1

After a security warning about FreeRadius, I am trying to build the FreeRadius 3.0.15 installation .deb files for Debian 9/Stretch for placing in my local repository.

I actually also need that version for a RadSec project and a couple of other bug fixes.

I build them using the following instructions:

git clone https://github.com/FreeRADIUS/freeradius-server.git
cd freeradius-server
git fetch origin v3.0.x:v3.0.x
git checkout v3.0.x
fakeroot dpkg-buildpackage -b -uc

However, when compiling it, I got back the following error:

dpkg-buildpackage: info: source package freeradius
dpkg-buildpackage: info: source version 3.0.15+git
dpkg-buildpackage: info: source distribution unstable
dpkg-buildpackage: info: source changed by Alan DeKok <aland@freeradius.org>
dpkg-buildpackage: info: host architecture amd64
 dpkg-source --before-build freeradius-server
dpkg-checkbuilddeps: error: Unmet build dependencies: libjson0 | libjson-c2
dpkg-buildpackage: warning: build dependencies/conflicts unsatisfied; aborting
dpkg-buildpackage: warning: (Use -d flag to override.)

What to do?

3

Alternatively, if you only need to upgrade FreeRadius to fix the vulnerability in question, you can install the latest FreeRadius packages from unstable; they fix the vulnerability too (with a minimal patch to 3.0.12).

An interesting general solution to this kind of problem, for users running testing and wishing to install security fixes from unstable as soon as they’re available, is to use Paul Wise’s extension to debsecan — it automatically pins packages to their unstable version as necessary when security fixes are released there.

  • 1
    Thanks for your input Stephen; I actually need more recent packages than 3.0.12 for a RadSec project and a couple of other bug fixes. I also do not feel entirely confy drinking from unstable in production systems due to bad experiences in the past. – Rui F Ribeiro May 31 '17 at 14:28
  • 1
    Perhaps it would be worth mentioning the extra requirements in your question ;-). You seem to be running testing in production; full security support with such a setup does involve pulling in from unstable from time to time (or rebuilding as you’re doing). Of course once Debian 9 is released you’ll be able to just use stable security! I note in passing (for othe readers) that upgrading to 3.0.15 means you need to provide your own security support going forwards. – Stephen Kitt May 31 '17 at 14:46
  • All valid points; I have actually moved forward in some systems to Debian 9 to get support for newer packages, and not for duplicating upgrade work as the launching date is already quite near; I have been drinking from the FR git for years now, as often both the official stable tar.gz and the Debian packages are barely adequate for our needs. – Rui F Ribeiro May 31 '17 at 15:04
1

libjson-c2 does not exist in Debian 9; doing an:

$apt-cache search libjson-c
libjson-c3 - JSON manipulation library - shared library

It is fairly evident it is now called libjson-c3; so I replaced in the debian control file of the project at freeradius-server/debian/control at line 10, libjson-c2 for libjson-c3

 10  libjson0 | libjson-c3,

Doing again :

fakeroot dpkg-buildpackage -b -uc

It compiles with success, and produces at the directory at freeradius-server/.. the following files:

freeradius_3.0.15+git_amd64.deb freeradius-common_3.0.15+git_all.deb freeradius-config_3.0.15+git_amd64.deb freeradius-dbg_3.0.15+git_amd64.deb freeradius-dhcp_3.0.15+git_amd64.deb freeradius-iodbc_3.0.15+git_amd64.deb freeradius-krb5_3.0.15+git_amd64.deb freeradius-ldap_3.0.15+git_amd64.deb freeradius-memcached_3.0.15+git_amd64.deb freeradius-mysql_3.0.15+git_amd64.deb freeradius-postgresql_3.0.15+git_amd64.deb freeradius-redis_3.0.15+git_amd64.deb freeradius-rest_3.0.15+git_amd64.deb freeradius-utils_3.0.15+git_amd64.deb freeradius-yubikey_3.0.15+git_amd64.deb libfreeradius3_3.0.15+git_amd64.deb libfreeradius-dev_3.0.15+git_amd64.deb

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.