Fedora 12 Update: freeradius-2.1.8-2.fc12

updates at fedoraproject.org updates at fedoraproject.org
Tue Jan 12 20:50:42 UTC 2010


--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2010-0423
2010-01-12 20:06:29
--------------------------------------------------------------------------------

Name        : freeradius
Product     : Fedora 12
Version     : 2.1.8
Release     : 2.fc12
URL         : http://www.freeradius.org/
Summary     : High-performance and highly configurable free RADIUS server
Description :
The FreeRADIUS Server Project is a high performance and highly configurable
GPL'd free RADIUS server. The server is similar in some respects to
Livingston's 2.0 server.  While FreeRADIUS started as a variant of the
Cistron RADIUS server, they don't share a lot in common any more. It now has
many more features than Cistron or Livingston, and is much more configurable.

FreeRADIUS is an Internet authentication daemon, which implements the RADIUS
protocol, as defined in RFC 2865 (and others). It allows Network Access
Servers (NAS boxes) to perform authentication for dial-up users. There are
also RADIUS clients available for Web servers, firewalls, Unix logins, and
more.  Using RADIUS allows authentication and authorization for a network to
be centralized, and minimizes the amount of re-configuration which has to be
done when adding or deleting new users.

--------------------------------------------------------------------------------
Update Information:

* Thu Jan  7 2010 John Dennis <jdennis at redhat.com> - 2.1.8-2  - resolves: bug
#526559 initial install should run bootstrap to create certificates    running
radiusd in debug mode to generate inital temporary certificates    is no longer
necessary, the /etc/raddb/certs/bootstrap is invoked on initial    rpm install
(not upgrade) if there is no existing /etc/raddb/certs/server.pem file  -
resolves: bug #528493 use sha1 algorithm instead of md5 during cert generation
the certificate configuration (/etc/raddb/certs/{ca,server,client}.cnf) files
were modifed to use sha1 instead of md5 and the validity reduced from 1 year to
2 months    * Wed Dec 30 2009 John Dennis <jdennis at redhat.com> - 2.1.8-1  -
update to latest upstream    Feature improvements    * Print more descriptive
error message for too many EAP sessions.      This gives hints on what to do
when "failed to store handler"    * Commands received from radmin are now
printed on stdout when      in debugging mode.    * Allow accounting packets to
be written to a detail file, even      if they were read from a different detail
file.    * Added OpenSSL license exception (src/LICENSE.openssl)      Bug fixes
* DHCP sockets can now set the broadcast flag before binding to a      socket.
You need to set "broadcast = yes" in the DHCP listener.    * Be more restrictive
on string parsing in the config files    * Fix password length in scripts
/create-users.pl    * Be more flexible about parsing the detail file.  This
allows      it to read files where the attributes have been edited.    * Ensure
that requests read from the detail file are cleaned up      (i.e. don't leak) if
they are proxied without a response.    * Write the PID file after opening
sockets, not before      (closes bug #29)    * Proxying large numbers of packets
no longer gives error      "unable to open proxy socket".    * Avoid mutex locks
in libc after fork    * Retry packet from detail file if there was no response.
* Allow old-style dictionary formats, where the vendor name is the      last
field in an ATTRIBUTE definition.    * Removed all recursive use of mutexes.
Some systems just don't      support this.    * Allow !* to work as documented.
* make templates work (see templates.conf)    * Enabled "allow_core_dumps" to
work again    * Print better errors when reading invalid dictionaries    * Sign
client certificates with CA, rather than server certs.    * Fix potential crash
in rlm_passwd when file was closed    * Fixed corner cases in conditional
dynamic expansion.    * Use InnoDB for MySQL IP Pools, to gain transactional
support    * Apply patch to libltdl for CVE-2009-3736.    * Fixed a few issues
found by LLVM's static checker    * Keep track of "bad authenticators" for
accounting packets    * Keep track of "dropped packets" for auth/acct packets
* Synced the "debian" directory with upstream    * Made "unlang" use unsigned
32-bit integers, to match the      dictionaries.    * Wed Dec 30 2009 John
Dennis <jdennis at redhat.com> - 2.1.7-7  - Remove devel subpackage. It doesn't
make much sense to have a devel package since    we don't ship libraries and it
produces multilib conflicts.    * Mon Dec 21 2009 John Dennis
<jdennis at redhat.com> - 2.1.7-6  - more spec file clean up from review comments
- remove freeradius-libs subpackage, move libfreeradius-eap and
libfreeradius-radius into the main package  - fix subpackage requires, change
from freeradius-libs to main package  - fix description of the devel subpackage,
remove referene to non-shipped libs  - remove execute permissions on src files
included in debuginfo  - remove unnecessary use of ldconfig  - since all sub-
packages now require main package remove user creation for sub-packages  - also
include the LGPL library license file in addition to the GPL license file  - fix
BuildRequires for perl so it's compatible with both Fedora, RHEL5 and RHEL6
--------------------------------------------------------------------------------
ChangeLog:

* Thu Jan  7 2010 John Dennis <jdennis at redhat.com> - 2.1.8-2
- resolves: bug #526559 initial install should run bootstrap to create certificates
  running radiusd in debug mode to generate inital temporary certificates
  is no longer necessary, the /etc/raddb/certs/bootstrap is invoked on initial
  rpm install (not upgrade) if there is no existing /etc/raddb/certs/server.pem file
- resolves: bug #528493 use sha1 algorithm instead of md5 during cert generation
  the certificate configuration (/etc/raddb/certs/{ca,server,client}.cnf) files
  were modifed to use sha1 instead of md5 and the validity reduced from 1 year to 2 months
* Wed Dec 30 2009 John Dennis <jdennis at redhat.com> - 2.1.8-1
- update to latest upstream
  Feature improvements
  * Print more descriptive error message for too many EAP sessions.
    This gives hints on what to do when "failed to store handler"
  * Commands received from radmin are now printed on stdout when
    in debugging mode.
  * Allow accounting packets to be written to a detail file, even
    if they were read from a different detail file.
  * Added OpenSSL license exception (src/LICENSE.openssl)

  Bug fixes
  * DHCP sockets can now set the broadcast flag before binding to a
    socket.  You need to set "broadcast = yes" in the DHCP listener.
  * Be more restrictive on string parsing in the config files
  * Fix password length in scripts/create-users.pl
  * Be more flexible about parsing the detail file.  This allows
    it to read files where the attributes have been edited.
  * Ensure that requests read from the detail file are cleaned up
    (i.e. don't leak) if they are proxied without a response.
  * Write the PID file after opening sockets, not before
    (closes bug #29)
  * Proxying large numbers of packets no longer gives error
    "unable to open proxy socket".
  * Avoid mutex locks in libc after fork
  * Retry packet from detail file if there was no response.
  * Allow old-style dictionary formats, where the vendor name is the
    last field in an ATTRIBUTE definition.
  * Removed all recursive use of mutexes.  Some systems just don't
    support this.
  * Allow !* to work as documented.
  * make templates work (see templates.conf)
  * Enabled "allow_core_dumps" to work again
  * Print better errors when reading invalid dictionaries
  * Sign client certificates with CA, rather than server certs.
  * Fix potential crash in rlm_passwd when file was closed
  * Fixed corner cases in conditional dynamic expansion.
  * Use InnoDB for MySQL IP Pools, to gain transactional support
  * Apply patch to libltdl for CVE-2009-3736.
  * Fixed a few issues found by LLVM's static checker
  * Keep track of "bad authenticators" for accounting packets
  * Keep track of "dropped packets" for auth/acct packets
  * Synced the "debian" directory with upstream
  * Made "unlang" use unsigned 32-bit integers, to match the
    dictionaries.
* Wed Dec 30 2009 John Dennis <jdennis at redhat.com> - 2.1.7-7
- Remove devel subpackage. It doesn't make much sense to have a devel package since
  we don't ship libraries and it produces multilib conflicts.
* Mon Dec 21 2009 John Dennis <jdennis at redhat.com> - 2.1.7-6
- more spec file clean up from review comments
- remove freeradius-libs subpackage, move libfreeradius-eap and
  libfreeradius-radius into the main package
- fix subpackage requires, change from freeradius-libs to main package
- fix description of the devel subpackage, remove referene to non-shipped libs
- remove execute permissions on src files included in debuginfo
- remove unnecessary use of ldconfig
- since all sub-packages now require main package remove user creation for sub-packages
- also include the LGPL library license file in addition to the GPL license file
- fix BuildRequires for perl so it's compatible with both Fedora, RHEL5 and RHEL6
* Mon Dec 21 2009 John Dennis <jdennis at redhat.com> - 2.1.7-5
- fix various rpmlint issues.
* Fri Dec  4 2009 Stepan Kasal <skasal at redhat.com> - 2.1.7-4
- rebuild against perl 5.10.1
* Thu Dec  3 2009 John Dennis <jdennis at redhat.com> - 2.1.7-3
- resolves: bug #522111 non-conformant initscript
  also change permission of /var/run/radiusd from 0700 to 0755
  so that "service radiusd status" can be run as non-root
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #526559 - initial install should run bootstrap to create certificates
        https://bugzilla.redhat.com/show_bug.cgi?id=526559
  [ 2 ] Bug #528493 - [RFE] FreeRADIUS: Add SHA1 algorithm use recommendation for certificate generation
        https://bugzilla.redhat.com/show_bug.cgi?id=528493
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use 
su -c 'yum update freeradius' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
http://fedoraproject.org/keys
--------------------------------------------------------------------------------


More information about the package-announce mailing list