One of my virtual servers uses LDAP auth. However, it isn't clear to me if modules/ldap can be configured with a secondary LDAP server, should the primary fail to respond. The group that provides the LDAP server can't set up multiple servers behind a load balancer due to cert issues, so I'm looking for a way to add a failover LDAP server to the RADIUS configuration. What's the easiest/best/recommended way to do something like this? Can modules/ldap be configured this way, or should I create a modules/ldap2 (or similar) and call it somehow? Suggestions welcome. Thanks! Justin McNutt Network Systems Analyst - Ninja DNPS, Mizzou Telecom (573) 882-5183 "Do you have a concussion?" Ping is NOT a service. You don't need it. Use a real test.
I'm pretty sure this is discussed, examples, etc in the doc: online and in FR conf files. Sorry I don't have exact location handy, but I'm sure its there. From: McNutt, Justin M. [mailto:McNuttJ@missouri.edu] Sent: Tuesday, March 08, 2011 05:02 PM To: freeradius-users@lists.freeradius.org <freeradius-users@lists.freeradius.org> Subject: Secondary LDAP server One of my virtual servers uses LDAP auth. However, it isn't clear to me if modules/ldap can be configured with a secondary LDAP server, should the primary fail to respond. The group that provides the LDAP server can't set up multiple servers behind a load balancer due to cert issues, so I'm looking for a way to add a failover LDAP server to the RADIUS configuration. What's the easiest/best/recommended way to do something like this? Can modules/ldap be configured this way, or should I create a modules/ldap2 (or similar) and call it somehow? Suggestions welcome. Thanks! Justin McNutt Network Systems Analyst - Ninja DNPS, Mizzou Telecom (573) 882-5183 "Do you have a concussion?" Ping is NOT a service. You don't need it. Use a real test. <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>
It's not anywhere in the config files, but I did find where RedHat hid the doc/* files. There's a /usr/share/doc/freeradius-2.1.7/configurable_failover that looks like what I need. Goes into some decent detail, too. --J ________________________________ From: freeradius-users-bounces+mcnuttj=missouri.edu@lists.freeradius.org [mailto:freeradius-users-bounces+mcnuttj=missouri.edu@lists.freeradius.org] On Behalf Of Gary Gatten Sent: Tuesday, March 08, 2011 5:17 PM To: 'freeradius-users@lists.freeradius.org' Subject: Re: Secondary LDAP server I'm pretty sure this is discussed, examples, etc in the doc: online and in FR conf files. Sorry I don't have exact location handy, but I'm sure its there. From: McNutt, Justin M. [mailto:McNuttJ@missouri.edu] Sent: Tuesday, March 08, 2011 05:02 PM To: freeradius-users@lists.freeradius.org <freeradius-users@lists.freeradius.org> Subject: Secondary LDAP server One of my virtual servers uses LDAP auth. However, it isn't clear to me if modules/ldap can be configured with a secondary LDAP server, should the primary fail to respond. The group that provides the LDAP server can't set up multiple servers behind a load balancer due to cert issues, so I'm looking for a way to add a failover LDAP server to the RADIUS configuration. What's the easiest/best/recommended way to do something like this? Can modules/ldap be configured this way, or should I create a modules/ldap2 (or similar) and call it somehow? Suggestions welcome. Thanks! Justin McNutt Network Systems Analyst - Ninja DNPS, Mizzou Telecom (573) 882-5183 "Do you have a concussion?" Ping is NOT a service. You don't need it. Use a real test. "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system."
On 03/08/2011 11:28 PM, McNutt, Justin M. wrote:
It's not anywhere in the config files, but I did find where RedHat hid the doc/* files. There's a /usr/share/doc/freeradius-2.1.7/configurable_failover that looks like what I need. Goes into some decent detail, too.
We don't hide anything :-) /usr/share/doc is the standard canonical documentation location for all FHS compliant Unix implementations. It's the first place you should look for documentation. Sometimes documentation is contained in optional subpackages which must be explicitly installed, this varies by package and is meant to address disk space issues. Our FreeRADIUS packaging does not currently have a separate doc package, so if you install the primary freeradius package you get the doc. If you ever have questions concerning FreeRADIUS on Red Hat you may want to consult this FAQ. It includes such information as how to find where files are located. http://wiki.freeradius.org/Red_Hat_FAQ Also since you're running on RHEL support should be available to you from Red Hat as a RHEL customer. -- John Dennis <jdennis@redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/
On Tue, Mar 08, 2011 at 05:16:35PM -0600, Gary Gatten wrote:
I'm pretty sure this is discussed, examples, etc in the doc: online and in FR conf files. Sorry I don't have exact location handy, but I'm sure its there.
From: McNutt, Justin M. [mailto:McNuttJ@missouri.edu] Sent: Tuesday, March 08, 2011 05:02 PM To: freeradius-users@lists.freeradius.org <freeradius-users@lists.freeradius.org> Subject: Secondary LDAP server
One of my virtual servers uses LDAP auth. However, it isn't clear to me if modules/ldap can be configured with a secondary LDAP server, should the primary fail to respond. The group that provides the LDAP server can't set up multiple servers behind a load balancer due to cert issues, so I'm looking for a way to add a failover LDAP server to the RADIUS configuration.
What's the easiest/best/recommended way to do something like this? Can modules/ldap be configured this way, or should I create a modules/ldap2 (or similar) and call it somehow?
Suggestions welcome.
Thanks!
Justin McNutt Network Systems Analyst - Ninja DNPS, Mizzou Telecom (573) 882-5183
Look at redundant, load-balance and redundant-load-balance in "man unlang". It goes over how to set this up and yes you will need to set up an ldap2. Cheers, Ken
participants (4)
-
Gary Gatten -
John Dennis -
Kenneth Marshall -
McNutt, Justin M.