I can’t realize a use-case for that… but, if you don’t mind please share with us what you have in mind… Btw, you could do some _hack_ using _socat_ as described in https://stackoverflow.com/questions/2149564/redirecting-tcp-traffic-to-a-uni... <https://stackoverflow.com/questions/2149564/redirecting-tcp-traffic-to-a-unix-domain-socket-under-linux> to see if the _unix-socket_ is useful in your case.

On 30 Apr 2022, at 04:46, Bjørn Mork <bjorn@mork.no> wrote:

William Tang <galaxyking0419@gmail.com> writes:

...

I'm wondering if freeradius has/will support for unix domain sockets for authentication and accounting?

Do you have a use case for that or are you just wondering?

Bjørn - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Jorge Pereira jpereira@networkradius.com

William Tang <galaxyking0419@gmail.com> writes:

...

I can’t realize a use-case for that… but, if you don’t mind please share with us what you have in mind…

I have a server running both strongswan VPN server and freeradius for authentication and accounting. Unix domain sockets would be more efficient for communication between processes on the same machine.

I dont' believe so. And my numbers are as good as yours. But for arguments sake, let's assume you're correct. How much time does your server spend on authenticating a session? How much of that is the actual IP transport delay? And to relate that to something: How much time does it take in total to set up a new VPN session? I any case: Why do you use RADIUS? Would it be more "efficient" to drop the external auth and just make strongswan authenticate without any commucation delays at all?

...

Btw, you could do some _hack_ using _socat_ as described in https://stackoverflow.com/questions/2149564/redirecting-tcp-traffic-to-a-uni... to see if the _unix-socket_ is useful in your case. Thanks for the suggestion, but redirecting the traffic will introduce even more overhead than plain tcp. So, freeradius does not support unix domain socket for authentication and accounting, right?

Are there any RFC documenting RADIUS over unix domain sockets? Are there any clients supporting this? Does your strongswan server support it? Do you think that there are so few real issues related to RADIUS and FreeRADIUS that you have to invent some? Maybe so. But personally I don't belive in bloating protocols or software just because you can. Every new feature should be needed and solve a real problem for someone. Otherwise it's a step back. Bjørn

I dont' believe so. And my numbers are as good as yours. There is no reason to believe that's true. Unix domain sockets can achieve 66% latency reduction and 7x throughput, https://stackoverflow.com/a/29436429.

I agree with Bjorn here. There's no value to this, and many negatives. Are there any RFC documenting RADIUS over unix domain sockets? Are there any clients supporting this? Does your strongswan server support it? Whether freeradius should implement this is out of the scope of this discussion. I'm just checking if it supports it.

On Mon, May 2, 2022 at 4:30 PM Alan DeKok <aland@deployingradius.com> wrote:

On May 2, 2022, at 3:57 AM, William Tang <galaxyking0419@gmail.com> wrote:

...

...

I can’t realize a use-case for that… but, if you don’t mind please share with us what you have in mind… I have a server running both strongswan VPN server and freeradius for authentication and accounting. Unix domain sockets would be more

efficient

...

for communication between processes on the same machine.

There is no reason to believe that's true.

I agree with Bjorn here. There's no value to this, and many negatives.

Alan DeKok.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

On May 2, 2022, at 4:08 PM, William Tang <galaxyking0419@gmail.com> wrote:

...

I dont' believe so. And my numbers are as good as yours. There is no reason to believe that's true. Unix domain sockets can achieve 66% latency reduction and 7x throughput, https://stackoverflow.com/a/29436429.

RADIUS systems usually get ~2K packets/s. There will be no appreciable difference between UDP, TCP, or unix domain sockets.

Whether freeradius should implement this is out of the scope of this discussion. I'm just checking if it supports it.

There is no secret documentation. All of the features are public, and publicly documented. I must admit I don't understand the reasons for asking for a feature which has no use-cases, which no one implements, and which doesn't add anything useful. Alan DeKok.

On May 13, 2022, at 3:08 AM, Michael Ströder via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:

One thing I like about Unix domain sockets is using the Unix peer credentials for password-less and secure authc of local client processes.

E.g. OpenLDAP can use LDAPI and authz-regexp to map the POSIX-UID/-GID to LDAP identities.

Not sure whether such a use-case would make sense for FreeRADIUS sense though.

radmin uses it. Not much else does, tho. I can't think of any use-case for RADIUS over unix domain sockets. Alan DeKok.