[Freeipa-devel] [PATCH] krb 1.12's OTP-Over-RADIUS
npmccallum at redhat.com
Thu Mar 7 23:36:58 UTC 2013
On Wed, 2013-03-06 at 13:04 -0500, Nathaniel McCallum wrote:
> On Wed, 2013-03-06 at 12:56 -0500, Nathaniel McCallum wrote:
> > Patch is attached.
> > There are currently a few security downsides to this patch:
> > 1. The daemon (ipa-otpd) runs as root and binds anonymously
> > 2. ipatokenRadiusSecret is readable by an anonymous bind
> > This patch also adds some new dependencies, namely:
> > 1. libverto (a dependency of krb5)
> > 2. systemd
> > 3. a krb5 patched for libk5radius support 
> > In the interest of trying to meet the Fedora Features deadline, I am
> > providing the patch in spite of the above issues.
> > Nathaniel
> > 1 - http://bit.ly/ZqtK79
> Also, I assumed the usability of 2.16.840.1.1137220.127.116.11 for the
> schema. This will need to be verified and finalized.
Updated version of the patch attached. Requires libk5radius from here:
This new version fixes a bug which caused a hang in the case of no entry
found during LDAP query.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 65774 bytes
Desc: not available
More information about the Freeipa-devel