Hi, For the next issue.... I have to use CentOS in FIPS mode which disallows MD5 use. What do I need to change to either encapsulate it in TLS on the client and server or what should I do to change the configuration to not advertise to CentOS 7 in FIPS mode that MD5 is being used? My understanding is that RADIUS uses MD5 by specification. FIPS mode disallows MD5 usage as being too weak. radiusd -X is up and ready for connections but the basic radtest with user bob generates an MD5 usage error stating that MD5 utlization is not allowed in FIPS mode.
On May 31, 2019, at 2:07 PM, Paul Pathiakis via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
I have to use CentOS in FIPS mode which disallows MD5 use.
So you don't plan on using RADIUS then.
What do I need to change to either encapsulate it in TLS on the client and server or what should I do to change the configuration to not advertise to CentOS 7 in FIPS mode that MD5 is being used?
RADIUS can be sent over TLS. But it still mandates the use of MD5.
My understanding is that RADIUS uses MD5 by specification. FIPS mode disallows MD5 usage as being too weak. radiusd -X is up and ready for connections but the basic radtest with user bob generates an MD5 usage error stating that MD5 utlization is not allowed in FIPS mode.
a) allow MD5 and use RADIUS b) disallow MD5 and don't use RADIUS. Blanket security prohibitions aren't very useful in the real world. We've put source code changes into "master" (not v3) to over-ride FIPS mode. i.e. the OS says "don't use MD5", but the application over-rides that with "yes, I really want to use MD5". Which makes FIPS mode sort of useless. All it does is ensure that you don't *accidentally* use MD5. Those changes might be portable back to v3. But it wouldn't be trivial. Alan DeKok.
Which makes FIPS mode sort of useless. All it does is ensure that you don't *accidentally* use MD5.
Kind of, it's more like OpenSSL says it's in FIPS mode, and we use our own internal implementation of MD5.
Those changes might be portable back to v3. But it wouldn't be trivial.
It's not. -Arran
Hi, Is there a time frame on it? Where can I find where this is posted so I don't bother the list again? :D P.
On Jun 3, 2019, at 8:10 AM, Paul Pathiakis via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
Is there a time frame on it? Where can I find where this is posted so I don't bother the list again? :D
There is no time frame for the v4 release. We will post an announcement here when it's released. The v4 rework is extensive, and takes a lot of time. We're also working on adding substantially more documentation, which should help with the upgrade process. Alan DeKok.
Thank you, Alan. I started reading about the re-work and the issues surrounding it right after I sent that mail. Good luck to you all, it seems like it's going to be a bear. P. On Monday, June 3, 2019, 8:22:05 AM EDT, Alan DeKok <aland@deployingradius.com> wrote: On Jun 3, 2019, at 8:10 AM, Paul Pathiakis via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
Is there a time frame on it? Where can I find where this is posted so I don't bother the list again? :D
There is no time frame for the v4 release. We will post an announcement here when it's released. The v4 rework is extensive, and takes a lot of time. We're also working on adding substantially more documentation, which should help with the upgrade process. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Jun 3, 2019, at 8:51 AM, Paul Pathiakis via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
I started reading about the re-work and the issues surrounding it right after I sent that mail. Good luck to you all, it seems like it's going to be a bear.
We're over the worst bits. We've re-written the interpreter, the threading model, the network IO, the dictionaries, and many more bits. There's only a few things left to do. But they'll take time and care. Alan DeKok.
Hello All I am new to radius and looking to set ssh with radius, where can i find helpful informations and/or tips Thank you Le lun. 3 juin 2019 à 14:56, Alan DeKok <aland@deployingradius.com> a écrit :
On Jun 3, 2019, at 8:51 AM, Paul Pathiakis via Freeradius-Users < freeradius-users@lists.freeradius.org> wrote:
I started reading about the re-work and the issues surrounding it right after I sent that mail. Good luck to you all, it seems like it's going to be a bear.
We're over the worst bits. We've re-written the interpreter, the threading model, the network IO, the dictionaries, and many more bits. There's only a few things left to do. But they'll take time and care.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Tahari.Abdeslam
Abdeslam Tahari, Don' t throw your questions into the random emails. please, send separated with a specific title describing what you' re looking for. On Mon, Jun 3, 2019 at 10:06 AM Abdeslam Tahari <abeslam@gmail.com> wrote:
Hello All
I am new to radius and looking to set ssh with radius, where can i find helpful informations and/or tips
Thank you
Le lun. 3 juin 2019 à 14:56, Alan DeKok <aland@deployingradius.com> a écrit :
On Jun 3, 2019, at 8:51 AM, Paul Pathiakis via Freeradius-Users < freeradius-users@lists.freeradius.org> wrote:
I started reading about the re-work and the issues surrounding it right after I sent that mail. Good luck to you all, it seems like it's going to be a bear.
We're over the worst bits. We've re-written the interpreter, the threading model, the network IO, the dictionaries, and many more bits. There's only a few things left to do. But they'll take time and care.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Tahari.Abdeslam - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (5)
-
Abdeslam Tahari -
Alan DeKok -
Arran Cudbard-Bell -
Jorge Pereira -
Paul Pathiakis