Duplicating accounting data between servers
I am setting up a couple of servers FreeRADIUS 3.0.4 (CentOS 7). They are pretty basic, handling RADIUS for dialup users. The users are stored in SQL (each servers has a local MariaDB instance, provisioned by an external management system). I have accounting data going to SQL as well, but then each server just has its own records (and of course NASes tend to flip back and forth on their own), so I would like to have FreeRADIUS duplicate the accounting records to both servers (so server A sends what it gets to server B and vice versa). I see radrelay references in buffered-sql and the like, but what I don't see is how do I keep accounting records from looping? If both servers are configured to copy to the other, what keeps records from bouncing back and forth? Or will they only forward records they receive directly from NASes? I couldn't find anything that explicitly documents that behavior. -- Chris Adams <cma@cmadams.net>
On Aug 27, 2015, at 12:31 PM, Chris Adams <cma@cmadams.net> wrote:
I am setting up a couple of servers FreeRADIUS 3.0.4 (CentOS 7). They are pretty basic, handling RADIUS for dialup users. The users are stored in SQL (each servers has a local MariaDB instance, provisioned by an external management system).
I have accounting data going to SQL as well, but then each server just has its own records (and of course NASes tend to flip back and forth on their own), so I would like to have FreeRADIUS duplicate the accounting records to both servers (so server A sends what it gets to server B and vice versa).
I see radrelay references in buffered-sql and the like, but what I don't see is how do I keep accounting records from looping? If both servers are configured to copy to the other, what keeps records from bouncing back and forth? Or will they only forward records they receive directly from NASes? I couldn't find anything that explicitly documents that behavior.
If you're not proxying to either of those servers, just check for the presence of &Proxy-State. If it's present, don't call the detail writer. -Arran
Once upon a time, Arran Cudbard-Bell <a.cudbardb@freeradius.org> said:
If you're not proxying to either of those servers, just check for the presence of &Proxy-State. If it's present, don't call the detail writer.
That sounds like it'll work fine for what I need - thanks! Now for the dumb question (because I'm missing something obvious I expect): how do I actually specify the other server to which the accounting packets should be proxied? I was looking at the copy-acct-to-home-server, but it seems to assume the other server is specified somewhere else (how?). Basically, on server A, where do I put server B's IP/secret? -- Chris Adams <cma@cmadams.net>
On Aug 27, 2015, at 3:46 PM, Chris Adams <cma@cmadams.net> wrote:
Once upon a time, Arran Cudbard-Bell <a.cudbardb@freeradius.org> said:
If you're not proxying to either of those servers, just check for the presence of &Proxy-State. If it's present, don't call the detail writer.
That sounds like it'll work fine for what I need - thanks!
Now for the dumb question (because I'm missing something obvious I expect): how do I actually specify the other server to which the accounting packets should be proxied? I was looking at the copy-acct-to-home-server, but it seems to assume the other server is specified somewhere else (how?).
Usually by setting &control:Proxy-To-Realm in the detail reader server. You'll need the servers configured in proxy.conf, and yes, you'll need a realm/home_server_pool/home_server for each server. -Arran
Once upon a time, Arran Cudbard-Bell <a.cudbardb@freeradius.org> said:
Usually by setting &control:Proxy-To-Realm in the detail reader server.
You'll need the servers configured in proxy.conf, and yes, you'll need a realm/home_server_pool/home_server for each server.
Thanks for your help, I have it working. -- Chris Adams <cma@cmadams.net>
participants (2)
-
Arran Cudbard-Bell -
Chris Adams