Started off just using it on our ORPS systems so proxying auth requests off to remote sites inbound auths using winbind -> our AD system. Basically eap-peap/mschapv2, eap-tls and proxying. Back end database postgresql with buffered-sql virtual server. EAP caching switched on, OCSP for EAP-TLS pointing at our XpressConnect ES server After my fights with built in RADSEC( which I lost), got that working using radsecproxy, means I can auth on uni eduroam using alex@sharaz.info which has auth chain of clearpass-><UoY ORPS> -> radsec/ipv6 -> my server in the cloud-> radsec/ipv6-> gateway to home net->FR 3.0.12 /ipv6 on os/x. (having issues with the final open directory bit, but I'm sure that's just a config thing). Will continue the battle next week. It's going to be something really silly, but at least I know I can do the stuff with radsecproxy. Up till this week, been running 3.0.13 on one of our Tier 2 servers doing eap-tls, eap-peap/mschapv2 mac auth buffered-sql -> postgres database. Also using MySQL for back end db that contains list of quarantined MAC addresses ( stored procedure isQuarantined(%{Calling-Station-Id}) returns true/false. Access-Accept packet contents tailored to type of device performing auths.Some static values some pulled form db. Last Friday started upgrading remaining 2 2.2.9 servers to 3.0.13. Seems to be working just fine. Security team pleased we've moved away from MySQL, no ones world has ended by moving to 3.0.13 :-) A On 10 January 2017 at 10:08, <A.L.M.Buxey@lboro.ac.uk> wrote:

Hi,

...

Been running 30.13 for months just fine

ditto. perhaps we need some stability feedback mechanism, reports what modules you are using etc?

alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html

On Jan 10, 2017, at 6:51 AM, Matthew Newton <mcn4@leicester.ac.uk> wrote:

I've just done a Debian sbuild with jessie-amd64 and wheezy-amd64. Jessie (stable) builds packages fine. Wheezy (oldstable) is fine if the dependencies for samba-dev* are removed, which I think is acceptable.

Sounds good, thanks. Alan DeKok.

...

...

Jessie (stable) builds packages fine. Wheezy (oldstable) is fine if the dependencies for samba-dev* are removed, which I think is acceptable.

Sounds good, thanks.

Sorry, I'm doing a build with the current trust router libraries (and the next version). It's going to take a little time.

Just to update: libtr 1.5.x works ok. libtr 2.x does not, but I've raised this on the Moonshot list to get this fixed in rlm_realm/trustrouter.c and possibly in the configure script to check which library is required. This could cause some fun in rpmbuild. Once that's fixed (and working), then I'd like to see 3.0.13 released. :-) Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

...

libtr 1.5.x works ok. libtr 2.x does not, but I've raised this on the Moonshot list to get this fixed in rlm_realm/trustrouter.c and possibly in the configure script to check which library is required. This could cause some fun in rpmbuild. Once that's fixed (and working), then I'd like to see 3.0.13 released. :-)

I'm inclined to update the "configure" script to just refuse to link to libtr2.x, up to and including the current release. The hope is that the next release will fix the issue.

The problem was more extensive, so we're looking at a compatible interface for the time being (so FR works with both libtr 1.5.x and 2.x). I'll retest the updated libraries with the existing FR 3.0.13 HEAD (built against TR 1.5.x).

Tho I can't figure out how the heck to build the trust router code. Or even where the official releases are...

git://git.project-moonshot.org/ for the repo, libraries etc are at http://repository.project-moonshot.org/ (Debian) and http://repository.project-moonshot.org/rpms/ (RedHat) :-) Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

On Wed, Jan 18, 2017 at 11:14:34AM -0500, Alan DeKok wrote:

On Jan 17, 2017, at 8:06 PM, Matthew Newton <mcn4@leicester.ac.uk> wrote:

...

I'm just working on updating the elasticsearch examples so they work with the latest version of elasticsearch/logstash. Simple changes but it won't work without; will hopefully push tomorrow.

Thanks. I'll release 3.0.13 shortly afterwards then.

OK... that took more updating than I thought it would. But it should all be up-to-date for Elasticsearch v5 now. I compiled it on FreeBSD 11 the other day which was very noisy (somthing about 64 bit magic numbers being too big IIRC) but the build seemed to work, so probably not an issue. Nothing else that I am aware of at the moment. Thanks, Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>

hi, what reason? get the 3.0.x from HEAD which will be 3.0.13 alan