I've searched around for a few weeks now and can't seem to find a clear answer to this question: Does Freeradius have the ability to use multiple nodes in similar fashion to name servers? An example of this would be a situation when the master freeradius server is down for some reason, but the slave freeradius server(s) continue to grant & deny access but do not receive any updates until the master is back up. Also, if there are any HOWTO or example configurations of this type of setup, those would be very helpful. Thanks in advance, Scott
What your trying to do is not completely the job of freeradius. some is the devices that do the querying to radius some is whatever means you use to do updates of the database. I doubt there is an of the shelf solution to your problem. Custom scripting is probably you solution ----- Original Message ----- From: Scott Hughes To: freeradius-users@lists.freeradius.org Sent: Tuesday, August 08, 2006 12:44 PM Subject: Question I've searched around for a few weeks now and can't seem to find a clear answer to this question: Does Freeradius have the ability to use multiple nodes in similar fashion to name servers? An example of this would be a situation when the master freeradius server is down for some reason, but the slave freeradius server(s) continue to grant & deny access but do not receive any updates until the master is back up. Also, if there are any HOWTO or example configurations of this type of setup, those would be very helpful. Thanks in advance, Scott ------------------------------------------------------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------------------------------------------------------ No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.1.405 / Virus Database: 268.10.7/411 - Release Date: 8/7/2006
Scott Hughes wrote:
Does Freeradius have the ability to use multiple nodes in similar fashion to name servers? An example of this would be a situation when the master freeradius server is down for some reason, but the slave freeradius server(s) continue to grant & deny access but do not receive any updates until the master is back up.
Yes, radius does this, but it is done on the client end which is why you can't find any docs for it. Clients are generally setup with primary and secondary radius servers that they talk to. When they don't hear from one within a set time, they try the other. Radius servers can also proxy to other radius servers (ie act as client) so have a look at the proxy.conf file. That may answer some of your questions. Not sure what you mean by updates....do you mean accounting requests? See the proxy.conf. You can send accounting requests wherever you want. Generally they go to the same server as the auth requests and fail over to secondary just like auth. Keep in mind that radius accounting is not guaranteed. We are talking UDP and while there is some checking, accounting requests can get lost. So if the primary server is the only one to accept accounting requests, if that server goes down, you will have missing data. The client won't store them and wait for the primary to come back. -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com
Thanks for the great answers. To clarify the "updates" part of my original message, I was referring to when a new user was added. In other words, like a DNS structure, when a new entry into a domain is added (i.e. new mail server), the admin would add it to the master server, then that master server would send the update to the slave servers. Stefan actually answered that question when he made the following comment: "Just setup the server twice (ideally both using _one_ authentication backend, e.g. a mySQL db on a different host that both can access) and tell your client devices about it." Thanks again! Scott -----Original Message----- From: freeradius-users-bounces+scott=renshawauto.com@lists.freeradius.org [mailto:freeradius-users-bounces+scott=renshawauto.com@lists.freeradius.org] On Behalf Of Dennis Skinner Sent: Tuesday, August 08, 2006 12:58 PM To: FreeRadius users mailing list Subject: Re: Question Scott Hughes wrote:
Does Freeradius have the ability to use multiple nodes in similar fashion to name servers? An example of this would be a situation when the master freeradius server is down for some reason, but the slave freeradius server(s) continue to grant & deny access but do not receive any updates until the master is back up.
Yes, radius does this, but it is done on the client end which is why you can't find any docs for it. Clients are generally setup with primary and secondary radius servers that they talk to. When they don't hear from one within a set time, they try the other. Radius servers can also proxy to other radius servers (ie act as client) so have a look at the proxy.conf file. That may answer some of your questions. Not sure what you mean by updates....do you mean accounting requests? See the proxy.conf. You can send accounting requests wherever you want. Generally they go to the same server as the auth requests and fail over to secondary just like auth. Keep in mind that radius accounting is not guaranteed. We are talking UDP and while there is some checking, accounting requests can get lost. So if the primary server is the only one to accept accounting requests, if that server goes down, you will have missing data. The client won't store them and wait for the primary to come back. -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
"Scott Hughes" <scott@renshawauto.com> wrote:
Stefan actually answered that question when he made the following comment: "Just setup the server twice (ideally both using _one_ authentication backend, e.g. a mySQL db on a different host that both can access) and tell your client devices about it."
That's where revision control comes in, too: http://deployingradius.com/documents/configuration/setup.html You could use CVS or another version control system to keep the configuration for the two systems in sync. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
participants (4)
-
Alan DeKok -
Dennis Skinner -
Mark Jones -
Scott Hughes