accounting to local and remote server
hi: I need to setup proxy for a realm, and sent accounting to remote radius server. but I want to keep a copy of accounting data at local radius server too. after searching the email list, I found strategy below: 1. create two detail file 2. use buffered-sql to write data to local sql server 3. use copy-acct-to-home-server to sent data to remote radius server is the above strategy correct? or there are better ways? thanks a lot for help!! Regards, tbskyd
On May 26, 2015, at 12:49 PM, d tbsky <tbskyd@gmail.com> wrote:
I need to setup proxy for a realm, and sent accounting to remote radius server. but I want to keep a copy of accounting data at local radius server too.
That's easy. Configure local accounting. Configure proxying. Done.
after searching the email list, I found strategy below:
1. create two detail file 2. use buffered-sql to write data to local sql server 3. use copy-acct-to-home-server to sent data to remote radius server
is the above strategy correct? or there are better ways?
That will work. You don't need buffered-sql, unless you're worried about the SQL server being down for extended periods of time. But it's often safer to use it. Go with that solution, it's fine. Alan DeKok.
2015-05-27 1:35 GMT+08:00 Alan DeKok <aland@deployingradius.com>:
On May 26, 2015, at 12:49 PM, d tbsky <tbskyd@gmail.com> wrote:
I need to setup proxy for a realm, and sent accounting to remote radius server. but I want to keep a copy of accounting data at local radius server too.
That's easy. Configure local accounting. Configure proxying. Done.
yes you are right. I have misunderstanding that if I configure proxy, local will not get accounting. now I have setup testing proxy with the upstream. I am a little confused about the attribute which upstream sent back. for example, If I use "test@upsteam" to authenticate, upstream will sent back "User-Name = test" alone with "Access-Accept". then the NAS will use username "test" to do accounting, not "test@upstream". but in my local accounting, I want to keep the nostrip name. I know I can filter out the reply attribute, but should I do that? or there are better ways to do with this kind of situation. eg: upstream get the strip accounting name he wants, and I get the nostrip accounting name I want? and should I enable "attr_filter.post-proxy" to further protecting our site?
On May 28, 2015, at 12:23 AM, d tbsky <tbskyd@gmail.com> wrote:
for example, If I use "test@upsteam" to authenticate, upstream will sent back "User-Name = test" alone with "Access-Accept". then the NAS will use username "test" to do accounting, not "test@upstream". but in my local accounting, I want to keep the nostrip name.
Then update that in the post-auth section: update reply { User-Name := "%{User-Name}" }
I know I can filter out the reply attribute, but should I do that? or there are better ways to do with this kind of situation. eg: upstream get the strip accounting name he wants, and I get the nostrip accounting name I want?
The post-auth section is designed to do this kind of thing.
and should I enable "attr_filter.post-proxy" to further protecting our site?
Yes. Alan DeKok.
participants (2)
-
Alan DeKok -
d tbsky