Development August 2018

development@lists.ipfire.org

14 participants
56 discussions

[PATCH] bind: Update to 9.11.4-P1 Hi,
by Matthias Fischer 16 Aug '18

16 Aug '18

Fixes CVE-2018-5740 and CVE-2018-5738. For details see: http://ftp.isc.org/isc/bind9/9.11.4-P1/RELEASE-NOTES-bind-9.11.4-P1.html Best, Matthias P.S: Sorry, seen too late... Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/bind | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/bind b/lfs/bind index 7a14a245a..8b04037b7 100644 --- a/lfs/bind +++ b/lfs/bind @@ -25,7 +25,7 @@ include Config -VER = 9.11.4 +VER = 9.11.4-P1 THISAPP = bind-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 9b4834d78f30cdb796ce437262272a36 +$(DL_FILE)_MD5 = b2c54d6c2003b693388041fd109e8b6b install : $(TARGET) -- 2.18.0

2 1

[PATCH v3] pciutils: update to 3.5.6
by Peter Müller 16 Aug '18

16 Aug '18

The third version of this patch superseds the first and second one which were broken due to bugs in the MUAs GPG implementation. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- config/rootfiles/common/pciutils | 2 +- lfs/pciutils | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/config/rootfiles/common/pciutils b/config/rootfiles/common/pciutils index 5bb11a259..da35ef6a1 100644 --- a/config/rootfiles/common/pciutils +++ b/config/rootfiles/common/pciutils @@ -1,7 +1,7 @@ bin/lspci bin/setpci lib/libpci.so.3 -lib/libpci.so.3.4.1 +lib/libpci.so.3.5.6 sbin/update-pciids #usr/include/pci #usr/include/pci/config.h diff --git a/lfs/pciutils b/lfs/pciutils index 7c313ba3e..1ebfef0c8 100644 --- a/lfs/pciutils +++ b/lfs/pciutils @@ -24,10 +24,10 @@ include Config -VER = 3.4.1 +VER = 3.5.6 THISAPP = pciutils-$(VER) -DL_FILE = $(THISAPP).tar.xz +DL_FILE = $(THISAPP).tar.gz DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 35763bb1eab7bc9bf6eb6efb72cbc8a1 +$(DL_FILE)_MD5 = 63b347d2bb5719b7769c03a1bb72a5b7 install : $(TARGET) -- 2.16.4

2 1

[PATCH v3] download ET IDS rules via HTTPS
by Peter Müller 16 Aug '18

16 Aug '18

The Emerging Threats ruleset server supports HTTPS. It should be used for downloading the ruleset in IPFire, too. This also needs to be applied on the upcoming ids.cgi file for Suricata which I will do in a second patch. The third version of this patch superseds the first and second one which were broken due to bugs in the MUAs GPG implementation. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- html/cgi-bin/ids.cgi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/cgi-bin/ids.cgi b/html/cgi-bin/ids.cgi index 9863251e2..d9d697deb 100644 --- a/html/cgi-bin/ids.cgi +++ b/html/cgi-bin/ids.cgi @@ -265,7 +265,7 @@ if (!$errormessage) { } elsif ($snortsettings{'RULES'} eq 'community') { $url=" https://www.snort.org/rules/community"; } else { - $url="http://rules.emergingthreats.net/open/snort-2.9.0/emerging.rules.tar.gz"; + $url="https://rules.emergingthreats.net/open/snort-2.9.0/emerging.rules.tar.gz"; } if ($snortsettings{'ACTION'} eq $Lang::tr{'save'} && $snortsettings{'ACTION2'} eq "snort" ) { -- 2.16.4

2 1

[PATCH v3] Postfix: update to 3.3.1
by Peter Müller 16 Aug '18

16 Aug '18

This updates Postfix to recent 3.3.x series, which contains some new features. Release announcement available at http://www.postfix.org/announcements/postfix-3.3.1.html The third version of this patch superseds the first and second one which were broken due to bugs in the MUAs GPG implementation. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- lfs/postfix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/postfix b/lfs/postfix index 0fe4dfe08..07a869594 100644 --- a/lfs/postfix +++ b/lfs/postfix @@ -24,7 +24,7 @@ include Config -VER = 3.2.6 +VER = 3.3.1 THISAPP = postfix-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = postfix -PAK_VER = 15 +PAK_VER = 16 DEPS = "" @@ -66,7 +66,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = d10f1fb551be86f6e48c2908dd8a12ff +$(DL_FILE)_MD5 = 4381c6492f415e4a69cf5099d4acea76 install : $(TARGET) -- 2.16.4

2 1

Kernel Self Protection: Status quo in IPFire 2.x
by Peter Müller 16 Aug '18

16 Aug '18

Hello, attached is the current status of security relevant kernel configure flags and other settings. I post this to the mailing list to provide people with better knowledge the ability to comment on it. The whole issue is filed under #11659, please refer to https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommend… for a list of recommended (= paranoid) settings. (a) CONFIG flags that differ from recommended settings - CONFIG_DEBUG_WX is disabled on AARCH64 - CONFIG_CC_STACKPROTECTOR_STRONG is unset on i586 PAE in favour of CONFIG_CC_STACKPROTECTOR_REGULAR - CONFIG_DEVMEM is enabled on all architectures (!) - CONFIG_IO_STRICT_DEVMEM is disabled on all architectures (!) - CONFIG_DEBUG_CREDENTIALS is disabled on all architectures - CONFIG_DEBUG_NOTIFIERS is disabled on all architectures - CONFIG_DEBUG_SG is disabled on all architectures - CONFIG_BUG_ON_DATA_CORRUPTION is disabled on all architectures - CONFIG_SCHED_STACK_END_CHECK is disabled on all architectures - CONFIG_SECURITY_YAMA is disabled on AARCH64 and i586 PAE (!) - CONFIG_HARDENED_USERCOPY is disabled on AARCH64 and ARM - CONFIG_SLUB_DEBUG is disabled on AARCH64 and i586 PAE - CONFIG_PAGE_POISONING is disabled on all architectures except i586 PAE (!) - CONFIG_PAGE_POISONING_NO_SANITY is disabled on all architectures - CONFIG_PAGE_POISONING_ZERO is enabled on i586 PAE only (!) - CONFIG_FORTIFY_SOURCE is disabled on AARCH64 - CONFIG_ACPI_CUSTOM_METHOD is enabled on all except ARM and AARCH64 - CONFIG_INET_DIAG is enabled on all architecture - CONFIG_BINFMT_MISC is enabled on all architecture Some flags have been omitted for the first time going through this on 4.14.x . They will be included as soon as the differences above are fixed or cleared. (b) GCC plugins flags that differ from recommended settings - CONFIG_GCC_PLUGIN_RANDSTRUCT is disabled on all architectures (c) Kernel command line options that differ from recommended settings - slub_debug=P is missing - page_poison=1 is missing - slab_nomerge is missing - pti=on is missing (d) sysctls that differ from recommended settings - user.max_user_namespaces is 15345 (recommended: 0) - kernel.kexec_load_disabled is not found (recommended: 1) -> TBD, patch - kernel.yama.ptrace_scope is not found (recommended: 1) - net.core.bpf_jit_harden is 0 (recommended: 2) - kernel.unprivileged_bpf_disabled is not found (recommended: 1) Is there any reason why some of these points have to stay this way (compatibility issues, hardware bugs, ...)? If yes, drop me a line. Otherwise I will change them step by step, merging everything in IPFire 3.x if this is finished. Thanks, and best regards, Peter Müller -- Microsoft DNS service terminates abnormally when it recieves a response to a DNS query that was never made. Fix Information: Run your DNS service on a different platform. -- bugtraq

1 0

[PATCH] do not expose kernel address spaces even to privileged users
by Peter Müller 16 Aug '18

16 Aug '18

Change this setting from 1 to 2 so kernel addresses are not displayed even if a user has CAPS_SYSLOG privileges. See also: - https://lwn.net/Articles/420403/ - https://tails.boum.org/contribute/design/kernel_hardening/ Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- config/etc/sysctl.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf index 011c4287e..345f8f52a 100644 --- a/config/etc/sysctl.conf +++ b/config/etc/sysctl.conf @@ -44,7 +44,7 @@ net.bridge.bridge-nf-call-iptables = 0 net.bridge.bridge-nf-call-arptables = 0 # Try to keep kernel address exposures out of various /proc files (kallsyms, modules, etc). -kernel.kptr_restrict = 1 +kernel.kptr_restrict = 2 # Avoid kernel memory address exposures via dmesg. kernel.dmesg_restrict = 1 -- 2.16.4

1 0

[PATCH] download ET IDS rules via HTTPS
by Peter Müller 16 Aug '18

16 Aug '18

The Emerging Threats ruleset server supports HTTPS. It should be used for downloading the ruleset in IPFire, too. This also needs to be applied on the upcoming ids.cgi file for Suricata which I will do in a second patch. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- html/cgi-bin/ids.cgi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/cgi-bin/ids.cgi b/html/cgi-bin/ids.cgi index 9863251e2..d9d697deb 100644 --- a/html/cgi-bin/ids.cgi +++ b/html/cgi-bin/ids.cgi @@ -265,7 +265,7 @@ if (!$errormessage) { } elsif ($snortsettings{'RULES'} eq 'community') { $url=" https://www.snort.org/rules/community"; } else { - $url="http://rules.emergingthreats.net/open/snort-2.9.0/emerging.rules.tar.gz"; + $url="https://rules.emergingthreats.net/open/snort-2.9.0/emerging.rules.tar.gz"; } if ($snortsettings{'ACTION'} eq $Lang::tr{'save'} && $snortsettings{'ACTION2'} eq "snort" ) { -- 2.16.4

2 3

[Discussion] Consequences of CPU vulnerabilities
by Peter Müller 16 Aug '18

16 Aug '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello *, during the past months, more and more vulnerabilities in modern CPUs were detected. At the moment, there is - - Spectre v1 and v2 - - Meltdown (sometimes referred to as Spectre v3) - - Spectre v4 - - a bunch of vulnerabilities similar to v4 (summarised as Spectre-NG) - - Spectre v5 - - and a lot more, at least five of them undisclosed. Needless to say, this complex is a total nightmare for anybody caring about security - not only because of the technical issues, but mainly due to very sloppy responses from the hardware vendors (I cannot resist naming Intel here directly). Further, the current CVE and patch situation (especially when it comes to the Linux kernel) is completely confusing, making it nearly impossible to check which has been backported whereto, addressing which security bulletin. In my humble opinion, the significance of security has decreased a lot and is still dropping. Being discontent with the overall security situation in the Linux kernel, the handling of recent CPU vulnerabilities did not help. That being said, I would like to discuss some changes to improve security in IPFire, most of them at kernel or sysctl level. (a) Disable hyperthreading by default? OpenBSD did so a while ago, arguing this makes some side-channel attacks more complicated or even impossible. HT was the source of some serious vulnerabilities in the past (starting around 2006), which is one reason why I never liked it too much. Would you consider disabling it acceptable (it will probably cause some performance impact)? (b) Update kernel more frequently It seems to be necessary to ship new kernels more frequently, as some security fixes are backported to 4.14.x very quickly. Unfortunately, this causes updates to become very big, as C121/122 turned out, and I am not familiar with the procedure behind this. How often do we want to ship a new kernel? Every second update? Every forth? I have no idea... :-) (c) Introduce kernel and sysctl hardening Fortunately, there are some configure flags and /etc/sysctl.conf settings improving the overall situation: https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommend… Their implementation in IPFire is on my TODO list (forgive me for being slow during the last time) and filed here: https://bugzilla.ipfire.org/show_bug.cgi?id=11659 How small should the chunks be here? A patch for every changed setting or can portions be bigger (same applies on OpenSSH hardening as well)? Just asking to avoid unnecessary noise afterwards. Comments? Anything I forgot here? Thanks, and best regards, Peter Müller - -- Microsoft DNS service terminates abnormally when it recieves a response to a DNS query that was never made. Fix Information: Run your DNS service on a different platform. -- bugtraq -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEvP4SiGhEYDJyrRLk2UjyD317n2gFAlt0T2IACgkQ2UjyD317 n2h8XQ//bWEYXJPfVzocEd1yZTKaoCRc4VyVSugV0p8kHfd42CS8uA0Pp3mM3Bzy cWWxu3ru7oDc344BD54jtdPHLYP6WidEOF6Omgd8xYoFudHBc1zodBnKfeMkFLmZ 0YwblIA4arg5pVmUiqrCiRbyn2B+07e8fYO9DyGKESfJHw/RwPzW7jhJv3J4R7+Z wabLfxaF3rbgB264FZ0YcfA1XUswvlvE4eKxxaOEUfnis7dFcmKZHB+LiQsIMXDj AshlnCuWl5r1OczAwlyQw4xEykyCEVDCeeoGjOyXqx373+ThaODSGQovOIEFxPz/ TCERMUQNvAZQ0mi113Nw8MIZ5ofCJWZZhYldxsYNptVk425BMH+7moQDDQfaWmWc GW/10j+rJITRhaYDq3LRNu6qACPE2N/T/7vz5kl5vslbmQ0pBuIf9HpdVIFHr5t9 yBclnxBs3r8z7G74Jvv0c9oNX5kUZ3AXUttZDghJQVkw15AOa1oZfl8nLZtW3KL2 aaeW8o9h19SBhywmUNL/7VMssM8IHeKf2rkT+ybOUC52MtXHnGuSKSdrjtFhpnAe h3irxsJf0EFjZoxq2id3vtOzX8BWFxGFKOHXog33dNlNKDD/COqv4iAx8tb0eyiS 9F49HlB4NDK5oT4SF+6HIzBp4MYv8nmkX6j+9TVTKfmFQbmzc9w= =Y+k+ -----END PGP SIGNATURE-----

2 1

[PATCH] bind: Update to 9.11.4
by Matthias Fischer 16 Aug '18

16 Aug '18

For details see: http://ftp.isc.org/isc/bind9/9.11.4/RELEASE-NOTES-bind-9.11.4.html Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/bind | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/bind b/lfs/bind index 35f76443e..7a14a245a 100644 --- a/lfs/bind +++ b/lfs/bind @@ -25,7 +25,7 @@ include Config -VER = 9.11.3 +VER = 9.11.4 THISAPP = bind-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 4ed2a3f235595eadbd763b7ecb687ca0 +$(DL_FILE)_MD5 = 9b4834d78f30cdb796ce437262272a36 install : $(TARGET) -- 2.18.0

2 1

[PATCH v2] Postfix: update to 3.3.1
by Peter Müller 16 Aug '18

16 Aug '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 This updates Postfix to recent 3.3.x series, which contains some new features. Release announcement available at http://www.postfix.org/announcements/postfix-3.3.1.html The second version of this patch supersedes the first one, which contained crappy line wraps due to a bug in PGP/MIME implementation in MUA. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> - --- lfs/postfix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/postfix b/lfs/postfix index 0fe4dfe08..07a869594 100644 - --- a/lfs/postfix +++ b/lfs/postfix @@ -24,7 +24,7 @@ include Config - -VER = 3.2.6 +VER = 3.3.1 THISAPP = postfix-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = postfix - -PAK_VER = 15 +PAK_VER = 16 DEPS = "" @@ -66,7 +66,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) - -$(DL_FILE)_MD5 = d10f1fb551be86f6e48c2908dd8a12ff +$(DL_FILE)_MD5 = 4381c6492f415e4a69cf5099d4acea76 install : $(TARGET) - -- 2.16.4 -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEvP4SiGhEYDJyrRLk2UjyD317n2gFAlt0PowACgkQ2UjyD317 n2jj/xAAoIo5yO7e1zuBswibAWb2DQSFPWq+IhtoVftrlh0DBRwPAf1CGvYXa1UH AjsbkthqDsqX3QoflXpUwHZOsGVqnzb9sDXLgDV3kof7au+8vUS8MRc1DKWgumdS 1lIbzCLtqZ4obwHrWvnRVjBOf4iecCuIeS4p6FPqQnz4SUAuZPHGFF0Mdy4eUh+M nhFzNkbAAuFC5LGWtP6DZibyvpeMeSGpCNKAf3sO5q6jSDKXE2x6ckiVp8FYWncg hisJbi6Yn57MVHcxu6uD5/pfqvBRdFQu9gm8VM3/kZ8hHviQDoBRNYLVEqo65J27 nNMojWXJMx6LUNbMiVfqOoFGeeQmtHTMb8qjY3ikhl3xdhUezmOYZM+EtTvvy2FT mqwlcnOIdmsizzCNNk+RJMkJIk5KOobE0zyof5vBfb582OhKJcTE+TPF0i2NrlOr VcW04zfHnqAsYDNbnoZiuJ2iNlCWNnk/jbPwQlqEgBkDhq6jEuj272zlgDBWKVph utSM9Tt4uac2xz3FIS4xv9gtyjsOBfsaHCScZ2bE0czkPoTnVhldncBKo6xd9pv6 205XUuRLotHiFHfUYJG/W09H+iBhi1Wpw5w5S2N2Ju8RI5fbLx8ilBV/QBB0MYbn LGegfmwSbVnOydxPRxW7UysiZxiNkfDkUltHFt7B4oUEWfoPt/w= =+HDs -----END PGP SIGNATURE-----

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development August 2018