Monitor the number of open EAP sessions
Hi everyone! I am facing a problem when freeradius reports that the limit of open sessions has been reached. These are log entries, like "Too many open sessions. Try increasing "max_sessions" in the EAP module configuration". During the debugging, it was determined that some ios devices (ipad/iphone), for a reason unknown to me, cyclically cannot complete eap/tls authentication process. I found that these devices successfully start communicating with the NAS (send EAP-Response/Identity). But after receiving the (TLS Start)-message, they no longer send the (TLS client_hello)-message, and restart the association process with the access point and therefore open a new EAP session. If recreate a wifi connection on such a device, it will connect successfully. Until I find the root cause of this behavior, I would like to monitor the number of open sessions of the radius server. But I couldn't find a suitable way to do it. Here is what I tried: - use the "status server" tool, but there is no suitable one among its counters - use tool "control-socket" and radmin but also i didn't find suitable counter Can you help me with this question? Thanks!
On May 24, 2022, at 11:28 AM, Sergey Marochkin <umnik.ru@gmail.com> wrote:
I am facing a problem when freeradius reports that the limit of open sessions has been reached. These are log entries, like "Too many open sessions. Try increasing "max_sessions" in the EAP module configuration".
During the debugging, it was determined that some ios devices (ipad/iphone), for a reason unknown to me, cyclically cannot complete eap/tls authentication process. I found that these devices successfully start communicating with the NAS (send EAP-Response/Identity). But after receiving the (TLS Start)-message, they no longer send the (TLS client_hello)-message, and restart the association process with the access point and therefore open a new EAP session. If recreate a wifi connection on such a device, it will connect successfully.
Weird. These sessions will automatically close after a period of time, as there's no point in leaving them open forever. You can lower this timeout by changing mods-enabled/eap, and looking for "timer_expire". The default is 60 seconds, which is likely conservative. You can probably change it to 10, and be OK.
Until I find the root cause of this behavior, I would like to monitor the number of open sessions of the radius server. But I couldn't find a suitable way to do it. Here is what I tried: - use the "status server" tool, but there is no suitable one among its counters - use tool "control-socket" and radmin but also i didn't find suitable counter
Can you help me with this question?
There's no real way to get per-module statistics out of the server. However, we're looking into fixing that. It's not completely trivial, due to a host of issues such as threading, etc. Alan DeKok.
Hi Alan!
There's no real way to get per-module statistics out of the server. However, we're looking into fixing that. It's not completely trivial, due to a host of issues such as threading, etc.
I would like to ask if you have found a way to fix this? Unfortunately, I periodically catch the previously described problem of overflow of open connections on the radius server, so I would like to be able to get statistics on them. Thanks вт, 24 мая 2022 г. в 20:55, Alan DeKok <aland@deployingradius.com>:
On May 24, 2022, at 11:28 AM, Sergey Marochkin <umnik.ru@gmail.com> wrote:
I am facing a problem when freeradius reports that the limit of open sessions has been reached. These are log entries, like "Too many open sessions. Try increasing "max_sessions" in the EAP module configuration".
During the debugging, it was determined that some ios devices (ipad/iphone), for a reason unknown to me, cyclically cannot complete eap/tls authentication process. I found that these devices successfully start communicating with the NAS (send EAP-Response/Identity). But after receiving the (TLS Start)-message, they no longer send the (TLS client_hello)-message, and restart the association process with the
access
point and therefore open a new EAP session. If recreate a wifi connection on such a device, it will connect successfully.
Weird.
These sessions will automatically close after a period of time, as there's no point in leaving them open forever. You can lower this timeout by changing mods-enabled/eap, and looking for "timer_expire".
The default is 60 seconds, which is likely conservative. You can probably change it to 10, and be OK.
Until I find the root cause of this behavior, I would like to monitor the number of open sessions of the radius server. But I couldn't find a suitable way to do it. Here is what I tried: - use the "status server" tool, but there is no suitable one among its counters - use tool "control-socket" and radmin but also i didn't find suitable counter
Can you help me with this question?
There's no real way to get per-module statistics out of the server. However, we're looking into fixing that. It's not completely trivial, due to a host of issues such as threading, etc.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Nov 23, 2023, at 10:01 AM, Sergey Marochkin <umnik.ru@gmail.com> wrote:
There's no real way to get per-module statistics out of the server. However, we're looking into fixing that. It's not completely trivial, due to a host of issues such as threading, etc.
Yes. If features are trivial, they usually go in quickly. If a feature has been waiting for a long time, it's usually because the feature is hard.
I would like to ask if you have found a way to fix this? Unfortunately, I periodically catch the previously described problem of overflow of open connections on the radius server, so I would like to be able to get statistics on them.
It's not "open connections", it's "partially completed EAP sessions". Since you can't fix the supplicant, you can only fix the server. The suggestions are: * set timer_expire to a low value. Too low, and normal sessions will expire before they're finished. Too high, and the server will use a lot of ram for no purpose. * set max_sessions to a high value It's just RAM. It's cheaper than developer time. Set it to maybe 10000, and the server will use another few megabytes of memory. Monitor it and see. If there's still an issue (and you have more RAM), bump up the number a bit. * edit rlm_eap to add a new configuration parameter: dedup_key = "%{Calling-Station-Id}" This will be a bit more work, but might help. The idea is to track old sessions for the same Calling-Station-Id, and forcibly expire the old one when a new session comes in. For this to work, you'll have to: * add it as a configuration in the CONF_PARSER * add it to the rlm_eap configuration data structure * if it's set, expand it when the EAP module starts a new session * add a thread-safe rbtree to the EAP module instance * look up the dedup_key in eap.c, just before the call to eap_handler_alloc() if there is an entry, delete it and the old handler. It's a bit of work, but likely not too bad. Let me take a look. Alan DeKok.
On Nov 23, 2023, at 10:01 AM, Sergey Marochkin <umnik.ru@gmail.com> wrote:
I would like to ask if you have found a way to fix this? Unfortunately, I periodically catch the previously described problem of overflow of open connections on the radius server, so I would like to be able to get statistics on them.
See https://github.com/FreeRADIUS/freeradius-server/commit/3a9cc7eaf366a726285d2... You can edit mods-available/eap: eap { ... dedup_key = "%{Calling-Station-Id}" } When the supplicant starts a new EAP session, the server will delete old sessions for that Calling-Station-Id. If the supplicant is *really* doing multiple EAP sessions, well, most of them will fail. But in the general case, the supplicant is only doing multiple EAP sessions when it's misbehaving. It's compile-tested. So it it works, great. If not, we're happy to accept patches or bug reports. Alan DeKok.
participants (2)
-
Alan DeKok -
Sergey Marochkin