Development May 2018

development@lists.ipfire.org

10 participants
46 discussions

[PATCH] BUG11695: Adding/editing rules with preset broken
by Alexander Marx 15 Jul '21

15 Jul '21

added another check to fill same ports in source and destination when a custom service is selected. Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> Reported-by: erik(a)vanlinsteeict.nl --- html/cgi-bin/firewall.cgi | 1 + 1 file changed, 1 insertion(+) diff --git a/html/cgi-bin/firewall.cgi b/html/cgi-bin/firewall.cgi index 499f279..d17afab 100644 --- a/html/cgi-bin/firewall.cgi +++ b/html/cgi-bin/firewall.cgi @@ -757,6 +757,7 @@ sub checkrule } } if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'dnatport'} eq ''){$fwdfwsettings{'dnatport'}=$custsrvport;} + if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'grp3'} eq 'cust_srv'){$fwdfwsettings{'dnatport'}=$custsrvport;} } #check if DNAT port is multiple if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'dnatport'} ne ''){ -- 2.7.4

3 2

[Fwd: Re: request for info: unbound via https / tls]
by Paul Simmons 13 Dec '18

13 Dec '18

Forgot the list cc :-(.

4 27

Re: ARM 64?
by Mathew McBride 20 Aug '18

20 Aug '18

Hi Michael, >From the software side, the support in the kernel is fairly good, mainline 4.15 and later works. We (Traverse) only maintain a patchset for some small drivers (such as hwmon sensors not yet in the kernel - not required to boot) and other minor fixes not yet applied upstream. If you build an image that uses UEFI boot it will work on both our hardware (bare metal), as a VM and on the ARM64 server platforms (Ampere/XGene, Centriq, ThunderX), or even our competitors (MacchiatoBin etc.) The big difference is that we use u-boot and it's EFI implementation - and that is improving at a rate that we don't feel it necessary to port TianoCore to our board. The board Guy linked (LS1043-S) is our OEM/volume product, and he can brief you on the pricing off-list. We also have a 'hacker' oriented product in the pipeline (Five64 - https://traverse.com.au/products/five64-arm64-platform/ ) - which is currently in the PCB layout phase. This one has a wider feature set (NVMe SSD, ATX PSU on/off, ability to 'debrick' the flash and control via a separate BMC board). This is one we intend to be available to everyone (through CrowdSupply - via the campaign and beyond), which addresses the channel 'accessibility' issue (in terms of individuals and small operators being able to buy them). It's pricing will be similar to the other boards (Omnia, Novena, Atom C2000/C3000). Regards, Matt -------- Forwarded Message -------- Subject: Re: ARM 64? Date: Wed, 23 May 2018 10:58:00 +0100 From: Michael Tremer mailto:michael.tremer@ipfire.org To: mailto:guy@traverse.com.au, mailto:development@lists.ipfire.org Hello Guy, thank you very much for getting in touch. Yes, we are working on an ARM 64 port, but so far we have not seen any hardware that was worth doing the port for. All those small and cheap single-board computers lack power, the bigger systems are basically unavailable and way too expensive. This board is way different though. CPU, Memory and especially the NICs are something that are way better sized and make a nice small appliance for bigger SOHOs or small to medium-sized offices. Not entirely sure why there is only one 10G port. Usually where 10G goes in, it has to go out somewhere else again... The big question is what software support is like in the Linux kernel for this. I have seen the patches linked on the product page and can only defer to Arne to have a look at it. My question would now be: What is the desired RRP for this or wholesale? I am just curious to find out if it is competitive or if people would find it too expensive and buy Intel again. Then we shouldn't really bother with putting the time into a port. If you are not comfortable sharing prices on the list, please feel free to email me in private about this. About the sponsorship. Thank you very much for considering us. I would be happy to have a closer look. Would you be able to ship this into the UK or Germany? Best, -Michael On Wed, 2018-05-23 at 12:46 +1000, Guy Ellis wrote: > Dear list, > > Just wondering if there is any interest in supporting ARM 64 hardware > moving forward? > > We can assist with donated hardware and support if there is interest. > https://traverse.com.au/products/ls1043s-router-board/ > > Regards, > - Guy. > >

3 15

Question regarding package updates, applying patches, and building
by Peter Müller 17 Jun '18

17 Jun '18

Hello, while trying to update entire packages in IPFire (some of them are outdated) and to fix some bugs, I ran into a couple of questions: (a) How to update entire packages? As far as I understood, to every package belongs a file in lfs/[package_name], containing information about how to build, apply patches to it, and so on. It seems like packages are downloaded from https://source.ipfire.org/ , but it did not became clear to me how to upload a new version of a package to this server. Of course, the download URL can be changed manually, but that seems rather ugly to me. Unfortunately, I was unable to find a sort of tutorial in the wiki for this issue. (b) How to apply patches to downloaded packages with changed filenames? As discussed in December (https://wiki.ipfire.org/devel/telco/2017-12-04), I am supposed to have a look at the DEFAULT cipher suite in OpenSSL. To change this value, the .tar.gz file needs to be downloaded and unpacked first. After that, the file "ssl/ssl.h" needs to be changed. The patch at src/patches/openssl-1.0.2h-weak-ciphers.patch does something similar: diff -Naur openssl-1.0.2h.org/ssl/ssl.h openssl-1.0.2h/ssl/ssl.h --- openssl-1.0.2h.org/ssl/ssl.h 2016-05-03 15:44:42.000000000 +0200 +++ openssl-1.0.2h/ssl/ssl.h 2016-05-03 18:49:10.393302264 +0200 @@ -338,7 +338,7 @@ * The following cipher list is used by default. It also is substituted when * an application-defined cipher list string starts with 'DEFAULT'. */ -# define SSL_DEFAULT_CIPHER_LIST "ALL:!EXPORT:!LOW:!aNULL:!eNULL:!SSLv2" +# define SSL_DEFAULT_CIPHER_LIST "ALL:!EXPORT:!LOW:!aNULL:!eNULL:!SSLv2:!RC2:!DES" /* * As of OpenSSL 1.0.0, ssl_create_cipher_list() in ssl/ssl_ciph.c always * starts with a reasonable order, and all we have to do for DEFAULT is But where does the file openssl-[...].org came from? (c) How to build the distribution partly? In the past, I handed in some patches to allow remote syslogging via TCP, too. After some struggles (settings are written by a C program, not the CGI file itself), I modified syslogdctrl.c, and the changes were shipped. (See https://bugzilla.ipfire.org/show_bug.cgi?id=11540 for details.) But since this program now crashes with a segfault on my machine (*sigh*), it seems like my patch contained some errors. However, building the entire distribution is somewhat time-consuming and not worth the effort for a probably small error. Is there any way of just building this C program, and omit the rest? Thanks in advance! Best regards, Peter Müller

2 3

[PATCH] tar: Update to 1.30 (V2)
by Matthias Fischer 07 Jun '18

07 Jun '18

For details see: https://www.gnu.org/software/tar/ Second attempt to update 'tar' to 1.30. Since new 'tar' has changes in commandline option parsing, the first commit broke cdrom build and probably some others. Sorry for the noise... Thanks to Marcel for tips and diffs and Arne for reverting. Here, these patches built without any errors, I hope it's all right now. Could somebody please have a look at this? Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/Config | 8 +++----- lfs/cdrom | 5 ++--- lfs/core-updates | 7 +++---- lfs/tar | 6 +++--- make.sh | 4 ++-- 5 files changed, 13 insertions(+), 17 deletions(-) diff --git a/lfs/Config b/lfs/Config index cf70f81f9..8e8e5879b 100644 --- a/lfs/Config +++ b/lfs/Config @@ -205,13 +205,11 @@ define PAK sed -e 's/BUILDTARGET/$(BUILDTARGET)/g' -e 's/KVER/$(KVER)/g' -e 's/MACHINE/$(BUILD_ARCH)/g' -i /install/packages/package/ROOTFILES sed -e 's/xxxKVERxxx/$(KVER)/g' -i /install/packages/package/install.sh chmod 755 /install/packages/package/{{,un}install,update}.sh - cd / && tar cf /install/packages/package/files.tmp --files-from=/install/packages/package/ROOTFILES --exclude='#*' \ - -p --numeric-owner + cd / && tar cfp /install/packages/package/files.tmp --numeric-owner --exclude='#*' --files-from=/install/packages/package/ROOTFILES # Double tar to remove double files - tar xf /install/packages/package/files.tmp -C /install/packages/package/tmp/ \ - -p --numeric-owner + tar xfp /install/packages/package/files.tmp --numeric-owner -C /install/packages/package/tmp/ rm -f /install/packages/package/files.tmp - cd /install/packages/package/tmp/ && tar cf - -p --numeric-owner * | xz $(XZ_OPT) > /install/packages/package/files.tar.xz + cd /install/packages/package/tmp/ && tar cJp --numeric-owner * | xz $(XZ_OPT) > /install/packages/package/files.tar.xz rm -r /install/packages/package/tmp -cat /install/packages/package/ROOTFILES | grep -v "#" > /install/packages/package/ROOTFILES.tmp mv /install/packages/package/ROOTFILES.tmp /install/packages/package/ROOTFILES diff --git a/lfs/cdrom b/lfs/cdrom index 00f185d81..6382034b5 100644 --- a/lfs/cdrom +++ b/lfs/cdrom @@ -65,9 +65,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) # Compress root filesystem # Reason for this tar+untar+tar is removing of entries listed two or more in src/ROOTFILES - tar -c -C / --files-from=/tmp/ROOTFILES \ - -f /$(SNAME).tar --exclude='#*' --exclude='dev/pts/*' \ - --exclude='proc/*' --exclude='tmp/ROOTFILES' + tar -c --exclude='#*' --exclude='proc/*' --exclude='dev/pts/*' --exclude='tmp/ROOTFILES' \ + -C / --files-from=/tmp/ROOTFILES -f /$(SNAME).tar rm -f /tmp/ROOTFILES tar -x -C /tmp -f /$(SNAME).tar rm -f /$(SNAME).tar diff --git a/lfs/core-updates b/lfs/core-updates index d34926967..3d12d40b1 100644 --- a/lfs/core-updates +++ b/lfs/core-updates @@ -72,10 +72,9 @@ core/%: sed -e "s/KVER/$(KVER)/g" -i /tmp/ROOTFILES #Remove doubled files with tar/untar/tar to save space - tar -c -C / --files-from=/tmp/ROOTFILES \ - -f /$(SNAME).tar --exclude='#*' --exclude='dev/pts/*' \ - --exclude='proc/*' --exclude='tmp/ROOTFILES' \ - --exclude-from=$(DIR_SRC)/config/rootfiles/$@/exclude + tar -c --exclude='proc/*' --exclude='tmp/ROOTFILES' --exclude='#*' --exclude='dev/pts/*' \ + --exclude-from=$(DIR_SRC)/config/rootfiles/$@/exclude \ + -C / --files-from=/tmp/ROOTFILES -f /$(SNAME).tar mv -f /tmp/ROOTFILES /install/packages/package/ROOTFILES tar -p --numeric-owner -x -C /tmp -f /$(SNAME).tar rm -f /$(SNAME).tar diff --git a/lfs/tar b/lfs/tar index 6a949a003..4e914b535 100644 --- a/lfs/tar +++ b/lfs/tar @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007 Michael Tremer & Christian Schmidt # +# Copyright (C) 2018 Michael Tremer & Christian Schmidt # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 1.28 +VER = 1.30 THISAPP = tar-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -50,7 +50,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 8f32b2bc1ed7ddf4cf4e4a39711341b0 +$(DL_FILE)_MD5 = 8404e4c1fc5a3000228ab2b8ad674a65 install : $(TARGET) diff --git a/make.sh b/make.sh index bfcfbc3e4..1050eb03b 100755 --- a/make.sh +++ b/make.sh @@ -1785,8 +1785,8 @@ toolchain) buildtoolchain echo "`date -u '+%b %e %T'`: Create toolchain image for ${BUILD_ARCH}" | tee -a $LOGFILE test -d $BASEDIR/cache/toolchains || mkdir -p $BASEDIR/cache/toolchains - cd $BASEDIR && tar -cf- --exclude='log/_build.*.log' build/${TOOLS_DIR} build/bin/sh log | xz ${XZ_OPT} \ - > cache/toolchains/$SNAME-$VERSION-toolchain-$TOOLCHAINVER-${BUILD_ARCH}.tar.xz + cd $BASEDIR && XZ_OPT="$(XZ_OPT)" tar -Jc --exclude='log/_build.*.log' -f cache/toolchains/$SNAME-$VERSION-toolchain-$TOOLCHAINVER-${BUILD_ARCH}.tar.xz --xz \ + build/${TOOLS_DIR} build/bin/sh log >> $LOGFILE md5sum cache/toolchains/$SNAME-$VERSION-toolchain-$TOOLCHAINVER-${BUILD_ARCH}.tar.xz \ > cache/toolchains/$SNAME-$VERSION-toolchain-$TOOLCHAINVER-${BUILD_ARCH}.md5 stdumount -- 2.17.0

2 6

unbound startup
by Tapani Tarvainen 02 Jun '18

02 Jun '18

Hi all, I'm only starting to use IPFire, so apologies if I'm missing some conventions here. I'm fairly experienced with Linux and firewalls in general, however. I found some operations in IPFire unexpectedly slow, in particular Edit Hosts: every operation, whether changing a host name or just disabling one, took about five minutes to complete. The machine in question is rather slow but not *that* slow (1GHz Via C3, 1GB RAM). What's more, during that time DNS is broken: ipfire responds to queries but gives wrong answers, specifically NXDOMAIN for hosts that do exist. And that was causing problems with my internal mail server. So I looked at the source. It turns out that every operation in Edit Hosts triggers unbound restart, and that's where the time goes: # time /etc/init.d/unbound restart [...] real 4m7.531s user 1m55.320s sys 0m7.760s Looking at the script, this is where it spends most of the time: update_hosts() { local enabled address hostname domainname while IFS="," read -r enabled address hostname domainname; do [ "${enabled}" = "on" ] || continue # Build FQDN local fqdn="${hostname}.${domainname}" unbound-control -q local_data "${fqdn} ${LOCAL_TTL} IN A ${address}" # Skip reverse resolution if the address equals the GREEN address [ "${address}" = "${GREEN_ADDRESS}" ] && continue # Add RDNS address=$(ip_address_revptr ${address}) unbound-control -q local_data "${address} ${LOCAL_TTL} IN PTR ${fqdn}" done < /var/ipfire/main/hosts } I have roughly 150 entries in hosts list, so that ends up calling unbound-control about 300 times. And there's a race condition between the time unbound is started and when those entries are added (at different times). I made the following simple change: update_hosts() { local enabled address hostname domainname while IFS="," read -r enabled address hostname domainname; do [ "${enabled}" = "on" ] || continue # Build FQDN local fqdn="${hostname}.${domainname}" echo "${fqdn} ${LOCAL_TTL} IN A ${address}" # Skip reverse resolution if the address equals the GREEN address [ "${address}" = "${GREEN_ADDRESS}" ] && continue # Add RDNS address=$(ip_address_revptr ${address}) echo "${address} ${LOCAL_TTL} IN PTR ${fqdn}" done < /var/ipfire/main/hosts | unbound-control -q local_datas } Result: # time /etc/init.d/unbound restart [...] real 0m15.568s user 0m4.827s sys 0m1.403s So it saves in my case four minutes at every hosts change, every dhcp change, every boot. Still not blazingly fast but already tolerably so. That is small and obvious enough change that perhaps it could be considered for next upgrade (121)? I can submit it as a patch if that helps. It's still not a good fix though: it doesn't remove the race condition window, only shortens it. Rather than using unbound-control to add local entries it'd be better to put them to a file and include that in unbound.conf (put the file or two in /etc/unbound/local.d/) so they'd all take effect immediately when unbound is started. This would be a bit bigger change but probably not much: if people think it'd be useful I could give it a go. Of course it's not actually necessary to restart unbound for every change in hosts or dhcp at all, they could be effected by making individual changes with unbound-control, but that would be a much bigger change (I haven't looked at that part of the code in detail enough to judge how big). But improving the startup time would be useful even if that's done at some point. -- Tapani Tarvainen

2 5

[PATCH 1/3] apply logging settings for OpenSSH correctly
by Peter Müller 31 May '18

31 May '18

The logging settings for OpenSSH (log to syslog with "AUTH" facility at "INFO" level) were not applied correctly. This patch fixes that for both installed systems and the LFS file. Partially addresses #11538. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- config/rootfiles/core/121/update.sh | 6 ++++++ lfs/openssh | 4 ++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/config/rootfiles/core/121/update.sh b/config/rootfiles/core/121/update.sh index 87d5f6ebd..5b8f2c86e 100644 --- a/config/rootfiles/core/121/update.sh +++ b/config/rootfiles/core/121/update.sh @@ -56,7 +56,13 @@ rm -rvf \ /usr/share/nagios/ \ /var/nagios/ +# Update SSH configuration +sed -i /etc/ssh/sshd_config \ + -e 's/^#SyslogFacility AUTH$/SyslogFacility AUTH/' \ + -e 's/^#LogLevel INFO$/LogLevel INFO/' + # Start services +/etc/init.d/sshd restart /etc/init.d/apache restart # This update needs a reboot... diff --git a/lfs/openssh b/lfs/openssh index 203446370..46561953d 100644 --- a/lfs/openssh +++ b/lfs/openssh @@ -91,8 +91,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) -e 's/^#\?IgnoreUserKnownHosts .*$$/IgnoreUserKnownHosts yes/' \ -e 's/^#\?UsePAM .*$$//' \ -e 's/^#\?X11Forwarding .*$$/X11Forwarding no/' \ - -e 's/^#\?SyslogFacility AUTH .*$$/SyslogFacility AUTH/' \ - -e 's/^#\?LogLevel INFO .*$$/LogLevel INFO/' \ + -e 's/^#SyslogFacility AUTH$/SyslogFacility AUTH/' \ + -e 's/^#LogLevel INFO$/LogLevel INFO/' \ -e 's/^#\?AllowTcpForwarding .*$$/AllowTcpForwarding no/' \ -e 's/^#\?PermitRootLogin .*$$/PermitRootLogin yes/' \ -e 's|^#\?HostKey /etc/ssh/ssh_host_dsa_key$$||' \ -- 2.13.6

2 3

[PATCH 2/3] enable "StrictModes" for OpenSSH
by Peter Müller 30 May '18

30 May '18

Always make sure permissions of .ssh/authorized_keys are checked. This prevents word-writeable keyfiles from being processed, reducing attack surface after misconfiguration. Partially addresses #11538 and depends on patch 1/3. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- config/rootfiles/core/121/update.sh | 3 ++- lfs/openssh | 1 + 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/config/rootfiles/core/121/update.sh b/config/rootfiles/core/121/update.sh index 5b8f2c86e..3ec251292 100644 --- a/config/rootfiles/core/121/update.sh +++ b/config/rootfiles/core/121/update.sh @@ -59,7 +59,8 @@ rm -rvf \ # Update SSH configuration sed -i /etc/ssh/sshd_config \ -e 's/^#SyslogFacility AUTH$/SyslogFacility AUTH/' \ - -e 's/^#LogLevel INFO$/LogLevel INFO/' + -e 's/^#LogLevel INFO$/LogLevel INFO/' \ + -e 's/^#StrictModes .*$/StrictModes yes/' # Start services /etc/init.d/sshd restart diff --git a/lfs/openssh b/lfs/openssh index 46561953d..7e8468ac9 100644 --- a/lfs/openssh +++ b/lfs/openssh @@ -95,6 +95,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) -e 's/^#LogLevel INFO$/LogLevel INFO/' \ -e 's/^#\?AllowTcpForwarding .*$$/AllowTcpForwarding no/' \ -e 's/^#\?PermitRootLogin .*$$/PermitRootLogin yes/' \ + -e 's/^#StrictModes .*$/StrictModes yes/' \ -e 's|^#\?HostKey /etc/ssh/ssh_host_dsa_key$$||' \ -e 's|^#\?HostKey /etc/ssh/ssh_host_ecdsa_key$$||' \ -e 's|^#\?HostKey /etc/ssh/ssh_host_ed25519_key$$||' \ -- 2.13.6

2 1

[PATCH] harden authentication and logging in OpenSSH server configuration
by Peter Müller 30 May '18

30 May '18

Update some values in the OpenSSH server configuration at /etc/ssh/sshd_config to secure values. Changes are also applied on existing installations via update.sh script. This partly solves #11538 and performs these changes: - never accept empty passwords for authentication - make sure OpenSSH always logs properly - make sure permissions of .ssh/authorized_keys are checked (StrictModes) - limit maximum concurring sessions to 5 - make sure custom rhosts files are always ignored - limit maximum authentication tries to 3 The logging options were not applied during build correctly, which is fixed now. Changes are not expected to break existing systems. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- config/rootfiles/core/121/update.sh | 12 ++++++++++++ lfs/openssh | 9 +++++++-- 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/config/rootfiles/core/121/update.sh b/config/rootfiles/core/121/update.sh index 87d5f6ebd..d3ceb84aa 100644 --- a/config/rootfiles/core/121/update.sh +++ b/config/rootfiles/core/121/update.sh @@ -32,6 +32,7 @@ for (( i=1; i<=$core; i++ )); do done # Stop services +/etc/init.d/sshd stop # Extract files extract_files @@ -56,8 +57,19 @@ rm -rvf \ /usr/share/nagios/ \ /var/nagios/ +# Update SSH configuration +sed -i /etc/ssh/sshd_config \ + -e 's/^#SyslogFacility AUTH$/SyslogFacility AUTH/' \ + -e 's/^#LogLevel INFO$/LogLevel INFO/' \ + -e 's/^#PermitEmptyPasswords no$/PermitEmptyPasswords no/' \ + -e 's/^#MaxAuthTries .*$/MaxAuthTries 3/' \ + -e 's/^#StrictModes .*$/StrictModes yes/' \ + -e 's/^#MaxSessions .*$/MaxSessions 5/' \ + -e 's/^#IgnoreRhosts .*$/IgnoreRhosts yes/' + # Start services /etc/init.d/apache restart +/etc/init.d/sshd start # This update needs a reboot... touch /var/run/need_reboot diff --git a/lfs/openssh b/lfs/openssh index 203446370..90279ac98 100644 --- a/lfs/openssh +++ b/lfs/openssh @@ -91,10 +91,15 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) -e 's/^#\?IgnoreUserKnownHosts .*$$/IgnoreUserKnownHosts yes/' \ -e 's/^#\?UsePAM .*$$//' \ -e 's/^#\?X11Forwarding .*$$/X11Forwarding no/' \ - -e 's/^#\?SyslogFacility AUTH .*$$/SyslogFacility AUTH/' \ - -e 's/^#\?LogLevel INFO .*$$/LogLevel INFO/' \ + -e 's/^#SyslogFacility AUTH$/SyslogFacility AUTH/' \ + -e 's/^#LogLevel INFO$/LogLevel INFO/' \ -e 's/^#\?AllowTcpForwarding .*$$/AllowTcpForwarding no/' \ -e 's/^#\?PermitRootLogin .*$$/PermitRootLogin yes/' \ + -e 's/^#PermitEmptyPasswords no$/PermitEmptyPasswords no/' \ + -e 's/^#MaxAuthTries .*$/MaxAuthTries 3/' \ + -e 's/^#StrictModes .*$/StrictModes yes/' \ + -e 's/^#MaxSessions .*$/MaxSessions 5/' \ + -e 's/^#IgnoreRhosts .*$/IgnoreRhosts yes/' \ -e 's|^#\?HostKey /etc/ssh/ssh_host_dsa_key$$||' \ -e 's|^#\?HostKey /etc/ssh/ssh_host_ecdsa_key$$||' \ -e 's|^#\?HostKey /etc/ssh/ssh_host_ed25519_key$$||' \ -- 2.13.6

2 3

Current 'next' won't build => 'cannot allocate memory'
by Matthias Fischer 29 May '18

29 May '18

Hi! Sorry, but last commit "make.sh: Use all processor cores for compression" causes the build to break. See https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=c8453e87599fe66f4d18d90… Build stops with: ***SNIP*** ... rm -f /tmp/ROOTFILES tar -x -C /tmp -f /ipfire.tar rm -f /ipfire.tar cd /tmp && tar cf - * | xz -T8 -8 --memory=5450MiB > /install/cdrom/distro.img && rm -rf * xz: (stdin): Cannot allocate memory make: *** [cdrom:66: /usr/src/log/cdrom] Error 1 ... ***SNAP*** On my machine, 'lsf/cdrom' doesn't like '-T8'. It needed '-T4'. I experienced this already during my tests. Can anyone confirm? Best, Matthias P.S.: Hardware is i7/2600 with HT, 8 GB RAM.

2 10

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development May 2018