RHEA-2010:0305 - Product Enhancement Advisory

Topic

A new package, freeradius2, is now available.

Description

FreeRADIUS is an Internet authentication daemon, which implements the
RADIUS protocol, as defined in RFC 2865 (and others). It allows Network
Access Servers (NAS boxes) to perform authentication for dial-up users.
There are also RADIUS clients available for Web servers, firewalls, Unix
logins, and more. Using RADIUS allows authentication and authorization for
a network to be centralized, and minimizes the amount of re-configuration
which has to be done when adding or deleting new users.

Red Hat Enterprise Linux 5 originally shipped with FreeRADIUS 1.1.3. Since
that time the FreeRADIUS project has had a major new release: FreeRADIUS 2.
Because of the numerous enhancements available in FreeRADIUS 2 many users
would prefer to use the more contemporary version of FreeRADIUS. This new
package, provides this newer version. (BZ#473704)

Note: versions 1.x and 2.x of FreeRADIUS are not configuration compatible.
Red Hat will continue to support and make available freeradius-1.1.3.
Customers who are utilizing the original freeradius-1.1.3 will see no
difference. For customers who wish to utilize the newer 2.x version of
FreeRADIUS in Red Hat Enterprise Linux 5 the new freeradius2 package
provides that capability.

Note: freeradius and freeradius2 cannot be installed simultaneously.
Because they share common files, rpm, the Red Hat Enterprise Linux package
manager, will prevent an installation of FreeRADIUS 2.x if FreeRADIUS 1.x
is already installed. To install freeradius2 on a system with freeradius
currently installed, freeradius must first be uninstalled. See the solution
section below for details.

Users wanting to take advantage of the enhancements available in FreeRADIUS
2.x should install and configure this new package.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

As noted above, if freeradius is present on a system, it must be
removed before freeradius2 can be installed. Prior to uninstalling
freeradius backup the freeradius configuration files located under
/etc/raddb.

Next, determine which freeradius 1.x packages you might have installed
with the following command:

rpm -qa freeradius\*

For every package listed by this command run either

yum remove [packagename]

or

rpm -e [packagename]

to remove each package. Note: removing these packages requires root
privileges.

Once all packages associated with freeradius-1.1.3 are removed install
the new freeradius2 packages.

Note: once freeradius2 is installed do not copy configuration
information from the old 1.x version into the new 2.x /etc/raddb
configuration. Freeradius 1.x and 2.x are not configuration
compatible.

Instead run the new server in debug mode as follows:

/usr/sbin/radiusd -X

This creates temporary certificates in /etc/raddb/certs which will be
necessary for EAP authentication and will provide the ability to
validate the Radius server that comes up and runs.

Then make the minor incremental changes to the configuration files
under /etc/raddb necessary to recreate the previous facilities running
with the FreeRADIUS 1.x.

The web site http://deployingradius.com/ has basic setup and
configuration examples for FreeRADIUS 2.x. In addition the FreeRADIUS
project wiki at http://wiki.freeradius.org provides additional
documentation.

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 550845 - freeradius2-devel has multilib conflicts

CVEs

(none)

References

(none)