Maximum number of virtual servers?
Any opinions (or hard facts) about the upper limit of virtual servers are advisable? Potentially more than 1,000 if we decide to go the virtual server route. Thanks, Clayton
On Feb 15, 2017, at 2:13 PM, Clayton Knorr <clayton.knorr@nuspire.com> wrote:
Any opinions (or hard facts) about the upper limit of virtual servers are advisable? Potentially more than 1,000 if we decide to go the virtual server route.
There is no limit. The virtual servers are placed into efficient data structures (trees) so that having 1000 is not much more expensive than having 1. That being said... 1000 seems a bit large. Why do you need that many? Alan DeKok.
We're going to have lots of users from different organizations in one LDAP directory and virtual servers would be a way to have a different basedn when searching for the user accounts for each organization. It isn't a necessity just one option we're looking at. -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+clayton.knorr=nuspire.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Wednesday, February 15, 2017 2:23 PM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Maximum number of virtual servers? On Feb 15, 2017, at 2:13 PM, Clayton Knorr <clayton.knorr@nuspire.com> wrote:
Any opinions (or hard facts) about the upper limit of virtual servers are advisable? Potentially more than 1,000 if we decide to go the virtual server route.
There is no limit. The virtual servers are placed into efficient data structures (trees) so that having 1000 is not much more expensive than having 1. That being said... 1000 seems a bit large. Why do you need that many? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Feb 15, 2017, at 2:25 PM, Clayton Knorr <clayton.knorr@nuspire.com> wrote:
We're going to have lots of users from different organizations in one LDAP directory and virtual servers would be a way to have a different basedn when searching for the user accounts for each organization. It isn't a necessity just one option we're looking at.
Have everyone login with their email address. Then, you can qualify the LDAP lookups by domain names. That's a lot easier than the alternative... The main reason to use different virtual servers is because you have wildly different policies for each organization. If the policies are similar and data driven... just put the information in a database, and select it by domain name. Alan DeKok.
I don't think we can count on all these locations having their own domain name, but we can just make use of a user attribute in ldap instead. -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+clayton.knorr=nuspire.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Wednesday, February 15, 2017 2:32 PM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Maximum number of virtual servers?
On Feb 15, 2017, at 2:25 PM, Clayton Knorr <clayton.knorr@nuspire.com> wrote:
We're going to have lots of users from different organizations in one LDAP directory and virtual servers would be a way to have a different basedn when searching for the user accounts for each organization. It isn't a necessity just one option we're looking at.
Have everyone login with their email address. Then, you can qualify the LDAP lookups by domain names. That's a lot easier than the alternative... The main reason to use different virtual servers is because you have wildly different policies for each organization. If the policies are similar and data driven... just put the information in a database, and select it by domain name. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,
We're going to have lots of users from different organizations in one LDAP directory and virtual servers would be a way to have a different basedn when searching for the user accounts for each organization. It isn't a necessity just one option we're looking at.
there are more efficient ways... the virtual_server itself doesnt define the basedn - thats a function of the LDAP module - so you COULD have many of those.... or, based on your first LDAP lookup (that "lots of users from different organizations in one LDAP directory") you could get an attribute (stored in local dictionary) then populate the basedn value in an %{ldap:} query dynamically.... alan
On 15 Feb 2017, at 19:22, Alan DeKok <aland@deployingradius.com> wrote:
On Feb 15, 2017, at 2:13 PM, Clayton Knorr <clayton.knorr@nuspire.com> wrote:
Any opinions (or hard facts) about the upper limit of virtual servers are advisable? Potentially more than 1,000 if we decide to go the virtual server route.
There is no limit. The virtual servers are placed into efficient data structures (trees) so that having 1000 is not much more expensive than having 1.
That being said... 1000 seems a bit large. Why do you need that many?
I could see the issue being select() if they’re bound to 1000+ interfaces. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
They wouldn't all listen on different interfaces. We'd be storing the clients in ldap and defining which virtual server to use at that level. -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+clayton.knorr=nuspire.com@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: Wednesday, February 15, 2017 2:26 PM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Maximum number of virtual servers?
On 15 Feb 2017, at 19:22, Alan DeKok <aland@deployingradius.com> wrote:
On Feb 15, 2017, at 2:13 PM, Clayton Knorr <clayton.knorr@nuspire.com> wrote:
Any opinions (or hard facts) about the upper limit of virtual servers are advisable? Potentially more than 1,000 if we decide to go the virtual server route.
There is no limit. The virtual servers are placed into efficient data structures (trees) so that having 1000 is not much more expensive than having 1.
That being said... 1000 seems a bit large. Why do you need that many?
I could see the issue being select() if they’re bound to 1000+ interfaces. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On Wed, Feb 15, 2017 at 07:29:53PM +0000, Clayton Knorr wrote:
They wouldn't all listen on different interfaces. We'd be storing the clients in ldap and defining which virtual server to use at that level.
In which case, why not just use the same lookup to determine which basedn to use? Seems a lot simpler to do two LDAP lookups in one virtual server rather than create hundreds of virtual servers. Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
participants (5)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Arran Cudbard-Bell -
Clayton Knorr -
Matthew Newton