Hi All, I've had a scan of the archives and the Internet; I wish to deploy two new FreeRADIUS servers for a new network. I don't need fancy floating IPs like with LVS, incoming requests are load-balanced across both server IPs (but the session are "sicky" in that they always go to the same RADIUS once established). So all I need (I believe) is master-master MySQL replication so that authentication can be made against either RADIUS and updates like new users etc are replicated beween the two. For many people "master-master" is a bad phrase, is anyone doing this successfully? Post reading all I seem to need is the power of auto_increment_offset and auto_increment_increment to make my MySQL repliation safe from PK clashing issues. Can anyone who is doing this confirm what they have done or have you tried this and it failed terribly? If you have two servers for load-balacning how have you done it if you are using a different configuration? Cheers, James.
Hi All, As a follow up to this I am thinking I shall use MariaDB if anyone has any thoughts on that. Cheers, James.
On 5 Aug 2014, at 11:33, James Bensley <jwbensley@gmail.com> wrote:
Hi All,
As a follow up to this I am thinking I shall use MariaDB if anyone has any thoughts on that.
What are you actually putting in the database? Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On 05/08/14 16:42, Arran Cudbard-Bell wrote:
On 5 Aug 2014, at 11:33, James Bensley <jwbensley@gmail.com> wrote:
Hi All,
As a follow up to this I am thinking I shall use MariaDB if anyone has any thoughts on that.
What are you actually putting in the database?
This. If you're just reading username/password, you don't need multi-master. If you're doing accounting, you *might* want that. But you could just relay the accounting to a central server and wait for it to replicate back out, or use radsqlrelay. Depends on your needs. If you're doing IP assignment it's a bit trickier, but there are solutions if your radius requests are reasonably sticky over long-ish timescales (minutes). We do the following: 1. SQL DB "users" - master server, read-only replica on radius servers via Postgres "Slony" 2. SQL DB "accounting" - master server only, radsqlrelay from radius servers; no local copy on radius servers. 3. SQL DB "ipassign" - local to each radius server, sqlippool queries modified to put update servername/timestamp column on rows, python script syncs most-recent IP assignment bi-directionally once a minute. I think a multi-master approach sounds fragile. We also use Postgresql rather than MySQL/MariaDB.
Hi All, Thanks for the input, I have spoken with a DBA friend I trust and he also warned against master-master because it is a pain to manage. The two servers are going into two seperate DCs to cover things like maintenance windows on core routers at the DCs and also to allow us to take the servers themselves down for maintenance individually so they need to be able to operate on their own for a period of time. After sending yesterdays email I read more, I didn't realise Postgres was supported natively! :) The RADIUS boxes are for an ADSL platform, they will hold user records and accounting records. I want both user account records and accounting info to be in the database (but not FreeRADIUS config [if that is even possible?] so people can't make a change and replicate that taking them both out simultaneously). I think perhaps a master to slave is best but with the loss of a master the slave must cache DB updates until the master returns. Looks like radsqlreplay is what I need, is that DB agnostic, will it support either MariaDB and Postgress denpending on which one I choose? Many thanks, James.
Hi James, I recently installed mysql cluster and freeradius. Each freeradius instance talks to its local mysql api only. http://www.mysql.com/why-mysql/white-papers/deploying-freeradius-with-the-my... I used disk data tables for accounting records, except for the indexes and so far so good. Anthony On 6 Aug 2014, at 09:38, James Bensley <jwbensley@gmail.com> wrote:
Hi All,
Thanks for the input, I have spoken with a DBA friend I trust and he also warned against master-master because it is a pain to manage. The two servers are going into two seperate DCs to cover things like maintenance windows on core routers at the DCs and also to allow us to take the servers themselves down for maintenance individually so they need to be able to operate on their own for a period of time.
After sending yesterdays email I read more, I didn't realise Postgres was supported natively! :)
The RADIUS boxes are for an ADSL platform, they will hold user records and accounting records. I want both user account records and accounting info to be in the database (but not FreeRADIUS config [if that is even possible?] so people can't make a change and replicate that taking them both out simultaneously). I think perhaps a master to slave is best but with the loss of a master the slave must cache DB updates until the master returns.
Looks like radsqlreplay is what I need, is that DB agnostic, will it support either MariaDB and Postgress denpending on which one I choose?
Many thanks, James. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Likewise, we recently installed MariaDB Galera Cluster which can do master-master in a pretty nice implementation. You really need 3 nodes though, rather than the usual 2 and it's a bit of a pain to set up. Cheers, Jonathan On 06/08/14 09:48, Anthony McGarry wrote: > Hi James, > > I recently installed mysql cluster and freeradius. Each freeradius instance talks to its local mysql api only. > > http://www.mysql.com/why-mysql/white-papers/deploying-freeradius-with-the-mysql-cluster-database/ > > I used disk data tables for accounting records, except for the indexes and so far so good. > > Anthony > > > On 6 Aug 2014, at 09:38, James Bensley <jwbensley@gmail.com> wrote: > >> Hi All, >> >> Thanks for the input, I have spoken with a DBA friend I trust and he >> also warned against master-master because it is a pain to manage. The >> two servers are going into two seperate DCs to cover things like >> maintenance windows on core routers at the DCs and also to allow us to >> take the servers themselves down for maintenance individually so they >> need to be able to operate on their own for a period of time. >> >> After sending yesterdays email I read more, I didn't realise Postgres >> was supported natively! :) >> >> The RADIUS boxes are for an ADSL platform, they will hold user records >> and accounting records. I want both user account records and >> accounting info to be in the database (but not FreeRADIUS config [if >> that is even possible?] so people can't make a change and replicate >> that taking them both out simultaneously). I think perhaps a master to >> slave is best but with the loss of a master the slave must cache DB >> updates until the master returns. >> >> Looks like radsqlreplay is what I need, is that DB agnostic, will it >> support either MariaDB and Postgress denpending on which one I choose? >> >> Many thanks, >> James. >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Wed, Aug 6, 2014 at 5:17 PM, Jonathan Gazeley <Jonathan.Gazeley@bristol.ac.uk> wrote:
Likewise, we recently installed MariaDB Galera Cluster which can do master-master in a pretty nice implementation. You really need 3 nodes though, rather than the usual 2
IIRC most clusters need some kind of tie-breaker to prevent split brain scenario.
and it's a bit of a pain to set up.
Galera? It's much simpler compared to mysql cluster. I recently tested mariadb + tokudb + galera from https://downloads.mariadb.org/mariadb-galera/10.0.12/ on ubuntu, using . Even though tokudb engine is not officially supported yet with galera, it should be excellent for radacct due to faster inserts (compared to innodb) and compressed storage. Once you get the hang of it, setting it up is pretty easy. The biggest downside of galera (compared to local mysql instance or old master-slave config) that I can think of is that all writes must be completed an all nodes, so you might see some increased latency. -- Fajar
Cheers, Jonathan
On 06/08/14 09:48, Anthony McGarry wrote:
Hi James,
I recently installed mysql cluster and freeradius. Each freeradius instance talks to its local mysql api only.
http://www.mysql.com/why-mysql/white-papers/deploying-freeradius-with-the-my...
I used disk data tables for accounting records, except for the indexes and so far so good.
Anthony
On 6 Aug 2014, at 09:38, James Bensley <jwbensley@gmail.com> wrote:
Hi All,
Thanks for the input, I have spoken with a DBA friend I trust and he also warned against master-master because it is a pain to manage. The two servers are going into two seperate DCs to cover things like maintenance windows on core routers at the DCs and also to allow us to take the servers themselves down for maintenance individually so they need to be able to operate on their own for a period of time.
After sending yesterdays email I read more, I didn't realise Postgres was supported natively! :)
The RADIUS boxes are for an ADSL platform, they will hold user records and accounting records. I want both user account records and accounting info to be in the database (but not FreeRADIUS config [if that is even possible?] so people can't make a change and replicate that taking them both out simultaneously). I think perhaps a master to slave is best but with the loss of a master the slave must cache DB updates until the master returns.
Looks like radsqlreplay is what I need, is that DB agnostic, will it support either MariaDB and Postgress denpending on which one I choose?
Many thanks, James. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi, On 05/08/2014 16:21, James Bensley wrote:
Can anyone who is doing this confirm what they have done or have you tried this and it failed terribly? If you have two servers for load-balacning how have you done it if you are using a different configuration?
We achieve this in a slightly unconventional way to get around the issue of replication and dual master. All of our FR servers have a local MySQL DB that they, and they alone, query and update. We have a primary "first among equals" server that all DB updates are made to (assuming normal operation), and this server has a cron-driven process every 4 hours to manually copy key tables from the "main" server to the "slaves". This operates without any MySQL replication involved - just a mysqldump piped into a mysql. We copy: nas radcheck radgroupcheck radgroupreply radpostauth radreply radusergroup We don't copy any of the accounting tables - so the accounting records are saved to whichever server the NAS happens to be talking to at the time. This works out OK for us, as we don't use the accounting records for anything critical - and when using them for troubleshooting etc. we have scripts that query all servers so it doesn't matter if a start and stop are on different machines. This works for us as (a) there are few DB changes so replication in real-time isn't necessary, and (b) the load from the NASes to the FR servers is sufficiently low that the tables being locked during the sync is not an issue. I suspect that under any serious loading, this would very quickly be a non-starter; it depends a bit if you're going for load balancing for redundancy or scaling. Paul.
participants (7)
-
Anthony McGarry -
Arran Cudbard-Bell -
Fajar A. Nugraha -
James Bensley -
Jonathan Gazeley -
Paul Thornton -
Phil Mayers