Freeradius 3.0.4-8.el7_3.x86_64 Update or not necessary ?
Hello I ask if is very necessary to update my actual version of FreeRadius ? Actually i have a version 3.0.4-8.el7_3.x86_64 on Linux. Can you confirm ? Because i found several security alert concerning this version. Regard -- Mr Karim Bourenane +33686464439
On Oct 4, 2017, at 10:10 AM, Karim Bourenane <karim.bourenane@gmail.com> wrote:
I ask if is very necessary to update my actual version of FreeRadius ? Actually i have a version 3.0.4-8.el7_3.x86_64 on Linux.
Can you confirm ? Because i found several security alert concerning this version.
If you're using an RPM from RH, ask RedHat for support. Alan DeKok.
On Wed, Oct 4, 2017 at 9:10 PM, Karim Bourenane <karim.bourenane@gmail.com> wrote:
Hello
I ask if is very necessary to update my actual version of FreeRadius ? Actually i have a version 3.0.4-8.el7_3.x86_64 on Linux.
Can you confirm ?
Short version: if you have redhat subscription, ask them.
Because i found several security alert concerning this version.
The release announcement should have details on what it fixes. If you use centos (and can't ask redhat directly), use google to find the relevant info (e.g. https://lists.centos.org/pipermail/centos-announce/2017-June/022487.html) -- Fajar
On 4 Oct 2017, at 22:26, Fajar A. Nugraha <list@fajar.net> wrote:
On Wed, Oct 4, 2017 at 9:10 PM, Karim Bourenane <karim.bourenane@gmail.com> wrote:
Hello
I ask if is very necessary to update my actual version of FreeRadius ? Actually i have a version 3.0.4-8.el7_3.x86_64 on Linux.
Can you confirm ?
Short version: if you have redhat subscription, ask them.
...and just to add Alan and Fajar are not being facetious. The code referred to by RHEL version numbers often contains many patches that weren't in the original release of that version. We have absolutely no idea what fixes 3.0.4 contains. -Arran
Yes, their answers were strange. Thank you for this addition and a better intelligent understanding and on existing divergence. Regard 2017-10-05 9:41 GMT+02:00 Arran Cudbard-Bell <a.cudbardb@freeradius.org>:
On 4 Oct 2017, at 22:26, Fajar A. Nugraha <list@fajar.net> wrote:
On Wed, Oct 4, 2017 at 9:10 PM, Karim Bourenane < karim.bourenane@gmail.com> wrote:
Hello
I ask if is very necessary to update my actual version of FreeRadius ? Actually i have a version 3.0.4-8.el7_3.x86_64 on Linux.
Can you confirm ?
Short version: if you have redhat subscription, ask them.
...and just to add Alan and Fajar are not being facetious. The code referred to by RHEL version numbers often contains many patches that weren't in the original release of that version. We have absolutely no idea what fixes 3.0.4 contains.
-Arran - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
-- Mr Karim Bourenane +33686464439
On Oct 5, 2017, at 3:59 AM, Karim Bourenane <karim.bourenane@gmail.com> wrote:
Yes, their answers were strange.
The answers were entirely correct. If you're buying support from RedHat, then you need to ask RedHat how your software works. I have no idea what's in the RHEL version of FreeRADIUS, and I'm not going to look. RedHat collects money from you for FreeRADIUS support, and doesn't pay a cent to me. It's wrong to pay RedHat for software, and then expect someone *else* to support you for free. Ask RedHat how their software works. Alan DeKok.
I ask if is very necessary to update my actual version of FreeRadius ? Actually i have a version 3.0.4-8.el7_3.x86_64 on Linux.
Can you confirm ?
Short version: if you have redhat subscription, ask them.
...and just to add Alan and Fajar are not being facetious. The code referred to by RHEL version numbers often contains many patches that weren't in the original release of that version. We have absolutely no idea what fixes 3.0.4 contains.
There was a recent communication from the team at RedHat who are responsible for FreeRADIUS package there that mentioned that they would rebase to a very recent version. I am not sure whether this was the 3.0.14 release or not (if it is, it’s already out of date given 3.0.15 has been out for some time). With Regards Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.
Thank you for the update! Is it possible to update us when RedHat does their thing?? On Mon, Oct 16, 2017 at 10:14 AM, Stefan Paetow <Stefan.Paetow@jisc.ac.uk> wrote:
I ask if is very necessary to update my actual version of FreeRadius ? Actually i have a version 3.0.4-8.el7_3.x86_64 on Linux.
Can you confirm ?
Short version: if you have redhat subscription, ask them.
...and just to add Alan and Fajar are not being facetious. The code referred to by RHEL version numbers often contains many patches that weren't in the original release of that version. We have absolutely no idea what fixes 3.0.4 contains.
There was a recent communication from the team at RedHat who are responsible for FreeRADIUS package there that mentioned that they would rebase to a very recent version. I am not sure whether this was the 3.0.14 release or not (if it is, it’s already out of date given 3.0.15 has been out for some time).
With Regards
Stefan Paetow Moonshot Industry & Research Liaison Coordinator
t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet
jisc.ac.uk
Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
On Mon, Oct 16, 2017 at 9:18 PM, Dave Macias <davama@gmail.com> wrote:
Thank you for the update! Is it possible to update us when RedHat does their thing??
IIRC rebasing generally happen with point release. Considering RHEL 7.4 (with freeradius-3.0.13-X) is 'recent', I doubt another rebase would happen anytime soon. https://bugzilla.redhat.com/show_bug.cgi?id=1202751#c36 https://access.redhat.com/errata/RHEA-2017:1954 -- Fajar
Hi, Although RedHat now ship freeradius-3.0.13 (with some of the recent security patches from 3.0.15 back ported in), be aware that this does not include winbind auth compiled into it. We are currently considering moving back to the RHEL package, as we only have one person familiar in compiling our own version (me), but it looks like we will have to take the backwards step to ntlm_auth if we do. We are about to start the load testing process. I have an open support query with RedHat who estimate around 6 months for winbind support. Dave Hartburn On 16/10/17 15:34, Fajar A. Nugraha wrote:
On Mon, Oct 16, 2017 at 9:18 PM, Dave Macias <davama@gmail.com> wrote:
Thank you for the update! Is it possible to update us when RedHat does their thing??
IIRC rebasing generally happen with point release. Considering RHEL 7.4 (with freeradius-3.0.13-X) is 'recent', I doubt another rebase would happen anytime soon.
https://bugzilla.redhat.com/show_bug.cgi?id=1202751#c36 https://access.redhat.com/errata/RHEA-2017:1954
the process (compile your own) is documented...and you can always document the process locally if there are any particular local things (eg using local OpenLDAP built against OpenSSL) - then you arent the SPOF . :) alan On 16 October 2017 at 15:47, David Hartburn <D.J.Hartburn@kent.ac.uk> wrote:
Hi,
Although RedHat now ship freeradius-3.0.13 (with some of the recent security patches from 3.0.15 back ported in), be aware that this does not include winbind auth compiled into it.
We are currently considering moving back to the RHEL package, as we only have one person familiar in compiling our own version (me), but it looks like we will have to take the backwards step to ntlm_auth if we do. We are about to start the load testing process.
I have an open support query with RedHat who estimate around 6 months for winbind support.
Dave Hartburn
On 16/10/17 15:34, Fajar A. Nugraha wrote:
On Mon, Oct 16, 2017 at 9:18 PM, Dave Macias <davama@gmail.com> wrote:
Thank you for the update! Is it possible to update us when RedHat does their thing??
IIRC rebasing generally happen with point release. Considering RHEL 7.4 (with freeradius-3.0.13-X) is 'recent', I doubt another rebase would happen anytime soon.
https://bugzilla.redhat.com/show_bug.cgi?id=1202751#c36 https://access.redhat.com/errata/RHEA-2017:1954
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thank you for the update! Is it possible to update us when RedHat does their thing??
There was a recent communication from the team at RedHat who are responsible for FreeRADIUS package there that mentioned that they would rebase to a very recent version. I am not sure whether this was the 3.0.14 release or not (if it is, it’s already out of date given 3.0.15 has been out for some time).
No... RedHat staff occasionally post on here, but I would watch their Bugzilla, or just not rely on their packages in the first place. We (Jisc) update our repositories for the Moonshot (dynamic realm lookup) version of FreeRADIUS within weeks of the official release of FR because those releases generally involve either security fixes or stability fixes that we would like our customers to have. Our packages require other dependencies though that are not necessary when you don’t run a Moonshot service. With Regards Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.
participants (8)
-
Alan Buxey -
Alan DeKok -
Arran Cudbard-Bell -
Dave Macias -
David Hartburn -
Fajar A. Nugraha -
Karim Bourenane -
Stefan Paetow