MySQL - One RADIUS database per realm
At my place of employment we have a web frontend to our radius server. This frontend will be used by several different clients. We want to store each client's usernames/passwords and MAC addresses in their own database. The database name will be the client's realm name. The reason we want this database separation is to hide users and MAC addresses that don't belong to a client from the web frontend. For obvious reasons, the client should only be able to see and modify the authentication details that belong to them. I haven't been able to find much documentation on the subject, leading me to believe that either A) This is not a smart idea and not recommended or B) Stuff like this isn't done often and therefore there isn't much documentation. So, my question is this: Is there a better way for me to achieve the desired results of client separation(modify the frontend and use one database probably)? Or, if this is possible, any instructions would be greatly appreciated. Thank you. -- - Dave
Hi Dave, I have not tested this, but I will try it as soon as I have a chance.. Create a sql.conf file per client. Be sure to create an "instance" of type sql per client/realm. eg. client1_sql sql { ..... lots of configuration parameter (configurable per client, including server/database/tables/queries) ..... } In the main server configuration you can then proxy to a client's virtual server. Best Regards, Danny Stemmet MSB micro systems On 25 Jul 2011, at 17:37, Dave Thompson <davexunit@gmail.com> wrote:
At my place of employment we have a web frontend to our radius server. This frontend will be used by several different clients. We want to store each client's usernames/passwords and MAC addresses in their own database. The database name will be the client's realm name. The reason we want this database separation is to hide users and MAC addresses that don't belong to a client from the web frontend. For obvious reasons, the client should only be able to see and modify the authentication details that belong to them. I haven't been able to find much documentation on the subject, leading me to believe that either A) This is not a smart idea and not recommended or B) Stuff like this isn't done often and therefore there isn't much documentation. So, my question is this: Is there a better way for me to achieve the desired results of client separation(modify the frontend and use one database probably)? Or, if this is possible, any instructions would be greatly appreciated. Thank you.
-- - Dave - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I think that multiple SQL instances are exactly what I'm looking for! Thank you for the information! On Mon, Jul 25, 2011 at 2:54 PM, Danny Stemmet <danny@msbmicro.com> wrote:
Hi Dave,
I have not tested this, but I will try it as soon as I have a chance..
Create a sql.conf file per client.
Be sure to create an "instance" of type sql per client/realm. eg. client1_sql sql { ..... lots of configuration parameter (configurable per client, including server/database/tables/queries) ..... }
In the main server configuration you can then proxy to a client's virtual server.
Best Regards, Danny Stemmet
MSB micro systems
On 25 Jul 2011, at 17:37, Dave Thompson <davexunit@gmail.com> wrote:
At my place of employment we have a web frontend to our radius server. This frontend will be used by several different clients. We want to store each client's usernames/passwords and MAC addresses in their own database. The database name will be the client's realm name. The reason we want this database separation is to hide users and MAC addresses that don't belong to a client from the web frontend. For obvious reasons, the client should only be able to see and modify the authentication details that belong to them. I haven't been able to find much documentation on the subject, leading me to believe that either A) This is not a smart idea and not recommended or B) Stuff like this isn't done often and therefore there isn't much documentation. So, my question is this: Is there a better way for me to achieve the desired results of client separation(modify the frontend and use one database probably)? Or, if this is possible, any instructions would be greatly appreciated. Thank you.
-- - Dave - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- - Dave
participants (2)
-
Danny Stemmet -
Dave Thompson