Failover with Active Directory
Hello all, I have been doing a lot of research and reading to set up freeradius to work with my situation. The final issue I'm not able to solve is failover. It seems when I test by disabling the network card on one of my Active Directory servers, freeradius no longer works correctly. When watching the debug it is usually super quick, when one AD is down the debug is really slow. I believe that it being slow is the reason why the authorizations fail, they timeout. As soon as I bring either one of the downed ADs back online it works well. In both default and inner-tunnel I have failover setup like this: authorized { redundant { ldap1 ldap2 } I have also setup ldap1 and ldap2 pool { start = 0 My end goal with freeradius is to use AD for authorization, then freeradius will to the authentication. I have one policy setup to find allowed groups for the user. CentOS 8 with Freeradius 3.0.17 Thanks, Rob
On Aug 17, 2020, at 2:16 AM, Robert Miller <miller.robertw@outlook.com> wrote:
I have been doing a lot of research and reading to set up freeradius to work with my situation. The final issue I'm not able to solve is failover. It seems when I test by disabling the network card on one of my Active Directory servers, freeradius no longer works correctly. When watching the debug it is usually super quick, when one AD is down the debug is really slow. I believe that it being slow is the reason why the authorizations fail, they timeout. As soon as I bring either one of the downed ADs back online it works well.
From mods-available/ldap: # Seconds to wait for response of the server. (network # failures) default: 10 # # LDAP_OPT_NETWORK_TIMEOUT is set to this value. net_timeout = 1 This also works for connections. But to be realistic, that timeout might not work on older versions of libldap before 2.4. And there's very little that we can do to fix it. FreeRADIUS doesn't implement the LDAP protocol. Instead it relies on the OpenLDAP libldap libraries. And if those libraries don't time out quickly enough, we can't do much about it. The short answer is that if RADIUS is critical for network access, you MUST ensure that RADIUS and all of things it needs are up and running. Alan DeKok.
From mods-available/ldap:
# Seconds to wait for response of the server. (network # failures) default: 10 # # LDAP_OPT_NETWORK_TIMEOUT is set to this value. net_timeout = 1
This also works for connections.
This was set to net_timeout = 1
But to be realistic, that timeout might not work on older versions of libldap before 2.4. And there's very little that we can do to fix it. FreeRADIUS doesn't implement the LDAP protocol. Instead it relies on the OpenLDAP libldap libraries. And if those libraries don't time out quickly enough, we can't do much about it.
What version of libldap does freeradius 3.0.17 contain? If prior to 2.4, will upgrading to 3.0.22 fix that?
The short answer is that if RADIUS is critical for network access, you MUST ensure that RADIUS and all of things it needs are up and running.
I understand and thank you for your time. Rob
On Aug 17, 2020, at 7:57 AM, Robert Miller <miller.robertw@outlook.com> wrote:
This was set to net_timeout = 1
That's good.
But to be realistic, that timeout might not work on older versions of libldap before 2.4. And there's very little that we can do to fix it. FreeRADIUS doesn't implement the LDAP protocol. Instead it relies on the OpenLDAP libldap libraries. And if those libraries don't time out quickly enough, we can't do much about it.
What version of libldap does freeradius 3.0.17 contain? If prior to 2.4, will upgrading to 3.0.22 fix that?
My point was that FreeRADIUS does NOT contain libldap. It's a separate piece of software. You'll have to look at your OS to see which version of libldap it supplies. Alan DeKok.
participants (2)
-
Alan DeKok -
Robert Miller