Development January 2019

development@lists.ipfire.org

16 participants
57 discussions

Peeking at unbound statistics from WUI
by Rachid Groeneveld 22 Jan '19

22 Jan '19

Hi all, I'm fairly new to perl and cgi scripts, I can find most of it on the web, but I've been unable to solve this riddle. Is it possible to query the unbound statistics from a cgi script? I can't seem to figure out how to do this without cron-ing a bash script and reading its output, I want them on-demand when a page is requested. I think it's a permission issue, as far as I've been able to assess the webpages run under 'nobody' and unbound-control needs elevated rights to execute a peek at the statistics. I'm using the following command to do so: "unbound-control stats_noreset". That way I can query all the DNS info I want (for reporting purposes), because I don't think unbound was compiled with dnstap enabled. At least I haven't found anything to back that up, that would eliminate the need for peeking at stats, because an up-to-date database can be built (async). I will further investigate dnstap in a later stage. Can someone point me in the right direction for peeking unbound statistics from perl/cgi scripts? I've tried sudo-ing (I'd rather not, for security reasons), separate bash scripts and qx/backticks, they all seem to fail with exit code 256 which seems to be a permission problem. Running anything from an SSH session obviously succeeds, because then I have all the rights I need. Thanks in advance. Cheers, Rachid

4 11

[PATCH] hide kernel addresses in /proc against privileged users
by Peter Müller 21 Jan '19

21 Jan '19

In order to make local privilege escalation more harder, hide kernel addresses in various /proc files against users with root (or similar) permissions, too. Common system hardening tools such as lynis recommend this. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- setup/sysctl/kernel-hardening.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup/sysctl/kernel-hardening.conf b/setup/sysctl/kernel-hardening.conf index 6751bbef6..9bb6e9f45 100644 --- a/setup/sysctl/kernel-hardening.conf +++ b/setup/sysctl/kernel-hardening.conf @@ -1,5 +1,5 @@ # Try to keep kernel address exposures out of various /proc files (kallsyms, modules, etc). -kernel.kptr_restrict = 1 +kernel.kptr_restrict = 2 # Avoid kernel memory address exposures via dmesg. kernel.dmesg_restrict = 1 -- 2.16.4

2 2

[PATCH] use HTTPS for downloading GeoIP database files
by Peter Müller 21 Jan '19

21 Jan '19

Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- src/scripts/xt_geoip_update | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/scripts/xt_geoip_update b/src/scripts/xt_geoip_update index b45c5b343..93884dcf5 100644 --- a/src/scripts/xt_geoip_update +++ b/src/scripts/xt_geoip_update @@ -26,7 +26,7 @@ SCRIPT_PATH=/usr/local/bin DEST_PATH=/usr/share/xt_geoip DB_PATH=/var/lib/GeoIP -DL_URL=http://geolite.maxmind.com/download/geoip/database +DL_URL=https://geolite.maxmind.com/download/geoip/database DL_FILE=GeoLite2-Country-CSV.zip eval $(/usr/local/bin/readhash /var/ipfire/proxy/settings) @@ -40,7 +40,7 @@ function download() { # Proxy settings. # Check if a proxy should be used. if [[ $UPSTREAM_PROXY ]]; then - PROXYSETTINGS="-e http_proxy=http://" + PROXYSETTINGS="-e https_proxy=http://" # Check if authentication against the proxy is configured. if [[ $UPSTREAM_USER && $UPSTREAM_PASSWORD ]]; then -- 2.16.4

2 2

Firefox won't connect to git.ipfire.org
by Bob Brewer 21 Jan '19

21 Jan '19

Started getting invalid certificate errors from Firefox when accessing any https pages on git.ipfire.org. It was OK earlier and I can still access from chrome(ium). Firefox Quantum 64.0 "Your connection is not secure The owner of git.ipfire.org has configured their website improperly. To protect your information from being stolen, Firefox has not connected to this website. This site uses HTTP Strict Transport Security (HSTS) to specify that Firefox may only connect to it securely. As a result, it is not possible to add an exception for this certificate." Rob

4 5

Using HTTPS for GeoIP database downloads
by Peter Müller 21 Jan '19

21 Jan '19

Hello, looking at https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=271bac39a0b2999c843a5ec… , I observer the download URL of the GeoIP database being HTTP. Could somebody make this into HTTPS before we close Core Update 127? Should I send in a patch for this? We used HTTPS for quite a while in the past and as far as I am concerned, it worked well. Thanks, and best regards, Peter Müller -- Microsoft DNS service terminates abnormally when it recieves a response to a DNS query that was never made. Fix Information: Run your DNS service on a different platform. -- bugtraq

2 1

[PATCH] logrotate: Update to 3.15
by Matthias Fischer 21 Jan '19

21 Jan '19

For details see: https://github.com/logrotate/logrotate/releases - timer unit: change trigger fuzz from 12h to 1h (#230) - service unit: only run if /var/log is mounted (#230) - preserve fractional part of timestamps when compressing (#226) - re-indent source code using spaces only (#188) - minage: avoid rounding issue while comparing the amount of seconds (#36) - never remove old log files if rotate -1 is specified (#202) - return non-zero exit status if a config file contains an error (#199) - make copytruncate work with rotate 0 (#191) - warn user if both size and the time interval options are used (#192) - pass rotated log file name as the 2nd argument of the postrotate script when sharedscript is not enabled (#193) - rename logrotate-default to logrotate.conf (#187) Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/logrotate | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/logrotate b/lfs/logrotate index a6b735443..143d09531 100644 --- a/lfs/logrotate +++ b/lfs/logrotate @@ -24,7 +24,7 @@ include Config -VER = 3.14.0 +VER = 3.15.0 THISAPP = logrotate-$(VER) DL_FILE = logrotate-$(VER).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 9d9cf1d0a0b0433f56e152c5117f7b31 +$(DL_FILE)_MD5 = 240105d3288657d0ad7782c6a34c9a85 install : $(TARGET) -- 2.18.0

2 1

[PATCH] httpd: include TLS 1.3 cipher suites
by Peter Müller 15 Jan '19

15 Jan '19

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> Cc: Erik Kapfer <erik.kapfer(a)ipfire.org> Cc: Michael Tremer <michael.tremer(a)ipfire.org> --- config/httpd/vhosts.d/ipfire-interface-ssl.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/httpd/vhosts.d/ipfire-interface-ssl.conf b/config/httpd/vhosts.d/ipfire-interface-ssl.conf index 63e77021b..f88a6a52a 100644 --- a/config/httpd/vhosts.d/ipfire-interface-ssl.conf +++ b/config/httpd/vhosts.d/ipfire-interface-ssl.conf @@ -11,7 +11,7 @@ SSLEngine on SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 - SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256 + SSLCipherSuite TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256 SSLHonorCipherOrder on SSLCompression off SSLSessionTickets off -- 2.16.4

1 0

Merge Window Closing Announcement for Core Update 127
by Michael Tremer 14 Jan '19

14 Jan '19

Hello guys, Upon request, I would like to announce that on Saturday, 12th Jan, we are going to branch Core Update 127. This means that we no longer accept any patches that introduce any new features and only accept patches that fix any bugs introduced. Nothing new here, you all know how this works :) This announcement is just coming now so that you all know this. It is a bit short notice this time, but I hope I will be better with this next time round. In the past some patches have been submitted after the merge window closed and had to be deferred to the next Core Update to the frustration of the submitters. Therefore, we now try this and hope that we can make the process better for everyone who is contributing! We have an update with many new features here. Please help testing as soon as the first build is available. Best, -Michael

4 8

[PATCH] xtables 3.2: Fix for rootfile
by Matthias Fischer 11 Jan '19

11 Jan '19

Found during the test builds... Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/xtables-addons | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/rootfiles/common/xtables-addons b/config/rootfiles/common/xtables-addons index 9e0739528..cb958ee7e 100644 --- a/config/rootfiles/common/xtables-addons +++ b/config/rootfiles/common/xtables-addons @@ -2,7 +2,6 @@ lib/xtables/libxt_ACCOUNT.so lib/xtables/libxt_CHAOS.so lib/xtables/libxt_DELUDE.so lib/xtables/libxt_DHCPMAC.so -#lib/xtables/libxt_DNETMAP.so lib/xtables/libxt_ECHO.so lib/xtables/libxt_IPMARK.so lib/xtables/libxt_LOGMARK.so @@ -26,6 +25,7 @@ usr/lib/libxt_ACCOUNT_cl.so.0.0.0 #usr/libexec/xtables-addons usr/libexec/xtables-addons/xt_geoip_build usr/libexec/xtables-addons/xt_geoip_dl +usr/local/bin/xt_geoip_build usr/sbin/iptaccount #usr/share/man/man1/xt_geoip_build.1 #usr/share/man/man1/xt_geoip_dl.1 -- 2.18.0

2 1

[PATCH] xtables-addons: Fix typo in lfs
by Matthias Fischer 11 Jan '19

11 Jan '19

Just some typos... Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/xtables-addons | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lfs/xtables-addons b/lfs/xtables-addons index da67aa761..260820955 100644 --- a/lfs/xtables-addons +++ b/lfs/xtables-addons @@ -96,7 +96,7 @@ ifeq "$(USPACE)" "1" cd $(DIR_APP) && make install # Install xt_geoip_build. - cd $(DIR_APP) && install -m 755 GeoIP/xt_geoip_build \ + cd $(DIR_APP) && install -m 755 geoip/xt_geoip_build \ /usr/local/bin/ else cd $(DIR_APP) && ./configure \ -- 2.18.0

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development January 2019