preferably not patching/recompiling code from time to time. Shall we configure MySQL/PostgreSQL database for accounting only? Thank you very much for your help. Zhi-Wei Lu IET-CR-Network Operations Center University of California, Davis (530) 752-0155
On Sep 13, 2017, at 11:38 AM, Zhi-Wei Lu <zwlu@ucdavis.edu> wrote:
Hi FreeRadius experts,
I would like to seek advice at configuring freeradius to overcome an issue that we had encountered recently. We noticed recently that login into our switches/routers took considerably longer than before.
The VM (CentOS 7, with freeradius 3.04)
Use 3.0.15. This issue has been fixed.
Now that we know the root cause of the problem, we could mitigate the problem by
Installing a version of the server with the fix. Alan DeKok.
The VM (CentOS 7, with freeradius 3.04) Use 3.0.15.
This issue has been fixed.
Thanks Alan. The new CentOS 7.4.1708 and update has upgraded freeradius to 3.0.13-8, which should include 3.0.12 fix for the detail log file fix. Is this version good enough? Does Redhat backport security enhancements from 3.0.14/3.0.15 to their 3.0.13-x? Thanks again! Zhi-Wei Lu
On Sep 13, 2017, at 1:04 PM, Zhi-Wei Lu <zwlu@ucdavis.edu> wrote:
The new CentOS 7.4.1708 and update has upgraded freeradius to 3.0.13-8, which should include 3.0.12 fix for the detail log file fix. Is this version good enough?
No. On further checks... you'll have to install the v3.0.x branch from git. It has some additional fixes which should help here.
Does Redhat backport security enhancements from 3.0.14/3.0.15 to their 3.0.13-x?
Generally yes, but ask RedHat how their software works. Alan DeKok.
On Sep 13, 2017, at 1:04 PM, Zhi-Wei Lu <zwlu@ucdavis.edu> wrote:
The new CentOS 7.4.1708 and update has upgraded freeradius to 3.0.13-8, which should include 3.0.12 fix for the detail log file fix. Is this version good enough?
No. On further checks... you'll have to install the v3.0.x branch from git. It has some additional fixes which should help here.
I have downloaded the zip file. After satisfying most of libraries in the Warning section, I was able to compile the code (3.0.16). However, the $FREERADIUS/etc/raddb/policy.d/filter file seems to have some syntax problem: if (&User-Name =~ /\.\./ ) { update request { &Module-Failure-Message += 'Rejected: User-Name contains multiple ..s' } reject } The older version has these code if (&User-Name =~ /\\.\\./ ) { update reply { Reply-Message += "Rejected: Username contains ..s" } reject } Actually, I was hit by this one while testing freeradius 3..0.13-8 on CentOS 7.4.1708 as well, I had to put \\.\\. back to be able to login into a test switch. Shall I file a bug report somewhere? Thank you. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Sep 13, 2017, at 7:34 PM, Zhi-Wei Lu <zwlu@ucdavis.edu> wrote:
I have downloaded the zip file. After satisfying most of libraries in the Warning section, I was able to compile the code (3.0.16). However, the $FREERADIUS/etc/raddb/policy.d/filter file seems to have some syntax problem:
if (&User-Name =~ /\.\./ ) {
That's correct, and it works.
The older version has these code
if (&User-Name =~ /\\.\\./ ) {
We fixed that...
Actually, I was hit by this one while testing freeradius 3..0.13-8 on CentOS 7.4.1708 as well, I had to put \\.\\. back to be able to login into a test switch.
Shall I file a bug report somewhere?
You need to edit radiusd.conf, and set "correct_escapes = true" Alan DeKk.
On Sep 13, 2017, at 7:34 PM, Zhi-Wei Lu <zwlu@ucdavis.edu> wrote:
I have downloaded the zip file. After satisfying most of libraries in the Warning section, I was able to compile the code (3.0.16). However, the $FREERADIUS/etc/raddb/policy.d/filter file seems to have some syntax problem:
if (&User-Name =~ /\.\./ ) {
That's correct, and it works.
The older version has these code
if (&User-Name =~ /\\.\\./ ) {
We fixed that...
Actually, I was hit by this one while testing freeradius 3..0.13-8 on CentOS 7.4.1708 as well, I had to put \\.\\. back to be able to login into a test switch.
Shall I file a bug report somewhere?
You need to edit radiusd.conf, and set "correct_escapes = true" Thank you, Alan.
I bent backwards, this flag was introduced in 3.0.5, while I am still using conf file from 3.04. I will carefully go over the new conf file to match what I need. Alan DeKk. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (2)
-
Alan DeKok -
Zhi-Wei Lu