fozzy wrote: 1. Can you go into a bit more details about what the problem was? I notice the patch is to one library file which seems to be a radius library not specific to yubikey. I'm wondering if this is a problem for all (non-yubikey) radius servers. My quick checking seemed to suggest the library version number didn't increment which creates potential confusion as to which library is installed. So I'm wondering if this is a stop gap fix which a more measured update still to come.
The issue stemmed from a security update FreeRADIUS made to a library we modified for YubiRADIUS. The updated library was distributed by Debian, overwriting the YubiRADIUS modified library, and causing the issues with YubiRADIUS. You are correct in that this is a stop-gap fix; we were already working on a packetized solution for the next release of YubiRADIUS when this issue occurred, which should prevent issues such as this from occurring in the future.
fozzy wrote: 2. It would be good to add to your notes the command line instructions for stopping automatic updates as well as GUI instructions.
I will be adding these as soon as I have a definite set of instructions. Thank you for the suggestion!
fozzy wrote: 3. A cosmetic observation. When bundling up the patch tarfile you've put the file in the toplevel directory rather than having all the files in a subdirectory as is usual convention/practice. I understand your focus was to get the patch out and such niceties may have been overlooked. Just commenting by way of improving the process for the future.
We apologize for the inelegant fix, but as you stated, we desired to get this fix out as soon as possible. However, your point is well made, and we are continually working to improve our processes.
hvbuel wrote: In the forum post you state : 'preventing the validation of any YubiKey generated OTP'
In our case the troubleshoot tab on the yubiradius server would succesfully authenticate a single OTP request.
But it would not authenticate a full request, including OTP and AD credentials as a result of this problem.
That is correct - I reported the issue with incorrect information. I have modified my original post, and beg your pardon for the confusion.
I wanted to thank the YubiRADIUS community for their patience during this issue. We understand that your authentication service is the gateway to most everything your users can do, and downtime on it represents a major impact on your work. YubiRADIUS continues to work towards our goal of becoming the most secure, most stable two-factor authentication solution for our price, and we thank all of our users in helping us do so.
|
