yubikey client dependency in FR 3.0
Hi Arran: I figured you would know this because your name seems to be all over the ykclient git repo :-) I noticed when trying to build FR 3.0 that some of the yubikey modules are being skipped because of a failed dependency. configure: WARNING: libykclient missing ykclient_request_process. A later version of libykclient is required. configure: WARNING: silently building without yubicloud support. requires: ykclient Our ykclient is at version 2.7 and it looks like it hasn't been updated in over a year. What version of ykclient is required? Is disabling of yubicloud support a serious determent or just a nice-have feature? Do you know the Fedora maintainer for ykclient? Do we need to give them a prod to get a more current version of ykclient packaged? John -- jdennis@redhat.com
On 17 Jul 2013, at 21:43, John Dennis <jdennis@redhat.com> wrote:
Hi Arran:
I figured you would know this because your name seems to be all over the ykclient git repo :-)
Yes :).
I noticed when trying to build FR 3.0 that some of the yubikey modules are being skipped because of a failed dependency.
configure: WARNING: libykclient missing ykclient_request_process. A later version of libykclient is required. configure: WARNING: silently building without yubicloud support. requires: ykclient
Our ykclient is at version 2.7 and it looks like it hasn't been updated in over a year.
What version of ykclient is required?
One that has the ykclient_request_process symbol ;) I believe those changes got rolled in ykclient-2.10. https://github.com/Yubico/yubico-c-client/archive/ykclient-2.10.tar.gz
Is disabling of yubicloud support a serious determent or just a nice-have feature?
It depends. rlm_yubikey can decode yubikey token codes locally (using yubico-c), or it can send them off to validation server (using ykclient). For simple setups/admins ykclient allows you to use yubico's yubicloud validation servers which have a nice web GUI, and require little configuration. There's a bit more work if you want to manage your tokens locally, you need to store replay counter values in a database for example, and manage the pre-shared aes-keys, but if it saves you $$$ then honestly it's not that complicated.
Do you know the Fedora maintainer for ykclient? Do we need to give them a prod to get a more current version of ykclient packaged?
No, unfortunately not. CCing Simon Josefsson who may... -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
On 07/17/2013 05:30 PM, Arran Cudbard-Bell wrote:
On 17 Jul 2013, at 21:43, John Dennis <jdennis@redhat.com> wrote:
Do you know the Fedora maintainer for ykclient? Do we need to give them a prod to get a more current version of ykclient packaged?
No, unfortunately not. CCing Simon Josefsson who may...
FYI: According to the Fedora Package Database the maintainer is: Nick Bebout <nick@bebout.net> I've filed this bug requesting the current 2.10 version to be packaged. https://bugzilla.redhat.com/show_bug.cgi?id=985829 Fedora currently has 2.7 which is 2 years old. John -- jdennis@redhat.com
There are some other EAP types like rlm_eap_pwd etc that my default SPEC also disabled... Do they remain disabled, or are we going to spin those up as well? Also, John, if you could let me know where I can get a copy of your spec, that would be lovely... then we can make sure here that we use a SPEC that is as close to the official one for our el6 packages. :-) Regards Stefan ________________________________________ From: freeradius-devel-bounces+stefan.paetow=diamond.ac.uk@lists.freeradius.org [freeradius-devel-bounces+stefan.paetow=diamond.ac.uk@lists.freeradius.org] on behalf of John Dennis [jdennis@redhat.com] Sent: Wednesday, July 17, 2013 9:43 PM To: Arran Cudbard-Bell; FreeRadius developers mailing list Subject: yubikey client dependency in FR 3.0 Hi Arran: I figured you would know this because your name seems to be all over the ykclient git repo :-) I noticed when trying to build FR 3.0 that some of the yubikey modules are being skipped because of a failed dependency. configure: WARNING: libykclient missing ykclient_request_process. A later version of libykclient is required. configure: WARNING: silently building without yubicloud support. requires: ykclient Our ykclient is at version 2.7 and it looks like it hasn't been updated in over a year. What version of ykclient is required? Is disabling of yubicloud support a serious determent or just a nice-have feature? Do you know the Fedora maintainer for ykclient? Do we need to give them a prod to get a more current version of ykclient packaged? John -- jdennis@redhat.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom
On 17 Jul 2013, at 22:46, <stefan.paetow@diamond.ac.uk> wrote:
There are some other EAP types like rlm_eap_pwd etc that my default SPEC also disabled... Do they remain disabled, or are we going to spin those up as well?
Also, John, if you could let me know where I can get a copy of your spec, that would be lovely... then we can make sure here that we use a SPEC that is as close to the official one for our el6 packages. :-)
Why you respond to wrong thread? Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
participants (3)
-
Arran Cudbard-Bell -
John Dennis -
stefan.paetow＠diamond.ac.uk