Thanks, this was helpful. I would rather not use LVS. I would prefer to use the built-in functionality of the NAS to fall back from a primary to secondary or tertiary auth/accounting servers. This whole setup would be far simpler and more robust if I could just do master-master replication with the MySQL servers. Oh well. I was not aware of radsqlrelay. I think this gets me closer to what I need than anything else. I can't guarantee which server the NAS will choose to log to at any given time. Therefore, I may need to use radsqlrelay on each server to keep the others in sync. Does this seem like a sensible plan? --Aaron Nicolas Baradakis wrote:
Aaron Paetznick wrote:
I've been struggling with this problem for a couple of weeks, and I thought I'd pass it along to the mailing list. Basically I'm trying to answer the following question. Given multiple identical dedicated servers each running Linux and MySQL, how can I configure FreeRADIUS for maximum stability, reliability, and performance? The question, it seems, is not as easy as is sounds.
I've already setup FreeRADIUS on multiple redundant servers, but never had the time to write a HOWTO. The main guideline is:
1. Use LVS in a "direct routing" setup to dispatch the RADIUS requests. http://www.linuxvirtualserver.org/VS-DRouting.html
2. Use MySQL replication for the authorize database, so each FreeRADIUS server connects to a local, read only database. http://dev.mysql.com/doc/refman/5.1/en/replication.html
3. Use radsqlrelay for the accounting database, so the accounting data is written to a central database without slowing down the RADIUS servers. radsqlrelay is to be found in the FreeRADIUS source tarball, you could read the "rlm_sql_log" and "radsqlrelay" manpages for more details.
On Mon 06 Nov 2006 19:38, Aaron Paetznick wrote:
Thanks, this was helpful. I would rather not use LVS. I would prefer to use the built-in functionality of the NAS to fall back from a primary to secondary or tertiary auth/accounting servers.
This whole setup would be far simpler and more robust if I could just do master-master replication with the MySQL servers. Oh well.
master-master = bad-bad Dont even consider it!!!!!!!!! MySQL's master-master implimentation is completely brain dead and WILL give you corrupt data is a very short time period (It doesn't do ANY locking across the cluster!!!). If you must use Mysql, use Master-Slave replication for as many authorization servers as you wish, but configure only ONE radius server to actually write accounting to the master database and all the others to use radrelay (or radsqlrelay) to get the data to that server Cheers -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc
Peter Nixon wrote:
If you must use Mysql, use Master-Slave replication for as many authorization servers as you wish, but configure only ONE radius server to actually write accounting to the master database and all the others to use radrelay (or radsqlrelay) to get the data to that server
We do something very much like this. We have 2 sql modules setup in the sql.conf file. The authorize section lists sql2 and then sql1 within a failover block and the accounting section only has sql1. MySQL does have a clustering option: http://www.mysql.com/products/database/cluster/ It has been a while since I read up on this, but I think it is fairly complex and requires more than 2 database servers (I could be wrong). In general I think it is overkill for a radius accounting situation. For serious billable accounting you probably want to write to files and then import them into the db (there is a module to help with this). Radius will happily skip queries that take too long or if there are not enough mysql connections available on the accounting side. -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com
Dennis Skinner wrote:
For serious billable accounting you probably want to write to files and then import them into the db (there is a module to help with this). Radius will happily skip queries that take too long or if there are not enough mysql connections available on the accounting side.
I remember reading about 'radsqlrelay' that does essentially this. It is also mentioned once in radiusd.conf but subsequent searching has brought up nothing worthwhile. Does anyone remember where there is doccumentation on this? regards Graham Beneke
Graham Beneke wrote:
I remember reading about 'radsqlrelay' that does essentially this. It is also mentioned once in radiusd.conf but subsequent searching has brought up nothing worthwhile.
Does anyone remember where there is doccumentation on this?
rlm_sql_log writes the logs scripts/radsqlrelay reads them, and writes them to SQL. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
On Fri 19 Jan 2007 09:10, Alan DeKok wrote:
Graham Beneke wrote:
I remember reading about 'radsqlrelay' that does essentially this. It is also mentioned once in radiusd.conf but subsequent searching has brought up nothing worthwhile.
Does anyone remember where there is doccumentation on this?
rlm_sql_log writes the logs scripts/radsqlrelay reads them, and writes them to SQL.
I notice that everyone seems to be recommending radsqlrelay allot these days, but there are some very good reasons why you would want to use radrelay with an sql driver configured instead of radsqlrelay. radsqlrelay tails a SQL logfile and forwards the queries to a database server... This means that the queries that are run are predetermined without the database having any say in the matter. radrelay on the other hand can read multiple (if necessary) detail files and then run them though a standard radiusd.conf including module failover. What this means is that you can do things like writing your accounting records to a primary accounting table by default, WITH a unique constraint on the table, then writing records that violate that constraint (Module will fail) to a secondary table to post processing/investigation. This means that you can basically eliminate duplicate records, in one step, without post processing.. something that I am sure most people who actually bill customers using this information will find very usefull... Now granted this IS possible with radsqlrelay by embedding that logic in a stored proceedure, however with radrelay the failover module could be another detail file instead of a sql table or anything else that your heart desires (that radiusd.conf supports).. Cheers -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc
I use a very simple system to get redundancy. I have 2 seperate radius servers. If i do a change i need to do it on both(biggest disadvantage). In all my access points or other applications i can enter 2 radius servers. When the first doesn't answer it autom. authenticates to the second. This has the advantage that i add another config to one of them for test systems, or to test some parameters without the change being synced to the other one. Stieven Struyf M.I.S. Division - System Operations Komatsu Europe International NV Mechelsesteenweg 586 B-1800 Vilvoorde Stieven.Struyf@komatsu.eu Tel. +32 (0)2 2552551 freeradius-users-bounces+stieven.struyf=komatsu.eu@lists.freeradius.org wrote on 01/19/2007 05:42:02 AM:
Dennis Skinner wrote:
For serious billable accounting you probably want to write to files and then import them into the db (there is a module to help with this). Radius will happily skip queries that take too long or if there are not enough mysql connections available on the accounting side.
I remember reading about 'radsqlrelay' that does essentially this. It is also mentioned once in radiusd.conf but subsequent searching has brought up nothing worthwhile.
Does anyone remember where there is doccumentation on this?
regards Graham Beneke - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Graham Beneke wrote:
Dennis Skinner wrote:
For serious billable accounting you probably want to write to files and then import them into the db (there is a module to help with this). Radius will happily skip queries that take too long or if there are not enough mysql connections available on the accounting side.
I remember reading about 'radsqlrelay' that does essentially this. It is also mentioned once in radiusd.conf but subsequent searching has brought up nothing worthwhile.
Does anyone remember where there is doccumentation on this?
"radsqlrelay" and "rlm_sql_log" have a manpage. -- Nicolas Baradakis
Nicolas Baradakis wrote:
Graham Beneke wrote:
Does anyone remember where there is doccumentation on this?
"radsqlrelay" and "rlm_sql_log" have a manpage.
Would it be possible for someone to dump all the man pages into the wiki? It may not be the preferred source of information but I find the wiki to be a lot more useful than the man pages. Reason being that I currently have to connect to the radius server i'm working though a horribly latent wireless connection and scrolling through man pages with a 700ms delay is really painful. At least the wiki pages I can load into my browser and read at my leisure without having to worry about the server connection. :-) regards Graham Beneke
On Fri 19 Jan 2007 18:56, Graham Beneke wrote:
Nicolas Baradakis wrote:
Graham Beneke wrote:
Does anyone remember where there is doccumentation on this?
"radsqlrelay" and "rlm_sql_log" have a manpage.
Would it be possible for someone to dump all the man pages into the wiki?
Please feel free to do it.. It is a wiki after all :-) -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc
On Friday 19 January 2007 14:02, Peter Nixon wrote:
On Fri 19 Jan 2007 18:56, Graham Beneke wrote:
Would it be possible for someone to dump all the man pages into the wiki?
Please feel free to do it.. It is a wiki after all :-)
Agreed. I've added a few things here and there, but that's just because I was poking around in those areas of freeradius recently. If you add stuff, I can clean up the page display, if necessary, after I find the box that contains my "free time". =) -Kevin
participants (8)
-
Aaron Paetznick -
Alan DeKok -
Dennis Skinner -
Graham Beneke -
Kevin Bonner -
Nicolas Baradakis -
Peter Nixon -
Stieven.Struyf＠komatsu.eu