Hi, I am just updating from an old freeradius (1.1.x) to a new one (2.1.1). Currently we have old style entries in the proxy.conf, some entries like: realm DEFAULT { type = radius authhost = 111.222.111.222:1812 accthost = 111.222.111.222:1813 secret = whatever nostrip } The old radius gave us (from time to time) log messages like: radius.log.6:Mon Sep 22 15:58:14 2008 : Proxy: marking accounting server 111.222.111.222:1813 for realm DEFAULT dead Using the same configuration file (which should still be supported), we get: Tue Sep 30 17:19:28 2008 : Error: PROXY: Marking home server 111.222.111.222 port 1813 as zombie (it looks like it is dead). For both servers (auth at 111.222.111.222:1812 and acc at port 1813) it reports "Marking _home_ server", so does it not differentiate between both? Or is this just an oversimplification? Could someone spread some light how a new configuration (using home_server and home_server_pool etc) should look like? In our setting we use the radius for authentication of local users and we use two proxies for users of other organisations (= two DEFAULT realms in proxy.conf). Thanks, cheers, Olaf -- Olaf Gellert Universitaet Hamburg Regionales Rechenzentrum Kommunikationsnetze Schlueterstrasse 70 20146 Hamburg Tel.: ++49 (0)40 42838 4694 Fax: ++49 (0)40 42838 3096 E-Mail: Olaf.Gellert@rrz.uni-hamburg.de
Olaf Gellert wrote:
Using the same configuration file (which should still be supported), we get:
Tue Sep 30 17:19:28 2008 : Error: PROXY: Marking home server 111.222.111.222 port 1813 as zombie (it looks like it is dead).
Note: IP *and* port.
For both servers (auth at 111.222.111.222:1812 and acc at port 1813) it reports "Marking _home_ server", so does it not differentiate between both? Or is this just an oversimplification?
It doesn't matter. The server is identified by IP && port, which is what's being printed out.
Could someone spread some light how a new configuration (using home_server and home_server_pool etc) should look like? In our setting we use the radius for authentication of local users and we use two proxies for users of other organisations (= two DEFAULT realms in proxy.conf).
If you're using two DEFAULT realms, then it's likely in a failover or load-balance scenario. The proxy.conf file has examples of this. Do you have specific questions about the examples? Alan DeKok.
Alan DeKok wrote:
For both servers (auth at 111.222.111.222:1812 and acc at port 1813) it reports "Marking _home_ server", so does it not differentiate between both? Or is this just an oversimplification?
It doesn't matter. The server is identified by IP && port, which is what's being printed out.
This was just to make sure. Thanks.
If you're using two DEFAULT realms, then it's likely in a failover or load-balance scenario. The proxy.conf file has examples of this.
Do you have specific questions about the examples?
Well, I guess the term "home_server" and the fact, that in the example the IP address is 127.0.0.1 made me think of something local, not a remote server to which requests are proxied. I will try a few things, if I have more specific questions I'll get back to the list. Regards, Olaf -- Olaf Gellert Universitaet Hamburg Regionales Rechenzentrum Kommunikationsnetze Schlueterstrasse 70 20146 Hamburg Tel.: ++49 (0)40 42838 4694 Fax: ++49 (0)40 42838 3096 E-Mail: Olaf.Gellert@rrz.uni-hamburg.de
Olaf Gellert wrote:
Well, I guess the term "home_server" and the fact, that in the example the IP address is 127.0.0.1 made me think of something local, not a remote server to which requests are proxied.
It's the users "home". It's where they are authenticated. The term is widely used in the industry and in the specifications defining RADIUS. Alan DeKok.
participants (4)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Olaf Gellert -
tnt＠kalik.net