Hello, here is a first draft for a freeradius tuning guide. It is mostly aimed at those using ldap/sql AAA. Suggestions and comments are welcome.
-- Kostas Kalevras Network Operations Center [EMAIL PROTECTED] National Technical University of Athens, Greece Work Phone: +30 10 7721861 'Go back to the shadow' Gandalf
------------ MAIN SERVER ------------- o If you have a large user base and/or many authentication requests try using a scalable authentication mechanism like ldap or sql. o Enable noatime on all the freeradius log files or better yet on the freeradius log directory. o Always use the latest cvs version. It will probably contain a few fixes and enhancements. o Always try to use the least modules possible. In particular if you can avoid it do not use the detail and radwtmp (files) modules. They will slow down your accounting. o Use the users file to only set default profiles. Do not place any users there. Keep it as small as possible. Always set default attributes in the users file and don't fill the user entries in ldap/sql with default values. In general the ldap/sql user profiles should contain user attributes only in special user cases. o Tune thread pool parameters to match your size requirements. Set max_requests_per_server to zero to avoid server thread restarts. o Enlarge the timeout (10 secs) and retries (5-7) in the access servers for accounting. That way you won't lose any accounting information. o Use well tuned Fast Ethernet connections to minimize latency. o freeradius is multi threaded and i/o bound. That means you should use the latest OS kernels/patches for improved multi processor and network performance. ------------ LDAP MODULE ------------- o Tune the ldap_connections_number to be larger than the number of simultaneous user authentication requests. o Try to maximize caching in the ldap server.In particular *always* enable indexing of the uid attribute (equality index) and the cn attribute (equality index - the cn attribute is used to search for groups). Make the ldap server entry/directory cache memory sizes as large as possible. In general try allocating as much memory as you can afford to your ldap server. o Put default profiles in ldap. User entries should only contain non standard values in order to remain small and maximize the gains of caching the user default/regular profiles. o Enable caching in the ldap module (try it first, the openldap code is not quite mature). ------------ SQL MODULE -------------- o Tune the num_sql_socks to be larger than the number of simultaneous authentication/accounting requests. o Create an index for the radacct table to minimize the penalty of a growing accounting table. The index should be for the UserName attribute with additional attributes: AcctSessionId,AcctStartTime,AcctStopTime,NASIPAddres ------------ COUNTER MODULE ---------- o Enable noatime on the counter db files. o Tune the cache-size configuration directive to match your needs. The cache size should be set to 2-3 * number of available nas ports ------------ DETAIL MODULE ----------- o In general try not using it. o Enable noatime on the detail directory ------------ RADUTMP MODULE ---------- o Enable noatime on the radutmp file ------------ UNIX MODULE (RADWTMP) --- o Enable noatime on the radwtmp file
