Rejected proxy requests not making it to the client

Ti Leggett leggett at mcs.anl.gov
Tue Jul 2 19:06:08 CEST 2013


I have a setup where we have three distinct OTP services, one by the organization and 2 specific to our group. Users can choose which service they want to use and this is done by membership in a netgroup (an rlm_perl script looks up the user to see what netgroup they belong to). We have proxy servers that all the clients talk to and their purpose is to determine which upstream OTP service to authenticate a user against and proxy the requests there. I'm seeing strange behavior when a user types their password incorrectly in that the reject never makes it all the way to the client and on the server I see the following on the server:

Tue Jul  2 10:39:04 2013 : Error: WARNING: Unresponsive child for request 0, in component <core> module <thread>
Tue Jul  2 10:39:05 2013 : Info: WARNING: Child is hung for request 0 in component <core> module <thread>.
Tue Jul  2 10:39:06 2013 : Info: WARNING: Child is hung for request 0 in component <core> module <thread>.
Tue Jul  2 10:39:09 2013 : Info: WARNING: Child is hung for request 0 in component <core> module <thread>.
Tue Jul  2 10:39:12 2013 : Info: WARNING: Child is hung for request 0 in component <core> module <thread>.
Tue Jul  2 10:39:17 2013 : Info: WARNING: Child is hung for request 0 in component <core> module <thread>.
Tue Jul  2 10:39:25 2013 : Info: WARNING: Child is hung for request 0 in component <core> module <thread>.
Tue Jul  2 10:39:36 2013 : Info: WARNING: Child is hung for request 0 in component <core> module <thread>.
...

The upstream server does get the request, send the reject back to the proxy and the proxy receives the reject but doesn't seem to send the reject back to the client. When the user types the password successfully everything works fine - the client gets an OK and none of the hung request errors show up.

A debug log of one of these failed sessions is at http://pastebin.com/8n7snaBV. Any ideas what might be going on?


More information about the Freeradius-Users mailing list