Development April 2019

development@lists.ipfire.org

12 participants
46 discussions

[PATCH 00/12] statusmail: Status and Log Summary Emails
by Tim FitzGeorge 08 Apr '19

08 Apr '19

Sends user-definable email messages on a user-definable schedule. The messages are PGP signed and optionally PGP encrypted. To setup: 1 - Make sure mail service is configured and working 2 - Generate signing key and export 3 - Import signing key into email client's key manager 4 - (If necessary) generate key pair in email client 5 - Export public key from email client's key manager 6 - Import public key into Status Email WUI 7 - Check entered into contacts and tick box to enable 8 - Define schedule and tick box to enable. It is possible to define a contact without a corresponding key, in which case the email will be signed but not encrypted. Multiple contacts can be selected for each schedule. Only one of day of week and day of month need be set. Many items have a parameter that allows the amount of data to be restricted. If there's no data for an item it's omitted from the email; if there are no items the email is not sent. For example, setting an hourly schedule with just ssh Errors and Logins enabled will only send an email if one of these events occurs in the last hour. *** BLURB HERE *** Tim FitzGeorge (12): statusmail: Main script statusmail: Perl module for encrypted Encrypted Mail statusmail: WUI statusmail: Supporting files statusmail: Language files statusmail: Infrastructure files statusmail: Plugins for services statusmail: Plugins for system statusmail: Other plugins statusmail: Graph infrastructure changes statusmail: Plugin for apcupsd statusmail: Plugin for clamav config/backup/include | 3 + config/cfgroot/graphs.pl | 274 +++- config/menu/10-system.menu | 5 + config/rootfiles/common/misc-progs | 1 + config/rootfiles/common/statusmail | 22 + config/rootfiles/common/web-user-interface | 2 + config/rootfiles/packages/apcupsd | 1 + config/rootfiles/packages/clamav | 1 + html/cgi-bin/entropy.cgi | 2 +- html/cgi-bin/statusmail.cgi | 1687 ++++++++++++++++++++ html/html/images/play.png | Bin 0 -> 182 bytes langs/de/cgi-bin/de.pl | 1 + langs/en/cgi-bin/en.pl | 94 ++ langs/es/cgi-bin/es.pl | 1 + langs/fr/cgi-bin/fr.pl | 92 ++ langs/it/cgi-bin/it.pl | 1 + langs/nl/cgi-bin/nl.pl | 1 + langs/pl/cgi-bin/pl.pl | 1 + langs/tr/cgi-bin/tr.pl | 1 + lfs/apcupsd | 2 +- lfs/clamav | 2 +- lfs/statusmail | 71 + make.sh | 2 + src/misc-progs/Makefile | 2 +- src/misc-progs/statusmailctrl.c | 36 + src/statusmail/EncryptedMail.pm | 1060 ++++++++++++ src/statusmail/StatusMail.pm | 530 ++++++ src/statusmail/generate_signature.sh | 51 + src/statusmail/plugins/graphs.pm | 697 ++++++++ src/statusmail/plugins/hardware_media_space.pm | 154 ++ src/statusmail/plugins/network_firewall.pm | 357 +++++ src/statusmail/plugins/services_clamav.pm | 170 ++ .../services_intrusion_prevention_system.pm | 239 +++ src/statusmail/plugins/services_ups_apc.pm | 115 ++ src/statusmail/plugins/services_urlfilter.pm | 275 ++++ src/statusmail/plugins/system_kernel.pm | 322 ++++ src/statusmail/plugins/system_pakfire.pm | 198 +++ src/statusmail/plugins/system_ssh.pm | 186 +++ src/statusmail/plugins/system_status_ps.pm | 132 ++ src/statusmail/plugins/system_status_services.pm | 390 +++++ src/statusmail/statusmail.pl | 422 +++++ src/statusmail/statusmail.sh | 3 + src/statusmail/stylesheet.css | 30 + src/statusmail/test_plugin.pl | 541 +++++++ 44 files changed, 8099 insertions(+), 78 deletions(-) create mode 100644 config/rootfiles/common/statusmail create mode 100755 html/cgi-bin/statusmail.cgi create mode 100644 html/html/images/play.png create mode 100644 lfs/statusmail create mode 100644 src/misc-progs/statusmailctrl.c create mode 100644 src/statusmail/EncryptedMail.pm create mode 100644 src/statusmail/StatusMail.pm create mode 100755 src/statusmail/generate_signature.sh create mode 100644 src/statusmail/plugins/graphs.pm create mode 100644 src/statusmail/plugins/hardware_media_space.pm create mode 100644 src/statusmail/plugins/network_firewall.pm create mode 100644 src/statusmail/plugins/services_clamav.pm create mode 100644 src/statusmail/plugins/services_intrusion_prevention_system.pm create mode 100644 src/statusmail/plugins/services_ups_apc.pm create mode 100644 src/statusmail/plugins/services_urlfilter.pm create mode 100644 src/statusmail/plugins/system_kernel.pm create mode 100644 src/statusmail/plugins/system_pakfire.pm create mode 100644 src/statusmail/plugins/system_ssh.pm create mode 100644 src/statusmail/plugins/system_status_ps.pm create mode 100644 src/statusmail/plugins/system_status_services.pm create mode 100755 src/statusmail/statusmail.pl create mode 100755 src/statusmail/statusmail.sh create mode 100755 src/statusmail/stylesheet.css create mode 100755 src/statusmail/test_plugin.pl -- 2.16.4

2 14

[PATCH] convert-snort: Re-order steps at end of script
by Stefan Schantl 08 Apr '19

08 Apr '19

This will ensure that the whole IDS is configured property, if no or an empty snort config file is present. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- config/suricata/convert-snort | 36 +++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/config/suricata/convert-snort b/config/suricata/convert-snort index 19aa38fbc..0ad2942b1 100644 --- a/config/suricata/convert-snort +++ b/config/suricata/convert-snort @@ -253,7 +253,24 @@ if (-f $IDS::rulestarball) { } # -## Step 8: Grab used ruleset files from snort config file and convert +## Step 8: Generate file for the HOME Net. +# + +# Call subfunction to generate the file. +&IDS::generate_home_net_file(); + +# +## Step 9: Setup automatic ruleset updates. +# + +# Check if a ruleset is configured. +if($rulessettings{"RULES"}) { + # Call suricatactrl and setup the periodic update mechanism. + &IDS::call_suricatactrl("cron", $rulessettings{'AUTOUPDATE_INTERVAL'}); +} + +# +## Step 10: Grab used ruleset files from snort config file and convert ## them into the new format. # @@ -298,23 +315,6 @@ close(SNORTCONF); # Pass the array of enabled rule files to the subfunction and write the file. &IDS::write_used_rulefiles_file(@enabled_rule_files); -# -## Step 9: Generate file for the HOME Net. -# - -# Call subfunction to generate the file. -&IDS::generate_home_net_file(); - -# -## Step 10: Setup automatic ruleset updates. -# - -# Check if a ruleset is configured. -if($rulessettings{"RULES"}) { - # Call suricatactrl and setup the periodic update mechanism. - &IDS::call_suricatactrl("cron", $rulessettings{'AUTOUPDATE_INTERVAL'}); -} - # ## Step 11: Start the IDS if enabled. # -- 2.20.1

1 0

[PATCH] convert-snort: Fix logic for detecting enough free disk space.
by Stefan Schantl 08 Apr '19

08 Apr '19

The subfunction only will return something if the check fails - so the logic of the if statement was wrong set and the downloader only was called if this check failed and to less diskspace would be available. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- config/suricata/convert-snort | 3 +++ 1 file changed, 3 insertions(+) diff --git a/config/suricata/convert-snort b/config/suricata/convert-snort index ca650b149..19aa38fbc 100644 --- a/config/suricata/convert-snort +++ b/config/suricata/convert-snort @@ -231,6 +231,9 @@ if (-f $snort_rules_tarball) { } else { # Check if enought disk space is available. if(&IDS::checkdiskspace()) { + # Print error message. + print "Could not download ruleset - Not enough free diskspace available.\n"; + } else { # Call the download function and grab the new ruleset. &IDS::downloadruleset(); } -- 2.20.1

1 0

[PATCH 2/3] allow SSH agent forwarding to be configured via WebUI
by Peter Müller 08 Apr '19

08 Apr '19

Fixes #11931 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> Cc: Michael Tremer <michael.tremer(a)ipfire.org> --- html/cgi-bin/remote.cgi | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/html/cgi-bin/remote.cgi b/html/cgi-bin/remote.cgi index 1b3dfed70..10d94fe99 100644 --- a/html/cgi-bin/remote.cgi +++ b/html/cgi-bin/remote.cgi @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2014 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -105,6 +105,7 @@ else { # used $remotesettings{'ENABLE_SSH_PASSWORDS'} = 'on' unless exists $remotesettings{'ENABLE_SSH_PASSWORDS'}; $remotesettings{'ENABLE_SSH_KEYS'} = 'on' unless exists $remotesettings{'ENABLE_SSH_KEYS'}; + $remotesettings{'SSH_AGENT_FORWARDING'} = 'off' unless exists $remotesettings{'SSH_AGENT_FORWARDING'}; $checked{'ENABLE_SSH'}{'off'} = ''; $checked{'ENABLE_SSH'}{'on'} = ''; @@ -121,6 +122,9 @@ $checked{'ENABLE_SSH_KEYS'}{$remotesettings{'ENABLE_SSH_KEYS'}} = "checked='chec $checked{'SSH_PORT'}{'off'} = ''; $checked{'SSH_PORT'}{'on'} = ''; $checked{'SSH_PORT'}{$remotesettings{'SSH_PORT'}} = "checked='checked'"; +$checked{'SSH_AGENT_FORWARDING'}{'off'} = ''; +$checked{'SSH_AGENT_FORWARDING'}{'on'} = ''; +$checked{'SSH_AGENT_FORWARDING'}{$remotesettings{'SSH_AGENT_FORWARDING'}} = "checked='checked'"; &Header::openpage($Lang::tr{'remote access'}, 1, ''); @@ -161,6 +165,11 @@ print <<END <td><input type='checkbox' name='SSH_PORT' $checked{'SSH_PORT'}{'on'} /></td> <td width='100%' class='base'>$Lang::tr{'ssh port'}</td> </tr> +<tr> + <td> </td> + <td><input type='checkbox' name='SSH_AGENT_FORWARDING' $checked{'SSH_AGENT_FORWARDING'}{'on'} /></td> + <td width='100%' class='base'>$Lang::tr{'ssh agent forwarding'}</td> +</tr> <tr> <td align='right' colspan='3'> <input type='submit' name='ACTION' value='$Lang::tr{'ssh tempstart15'}' /> -- 2.16.4

1 0

[PATCH 3/3] change AllowAgentForwarding in SSHD configuration if, necessary
by Peter Müller 08 Apr '19

08 Apr '19

Fixes #11931 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> Cc: Michael Tremer <michael.tremer(a)ipfire.org> --- src/misc-progs/sshctrl.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/misc-progs/sshctrl.c b/src/misc-progs/sshctrl.c index 30074973d..476dbc9d5 100644 --- a/src/misc-progs/sshctrl.c +++ b/src/misc-progs/sshctrl.c @@ -76,6 +76,11 @@ int main(int argc, char *argv[]) else strlcat(command, "s/^Port .*$/Port 222/", STRING_SIZE - 1 ); + if(findkey(kv, "SSH_AGENT_FORWARDING", buffer) && !strcmp(buffer,"on")) + strlcat(command, "s/^AllowAgentForwarding .*$/AllowAgentForwarding yes/;", STRING_SIZE - 1 ); + else + strlcat(command, "s/^AllowAgentForwarding .*$/AllowAgentForwarding no/;", STRING_SIZE - 1 ); + freekeyvalues(kv); snprintf(buffer, STRING_SIZE - 1, "' /etc/ssh/sshd_config >&%d", config_fd ); -- 2.16.4

1 0

[PATCH] wget: Update to 1.20.3
by Matthias Fischer 06 Apr '19

06 Apr '19

For details see: https://fossies.org/linux/wget/ChangeLog Excerpt from "NEWS": "2019-04-05 Tim Ruehsen <tim.ruehsen(a)gmx.de> Fix a buffer overflow vulnerability * src/iri.c(do_conversion): Reallocate the output buffer to a larger size if it is already full" Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/wget | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/wget b/lfs/wget index ac2fa826c..00ca75033 100644 --- a/lfs/wget +++ b/lfs/wget @@ -24,7 +24,7 @@ include Config -VER = 1.20.2 +VER = 1.20.3 THISAPP = wget-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 2692f6678e93601441306b5c1fc6a77a +$(DL_FILE)_MD5 = db4e6dc7977cbddcd543b240079a4899 install : $(TARGET) -- 2.18.0

2 1

[PATCH] Postfix: update to 3.4.5
by Peter Müller 06 Apr '19

06 Apr '19

See http://www.postfix.org/announcements/postfix-3.4.5.html for release notes. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- lfs/postfix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/postfix b/lfs/postfix index c34162d41..41ac90879 100644 --- a/lfs/postfix +++ b/lfs/postfix @@ -24,7 +24,7 @@ include Config -VER = 3.4.3 +VER = 3.4.5 THISAPP = postfix-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = postfix -PAK_VER = 19 +PAK_VER = 20 DEPS = "" @@ -66,7 +66,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 7f539d5497f4cb0c3f5b66227aaeb561 +$(DL_FILE)_MD5 = 093109941095390562166de766d4720d install : $(TARGET) -- 2.16.4

2 1

[PATCH] apache: Update to 2.4.39
by Matthias Fischer 04 Apr '19

04 Apr '19

For details see: http://mirror.checkdomain.de/apache//httpd/CHANGES_2.4.39 Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/apache2 | 1 + lfs/apache2 | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/apache2 b/config/rootfiles/common/apache2 index ee09c6cbe..4866fb6bd 100644 --- a/config/rootfiles/common/apache2 +++ b/config/rootfiles/common/apache2 @@ -1646,6 +1646,7 @@ usr/lib/apache/mod_slotmem_plain.so usr/lib/apache/mod_slotmem_shm.so usr/lib/apache/mod_socache_dbm.so usr/lib/apache/mod_socache_memcache.so +usr/lib/apache/mod_socache_redis.so usr/lib/apache/mod_socache_shmcb.so usr/lib/apache/mod_speling.so usr/lib/apache/mod_ssl.so diff --git a/lfs/apache2 b/lfs/apache2 index be5ffd9ec..87f639efe 100644 --- a/lfs/apache2 +++ b/lfs/apache2 @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -25,7 +25,7 @@ include Config -VER = 2.4.38 +VER = 2.4.39 THISAPP = httpd-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -45,7 +45,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 4a2b87ca55e42017d21f18724c560084 +$(DL_FILE)_MD5 = 930e217ba2d71e708a3f1521ecae7ec0 install : $(TARGET) -- 2.18.0

3 3

[PATCH] wget: Update to 1.20.2
by Matthias Fischer 04 Apr '19

04 Apr '19

For details see: https://fossies.org/linux/wget/ChangeLog Excerpt from "NEWS": * Changes in Wget 1.20.2 ** NTLM authentication will retry under certain cases ** Fixed a buffer overflow vulnerability" Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/wget | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/wget b/lfs/wget index b8c83d10d..ac2fa826c 100644 --- a/lfs/wget +++ b/lfs/wget @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 1.20.1 +VER = 1.20.2 THISAPP = wget-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = f6ebe9c7b375fc9832fb1b2028271fb7 +$(DL_FILE)_MD5 = 2692f6678e93601441306b5c1fc6a77a install : $(TARGET) -- 2.18.0

2 1

[PATCH] nettle: Update to 3.4.1
by Matthias Fischer 04 Apr '19

04 Apr '19

For details see: https://fossies.org/linux/nettle/ChangeLog Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/nettle | 8 ++++++-- lfs/nettle | 6 +++--- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/config/rootfiles/common/nettle b/config/rootfiles/common/nettle index 3f23cb70a..d3621683c 100644 --- a/config/rootfiles/common/nettle +++ b/config/rootfiles/common/nettle @@ -17,6 +17,7 @@ #usr/include/nettle/cast128.h #usr/include/nettle/cbc.h #usr/include/nettle/ccm.h +#usr/include/nettle/cfb.h #usr/include/nettle/chacha-poly1305.h #usr/include/nettle/chacha.h #usr/include/nettle/ctr.h @@ -32,6 +33,7 @@ #usr/include/nettle/eddsa.h #usr/include/nettle/gcm.h #usr/include/nettle/gosthash94.h +#usr/include/nettle/hkdf.h #usr/include/nettle/hmac.h #usr/include/nettle/knuth-lfib.h #usr/include/nettle/macros.h @@ -48,6 +50,8 @@ #usr/include/nettle/pgp.h #usr/include/nettle/pkcs1.h #usr/include/nettle/poly1305.h +#usr/include/nettle/pss-mgf1.h +#usr/include/nettle/pss.h #usr/include/nettle/realloc.h #usr/include/nettle/ripemd160.h #usr/include/nettle/rsa.h @@ -64,9 +68,9 @@ #usr/include/nettle/yarrow.h usr/lib/libhogweed.so usr/lib/libhogweed.so.4 -usr/lib/libhogweed.so.4.3 +usr/lib/libhogweed.so.4.5 #usr/lib/libnettle.so usr/lib/libnettle.so.6 -usr/lib/libnettle.so.6.3 +usr/lib/libnettle.so.6.5 #usr/lib/pkgconfig/hogweed.pc #usr/lib/pkgconfig/nettle.pc diff --git a/lfs/nettle b/lfs/nettle index 2d3f4864e..36f247d34 100644 --- a/lfs/nettle +++ b/lfs/nettle @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 3.3 +VER = 3.4.1 THISAPP = nettle-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 10f969f78a463704ae73529978148dbe +$(DL_FILE)_MD5 = 9bdebb0e2f638d3b9d91f7fc264b70c1 install : $(TARGET) -- 2.18.0

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development April 2019