Using DHCP for Radius on a Cable Modem Plant
Morning, Has anyone use freeradius and the built-in dhcp server in freeradius for a small cable modem plant? I am using LDAP for the authentication part and it works. Radius just seems like a much cleaner solution. So, the idea I have in mind is using freeradius for authentication and go ahead and use it for DHCP. I will use a SQL database backend to keep track of users. So, my question has to do with documentation. Most of seems to be dealing with version 2, and the main page says.. hey.. do not use version 2 configs as a starting space. Also, documentation seems weak on the new DHCP options. The way I figure it, if I am going to complain about documentation or lack thereof, I just need to write some documentation and submit to the group. That being said, some directions in the right direction would help me get started. I have seen documentation on each of the separate items below, but not much in tieing it all together. Platform will be Linux running a standard LAMP installation. SQL database (mysql, postgress, I do not care) to keep track of information, specifically the MAC address which will be used for authentication. DHCP? Should I use the DHCP built into Radius? Or outside DHCP server. I kind like the idea of allowing Radius handling it all. So. At the end, I guess I am looking for some general advice on best practices of setting this up. Once I get an overview setup, then I can start working on specifics. John
On Aug 21, 2015, at 11:29 AM, John Alcock <john@alcock.org> wrote:
Morning,
Has anyone use freeradius and the built-in dhcp server in freeradius for a small cable modem plant?
I am using LDAP for the authentication part and it works.
Radius just seems like a much cleaner solution.
So, the idea I have in mind is using freeradius for authentication and go ahead and use it for DHCP. I will use a SQL database backend to keep track of users.
You mean leases, right?
So, my question has to do with documentation. Most of seems to be dealing with version 2, and the main page says.. hey.. do not use version 2 configs as a starting space.
There's an example DHCP server in v3.0.x too.
Also, documentation seems weak on the new DHCP options.
Look at the dictionaries for decodable options, and read the DHCP RFCs, you need to understand exactly how DHCP works to get FreeRADIUS working as a DHCP server. You're just presented with the type of DHCP packet and a bunch of options that were included, you need to write the logic to deal with that and send back the correct response.
The way I figure it, if I am going to complain about documentation or lack thereof, I just need to write some documentation and submit to the group.
Good attitude :)
That being said, some directions in the right direction would help me get started. I have seen documentation on each of the separate items below, but not much in tieing it all together.
Platform will be Linux running a standard LAMP installation.
SQL database (mysql, postgress, I do not care) to keep track of information, specifically the MAC address which will be used for authentication.
So DHCP leases are only allocated if the device has performed RADIUS based authentication of some kind?
DHCP? Should I use the DHCP built into Radius? Or outside DHCP server. I kind like the idea of allowing Radius handling it all.
Do you mean passing back IP addresses using Framed-IP-Address and having the NAS deal with allocating leases? Or do you mean setting up FreeRADIUS to speak DHCP and allocate leases? If you have the option of passing back Framed-IP-Address it'll almost certainly scale better, because then the DHCP servers are distributed. This is how the Alcatel service routers handle DHCP. -Arran
On Aug 21, 2015, at 11:29 AM, John Alcock <john@alcock.org> wrote:
Has anyone use freeradius and the built-in dhcp server in freeradius for a small cable modem plant?
There are a number of people using it.
So, my question has to do with documentation. Most of seems to be dealing with version 2, and the main page says.. hey.. do not use version 2 configs as a starting space.
The documentation does need updating for v3.
Also, documentation seems weak on the new DHCP options.
Yes sorry. It should be relatively simple: see raddb/sites-available/dhcp.
The way I figure it, if I am going to complain about documentation or lack thereof, I just need to write some documentation and submit to the group.
A good "how to" would be nice. But the wiki has a good start: http://wiki.freeradius.org/guide/dhcp-for-static-ip-allocation
That being said, some directions in the right direction would help me get started. I have seen documentation on each of the separate items below, but not much in tieing it all together.
That is a problem.
SQL database (mysql, postgress, I do not care) to keep track of information, specifically the MAC address which will be used for authentication.
I'd say use Postgres. And then the sqlippool module, which works for both RADIUS and DHCP.
DHCP? Should I use the DHCP built into Radius? Or outside DHCP server. I kind like the idea of allowing Radius handling it all.
Me, too.
So. At the end, I guess I am looking for some general advice on best practices of setting this up.
Read raddb/sites-available/dhcp. See the sqlippool schema in raddb/mods-config/sql/ippool, and the dhcp_sqlippool module in raddb/mods-available, and the dhcp_sqlippool policies in raddb/policy.d/dhcp_sqlippool. That could probably be simplified. But it should be enough to get you up and running in less than a day. Alan DeKok.
Alan DeKok wrote:
On Aug 21, 2015, at 11:29 AM, John Alcock <john@alcock.org> wrote:
Has anyone use freeradius and the built-in dhcp server in freeradius for a small cable modem plant? [..] SQL database (mysql, postgress, I do not care) to keep track of information, specifically the MAC address which will be used for authentication.
I'd say use Postgres.
I'd also like to try to replace ISC dhcpd currently used with LDAP backend by FreeRADIUS already running for WLAN access. Any change to set up a plain DHCP server with LDAP as backend? Ciao, Michael.
On Aug 21, 2015, at 12:18 PM, Michael Ströder <michael@stroeder.com> wrote:
I'd also like to try to replace ISC dhcpd currently used with LDAP backend by FreeRADIUS already running for WLAN access. Any change to set up a plain DHCP server with LDAP as backend?
It's probably possible. The only consideration is what's in LDAP? If you're doing static IPs in LDAP, it's pretty simple. I don't think there's a standard for doing dynamic leases in LDAP. Alan DeKok.
On Aug 21, 2015, at 12:34 PM, Alan DeKok <aland@deployingradius.com> wrote:
On Aug 21, 2015, at 12:18 PM, Michael Ströder <michael@stroeder.com> wrote:
I'd also like to try to replace ISC dhcpd currently used with LDAP backend by FreeRADIUS already running for WLAN access. Any change to set up a plain DHCP server with LDAP as backend?
It's probably possible. The only consideration is what's in LDAP?
If you're doing static IPs in LDAP, it's pretty simple. I don't think there's a standard for doing dynamic leases in LDAP.
There's a draft from 99 https://tools.ietf.org/html/draft-gu-dhcp-ldap-schema-00 Could follow that. -Arran
On Aug 21, 2015, at 12:42 PM, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On Aug 21, 2015, at 12:34 PM, Alan DeKok <aland@deployingradius.com> wrote:
On Aug 21, 2015, at 12:18 PM, Michael Ströder <michael@stroeder.com> wrote:
I'd also like to try to replace ISC dhcpd currently used with LDAP backend by FreeRADIUS already running for WLAN access. Any change to set up a plain DHCP server with LDAP as backend?
It's probably possible. The only consideration is what's in LDAP?
If you're doing static IPs in LDAP, it's pretty simple. I don't think there's a standard for doing dynamic leases in LDAP.
There's a draft from 99 https://tools.ietf.org/html/draft-gu-dhcp-ldap-schema-00
Could follow that.
Or there's whatever ISC is using. I guess that's better as it'd allow an easy migration path. http://www.freeipa.org/page/DHCP_Integration_Design -Arran
Arran Cudbard-Bell wrote:
On Aug 21, 2015, at 12:42 PM, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On Aug 21, 2015, at 12:34 PM, Alan DeKok <aland@deployingradius.com> wrote:
On Aug 21, 2015, at 12:18 PM, Michael Ströder <michael@stroeder.com> wrote:
I'd also like to try to replace ISC dhcpd currently used with LDAP backend by FreeRADIUS already running for WLAN access. Any change to set up a plain DHCP server with LDAP as backend?
It's probably possible. The only consideration is what's in LDAP?
If you're doing static IPs in LDAP, it's pretty simple. I don't think there's a standard for doing dynamic leases in LDAP.
There's a draft from 99 https://tools.ietf.org/html/draft-gu-dhcp-ldap-schema-00 Could follow that.
Yes, references to ManagedSystemElement sounds like that bloated DEN / CIM stuff. I'm pretty sure you don't want to get into that. There were even two more drafts for a DHCP-LDAP schema: https://tools.ietf.org/html/draft-ietf-dhc-schema (March 2000) https://tools.ietf.org/html/draft-miller-dhcp-ldap-schema AFAICS the ISC schema is not one of the above. And MS AD has its own schema. And I also vaguely remember that Novell has something in eDirectory (maybe almost draft-miller-dhcp-ldap-schema). I have to dig my harddisk...we should invent another LDAP schema. ;-)
Or there's whatever ISC is using. I guess that's better as it'd allow an easy migration path.
The ISC schema has schema descriptions for DHCP leases (but they don't use it). Mainly they develop their new DHCP server "kea" which stores leases into SQL DBs (DB abstraction layer). But I'd rather avoid the ISC-LDAP schema. It makes my eyes hurt because it was simply designed for easily converting an existing textual configuration. So attributes contain text bloat instead of indexable, searchable information. I have to look at your leases SQL schema... Ciao, Michael.
On Aug 21, 2015, at 3:10 PM, Michael Ströder <michael@stroeder.com> wrote:
Arran Cudbard-Bell wrote:
On Aug 21, 2015, at 12:42 PM, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On Aug 21, 2015, at 12:34 PM, Alan DeKok <aland@deployingradius.com> wrote:
On Aug 21, 2015, at 12:18 PM, Michael Ströder <michael@stroeder.com> wrote:
I'd also like to try to replace ISC dhcpd currently used with LDAP backend by FreeRADIUS already running for WLAN access. Any change to set up a plain DHCP server with LDAP as backend?
It's probably possible. The only consideration is what's in LDAP?
If you're doing static IPs in LDAP, it's pretty simple. I don't think there's a standard for doing dynamic leases in LDAP.
There's a draft from 99 https://tools.ietf.org/html/draft-gu-dhcp-ldap-schema-00 Could follow that.
Yes, references to ManagedSystemElement sounds like that bloated DEN / CIM stuff. I'm pretty sure you don't want to get into that.
There were even two more drafts for a DHCP-LDAP schema: https://tools.ietf.org/html/draft-ietf-dhc-schema (March 2000) https://tools.ietf.org/html/draft-miller-dhcp-ldap-schema
AFAICS the ISC schema is not one of the above.
And MS AD has its own schema. And I also vaguely remember that Novell has something in eDirectory (maybe almost draft-miller-dhcp-ldap-schema).
I have to dig my harddisk...we should invent another LDAP schema. ;-)
:/
Or there's whatever ISC is using. I guess that's better as it'd allow an easy migration path.
The ISC schema has schema descriptions for DHCP leases (but they don't use it). Mainly they develop their new DHCP server "kea" which stores leases into SQL DBs (DB abstraction layer).
Ug.
But I'd rather avoid the ISC-LDAP schema. It makes my eyes hurt because it was simply designed for easily converting an existing textual configuration. So attributes contain text bloat instead of indexable, searchable information. I have to look at your leases SQL schema...
I'd be interested to know if ISC have found a way to do sparse allocation of DHCP leases. AFAICT our SQL schemas require rows to be inserted into the SQL db, representing each lease in the pool, before the module can allocate them. Which is fine, I guess, just seems a little wasteful. The problem with using LDAP for IP allocation, is with OpenLDAP at least, the whole server is setup for read performance. When you start writing you blow out the object caches in BDB and OpenLDAP and read performance starts to suck too. With LMDB you're looking at around 3000 writes/s max, as there's only a single writer thread. It's really not designed for balanced read/write loads. For that you'd want to look at either SQL or one of the numerous in memory K/V stores which have popped up in recent years. -Arran
On Aug 21, 2015, at 3:40 PM, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
I'd be interested to know if ISC have found a way to do sparse allocation of DHCP leases.
Nope. I had patches for ISC to do that 10 years ago. They told me it wasn't possible, so they didn't want to see the patches.
AFAICT our SQL schemas require rows to be inserted into the SQL db, representing each lease in the pool, before the module can allocate them.
Which is fine, I guess, just seems a little wasteful.
My patches for ISC tracked ranges: start, stop, last IP checked. If it couldn't find a lease in the IP table, it looked in the range table, and updated the "last IP checked". It was pretty simple, TBH.
The problem with using LDAP for IP allocation, is with OpenLDAP at least, the whole server is setup for read performance. When you start writing you blow out the object caches in BDB and OpenLDAP and read performance starts to suck too.
With LMDB you're looking at around 3000 writes/s max, as there's only a single writer thread.
It's really not designed for balanced read/write loads. For that you'd want to look at either SQL or one of the numerous in memory K/V stores which have popped up in recent years.
Yup. LDAP is fine for static leases. Dynamic... not so much. Alan DeKok.
Alan DeKok wrote:
Yup. LDAP is fine for static leases. Dynamic... not so much.
In my scenario the majority of leases would be static since it's about security controls at network level. Only some dynamic leases, far from what others need when providing access services for millions of users. Ciao, Michael.
What I have in mind is based on some parameter in the SQL database, it will return the correct ip pool and other options. For example: A Non-Pay would get an IP from the wall-garden IP-Pool. Also, with the exhaustion of public routeable ip's, I may want users to get an ip from my NAT Pool. Other users may get an ip address from the public pool. So the general idea is this. Client comes up and makes DHCP Request to DHCP Server. DHCP Server makes request to Radius Server using mac address Radius Server checks SQL SQL returns correct DHCP Options back to Radius (IP Pool, tftp, dns, etc) Radius sends DHCP options to DHCP Server. DHCP Server sends correct information back to clients. At least that is how I see it? Sound about right? John On Fri, Aug 21, 2015 at 4:00 PM, Michael Ströder <michael@stroeder.com> wrote:
Alan DeKok wrote:
Yup. LDAP is fine for static leases. Dynamic... not so much.
In my scenario the majority of leases would be static since it's about security controls at network level.
Only some dynamic leases, far from what others need when providing access services for millions of users.
Ciao, Michael.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Client comes up and makes DHCP Request to DHCP Server. DHCP Server makes request to Radius Server using mac address
I don't think you need a RADIUS server at all here. The DHCP server (FreeRADIUS) can check the MAC against the DB itself. On 22 August 2015 at 00:16, John Alcock <john@alcock.org> wrote:
What I have in mind is based on some parameter in the SQL database, it will return the correct ip pool and other options.
For example:
A Non-Pay would get an IP from the wall-garden IP-Pool. Also, with the exhaustion of public routeable ip's, I may want users to get an ip from my NAT Pool. Other users may get an ip address from the public pool.
So the general idea is this.
Client comes up and makes DHCP Request to DHCP Server. DHCP Server makes request to Radius Server using mac address Radius Server checks SQL SQL returns correct DHCP Options back to Radius (IP Pool, tftp, dns, etc) Radius sends DHCP options to DHCP Server. DHCP Server sends correct information back to clients.
At least that is how I see it? Sound about right?
John
On Fri, Aug 21, 2015 at 4:00 PM, Michael Ströder <michael@stroeder.com> wrote:
Alan DeKok wrote:
Yup. LDAP is fine for static leases. Dynamic... not so much.
In my scenario the majority of leases would be static since it's about security controls at network level.
Only some dynamic leases, far from what others need when providing access services for millions of users.
Ciao, Michael.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Бен Томпсон, инженер отдела внедрения и техподдержки, компания "Латера" | www.latera.ru тел.: +7 (499) 940-95-05, доб. 221 E-mail: b.thompson@latera.ru Присоединяйтесь к нам в социальных сетях [image: Встроенное изображение 1] <https://www.facebook.com/pages/%D0%91%D0%B8%D0%BB%D0%BB%D0%B8%D0%BD%D0%B3-%D0%93%D0%B8%D0%B4%D1%80%D0%B0/622692344514207> [image: Встроенное изображение 2] <https://twitter.com/Hydra_billing_> [image: Встроенное изображение 3] <http://www.youtube.com/channel/UC0SHZ4fnWJ443xUwYEAbT5g?spfreload=10> [image: Встроенное изображение 5] <https://www.linkedin.com/company/9347770?trk=hp-feed-company-name>
On Aug 21, 2015, at 12:18 PM, Michael Ströder <michael@stroeder.com> wrote:
Alan DeKok wrote:
On Aug 21, 2015, at 11:29 AM, John Alcock <john@alcock.org> wrote:
Has anyone use freeradius and the built-in dhcp server in freeradius for a small cable modem plant? [..] SQL database (mysql, postgress, I do not care) to keep track of information, specifically the MAC address which will be used for authentication.
I'd say use Postgres.
I'd also like to try to replace ISC dhcpd currently used with LDAP backend by FreeRADIUS already running for WLAN access. Any change to set up a plain DHCP server with LDAP as backend?
Well there's no allocation module for LDAP, because that would be quite slow (using lmdb at least)... If you're using static IP assignments then it'd be fairly trivial to do it today. Just use unlang to pull the IP addresses out. There are vague plans to merged all the ippool modules into a single module with drivers, like the cache module, eap module, and sql module, we could look at adding LDAP based allocation then, but it's not something i'm overly enthusiastic about writing now :) -Arran
participants (5)
-
Alan DeKok -
Arran Cudbard-Bell -
John Alcock -
Michael Ströder -
Бен Томпсон