Development September 2018

development@lists.ipfire.org

10 participants
42 discussions

[PATCH] BUG11695: Adding/editing rules with preset broken
by Alexander Marx 15 Jul '21

15 Jul '21

added another check to fill same ports in source and destination when a custom service is selected. Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> Reported-by: erik(a)vanlinsteeict.nl --- html/cgi-bin/firewall.cgi | 1 + 1 file changed, 1 insertion(+) diff --git a/html/cgi-bin/firewall.cgi b/html/cgi-bin/firewall.cgi index 499f279..d17afab 100644 --- a/html/cgi-bin/firewall.cgi +++ b/html/cgi-bin/firewall.cgi @@ -757,6 +757,7 @@ sub checkrule } } if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'dnatport'} eq ''){$fwdfwsettings{'dnatport'}=$custsrvport;} + if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'grp3'} eq 'cust_srv'){$fwdfwsettings{'dnatport'}=$custsrvport;} } #check if DNAT port is multiple if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'dnatport'} ne ''){ -- 2.7.4

3 2

[Fwd: Re: request for info: unbound via https / tls]
by Paul Simmons 13 Dec '18

13 Dec '18

Forgot the list cc :-(.

4 27

[PATCH] Allow kernel to swap memory on high demand
by Tim FitzGeorge 04 Oct '18

04 Oct '18

Signed-off-by: Tim FitzGeorge <ipfr at tfitzgeorge.me.uk> Fixes: Bug 11839 --- config/etc/sysctl.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf index 345f8f52a..4066af767 100644 --- a/config/etc/sysctl.conf +++ b/config/etc/sysctl.conf @@ -27,7 +27,7 @@ net.ipv4.conf.all.accept_source_route = 0 net.ipv4.conf.all.log_martians = 1 kernel.printk = 1 4 1 7 -vm.swappiness=0 +vm.swappiness=1 vm.mmap_min_addr = 4096 vm.min_free_kbytes = 8192 -- 2.16.4

3 6

[PATCH] Cosmetics: New icons for backup.cgi
by Matthias Fischer 29 Sep '18

29 Sep '18

Hi, this was triggered by: https://forum.ipfire.org/viewtopic.php?f=17&t=21372 As suggested there, I added new icons for better readability. But I kept the icon order. Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- html/cgi-bin/backup.cgi | 24 ++++++++++++------------ html/html/images/download.png | Bin 0 -> 646 bytes html/html/images/restore.png | Bin 0 -> 459 bytes 3 files changed, 12 insertions(+), 12 deletions(-) create mode 100644 html/html/images/download.png create mode 100644 html/html/images/restore.png diff --git a/html/cgi-bin/backup.cgi b/html/cgi-bin/backup.cgi index cac4146ab..e015abce4 100644 --- a/html/cgi-bin/backup.cgi +++ b/html/cgi-bin/backup.cgi @@ -178,7 +178,7 @@ print <<END </tr> <tr><td align='center' colspan='2'> <input type='hidden' name='ACTION' value='backup' /> - <input type='image' alt='$Lang::tr{'backup'}' title='$Lang::tr{'backup'}' src='/images/document-save.png' /> + <input type='image' alt='$Lang::tr{'backup'}' title='$Lang::tr{'backup'}' src='/images/media-floppy.png' /> </td></tr> </table> </form> @@ -202,8 +202,8 @@ my $Datei = "/var/ipfire/backup/".$_; my @Info = stat($Datei); my $Size = $Info[7] / 1024 / 1024; $Size = sprintf("%0.2f", $Size); -print "<tr><td align='center'>$Lang::tr{'backup from'} $_ $Lang::tr{'size'} $Size MB</td><td width='5'><form method='post' action='$ENV{'SCRIPT_NAME'}'><input type='hidden' name='ACTION' value='download' /><input type='hidden' name='FILE' value='$_' /><input type='image' alt='$Lang::tr{'download'}' title='$Lang::tr{'download'}' src='/images/package-x-generic.png' /></form></td>"; -print "<td width='5'><form method='post' action='$ENV{'SCRIPT_NAME'}'><input type='hidden' name='ACTION' value='delete' /><input type='hidden' name='FILE' value='$_' /><input type='image' alt='$Lang::tr{'delete'}' title='$Lang::tr{'delete'}' src='/images/user-trash.png' /></form></td></tr>"; +print "<tr><td align='center'>$Lang::tr{'backup from'} $_ $Lang::tr{'size'} $Size MB</td><td width='5'><form method='post' action='$ENV{'SCRIPT_NAME'}'><input type='hidden' name='ACTION' value='download' /><input type='hidden' name='FILE' value='$_' /><input type='image' alt='$Lang::tr{'download'}' title='$Lang::tr{'download'}' src='/images/download.png' /></form></td>"; +print "<td width='5'><form method='post' action='$ENV{'SCRIPT_NAME'}'><input type='hidden' name='ACTION' value='delete' /><input type='hidden' name='FILE' value='$_' /><input type='image' alt='$Lang::tr{'delete'}' title='$Lang::tr{'delete'}' src='/images/delete.gif' /></form></td></tr>"; } foreach (@backupisos){ if ( $_ !~ /iso$/){next;} @@ -212,8 +212,8 @@ my $Datei = "/var/tmp/backupiso/".$_; my @Info = stat($Datei); my $Size = $Info[7] / 1024 / 1024; $Size = sprintf("%0.2f", $Size); -print "<tr><td align='center'>$Lang::tr{'backup from'} $_ $Lang::tr{'size'} $Size MB</td><td width='5'><form method='post' action='$ENV{'SCRIPT_NAME'}'><input type='hidden' name='ACTION' value='downloadiso' /><input type='hidden' name='FILE' value='$_' /><input type='image' alt='$Lang::tr{'download'}' title='$Lang::tr{'download'}' src='/images/package-x-generic.png' /></form></td>"; -print "<td width='5'><form method='post' action='$ENV{'SCRIPT_NAME'}'><input type='hidden' name='ACTION' value='delete' /><input type='hidden' name='FILE' value='$_' /><input type='image' alt='$Lang::tr{'delete'}' title='$Lang::tr{'delete'}' src='/images/user-trash.png' /></form></td></tr>"; +print "<tr><td align='center'>$Lang::tr{'backup from'} $_ $Lang::tr{'size'} $Size MB</td><td width='5'><form method='post' action='$ENV{'SCRIPT_NAME'}'><input type='hidden' name='ACTION' value='downloadiso' /><input type='hidden' name='FILE' value='$_' /><input type='image' alt='$Lang::tr{'download'}' title='$Lang::tr{'download'}' src='/images/download.png' /></form></td>"; +print "<td width='5'><form method='post' action='$ENV{'SCRIPT_NAME'}'><input type='hidden' name='ACTION' value='delete' /><input type='hidden' name='FILE' value='$_' /><input type='image' alt='$Lang::tr{'delete'}' title='$Lang::tr{'delete'}' src='/images/delete.gif' /></form></td></tr>"; } print <<END </table> @@ -258,14 +258,14 @@ print <<END <form method='post' action='$ENV{'SCRIPT_NAME'}'> <input type='hidden' name='ACTION' value='downloadaddon' /> <input type='hidden' name='FILE' value='$_.ipf' /> - <input type='image' alt='$Lang::tr{'download'}' title='$Lang::tr{'download'}' src='/images/package-x-generic.png' /> + <input type='image' alt='$Lang::tr{'download'}' title='$Lang::tr{'download'}' src='/images/download.png' /> </form> </td> <td align='right' width='5'> <form method='post' action='$ENV{'SCRIPT_NAME'}'> <input type='hidden' name='ACTION' value='delete' /> <input type='hidden' name='FILE' value='$_.ipf' /> - <input type='image' alt='$Lang::tr{'delete'}' title='$Lang::tr{'delete'}' src='/images/user-trash.png' /> + <input type='image' alt='$Lang::tr{'delete'}' title='$Lang::tr{'delete'}' src='/images/delete.gif' /> </form> </td> END @@ -279,7 +279,7 @@ print <<END <form method='post' action='$ENV{'SCRIPT_NAME'}'> <input type='hidden' name='ACTION' value='addonbackup' /> <input type='hidden' name='ADDON' value='$_' /> - <input type='image' alt='$Lang::tr{'backup'}' title='$Lang::tr{'backup'}' src='/images/document-save.png' /> + <input type='image' alt='$Lang::tr{'backup'}' title='$Lang::tr{'backup'}' src='/images/media-floppy.png' /> </form> </td></tr> END @@ -297,14 +297,14 @@ print <<END <form method='post' action='$ENV{'SCRIPT_NAME'}'> <input type='hidden' name='ACTION' value='downloadaddon' /> <input type='hidden' name='FILE' value='$_.ipf' /> - <input type='image' alt='$Lang::tr{'download'}' title='$Lang::tr{'download'}' src='/images/package-x-generic.png' /> + <input type='image' alt='$Lang::tr{'download'}' title='$Lang::tr{'download'}' src='/images/download.png' /> </form> </td> <td align='right' width='5'> <form method='post' action='$ENV{'SCRIPT_NAME'}'> <input type='hidden' name='ACTION' value='delete' /> <input type='hidden' name='FILE' value='$_.ipf' /> - <input type='image' alt='$Lang::tr{'delete'}' title='$Lang::tr{'delete'}' src='/images/user-trash.png' /> + <input type='image' alt='$Lang::tr{'delete'}' title='$Lang::tr{'delete'}' src='/images/delete.gif' /> </form> </td> <td align='right' width='5'></td></tr> @@ -323,8 +323,8 @@ print "</table>"; print <<END <table width='95%' cellspacing='0'> <tr><td align='center' colspan='2'><font color='red'><br />$Lang::tr{'backupwarning'}</font><br /><br /></td></tr> -<tr><td align='left'>$Lang::tr{'backup'}</td><td align='left'><form method='post' enctype='multipart/form-data' action='$ENV{'SCRIPT_NAME'}'><input type="file" size='50' name="UPLOAD" /><input type='hidden' name='ACTION' value='restore' /><input type='hidden' name='FILE' /><input type='image' alt='$Lang::tr{'restore'}' title='$Lang::tr{'restore'}' src='/images/media-floppy.png' /></form></td></tr> -<tr><td align='left'>$Lang::tr{'backupaddon'}</td><td align='left'><form method='post' enctype='multipart/form-data' action='$ENV{'SCRIPT_NAME'}'><input type="file" size='50' name="UPLOAD" /><input type='hidden' name='ACTION' value='restoreaddon' /><input type='hidden' name='FILE' /><input type='image' alt='$Lang::tr{'restore'}' title='$Lang::tr{'restore'}' src='/images/media-floppy.png' /></form></td></tr> +<tr><td align='left'>$Lang::tr{'backup'}</td><td align='left'><form method='post' enctype='multipart/form-data' action='$ENV{'SCRIPT_NAME'}'><input type="file" size='50' name="UPLOAD" /><input type='hidden' name='ACTION' value='restore' /><input type='hidden' name='FILE' /><input type='image' alt='$Lang::tr{'restore'}' title='$Lang::tr{'restore'}' src='/images/restore.png' /></form></td></tr> +<tr><td align='left'>$Lang::tr{'backupaddon'}</td><td align='left'><form method='post' enctype='multipart/form-data' action='$ENV{'SCRIPT_NAME'}'><input type="file" size='50' name="UPLOAD" /><input type='hidden' name='ACTION' value='restoreaddon' /><input type='hidden' name='FILE' /><input type='image' alt='$Lang::tr{'restore'}' title='$Lang::tr{'restore'}' src='/images/restore.png' /></form></td></tr> </table> END ; diff --git a/html/html/images/download.png b/html/html/images/download.png new file mode 100644 index 0000000000000000000000000000000000000000..6a12420a54eb0705aceb727ba47330a1ab911175 GIT binary patch literal 646 zcmV;10(t$3P)<h;3K|Lk000e1NJLTq000mG000mO1^@s6AM^iV0006_Nkl<ZIE{^x zKWGzi6vsbzziUjIrcK)XF~O4l|A#FtU0lS)ML`rC6>)W|Q<q9XyNeD*X(tJSh=|~y z%|Xz`lR8<u*rLVSHkWJC<kIHue&>+1w3vWzdhhXlAHMJL6zaue=nh7_qpj8JrczI; z)dc{4zs6`RLCLQ0W5;YHYYb@fcQBTm#IOn&d&|IfU7gwp&?JI{PNWF>;xvh1LkGw9 zns_z51dJcl=X=gzmJ58@_;ytGb?Nf*#6J#nUBCYz`Di?<Bq-Sy5r2sF!Y29sA`yRx zl5G*%Z{t>eYJ6c~;r=lPx~_K#Ay)f)M<~e>*FIk5dtsSVt#JU>3tJ4d46!(wK~w~< z-@K$)-0hy8o?bg}Fx$}{LkK~8pp9qeUeMLt!%B9ImFybn<{qA&eNH?SMbmtAc6MP| z)+~Uc>v~uSVfOcqAcWxe#vf9tI9bc!()$a<MUvaGJ9w5xz^^jU*G*x!Kqj+DKA(?h zz*I}H6(IxwspLuUAR37A>EdTR&qGRyD<!t=P^sAXntUV@DYDt@l%ngp>9}54RTLCO zsa~ZvB&Ec4U0mrR-CBNFyO^fAquI6{K0P{yq9`bE2&wzGz^1*4Eo{<(H1iMV!&)wv z1K{nu52!*#sA?6a)L=*6Wq2sf-1=RJ!rb6J48uS(3<H3z?HogcX@pQwRTWjOI-&*x zD3{9=_e%UK{=}6oxm>OaXb$+fdE?4|t&r(^QcWb-wv93~Gh;fA6LuU2$8io1C8fmk gJUq{9fC6CWFUS4*oKn&t!2kdN07*qoM6N<$f*4&i3;+NC literal 0 HcmV?d00001 diff --git a/html/html/images/restore.png b/html/html/images/restore.png new file mode 100644 index 0000000000000000000000000000000000000000..6be95adaf7e9742b34f8afd94b3422dbef25e638 GIT binary patch literal 459 zcmV;+0W|)JP)<h;3K|Lk000e1NJLTq000;O000;W1^@s6;CDUv00004b3#c}2nYxW zd<bNS00009a7bBm000XU000XU0RWnu7ytkPZAnByR7i>K)z3;*K^zD0&vA2wOnLxu z(LxHZxM@`jkrL5*f?gyes|&qBJwOqP(YiPAA1J<nc3l~@RSPtN+hXS0aG870Ioi@M z40D+IeZSw|%$eT|*Z2=8@EEH&#BZFVjgOeWig**d=#;c=+^H-65I>{95uRZZjo6x4 z!nYW6g4wF#lZp5WZVZSW!CGQcx{?AriFi>Vp&~KaDhpopZ(DMichJg=-^BMgfAQmo zGJ#KH{|>*(vPp0nIjKh0;C}4C)DZ8Y%Xu)!U@Z1uFJZ9Xqj7<j{%8DkPizN!n93Lo z$N96Id(PxlChm!_x<7b}TglvX<Q?P;dQD#T3la)#SvUln$@q)N{V;&570FdFj(hQY z6hETDTt$9m6!;v)H|h}I;FC~9{V<w{A7i4b_-&zhIzoj$7fwz?I4#q{o_Dw97&CRU zhr7a6Ty|Zr*U3DG1>tdN3lGkjP*m^n=qke3@E1{rYo;z~V&4D&002ovPDHLkV1j0b B$)NxM literal 0 HcmV?d00001 -- 2.18.0

2 2

[PATCH] gnutls: Update to 3.5.19
by Matthias Fischer 28 Sep '18

28 Sep '18

Hi, For changelogs since '3.5.15' see: https://lists.gnupg.org/pipermail/gnutls-devel/2017-October/008523.html https://lists.gnupg.org/pipermail/gnutls-devel/2018-January/008538.html https://lists.gnupg.org/pipermail/gnutls-devel/2018-February/008540.html https://lists.gnupg.org/pipermail/gnutls-devel/2018-July/008583.html Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/gnutls | 2 +- lfs/gnutls | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/gnutls b/config/rootfiles/common/gnutls index 8231c7588..137fbe124 100644 --- a/config/rootfiles/common/gnutls +++ b/config/rootfiles/common/gnutls @@ -33,7 +33,7 @@ usr/lib/libgnutls-dane.so.0.4.1 #usr/lib/libgnutls.la #usr/lib/libgnutls.so usr/lib/libgnutls.so.30 -usr/lib/libgnutls.so.30.14.7 +usr/lib/libgnutls.so.30.14.11 #usr/lib/libgnutlsxx.la #usr/lib/libgnutlsxx.so usr/lib/libgnutlsxx.so.28 diff --git a/lfs/gnutls b/lfs/gnutls index 5484d9821..8e6b54236 100644 --- a/lfs/gnutls +++ b/lfs/gnutls @@ -24,7 +24,7 @@ include Config -VER = 3.5.15 +VER = 3.5.19 THISAPP = gnutls-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = bcdcbc65c50a7499617ad9f4d0058de9 +$(DL_FILE)_MD5 = 1002f4099ce11d785e9811099aaa59a6 install : $(TARGET) -- 2.18.0

1 0

[PATCH] Avoid calling a perl script for getting DNS-Servers from DHCP
by Jonatan Schlag 26 Sep '18

26 Sep '18

This codes does the same as before but we do everythin in Bash now. Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- config/rootfiles/common/aarch64/initscripts | 1 - config/rootfiles/common/armv5tel/initscripts | 1 - config/rootfiles/common/i586/initscripts | 1 - config/rootfiles/common/x86_64/initscripts | 1 - src/initscripts/helper/getdnsfromdhcpc.pl | 47 ---------------------------- src/initscripts/networking/dhcpcd.exe | 16 ++++++++-- 6 files changed, 14 insertions(+), 53 deletions(-) delete mode 100644 src/initscripts/helper/getdnsfromdhcpc.pl diff --git a/config/rootfiles/common/aarch64/initscripts b/config/rootfiles/common/aarch64/initscripts index bce6d0f..081e6d4 100644 --- a/config/rootfiles/common/aarch64/initscripts +++ b/config/rootfiles/common/aarch64/initscripts @@ -2,7 +2,6 @@ etc/init.d #etc/rc.d #etc/rc.d/helper etc/rc.d/helper/aws-setup -etc/rc.d/helper/getdnsfromdhcpc.pl #etc/rc.d/init.d etc/rc.d/init.d/acpid etc/rc.d/init.d/apache diff --git a/config/rootfiles/common/armv5tel/initscripts b/config/rootfiles/common/armv5tel/initscripts index bce6d0f..081e6d4 100644 --- a/config/rootfiles/common/armv5tel/initscripts +++ b/config/rootfiles/common/armv5tel/initscripts @@ -2,7 +2,6 @@ etc/init.d #etc/rc.d #etc/rc.d/helper etc/rc.d/helper/aws-setup -etc/rc.d/helper/getdnsfromdhcpc.pl #etc/rc.d/init.d etc/rc.d/init.d/acpid etc/rc.d/init.d/apache diff --git a/config/rootfiles/common/i586/initscripts b/config/rootfiles/common/i586/initscripts index f793952..134d9ca 100644 --- a/config/rootfiles/common/i586/initscripts +++ b/config/rootfiles/common/i586/initscripts @@ -2,7 +2,6 @@ etc/init.d #etc/rc.d #etc/rc.d/helper etc/rc.d/helper/aws-setup -etc/rc.d/helper/getdnsfromdhcpc.pl #etc/rc.d/init.d etc/rc.d/init.d/acpid etc/rc.d/init.d/apache diff --git a/config/rootfiles/common/x86_64/initscripts b/config/rootfiles/common/x86_64/initscripts index f793952..134d9ca 100644 --- a/config/rootfiles/common/x86_64/initscripts +++ b/config/rootfiles/common/x86_64/initscripts @@ -2,7 +2,6 @@ etc/init.d #etc/rc.d #etc/rc.d/helper etc/rc.d/helper/aws-setup -etc/rc.d/helper/getdnsfromdhcpc.pl #etc/rc.d/init.d etc/rc.d/init.d/acpid etc/rc.d/init.d/apache diff --git a/src/initscripts/helper/getdnsfromdhcpc.pl b/src/initscripts/helper/getdnsfromdhcpc.pl deleted file mode 100644 index e4d461d..0000000 --- a/src/initscripts/helper/getdnsfromdhcpc.pl +++ /dev/null @@ -1,47 +0,0 @@ -#!/usr/bin/perl -############################################################################### -# # -# IPFire.org - A linux based firewall # -# Copyright (C) 2007 Michael Tremer & Christian Schmidt # -# # -# This program is free software: you can redistribute it and/or modify # -# it under the terms of the GNU General Public License as published by # -# the Free Software Foundation, either version 3 of the License, or # -# (at your option) any later version. # -# # -# This program is distributed in the hope that it will be useful, # -# but WITHOUT ANY WARRANTY; without even the implied warranty of # -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # -# GNU General Public License for more details. # -# # -# You should have received a copy of the GNU General Public License # -# along with this program. If not, see <http://www.gnu.org/licenses/>. # -# # -############################################################################### - -use strict; -require '/var/ipfire/general-functions.pl'; - -my $count = $ARGV[0]; -my ($dhcp, $dns, @alldns, %dhcpc); - -if ($count eq "" || $count < 1) { - die "Bad DNS number given"; } - -if (open(FILE, "${General::swroot}/red/iface")) { - my $iface = <FILE>; - close FILE; - chomp ($iface); - if (!&General::readhash("${General::swroot}/dhcpc/dhcpcd-$iface.info", \%dhcpc)) { - die "Could not open dhcpc info file"; - } -} else { - die "Could not open interface file"; -} - - -$dns = $dhcpc{'domain_name_servers'}; - -@alldns = split(' ', $dns); - -print "$alldns[$count - 1]\n"; diff --git a/src/initscripts/networking/dhcpcd.exe b/src/initscripts/networking/dhcpcd.exe index a2cdc66..227481e 100644 --- a/src/initscripts/networking/dhcpcd.exe +++ b/src/initscripts/networking/dhcpcd.exe @@ -49,8 +49,20 @@ dhcpcd_up() echo -n ${DNS0} > /var/ipfire/red/dns1 echo -n ${DNS1} > /var/ipfire/red/dns2 else - echo -n `/etc/rc.d/helper/getdnsfromdhcpc.pl 1` > /var/ipfire/red/dns1 - echo -n `/etc/rc.d/helper/getdnsfromdhcpc.pl 2` > /var/ipfire/red/dns2 + # Check that we get DNS-Servers from our DHCP Server + if [ -n "${new_domain_name_servers}" ]; then + # Convert the string into an arry + dhcp_dns_servers=(${new_domain_name_servers}) + # We need 2 DNS-Servers + if [ ${#dhcp_dns_servers[@]} -lt 2 ]; then + logger -p local0.error -t dhcpcd.exe[$$] "DHCP Server does provides less then two DNS-Servers" + else + echo -n "${dhcp_dns_servers[0]}" > /var/ipfire/red/dns1 + echo -n "${dhcp_dns_servers[1]}" > /var/ipfire/red/dns2 + fi + else + logger -p local0.error -t dhcpcd.exe[$$] "DHCP Servers does not provide any DNS-Servers." + fi fi #Get IP Address -- 1.8.3.1

1 0

[PATCH 1/2 v3] add hardened SSH server configuration
by Peter Müller 26 Sep '18

26 Sep '18

In order to harden OpenSSH server in IPFire, using the upstream default configuration and edit it via sed commands in LFS file is error-prone and does not scale. Thereof we ship a custom and more secure OpenSSH server configuration which is copied into the image during build time. The third version of this patch corrects default value where no root login was possible (default is "prohibit-password") on default installations. It also enables password-based authentication by default so rewriting this during startup becomes obsolete. Fixes #11750 Fixes #11751 Partially fixes #11538 Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> Cc: Marcel Lorenz <marcel.lorenz(a)ipfire.org> Cc: Michael Tremer <michael.tremer(a)ipfire.org> --- config/ssh/sshd_config | 82 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 82 insertions(+) create mode 100644 config/ssh/sshd_config diff --git a/config/ssh/sshd_config b/config/ssh/sshd_config new file mode 100644 index 000000000..8b8e042c4 --- /dev/null +++ b/config/ssh/sshd_config @@ -0,0 +1,82 @@ +# ultra-secure OpenSSH server configuration + +# only allow version 2 of SSH protocol +Protocol 2 + +# listen on port 22 by default +Port 22 + +# listen on these interfaces and protocols +AddressFamily any +ListenAddress 0.0.0.0 +ListenAddress :: + +# limit authentication thresholds +LoginGraceTime 30s +MaxAuthTries 3 + +# limit maximum instanctes to prevent DoS +MaxStartups 5 + +# ensure proper logging +SyslogFacility AUTH +LogLevel INFO + +# enforce permission checks before a login is accepted +# (prevents damage because of hacked systems with world-writeable +# home directories or similar) +StrictModes yes + +# only allow safe crypto algorithms (may break some _very_ outdated clients) +# see also: https://stribika.github.io/2015/01/04/secure-secure-shell.html +KexAlgorithms curve25519-sha256(a)libssh.org,diffie-hellman-group-exchange-sha256 +Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com +MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com + +# enable data compression after successful login only +Compression delayed + +# only allow cryptographically safe SSH host keys (adjust paths if needed) +HostKey /etc/ssh/ssh_host_ed25519_key +HostKey /etc/ssh/ssh_host_ecdsa_key +HostKey /etc/ssh/ssh_host_rsa_key + +# only allow login via public key by default +PubkeyAuthentication yes +PasswordAuthentication yes +ChallengeResponseAuthentication no +PermitEmptyPasswords no + +# permit root login as there is no other user in IPFire 2.x +PermitRootLogin yes + +# specify preferred authentication methods (public keys come first) +AuthenticationMethods publickey,password + +# ignore user ~/.rhost* files +IgnoreRhosts yes + +# ignore user known hosts file +IgnoreUserKnownHosts yes + +# ignore user environments +PermitUserEnvironment no + +# do not allow any kind of forwarding (provides only low security) +# some of them might need to be re-enabled if SSH server is a jump platform +X11Forwarding no +AllowTcpForwarding no +AllowAgentForwarding no +PermitTunnel no +GatewayPorts no +PermitOpen none + +# detect broken sessions by sending keep-alive messages to +# clients (both via TCP and SSH) +TCPKeepAlive yes +ClientAliveInterval 10 + +# close unresponsive SSH sessions which fail to answer keep-alive +ClientAliveCountMax 6 + +# EOF -- 2.16.4

2 2

PiStrong
by Tom Rymes 25 Sep '18

25 Sep '18

I saw this on the Strongswan users list, so I’m sure you are all already aware of it, but I don’t know if it has any potential use for IPFire. Tom https://github.com/gitbls/pistrong/tree/master

2 3

[PATCH] bind: Update to 9.11.4-P2
by Matthias Fischer 24 Sep '18

24 Sep '18

For details see: http://ftp.isc.org/isc/bind9/9.11.4-P2/RELEASE-NOTES-bind-9.11.4-P2.html Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/bind | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/bind b/lfs/bind index 8b04037b7..085fa005b 100644 --- a/lfs/bind +++ b/lfs/bind @@ -25,7 +25,7 @@ include Config -VER = 9.11.4-P1 +VER = 9.11.4-P2 THISAPP = bind-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = b2c54d6c2003b693388041fd109e8b6b +$(DL_FILE)_MD5 = 3b831d1cb9dcb3e0868409cf98d4519b install : $(TARGET) -- 2.18.0

1 0

[PATCH] kernel: Enable DFS support for ath*k drivers
by Michael Tremer 24 Sep '18

24 Sep '18

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- kernel/config-generic | 16 ++++++++++------ kernel/kernel.nm | 2 +- 2 files changed, 11 insertions(+), 7 deletions(-) diff --git a/kernel/config-generic b/kernel/config-generic index 0c8fdf6ab7b3..afc1179912ed 100644 --- a/kernel/config-generic +++ b/kernel/config-generic @@ -189,7 +189,7 @@ CONFIG_SLAB_MERGE_DEFAULT=y CONFIG_SLAB_FREELIST_RANDOM=y CONFIG_SLAB_FREELIST_HARDENED=y CONFIG_SLUB_CPU_PARTIAL=y -CONFIG_SYSTEM_DATA_VERIFICATION=y +# CONFIG_SYSTEM_DATA_VERIFICATION is not set # CONFIG_PROFILING is not set CONFIG_TRACEPOINTS=y # CONFIG_KPROBES is not set @@ -1148,9 +1148,10 @@ CONFIG_WEXT_PRIV=y CONFIG_CFG80211=m # CONFIG_NL80211_TESTMODE is not set # CONFIG_CFG80211_DEVELOPER_WARNINGS is not set -# CONFIG_CFG80211_CERTIFICATION_ONUS is not set -CONFIG_CFG80211_REQUIRE_SIGNED_REGDB=y -CONFIG_CFG80211_USE_KERNEL_REGDB_KEYS=y +CONFIG_CFG80211_CERTIFICATION_ONUS=y +# CONFIG_CFG80211_REQUIRE_SIGNED_REGDB is not set +# CONFIG_CFG80211_REG_CELLULAR_HINTS is not set +CONFIG_CFG80211_REG_RELAX_NO_IR=y CONFIG_CFG80211_DEFAULT_PS=y # CONFIG_CFG80211_DEBUGFS is not set CONFIG_CFG80211_CRDA_SUPPORT=y @@ -2014,10 +2015,13 @@ CONFIG_ADM8211=m CONFIG_ATH_COMMON=m CONFIG_WLAN_VENDOR_ATH=y # CONFIG_ATH_DEBUG is not set +CONFIG_ATH_REG_DYNAMIC_USER_REG_HINTS=y +# CONFIG_ATH_REG_DYNAMIC_USER_CERT_TESTING is not set CONFIG_ATH5K=m # CONFIG_ATH5K_DEBUG is not set # CONFIG_ATH5K_TRACER is not set CONFIG_ATH5K_PCI=y +# CONFIG_ATH5K_TEST_CHANNELS is not set CONFIG_ATH9K_HW=m CONFIG_ATH9K_COMMON=m CONFIG_ATH9K_BTCOEX_SUPPORT=y @@ -2025,6 +2029,7 @@ CONFIG_ATH9K=m CONFIG_ATH9K_PCI=y CONFIG_ATH9K_AHB=y # CONFIG_ATH9K_DEBUGFS is not set +CONFIG_ATH9K_DFS_CERTIFIED=y CONFIG_ATH9K_DYNACK=y CONFIG_ATH9K_WOW=y CONFIG_ATH9K_RFKILL=y @@ -2050,6 +2055,7 @@ CONFIG_ATH10K_USB=m # CONFIG_ATH10K_DEBUG is not set # CONFIG_ATH10K_DEBUGFS is not set # CONFIG_ATH10K_TRACING is not set +CONFIG_ATH10K_DFS_CERTIFIED=y CONFIG_WCN36XX=m # CONFIG_WCN36XX_DEBUGFS is not set CONFIG_WLAN_VENDOR_ATMEL=y @@ -5787,8 +5793,6 @@ CONFIG_ASYMMETRIC_KEY_TYPE=y CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y CONFIG_X509_CERTIFICATE_PARSER=y CONFIG_PKCS7_MESSAGE_PARSER=y -# CONFIG_PKCS7_TEST_KEY is not set -# CONFIG_SIGNED_PE_FILE_VERIFICATION is not set # # Certificates for signature checking diff --git a/kernel/kernel.nm b/kernel/kernel.nm index d79dd8b77a2b..3533c7528b36 100644 --- a/kernel/kernel.nm +++ b/kernel/kernel.nm @@ -5,7 +5,7 @@ name = kernel version = 4.16.18 -release = 1 +release = 2 thisapp = linux-%{version} maintainer = Arne Fitzenreiter <arne.fitzenreiter(a)ipfire.org> -- 2.17.1

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development September 2018