I have two systems that both use freeradius out of MySQL. I would like to consolidate onto a single system, but maintain the database separation to ensure there are no username collisions and ease in auditing/reporting, etc. System A already has a database of freeradius_A and system B has a database of freeradius_B. What is the preferred method to configure freeradius to authenticate two sets of users out of two databases? Should I look at running multiple instances of freeRADIUS or can I utilize both databases with one instance? --Blake
Blake Hudson [blake@ispn.net] writes:
What is the preferred method to configure freeradius to authenticate two sets of users out of two databases? Should I look at running multiple instances of freeRADIUS or can I utilize both databases with one instance?
This should be doable by defining multiple named sql instances, then, based on the criteria you use to separate sessions for the two services, invoke one or the other of them by name appropriately. Basically look for every place in the configs where the sql module is called, either as a directive, or inside a string xlat, and you would have to multiplex each of those statements to use the appropriate name (instead of "sql") in the appropriate case. Also, multiple instances of FreeRADIUS are not hard to do, and can sometimes be preferable is you would like to add a bit more partitioning from a security perspective, but each will require its own port and/or IP address so your NAS flexibility may play a part in that decision.
Brian Julin wrote the following on 1/16/2012 9:01 AM:
Blake Hudson [blake@ispn.net] writes:
What is the preferred method to configure freeradius to authenticate two sets of users out of two databases? Should I look at running multiple instances of freeRADIUS or can I utilize both databases with one instance? This should be doable by defining multiple named sql instances, then, based on the criteria you use to separate sessions for the two services, invoke one or the other of them by name appropriately. Basically look for every place in the configs where the sql module is called, either as a directive, or inside a string xlat, and you would have to multiplex each of those statements to use the appropriate name (instead of "sql") in the appropriate case.
Thanks for the response, I've created a couple named sql instances, but I'm not sure how to configure one nas to use one instance and the other nas to use the other instance. It seems pretty straight forward to use one instance for auth and another for accounting, but I did not see an example or documentation on how to associate a sql instance to a nas. If you could point me in the right direction I'd appreciate it. --Blake
On 16/01/12 16:55, Blake Hudson wrote:
It seems pretty straight forward to use one instance for auth and another for accounting, but I did not see an example or documentation on how to associate a sql instance to a nas. If you could point me in the right direction I'd appreciate it.
Simply match any attribute you want in the request, and then call the relevant modules: authorize { ... if (Client-IP-Address == 192.0.2.1) { sql1 } elsif (Client-IP-Address == 192.0.2.2) { sql2 } ... } You probably want to match on Huntgroup, Client-Shortname or some other more useful field than source IP.
Phil Mayers wrote the following on 1/16/2012 11:18 AM:
On 16/01/12 16:55, Blake Hudson wrote:
It seems pretty straight forward to use one instance for auth and another for accounting, but I did not see an example or documentation on how to associate a sql instance to a nas. If you could point me in the right direction I'd appreciate it.
Simply match any attribute you want in the request, and then call the relevant modules:
authorize { ... if (Client-IP-Address == 192.0.2.1) { sql1 } elsif (Client-IP-Address == 192.0.2.2) { sql2 } ... }
You probably want to match on Huntgroup, Client-Shortname or some other more useful field than source IP.
Thanks. That's awesome. I didn't realize that I could create decision points in the config like that. Hunt groups combined with a couple if statements should provide a great mechanism for what I want to implement. Thanks for the direction. --Blake
participants (3)
-
Blake Hudson -
Brian Julin -
Phil Mayers