Hi Yes please do this. I looked what i did and this was exactly the fault. Since they are no freeradius 3 packages for OpenSuse (which is a shame since OpenSuse is availably for quite a couple of time) i tried installing from the "factory" repository. Obviously there the SSL version doesn't match the one in 13.2 Best, Thomas Am 28.10.2015 um 16:37 schrieb Michael Ströder:

Nick Lowe wrote:

...

Regardless, the as-yet-unreleased FreeRADIUS 3.0.11 is needed to get compatibility with OpenSSL 1.0.2 As soon as you get 3.0.11 out of the door and I will push it into OBS pretty quickly.

Ciao, Michael.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

-- Thomas Stather IT Services Tel: +49 6221-486 628 Fax: +49 6221-486 561 ------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany

I tried to build my own OpenSuse 13.2 using the .spec file included in the official tarball and rpmbuild -bb freeradius.spec The compile process starts but then i get an error: ----------------------------------------------- .... INSTALL rlm_expr.5 INSTALL rlm_idn.5 INSTALL radrelay.conf.5 INSTALL radsqlrelay.8 INSTALL radrelay.8 INSTALL radcrypt.8 INSTALL raddebug.8 INSTALL radmin.8 INSTALL radiusd.8 INSTALL radsniff.8 + RADDB=/usr/src/packages/BUILDROOT/freeradius-server-3.0.10-0.x86_64/etc/raddb + perl -i -pe 's/^#user =.*$/user = radiusd/' /usr/src/packages/BUILDROOT/freeradius-server-3.0.10-0.x86_64/etc/raddb/radiusd.conf + perl -i -pe 's/^#group =.*$/group = radiusd/' /usr/src/packages/BUILDROOT/freeradius-server-3.0.10-0.x86_64/etc/raddb/radiusd.conf + /sbin/ldconfig -n /usr/src/packages/BUILDROOT/freeradius-server-3.0.10-0.x86_64/usr/lib64/freeradius + touch /usr/src/packages/BUILDROOT/freeradius-server-3.0.10-0.x86_64/var/log/radius/radutmp + touch /usr/src/packages/BUILDROOT/freeradius-server-3.0.10-0.x86_64/var/log/radius/radius.log + install -d /usr/src/packages/BUILDROOT/freeradius-server-3.0.10-0.x86_64/etc/pam.d + install -d /usr/src/packages/BUILDROOT/freeradius-server-3.0.10-0.x86_64/etc/logrotate.d + install -m 644 suse/radiusd-pam /usr/src/packages/BUILDROOT/freeradius-server-3.0.10-0.x86_64/etc/pam.d/radiusd + install -m 644 suse/radiusd-logrotate /usr/src/packages/BUILDROOT/freeradius-server-3.0.10-0.x86_64/etc/logrotate.d/freeradius-server + install -d -m 755 /usr/src/packages/BUILDROOT/freeradius-server-3.0.10-0.x86_64/etc/init.d + install -m 744 suse/rcradiusd /usr/src/packages/BUILDROOT/freeradius-server-3.0.10-0.x86_64/etc/init.d/freeradius + ln -sf ../../etc/init.d/freeradius /usr/src/packages/BUILDROOT/freeradius-server-3.0.10-0.x86_64/usr/sbin/rcfreeradius + install -d /usr/src/packages/BUILDROOT/freeradius-server-3.0.10-0.x86_64/etc/tmpfiles.d + install -m 0644 /usr/src/packages/SOURCES/freeradius-server-tmpfiles.conf /usr/src/packages/BUILDROOT/freeradius-server-3.0.10-0.x86_64/etc/tmpfiles.d/radiusd.conf install: cannot stat â/usr/src/packages/SOURCES/freeradius-server-tmpfiles.confâ: No such file or directory error: Bad exit status from /var/tmp/rpm-tmp.b81Q28 (%install) ----------------------------------------------- Best, Thomas Am 29.10.2015 um 09:33 schrieb Thomas Stather:

Hi Yes please do this.

I looked what i did and this was exactly the fault. Since they are no freeradius 3 packages for OpenSuse (which is a shame since OpenSuse is availably for quite a couple of time) i tried installing from the "factory" repository.

Obviously there the SSL version doesn't match the one in 13.2

Best,

Thomas

Am 28.10.2015 um 16:37 schrieb Michael Ströder:

...

Nick Lowe wrote:

...

Regardless, the as-yet-unreleased FreeRADIUS 3.0.11 is needed to get compatibility with OpenSSL 1.0.2 As soon as you get 3.0.11 out of the door and I will push it into OBS pretty quickly.

Ciao, Michael.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

-- Thomas Stather IT Services Tel: +49 6221-486 628 Fax: +49 6221-486 561 ------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany

Hello I was able to install freeradius-server using your branched repo. Thanks a lot! Best, Thomas Am 29.10.2015 um 10:11 schrieb Michael Ströder:

Thomas Stather wrote:

...

I tried to build my own OpenSuse 13.2 using the .spec file included in the official tarball and

rpmbuild -bb freeradius.spec

The compile process starts but then i get an error: Sorry, I'm not sure whether your build system is really clean. I suspect there are more things screwed up by local installation of other packages.

So please get an OBS account and branch the package. Then adjust your repo/build options to build solely for openSUSE 13.2 (OBS is pretty busy so be friendly). OBS builds are always done in a clean VM set up from scratch according to BuildRequire in .spec which avoids any locally messed up dependencies causing unpredictible build behaviour.

After that you can add your own repo with "zypper addrepo".

Look at my branch package as an example here: https://build.opensuse.org/package/show/home:stroeder:branches:network/freer...

This gets off-topic here. I'd suggest to subscribe to the opensuse-packaging mailing list if you have openSUSE specific build issues.

Ciao, Michael.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

-- Thomas Stather IT Services Tel: +49 6221-486 628 Fax: +49 6221-486 561 ------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany

On 28 Oct 2015, at 09:12, Alan DeKok <aland@deployingradius.com> wrote:

On Oct 28, 2015, at 8:56 AM, Thomas Stather <Thomas.Stather@mpimf-heidelberg.mpg.de> wrote:

...

I installed freeradius-server 3.0.10 from the OpenSuse "network" repo (OpenSuse OBS) ... but when i try to start it, i get:

-------------------------------------- radius1:~ # radiusd -X libssl version mismatch. built: 1000204f linked: 100010bf --------------------------------------

Probably because they updated OpenSSL, and didn't bother re-building FreeRADIUS.

This check avoids run-time problems with OpenSSL. They have problems changing their APIs so that programs using OpenSSL crash when you upgrade OpenSSL, and not the program.

We may be able to fix that in future releases,

Not really. There's no guarantee two versions of OpenSSL will be ABI Compatible. There's no guarantee two versions of OpenSSL will have the same behaviour (as we saw with 1.0.2). We're already lenient allowing the least significant part of the version to change. The OpenSuse guys fucked up, and put OpenSSL 1.0.2 on their build server but still use 1.0.1 in their release. This is really basic shit. What the fuck are they doing. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

Thomas Stather wrote:

OK thanks for the hint, this points me in the right direction. Maybe i'll switch the distro :)

This would be unwise since openSUSE is the only distro shipping with recent Samba 4 stuff and for which are recent freeradius packages available. But you have to know what you're doing. Ciao, Michael.

On Wed, Oct 28, 2015 at 05:36:51PM +0000, Alan Buxey wrote:

Oooh. Recent SAMBA 4 stuff? I'm interested. I'll have to check now to see what the version is...

Looks like 4.3.1 :) http://download.opensuse.org/repositories/network:/samba:/STABLE/openSUSE_13... Also there for several other distros - I guess all out of OBS. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>

On Wed, Oct 28, 2015 at 05:03:46PM -0400, Arran Cudbard-Bell wrote:

Do you know if it's possible to get group memberships via winbind? I assume yes, but I can't see any functions in the client API to do that...

I suspect something in https://github.com/samba-team/samba/blob/master/nsswitch/libwbclient/wbclien... would give what you want. Though they may have been "translated" into unix groups by winbind by the time you see them, which is what you get from wbinfo: # /opt/samba/bin/wbinfo --user-info=DOMAIN\\user DOMAIN\user:*:16777216:16777216:Surname, Forename I.:/home/DOMAIN/user:/bin/bash # /opt/samba/bin/wbinfo --user-groups=DOMAIN\\user 16777216 16777217 16777218 16777219 16777220 16777221 16777222 ... # /opt/samba/bin/wbinfo --gid-info=16777216 DOMAIN\domain users:x:16777216: It's been a few months so I'd have to look in more detail again to see what's available. But I think by the time the data comes over the socket from winbind it's already been "mapped" to a UNIX GID number. It returns this struct in the extra_data: https://github.com/samba-team/samba/blob/master/nsswitch/winbind_struct_prot... (this isn't visible in the API IIRC) which is then copied to a normal unix struct group: https://github.com/samba-team/samba/blob/master/nsswitch/libwbclient/wbc_pwd...

It'd save calls to LDAP if we could grab everything at the same time.

It's also got a number of mallocs, so not designed for speed, but might be faster than LDAP. And winbind caches information locally (even when just doing auths which is a bit annoying as I think this also slows things down unnecessarily in the mschap stuff) but would be useful for the group lookups. My to-do list also contains adding use of wbcCtxChangeUserPassword to improve the ntlm_auth change password code. Stalled on that before as I didn't have an quick way to test it :) Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>

On Wed, Oct 28, 2015 at 11:04:56PM +0100, Michael Ströder wrote:

Matthew Newton wrote:

...

http://download.opensuse.org/repositories/network:/samba:/STABLE/openSUSE_13...

Note that this is kind of a development repo which feeds what goes into Factory/Tumbleweed. This is *not what you get from a plain openSUSE 13.2 installation.

OK, thanks.

Samba to be released with upcoming Leap 42.1 (to be finally released within a week) seems to be 4.2.4: https://build.opensuse.org/package/show/openSUSE:Leap:42.1/samba

4.2.4 is good :)

Fortunately they accepted my vote for freeradius-server 3.0.10 in Leap 42.1: https://build.opensuse.org/package/show/openSUSE:Leap:42.1/freeradius-server

Does not look too bad.

Agreed! Thanks, Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>

It's likely that he's picked up a pre-release package for a future openSUSE which will have OpenSSL 1.0.2. All the more reason to get a 2.2.10 and 3.0.11 out that has an interoperability fix. Cheers, Nick

On 28 Oct 2015, at 11:43, Michael Ströder <michael@stroeder.com> wrote:

Nick Lowe wrote:

...

It's likely that he's picked up a pre-release package for a future openSUSE which will have OpenSSL 1.0.2. All the more reason to get a 2.2.10 and 3.0.11 out that has an interoperability fix. I suspect he installed packages built for Tumbleweed on openSUSE 13.2.

If that's the case, why aren't there strict inter-package dependencies? Why is there not a dependency on OpenSSL 1.0.2 for the FreeRADIUS packages built with OpenSSL 1.0.2? Seems like basic stuff to me... Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

Because it would be unnecessary bloat in cross-version .spec files.

Oh dear. It's the end of the world that! I'd rather have a .spec file that properly manages dependencies than install something only for it to blow up because someone didn't specify the dependencies properly :-)

I'd say everybody installing packages not directly shipped by the distribution should be familiar enough to choose a version-specific repo.

That's lovely. Provided the specific version actually stays up to date (which is all too often not the case). Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Networkshop44, University of Manchester. Save the date: 22-24 March, 2016. #NWS44 Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc¹s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.

On 28 Oct 2015, at 12:49, Michael Ströder <michael@stroeder.com> wrote:

Stefan Paetow wrote:

...

...

Because it would be unnecessary bloat in cross-version .spec files.

Oh dear. It's the end of the world that! I'd rather have a .spec file that properly manages dependencies than install something only for it to blow up because someone didn't specify the dependencies properly :-)

I'm not sure spec file bloat is a valid reason anyway. It would be fairly easy to query the version of the OpenSSL rpm used on the build system, and use version components from that to set the correct version for the dependency. It would also protect users from accidentally installing a newer OpenSSL RPM from a none Suse source, and breaking their RADIUS server. There are good, valid, proven reasons for having such strict dependencies. If you build FreeRADIUS with OpenSSL 1.0.1 and try to use it with OpenSSL 1.0.2 it will not work correctly with rlm_eap. If you build FreeRADIUS with OpenSSL 1.0.0 and use it with OpenSSL >= 1.0.1 authentication will appear to succeed, but the MPPE keys will be calculated incorrectly. The nature of the protocols that FreeRADIUS is implementing requires tight integration with whatever OpenSSL library. The RPM dependencies should reflect this. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

On 28 Oct 2015, at 11:56, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:

...

On 28 Oct 2015, at 11:35, Michael Ströder <michael@stroeder.com> wrote:

Arran Cudbard-Bell wrote:

...

The OpenSuse guys fucked up, and put OpenSSL 1.0.2 on their build server but still use 1.0.1 in their release.

I doubt your statement is correct.

Either their statement is either correct, or they've messed up the dependencies on the packages.

I'll grant you that it could be the later.

*latter Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2