Group administrators:
Moonshot Code Update
6 September 2013 at 5:06pm
Last night Sam Hartman from Painless Security published a code update to ensure Moonshot is in line with the the latest IETF specs.
In particular:
- We now use RFC 3961 MIC tokens per the approved spec
- We no longer depend on FreeRADIUS; we use Alan's NetworkRADIUS library. Thanks Alan for working with us and thanks to Luke for doing the integration!
- OIDs and attribute names are updated from the current versions of the IETF specs.
This code update represents a significant incompatible change with previous versions, so if you have Moonshot code in production and need to support both versions, leave a comment below or email moonshot-community@jiscmail.ac.uk and Sam will help you work through how to do that.
In particular, the following things need to be updated to use the new code:
- You will need to change the OIDs you are using; see the mech_eap/mech file for the new OIDs.
- You need to remove the dictionary line from radsec.conf.
- You need to update the URNs of any GSS attributes you use in your Shibboleth configuration.
- We're now using different RADIUS attribute numbers because our attributes have been approved and registered with IANA.
Here's a dictionary fragment:
ATTRIBUTE | GSS-Acceptor-Service-Name | 164 | string |
ATTRIBUTE | GSS-Acceptor-Host-Name | 165 | string |
ATTRIBUTE | GSS-Acceptor-Service-Specifics | 166 | string |
ATTRIBUTE | GSS-Acceptor-Realm-Name | 167 | string |
Links to the code, including the latest DVD image, can be found at https://community.ja.net/groups/moonshot/article/moonshot-dvd-image-and-...