two freeradius servers - question for advice
Hi everyone, I'm going to start two freeradius servers to authenticate PPPoE users, both independent of the other. First as primary and second as secondary. I'm going to start PostgreSQL server also, but in case of unavailability of sql server freeradius server must have work properly. Both freeradius have to have actual data of arleady logged users to provide simultanieusly use. I'm going to check authenticate in db and if if failed get user from files (created in background). accounitng i'm going to do with linelog and afterwards put in to database. I need advice from you, more advanced users than me. How to achieve that HA and avablitity. Thanks in advance. -- Best Regards Marcin / nicraM
On Apr 1, 2016, at 2:59 AM, Marcin <marcin@nicram.net> wrote:
I'm going to start two freeradius servers to authenticate PPPoE users, both independent of the other. First as primary and second as secondary. I'm going to start PostgreSQL server also, but in case of unavailability of sql server freeradius server must have work properly.
What does that mean? It's always a red flag for me when people say vague things like "it must work properly". Computers aren't magic. They don't know your intention, or your requirements.
Both freeradius have to have actual data of arleady logged users to provide simultanieusly use.
i.e. The databases have to replicate data to each other. Or, each server has to write to both databases. Database replication is complex. You really need to have a good understanding of the systems (and their failure modes) before implementing it.
I'm going to check authenticate in db and if if failed get user from files (created in background).
Hmm... that would work, I guess.. buy you'd need a cron job (or something similar) to regularly dump the DB to files. Though the next question is "If the files are up to date, why use a database?"
accounitng i'm going to do with linelog and afterwards put in to database.
The server already supports writing and reading "detail" files into the DB. It doesn't support reading "linelog" entries.
I need advice from you, more advanced users than me. How to achieve that HA and avablitity.
The short solution is to set up two independent servers. Each reads and writes to their own DB. Then, each replicates accounting traffic to the other. There are examples of this is raddb/sites-available/ The longer answer is that HA is a complicated configuration. It's really not possible to describe all of the possibilities, problems, and solutions in a short email. You have to understand all of the pieces, and understand the trade-offs each solution has. To be honest, for less than 10K users, you just don't need HA. Run one server, and make sure it stays up. Alan DeKok.
On Fri, Apr 01, 2016 at 07:23:21AM -0400, Alan DeKok wrote:
On Apr 1, 2016, at 2:59 AM, Marcin <marcin@nicram.net> wrote:
I'm going to check authenticate in db and if if failed get user from files (created in background).
Hmm... that would work, I guess.. buy you'd need a cron job (or something similar) to regularly dump the DB to files.
Though the next question is "If the files are up to date, why use a database?"
Exactly. Much faster to check files first, and if that fails then fall back to checking database in case the user has been added since the files were last updated. But you may as well just dump the database tables to a file every 5 minutes and check that only. Not quite real time but near enough, and resilient if the database goes down. As Alan says, HA is complex, and not just limited to the FreeRADIUS part. You have to understand and design the whole stack top to bottom, and know what the different failure modes are[0]. Matthew [0] for example, including dump db tables to a temporary file, and only move over the live file if the dump completed sucessfully. -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
2016-04-01 13:23 GMT+02:00 Alan DeKok <aland@deployingradius.com>:
On Apr 1, 2016, at 2:59 AM, Marcin <marcin@nicram.net> wrote:
I'm going to start two freeradius servers to authenticate PPPoE users, both independent of the other. First as primary and second as secondary. I'm going to start PostgreSQL server also, but in case of unavailability of sql server freeradius server must have work properly.
What does that mean?
It's always a red flag for me when people say vague things like "it must work properly". Computers aren't magic. They don't know your intention, or your requirements.
Yes I know :)
Both freeradius have to have actual data of arleady logged users to provide simultanieusly use.
i.e. The databases have to replicate data to each other. Or, each server has to write to both databases.
Database replication is complex. You really need to have a good understanding of the systems (and their failure modes) before implementing it.
I don't want replicate database. I want to have as simple configuration as possible, having two independent freeradius server with the same data.
I'm going to check authenticate in db and if if failed get user from files (created in background).
Hmm... that would work, I guess.. buy you'd need a cron job (or something similar) to regularly dump the DB to files.
no, I'm going to use cron to generate files for radius from database if something was canged in db.
Though the next question is "If the files are up to date, why use a database?"
My first though was not to use database directly, but only for generating radius files configurations. but i need to allow onlu 1 conection per client so i must use "Simultaneous-Use". I red that reading it from db is the best way. so that i want db.
accounitng i'm going to do with linelog and afterwards put in to database.
The server already supports writing and reading "detail" files into the DB. It doesn't support reading "linelog" entries.
I need advice from you, more advanced users than me. How to achieve that HA and avablitity.
The short solution is to set up two independent servers. Each reads and writes to their own DB. Then, each replicates accounting traffic to the other. There are examples of this is raddb/sites-available/
The longer answer is that HA is a complicated configuration. It's really not possible to describe all of the possibilities, problems, and solutions in a short email. You have to understand all of the pieces, and understand the trade-offs each solution has.
To be honest, for less than 10K users, you just don't need HA. Run one server, and make sure it stays up.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I don't have to have Full HA. I've few spread PPPoE servers. I want to prepare in case if something went wrong with one of freeradius server. -- Pozdrawiam Marcin / nicraM
On Apr 1, 2016, at 7:58 AM, Marcin <marcin@nicram.net> wrote:
I don't want replicate database. I want to have as simple configuration as possible, having two independent freeradius server with the same data.
You said you wanted Simultaneous-Use to work in an HA environment. This means the accounting data has to be replicated to both systems. i.e. database replication.
Hmm... that would work, I guess.. buy you'd need a cron job (or something similar) to regularly dump the DB to files.
no, I'm going to use cron to generate files for radius from database if something was canged in db.
So... yes, you will use cron to regularly dump the DB to files. There's no need to argue over the details. It's unfriendly.
My first though was not to use database directly, but only for generating radius files configurations. but i need to allow onlu 1 conection per client so i must use "Simultaneous-Use". I red that reading it from db is the best way. so that i want db.
You are aware of the difference between authentication data and accounting data, right? Simultaneous-Use looks at accounting data in SQL. So... you'll need accounting data in SQL for it to work. Which also means database replication.
I don't have to have Full HA. I've few spread PPPoE servers. I want to prepare in case if something went wrong with one of freeradius server.
<sigh> If you don't want full HA, then don't ask for HA. There's no "half-full HA", or "mostly HA, but not really". My suggestion is to drop anything related to HA. Not only is it complicated, it's clear you don't even know what you want, much less understand the underlying concepts. Alan DeKok.
Hi So how can I use "Simultaneous-Use := 1" efficiently and without database? 2016-04-01 13:58 GMT+02:00 Marcin <marcin@nicram.net>:
2016-04-01 13:23 GMT+02:00 Alan DeKok <aland@deployingradius.com>:
On Apr 1, 2016, at 2:59 AM, Marcin <marcin@nicram.net> wrote:
I'm going to start two freeradius servers to authenticate PPPoE users, both independent of the other. First as primary and second as secondary. I'm going to start PostgreSQL server also, but in case of unavailability of sql server freeradius server must have work properly.
What does that mean?
It's always a red flag for me when people say vague things like "it must work properly". Computers aren't magic. They don't know your intention, or your requirements.
Yes I know :)
Both freeradius have to have actual data of arleady logged users to provide simultanieusly use.
i.e. The databases have to replicate data to each other. Or, each server has to write to both databases.
Database replication is complex. You really need to have a good understanding of the systems (and their failure modes) before implementing it.
I don't want replicate database. I want to have as simple configuration as possible, having two independent freeradius server with the same data.
I'm going to check authenticate in db and if if failed get user from files (created in background).
Hmm... that would work, I guess.. buy you'd need a cron job (or something similar) to regularly dump the DB to files.
no, I'm going to use cron to generate files for radius from database if something was canged in db.
Though the next question is "If the files are up to date, why use a database?"
My first though was not to use database directly, but only for generating radius files configurations. but i need to allow onlu 1 conection per client so i must use "Simultaneous-Use". I red that reading it from db is the best way. so that i want db.
accounitng i'm going to do with linelog and afterwards put in to database.
The server already supports writing and reading "detail" files into the DB. It doesn't support reading "linelog" entries.
I need advice from you, more advanced users than me. How to achieve that HA and avablitity.
The short solution is to set up two independent servers. Each reads and writes to their own DB. Then, each replicates accounting traffic to the other. There are examples of this is raddb/sites-available/
The longer answer is that HA is a complicated configuration. It's really not possible to describe all of the possibilities, problems, and solutions in a short email. You have to understand all of the pieces, and understand the trade-offs each solution has.
To be honest, for less than 10K users, you just don't need HA. Run one server, and make sure it stays up.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I don't have to have Full HA. I've few spread PPPoE servers. I want to prepare in case if something went wrong with one of freeradius server.
-- Pozdrawiam Marcin / nicraM
-- Pozdrawiam Marcin / nicraM
On Apr 3, 2016, at 10:56 AM, Marcin <marcin@nicram.net> wrote:
So how can I use "Simultaneous-Use := 1" efficiently and without database?
For ~100 users, the "radutmp" file works. The default configuration has examples. For more users, use a database. You're not going to store 100K users efficiently without a database. FreeRADIUS isn't a database. So... you'll need a database. Alan DeKok.
Ok, now I understand. I'll must use db. Thanks. 2016-04-03 17:03 GMT+02:00 Alan DeKok <aland@deployingradius.com>:
On Apr 3, 2016, at 10:56 AM, Marcin <marcin@nicram.net> wrote:
So how can I use "Simultaneous-Use := 1" efficiently and without
database?
For ~100 users, the "radutmp" file works. The default configuration has examples.
For more users, use a database.
You're not going to store 100K users efficiently without a database. FreeRADIUS isn't a database. So... you'll need a database.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Pozdrawiam Marcin / nicraM
participants (3)
-
Alan DeKok -
Marcin -
Matthew Newton