Apache with mod_auth_radius starts X requests
Hi, I'm using Debian9 with Apache + radius_mod_auth to authenticate some user while accessing a directory on that server. But that didn't work. I can see Radius Access-Request and Access-Accepts via tcpdump, the probleme is, that the request never ends. I interrupted the request with an Apache restart after 3Minutes and 1500 Radius-Request (still running). 07:10:14.010157 IP Radius-IP.1812 > 10.19.56.57.1026: RADIUS, Access-Accept .... 07:13:27.547061 IP 10.19.56.57.1026 > Radius-IP.1812: RADIUS, Access-Request (1), id: 0xc2 length: 80 07:13:27.674561 IP Radius-IP.1812 > 10.19.56.57.1026: RADIUS, Access-Accept (2), id: 0xc2 length: 20 3000 packets captured Any Idea about that? I used that guid for configuration: https://github.com/FreeRADIUS/mod_auth_radius P.S: I can't turn on the debug option, the server wouldn't start. Regards Carsten
On Aug 16, 2018, at 1:38 AM, Carsten Schulze <carsten.schulze@leuphana.de> wrote:
I'm using Debian9 with Apache + radius_mod_auth to authenticate some user while accessing a directory on that server.
Which version of Apache, and which version of the module?
But that didn't work.
I can see Radius Access-Request and Access-Accepts via tcpdump, the probleme is, that the request never ends. I interrupted the request with an Apache restart after 3Minutes and 1500 Radius-Request (still running).
07:10:14.010157 IP Radius-IP.1812 > 10.19.56.57.1026: RADIUS, Access-Accept .... 07:13:27.547061 IP 10.19.56.57.1026 > Radius-IP.1812: RADIUS, Access-Request (1), id: 0xc2 length: 80 07:13:27.674561 IP Radius-IP.1812 > 10.19.56.57.1026: RADIUS, Access-Accept (2), id: 0xc2 length: 20 3000 packets captured
Any Idea about that?
Nope. I haven't looked at it in a while, but other people say it works for them.
I used that guid for configuration: https://github.com/FreeRADIUS/mod_auth_radius
P.S: I can't turn on the debug option, the server wouldn't start.
I have no idea what that is. Alan DeKok.
Hi Alan, thanks for helping me again. Am 16.08.2018 um 13:25 schrieb Alan DeKok:
On Aug 16, 2018, at 1:38 AM, Carsten Schulze <carsten.schulze@leuphana.de> wrote:
I'm using Debian9 with Apache + radius_mod_auth to authenticate some user while accessing a directory on that server. Which version of Apache, and which version of the module? libapache2-mod-auth-radius (1.5.8-1.3)
Server version: Apache/2.4.25 (Debian)
But that didn't work.
I can see Radius Access-Request and Access-Accepts via tcpdump, the probleme is, that the request never ends. I interrupted the request with an Apache restart after 3Minutes and 1500 Radius-Request (still running).
07:10:14.010157 IP Radius-IP.1812 > 10.19.56.57.1026: RADIUS, Access-Accept .... 07:13:27.547061 IP 10.19.56.57.1026 > Radius-IP.1812: RADIUS, Access-Request (1), id: 0xc2 length: 80 07:13:27.674561 IP Radius-IP.1812 > 10.19.56.57.1026: RADIUS, Access-Accept (2), id: 0xc2 length: 20 3000 packets captured
Any Idea about that? Nope. I haven't looked at it in a while, but other people say it works for them. It works for me as well.
We have got a normal Webpage. The Index.php was delivered, I enter the username + password, one Radius-Request was send and I can work. -------- The second server is a software distribution with directory listing. There are no index files or so. I turned on the logging on my apache and I can see the auth requests for: requests /Mitarbeitende/ requests /Mitarbeitende/index.html requests /Mitarbeitende/index.cgi requests /Mitarbeitende/index.pl requests /Mitarbeitende/index.php requests /Mitarbeitende/index.xhtml requests /Mitarbeitende/index.htm and for every subfolder the same requests /Mitarbeitende/Software/ requests /Mitarbeitende/Software/index.html .. . It looks, if it search for alle the files on the first and all second folders. Please see the attached logs. And the browser didn't request the files, I only see a initial GET /Mitarbeitende/ HTTP/1.1 Host: software.domain.de followd by 14 Radius-Requests and than a answer to that GET request. ------------ The third server is a syslog with also directory listing. There are 214 Directorys in it and the radius requests stops after 1500 request and the content will be delivered. 214 Folders * 7 Requests (1 Directory and 6 index.*) = 1498?
I used that guid for configuration: https://github.com/FreeRADIUS/mod_auth_radius
P.S: I can't turn on the debug option, the server wouldn't start. I have no idea what that is. Seems that the debug option is only available in 1.6?
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Regards Carsten
On Aug 17, 2018, at 4:44 AM, Carsten Schulze <carsten.schulze@leuphana.de> wrote:
We have got a normal Webpage. The Index.php was delivered, I enter the username + password, one Radius-Request was send and I can work.
That's good.
-------- The second server is a software distribution with directory listing. There are no index files or so.
Maybe that's the issue?
I turned on the logging on my apache and I can see the auth requests for:
requests /Mitarbeitende/ requests /Mitarbeitende/index.html requests /Mitarbeitende/index.cgi requests /Mitarbeitende/index.pl requests /Mitarbeitende/index.php requests /Mitarbeitende/index.xhtml requests /Mitarbeitende/index.htm
and for every subfolder the same
That's bad. The module is *supposed* to set a cookie which means that subsequent authentication checks just check the cookie. Maybe that isn' happening. Alan DeKok.
Hi, to finalize. I installed a PHP Directory Listner to that folder, with that, only one request was generated. If its not possible, you can reduce the index.* (checks) in apache, which will reduce the total amount of Radius-Reuqests. /etc/apache2/mods-enabled/dir.conf <IfModule mod_dir.c> #DirectoryIndex index.html index.cgi index.pl index.php index.xhtml index.htm DirectoryIndex index.php </IfModule> Regards Carsten On Aug 17, 2018, at 4:44 AM, Carsten Schulze <carsten.schulze@leuphana.de> wrote:
We have got a normal Webpage. The Index.php was delivered, I enter the username + password, one Radius-Request was send and I can work.
That's good.
-------- The second server is a software distribution with directory listing. There are no index files or so.
Maybe that's the issue?
I turned on the logging on my apache and I can see the auth requests for:
requests /Mitarbeitende/ requests /Mitarbeitende/index.html requests /Mitarbeitende/index.cgi requests /Mitarbeitende/index.pl requests /Mitarbeitende/index.php requests /Mitarbeitende/index.xhtml requests /Mitarbeitende/index.htm
and for every subfolder the same
That's bad. The module is *supposed* to set a cookie which means that subsequent authentication checks just check the cookie. Maybe that isn' happening. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Tue, Aug 21, 2018 at 4:22 PM, Carsten Schulze < carsten.schulze@leuphana.de> wrote:
Hi,
to finalize.
I installed a PHP Directory Listner to that folder, with that, only one request was generated.
If its not possible, you can reduce the index.* (checks) in apache, which will reduce the total amount of Radius-Reuqests.
/etc/apache2/mods-enabled/dir.conf <IfModule mod_dir.c> #DirectoryIndex index.html index.cgi index.pl index.php index.xhtml index.htm DirectoryIndex index.php </IfModule>
Isn't that basically what https://github.com/FreeRADIUS/mod_auth_radius#4-some-warnings says? -- Fajar
What output do you get when trying to run it in debug mode? Alan On Thu, 16 Aug 2018, 06:38 Carsten Schulze, <carsten.schulze@leuphana.de> wrote:
Hi,
I'm using Debian9 with Apache + radius_mod_auth to authenticate some user while accessing a directory on that server.
But that didn't work.
I can see Radius Access-Request and Access-Accepts via tcpdump, the probleme is, that the request never ends. I interrupted the request with an Apache restart after 3Minutes and 1500 Radius-Request (still running).
07:10:14.010157 IP Radius-IP.1812 > 10.19.56.57.1026: RADIUS, Access-Accept .... 07:13:27.547061 IP 10.19.56.57.1026 > Radius-IP.1812: RADIUS, Access-Request (1), id: 0xc2 length: 80 07:13:27.674561 IP Radius-IP.1812 > 10.19.56.57.1026: RADIUS, Access-Accept (2), id: 0xc2 length: 20 3000 packets captured
Any Idea about that?
I used that guid for configuration: https://github.com/FreeRADIUS/mod_auth_radius
P.S: I can't turn on the debug option, the server wouldn't start.
Regards Carsten
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (4)
-
Alan Buxey -
Alan DeKok -
Carsten Schulze -
Fajar A. Nugraha