Development August 2018

development@lists.ipfire.org

14 participants
56 discussions

[PATCH 1/3 v2] Unbound: Enable DNS cache poisoning mitigation
by Peter Müller 28 Aug '18

28 Aug '18

By default, Unbound neither keeps track of the number of unwanted replies nor initiates countermeasures if they become too large (DNS cache poisoning). This sets the maximum number of tolerated unwanted replies to 1M, causing the cache to be flushed afterwards. (Upstream documentation recommends 10M as a threshold, but this turned out to be ineffective against attacks in the wild.) See https://nlnetlabs.nl/documentation/unbound/unbound.conf/ for details. This version of the patch uses 1M as threshold instead of 5M and supersedes the first version. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- config/unbound/unbound.conf | 3 +++ 1 file changed, 3 insertions(+) diff --git a/config/unbound/unbound.conf b/config/unbound/unbound.conf index 3f724d8f7..fa2ca3fd4 100644 --- a/config/unbound/unbound.conf +++ b/config/unbound/unbound.conf @@ -61,6 +61,9 @@ server: harden-algo-downgrade: no use-caps-for-id: no + # Harden against DNS cache poisoning + unwanted-reply-threshold: 1000000 + # Listen on all interfaces interface-automatic: yes interface: 0.0.0.0 -- 2.16.4

2 4

None
by Fabian Horst 27 Aug '18

27 Aug '18

1 0

[PATCH v3] embed background image in redirect template
by Peter Müller 27 Aug '18

27 Aug '18

Embed the IPFire background image into the redirect template directly via CSS instead of loading it from somewhere else. This is necessary because of Content Security Policy (CSP). This patch inserts the base64 encoded image during build so nothing needs to be updated twice in case background image changes. It supersedes first and second version of this patch and has been successfully tested during a clean build. Fixes #11650 Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- html/html/redirect-templates/legacy/template.html | 7 ++++++- lfs/web-user-interface | 5 +++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/html/html/redirect-templates/legacy/template.html b/html/html/redirect-templates/legacy/template.html index b5fb61ebe..297561e3a 100644 --- a/html/html/redirect-templates/legacy/template.html +++ b/html/html/redirect-templates/legacy/template.html @@ -3,11 +3,16 @@ <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>ACCESS MESSAGE</title> + <style content="text/css"> + td.image { + background-image: url(data:image/gif;base64,IMAGEDATAPLACEHOLDER); + } + </style> </head> <body> <table width="100%" height='100%' border="0"> <tr> - <td colspan='3' width='100%' height='130' align="center" background="<TMPL_VAR NAME="ADDRESS">/images/background.gif"> + <td colspan='3' width='100%' height='152px' align="center" class="image"> </td> <tr> <td width='10%'> <td align='center' bgcolor='#CC000000' width='80%'> diff --git a/lfs/web-user-interface b/lfs/web-user-interface index 0c5688252..f3367713a 100644 --- a/lfs/web-user-interface +++ b/lfs/web-user-interface @@ -55,6 +55,11 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) mkdir -p /var/updatecache/{download,metadata} cp -aR $(DIR_SRC)/html/* /srv/web/ipfire + # Add base64 encoded background image to Squid content access page + basedata="$$( base64 ${DIR_SRC}/html/html/images/background.gif | tr -d '\n' )"; \ + sed -i "s|IMAGEDATAPLACEHOLDER|$${basedata}|g" \ + /srv/web/ipfire/html/redirect-templates/legacy/template.html + # Change CONFIG_ROOT in cgi-scripts for i in /srv/web/ipfire/cgi-bin/{*,logs.cgi/*,vpn.cgi/*}; do \ if [ -f $$i ]; then \ -- 2.16.4

2 3

[PATCH 3/3 v3] Unbound: Use aggressive NSEC
by Peter Müller 27 Aug '18

27 Aug '18

This avoids some needless lookups to destination domains with a very high NXDOMAIN rate and reduces load on upstream servers. See https://nlnetlabs.nl/documentation/unbound/unbound.conf/ for further details. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- config/unbound/unbound.conf | 1 + 1 file changed, 1 insertion(+) diff --git a/config/unbound/unbound.conf b/config/unbound/unbound.conf index 8b5d34ee3..8ad6bcb03 100644 --- a/config/unbound/unbound.conf +++ b/config/unbound/unbound.conf @@ -60,6 +60,7 @@ server: harden-referral-path: yes harden-algo-downgrade: no use-caps-for-id: yes + aggressive-nsec: yes # Harden against DNS cache poisoning unwanted-reply-threshold: 5000000 -- 2.16.4

1 0

[PATCH 2/3 v3] Unbound: Use caps for IDs
by Peter Müller 27 Aug '18

27 Aug '18

Attempt to detect DNS spoofing attacks by inserting 0x20-encoded random bits into upstream queries. Upstream documentation claims it to be an experimental implementation, it did not cause any trouble on productive systems here. See https://nlnetlabs.nl/documentation/unbound/unbound.conf/ for further details. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- config/unbound/unbound.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/unbound/unbound.conf b/config/unbound/unbound.conf index fa2ca3fd4..8b5d34ee3 100644 --- a/config/unbound/unbound.conf +++ b/config/unbound/unbound.conf @@ -59,7 +59,7 @@ server: harden-below-nxdomain: yes harden-referral-path: yes harden-algo-downgrade: no - use-caps-for-id: no + use-caps-for-id: yes # Harden against DNS cache poisoning unwanted-reply-threshold: 5000000 -- 2.16.4

1 0

[PATCH 3/3] Unbound: Use aggressive NSEC
by Peter Müller 27 Aug '18

27 Aug '18

2 2

[PATCH 2/3] Unbound: Use caps for IDs
by Peter Müller 27 Aug '18

27 Aug '18

2 4

[PATCH 1/3] Unbound: Enable DNS cache poisoning mitigation
by Peter Müller 26 Aug '18

26 Aug '18

By default, Unbound neither keeps track of the number of unwanted replies nor initiates countermeasures if they become too large (DNS cache poisoning). This sets the maximum number of tolerated unwanted replies to 5M, causing the cache to be flushed afterwards. (Upstream documentation recommends 10M as a threshold, but this turned out to be ineffective against attacks in the wild.) See https://nlnetlabs.nl/documentation/unbound/unbound.conf/ for details. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- config/unbound/unbound.conf | 3 +++ 1 file changed, 3 insertions(+) diff --git a/config/unbound/unbound.conf b/config/unbound/unbound.conf index 3f724d8f7..fa2ca3fd4 100644 --- a/config/unbound/unbound.conf +++ b/config/unbound/unbound.conf @@ -61,6 +61,9 @@ server: harden-algo-downgrade: no use-caps-for-id: no + # Harden against DNS cache poisoning + unwanted-reply-threshold: 5000000 + # Listen on all interfaces interface-automatic: yes interface: 0.0.0.0 -- 2.16.4

2 4

Wiki-Link leads to chrisbenton
by Matthias Fischer 26 Aug '18

26 Aug '18

Hi! This just came to my view: The current link for "Drop vs Reject" on https://wiki.ipfire.org/configuration/firewall/start leads to http://www.chrisbrenton.org/2009/07/why-firewall-reject-rules-are-better-th…. But this URL only shows a big, white page on chrisbenton.org: "Diese Domain kaufen". No relevant contents at all. Deleted without warning!? Best, Matthias

2 1

[PATCH 1/2] add hardened SSH server configuration
by Peter Müller 24 Aug '18

24 Aug '18

In order to harden OpenSSH server in IPFire, using the upstream default configuration and edit it via sed commands in LFS file is error-prone and does not scale. Thereof we ship a custom and more secure OpenSSH server configuration which is copied into the image during build time. Fixes #11750 Fixes #11751 Partially fixes #11538 Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- config/ssh/sshd_config | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 68 insertions(+) create mode 100644 config/ssh/sshd_config diff --git a/config/ssh/sshd_config b/config/ssh/sshd_config new file mode 100644 index 000000000..7acf48109 --- /dev/null +++ b/config/ssh/sshd_config @@ -0,0 +1,68 @@ +# ultra-secure OpenSSH server configuration + +# only allow version 2 of SSH protocol +Protocol 2 + +# listen on these interfaces and protocols +AddressFamily any +ListenAddress 0.0.0.0 +ListenAddress :: + +# limit authentication thresholds +LoginGraceTime 20s +MaxAuthTries 3 +MaxSessions 5 + +# limit maximum instanctes +MaxStartups 5 + +# ensure proper logging +SyslogFacility AUTH +LogLevel INFO + +# always turn on strict mode +StrictModes yes + +# only allow safe crypto algorithms (may break some _very_ outdated clients) +# see also: https://stribika.github.io/2015/01/04/secure-secure-shell.html +KexAlgorithms curve25519-sha256(a)libssh.org,diffie-hellman-group-exchange-sha256 +Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr +MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com + +# enable data compression after successful login +Compression yes + +# only allow cryptographically safe SSH host keys (adjust paths if needed) +HostKey /etc/ssh/ssh_host_ed25519_key +HostKey /etc/ssh/ssh_host_ecdsa_key +HostKey /etc/ssh/ssh_host_rsa_key + +# only allow login via public key +PubkeyAuthentication yes +PasswordAuthentication no +ChallengeResponseAuthentication no +PermitEmptyPasswords no +AuthenticationMethods publickey + +# ignore user ~/.rhost* files +IgnoreRhosts yes + +# ignore user known hosts file +IgnoreUserKnownHosts yes + +# ignore user environments +PermitUserEnvironment no + +# do not allow any kind of forwarding (provides only low security) +# some of them might need to be re-enabled if SSH server is a jump platform +X11Forwarding no +AllowTcpForwarding no +AllowAgentForwarding no +PermitTunnel no +GatewayPorts no +PermitOpen none + +# close broken session (clients went offline, ...) automagically +TCPKeepAlive yes + +# EOF -- 2.16.4

2 5

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development August 2018