In line (same as you). On Fri, Jun 13, 2014 at 4:47 AM, Arran Cudbard-Bell < a.cudbardb@freeradius.org> wrote:

On 13 Jun 2014, at 09:32, Brandon Jozsa <bjozsa@gmail.com> wrote:

...

Hello,

I've been trying to work through the issues and by searching high and low for solutions before turning to this users list. I'm sorry if this is a stupid question (I've seen worse though, so maybe I shouldn't feel bad).

I have a very high need to use the rlm_cache module with Freeradius on CentOS 6.5. I'm trying to first us the statement:

----- snipped -----

authorize { if (!notfound) { update control { Proxy-To-Realm := "SOME_REALM" } } ----- snipped -----

which works GREAT alone...but I also want to use the cache function like so:

----- snipped ----- update control { Cache-Status-Only = 'yes' } cache if (notfound) { sql } update control { Cache-Status-Only := 'no' } cache

In 3.0.4 that will be.

update control { Cache-Read-Only = 'yes' } cache if (notfound) { sql cache }

Much nicer :)

I like it! Can't wait to play around with the new version...when CentOS finally catches up!

...

which doesn't work (obviously) because rlm_cache isn't included with 2.1.12, or so it seems anyway.

Yep.

...

My hope is (it is a hope anyway) that I can collect authN/authZ replies from an upstream radius server and cache them locally; thus building a mysql database of users access/privileges and let this run on an environment before cutting completely over to our new Freeradius setup. Again, I'm hoping it can work like this...getting rid of RSA and using LinOTP or MOTP would be so nice;

Yubikey FTW.

Good suggestion, I will check it out. Thanks for the tip.

...

it would be more flexible and user friendly, but I really need to collect authN and authZ in order to rebuild our massive user-base.

My issue...CentOS, which is our "approved platform" (I'm rolling my eyes and giving air quotes), doesn't have a newer version of Freeradius other than 2.1.12. I think the rlm_cache modules are only included in 3.0.0 and higher, is that right?

No, a cut down version is also present 2.2.x from 2.2.0, and working since 2.2.1.

So, I'm not crazy...and what I want to do can actually be done? Reading through a lot of the documentation, that seemed to be an appropriate way to forklift a Freeradius solution into our environment...a TRUE forklift, if it can be done this way.

...

So, I started looking on how to build from source...and I found one; great news I thought!! Enter: http://confluence.diamond.ac.uk/display/PAAUTH/FreeRADIUS+specs+and+sources+.... I thought this would save the day, but there are broken links for 3.0.0 and I am running into major issues;

There are spec files for RHEL bundled with the source, chances are you can just use those...

Didn't seem to work, like I mentioned below. Wasted a lot of time trying to go down that route.

...

it just doesn't seem to work at all. I also tried to build it out, take the rlm_cache.so lib over to my 2.1.12 installation, but Freeradius barfed all over that little trick.

In FreeRADIUS 3.0.x we added explicit validation checks to stop people trying to do stuff like that. There's no guarantee the ABI of libfreeradius will be compatible between versions, and given how frequently the internal API changes, there's a good chance it won't be.

Makes sense, and I can understand why...it's a way to control things. I think some of the suggestions to use version 2.2.5 may be an option, and not really break anything. That's even something that would compile easier...worst case scenario. Thanks for the tips everyone! Really glad to be part of the group and even help contribute! -Arran

Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team

FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

-- Brandon

On Fri, Jun 13, 2014 at 5:16 PM, Stefan Paetow <Stefan.Paetow@ja.net> wrote:

...

...

So, I started looking on how to build from source...and I found one; great news I thought!! I thought this would save the day, but there are broken links for 3.0.0 and I am running into major issues; There are spec files for RHEL bundled with the source, chances are you can just use those... Didn't seem to work, like I mentioned below. Wasted a lot of time trying to go down that route.

When you say "didn't seem to work", what exactly do you mean? Didn't build or didn't work when you installed the resulting packages?

I think he means that the bundled spec in 2.2.5 and 3.0.3 produced an error when you run rpmbuild. Which is true (due to addition of some config files and/or modules, IIRC). The fix is already in git. The packages on opensuse build service already contain that particular packaging fix. If anyone is interested to build their own packages, then can do so by replacing the spec file manually: https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/redhat/freeradiu... https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/redhat/freeradiu... -- Fajar

If you want to use prebuilt packages, try http://software.opensuse.org/download.html?project=home%3Afreeradius%3A2.x.x... unofficial, but should work for centos. Upgrading from 2.1.12 to 2.5.5 should be easy enough. Or, use 3.0.x: http://software.opensuse.org/download.html?project=home%3Afreeradius%3A3.0.x...

As long as they don’t contain a requirement for systemd-units, then you’re good. ☺ Stefan Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238

This worked perfectly! I see the updates, ran them and things worked just fine. Thank you (all) so much for your contributions and support. This was extremely helpful and I am able to get what I need now. On Fri, Jun 13, 2014 at 6:12 AM, Stefan Paetow <Stefan.Paetow@ja.net> wrote:

...

So, I started looking on how to build from source...and I found one; great news I thought!!

...

Enter: http://confluence.diamond.ac.uk/display/PAAUTH/FreeRADIUS+specs+and+sources+....

...

I thought this would save the day, but there are broken links for 3.0.0 and I am running into major issues; it

...

just doesn't seem to work at all. I also tried to build it out, take the rlm_cache.so lib over to my 2.1.12

...

installation, but Freeradius barfed all over that little trick.

Oh dear! That’s not good. Thanks for letting me know, although all the links seemed to work when I used them a few minutes ago?

I’ve however changed the parent page to refer to the OpenSUSE packages instead, since there are now live packages that can be used on CentOS, and deleted that reference. :-)

Stefan

Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

-- Brandon

I guess it depends on what your search terms were but it's always surprising how many people use 3rd party docs rather than the official docs and how many people write up their own web pages rather than contributing to or fixing the official docs. alan

On the standard CentOS/RHEL platform, the only dependency hell you would have is if you used the Fedora SRPM and didn't replace the SPEC file. It includes a reference to systemd-units which does not really exist for the EL6 platform. All other build packages should be standard and present and not present any issues. Anyway… Nick from RedHat is on this list, so it would be a question for Nick, how 2.2.x could be pushed into the 6.x repos to replace 2.1.12 (the last official version). Stefan ________________________________ From: freeradius-users-bounces+stefan.paetow=ja.net@lists.freeradius.org [freeradius-users-bounces+stefan.paetow=ja.net@lists.freeradius.org] on behalf of Brandon B. Jozsa [bjozsa@gmail.com] Sent: 14 June 2014 13:39 To: Alan Buxey Cc: FreeRadius users mailing list Subject: Re: Issues with building Freeradius on CentOS 6.5: need rlm_cache It wasn't any limitation of the documentation or freeradius at all. To me, it's a limitation of some of the Linux distros. I'm a fan of FreeBSD for servers, but our requirement is using either RHEL or Centos. When you build on those systems it seems like you're locked in dependency hell. I could have built from spec, but then some other operations group has to support it after it's developed. And of course that makes the system less supportable for the masses. Is there any way to get this 2.5 version into the Centos 6 stable repos? My main issue was the need for rlm_cache...as it's a direct requirement for my needs in this case. -- Brandon B. Jozsa Principal Of Technology Security - AT&T - Chief Security Office Phone: 704.966.9576<tel:704.966.9576> AT&T Proprietary; not for use or disclosure outside the AT&T companies. This message and any attachments to it contain confidential business information intended solely for the recipient(s). If you have received this message in error, please notify the sender and delete this message immediately from your computer. Any other use, retention, dissemination, forwarding, printing, or copying of this e-mail is strictly prohibited. On Jun 14, 2014, at 3:40 AM, Alan Buxey <A.L.M.Buxey@lboro.ac.uk<mailto:A.L.M.Buxey@lboro.ac.uk>> wrote: I guess it depends on what your search terms were but it's always surprising how many people use 3rd party docs rather than the official docs and how many people write up their own web pages rather than contributing to or fixing the official docs. alan Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238