Development February 2019

development@lists.ipfire.org

14 participants
55 discussions

[PATCH] BUG11695: Adding/editing rules with preset broken
by Alexander Marx 15 Jul '21

15 Jul '21

added another check to fill same ports in source and destination when a custom service is selected. Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org> Reported-by: erik(a)vanlinsteeict.nl --- html/cgi-bin/firewall.cgi | 1 + 1 file changed, 1 insertion(+) diff --git a/html/cgi-bin/firewall.cgi b/html/cgi-bin/firewall.cgi index 499f279..d17afab 100644 --- a/html/cgi-bin/firewall.cgi +++ b/html/cgi-bin/firewall.cgi @@ -757,6 +757,7 @@ sub checkrule } } if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'dnatport'} eq ''){$fwdfwsettings{'dnatport'}=$custsrvport;} + if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'grp3'} eq 'cust_srv'){$fwdfwsettings{'dnatport'}=$custsrvport;} } #check if DNAT port is multiple if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'dnatport'} ne ''){ -- 2.7.4

3 2

OpenSSL-1.1.1a - No TLSv1.3 with unbound
by ummeegge 24 May '19

24 May '19

Hi all, did an fresh install from origin/next of Core 128 with the new OpenSSL- 1.1.1a . Have checked also DNS-over-TLS which works well but kdig points out that the TLS sessions operates only with TLSv1.2 instaed of the new delivered TLSv1.3 . A test with Cloudflair (which uses TLSv1.3) looks like this --> kdig Test: ;; DEBUG: Querying for owner(www.isoc.org.), class(1), type(1), server(1.1.1.1), port(853), protocol(TCP) ;; DEBUG: TLS, imported 135 certificates from '/etc/ssl/certs/ca-bundle.crt' ;; DEBUG: TLS, received certificate hierarchy: ;; DEBUG: #1, C=US,ST=California,L=San Francisco,O=Cloudflare\, Inc.,CN=cloudflare-dns.com ;; DEBUG: SHA-256 PIN: V6zes8hHBVwUECsHf7uV5xGM7dj3uMXIS9//7qC8+jU= ;; DEBUG: #2, C=US,O=DigiCert Inc,CN=DigiCert ECC Secure Server CA ;; DEBUG: SHA-256 PIN: PZXN3lRAy+8tBKk2Ox6F7jIlnzr2Yzmwqc3JnyfXoCw= ;; DEBUG: TLS, skipping certificate PIN check ;; DEBUG: TLS, The certificate is trusted. ;; TLS session (TLS1.2)-(ECDHE-ECDSA-SECP256R1)-(AES-256-GCM) ;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 51175 ;; Flags: qr rd ra ad; QUERY: 1; ANSWER: 2; AUTHORITY: 0; ADDITIONAL: 1 ;; EDNS PSEUDOSECTION: ;; Version: 0; flags: do; UDP size: 1452 B; ext-rcode: NOERROR ;; PADDING: 239 B ;; QUESTION SECTION: ;; www.isoc.org. IN A ;; ANSWER SECTION: www.isoc.org. 300 IN A 46.43.36.222 www.isoc.org. 300 IN RRSIG A 7 3 300 20190224085001 20190210085001 45830 isoc.org. g64C7zJUL1zqUBbcZVDcEKO05EHz19ZHwxr4i8kTieW8XgX63lLZwhJTL1UK0NxOGCPOZSVthWBp9HF9WnFjPsxsfkrxkOoz/Hcl1ZuTpWUTBLfBKqnpPJm2NJ2yoR7hPerUvtl0sHJnIOczrHnAlCwZBo8OOw9tlW0va+706ZQ= ;; Received 468 B ;; Time 2019-02-10 12:40:19 CET ;; From 1.1.1.1@853(TCP) in 18.0 ms And a test with s_client: [root@ipfire tmp]# openssl s_client -connect 1.1.1.1:853 CONNECTED(00000003) depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA verify return:1 depth=1 C = US, O = DigiCert Inc, CN = DigiCert ECC Secure Server CA verify return:1 depth=0 C = US, ST = California, L = San Francisco, O = "Cloudflare, Inc.", CN = cloudflare-dns.com verify return:1 --- Certificate chain 0 s:C = US, ST = California, L = San Francisco, O = "Cloudflare, Inc.", CN = cloudflare-dns.com i:C = US, O = DigiCert Inc, CN = DigiCert ECC Secure Server CA 1 s:C = US, O = DigiCert Inc, CN = DigiCert ECC Secure Server CA i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA --- Server certificate -----BEGIN CERTIFICATE----- MIIFxjCCBUygAwIBAgIQAczjGN6fVn+rKySQH62nHTAKBggqhkjOPQQDAjBMMQsw CQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMSYwJAYDVQQDEx1EaWdp Q2VydCBFQ0MgU2VjdXJlIFNlcnZlciBDQTAeFw0xOTAxMjgwMDAwMDBaFw0yMTAy MDExMjAwMDBaMHIxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYw FAYDVQQHEw1TYW4gRnJhbmNpc2NvMRkwFwYDVQQKExBDbG91ZGZsYXJlLCBJbmMu MRswGQYDVQQDExJjbG91ZGZsYXJlLWRucy5jb20wWTATBgcqhkjOPQIBBggqhkjO PQMBBwNCAATFIHCMIEJQKB59REF8MHkpHGNeHUSbxfdxOive0qKksWw9ash3uMuP LlBT/fQYJn9hN+3/wr7pC125fuHfHOJ0o4ID6DCCA+QwHwYDVR0jBBgwFoAUo53m H/naOU/AbuiRy5Wl2jHiCp8wHQYDVR0OBBYEFHCV3FyjjmYH28uBEMar58OoRX+g MIGsBgNVHREEgaQwgaGCEmNsb3VkZmxhcmUtZG5zLmNvbYIUKi5jbG91ZGZsYXJl LWRucy5jb22CD29uZS5vbmUub25lLm9uZYcEAQEBAYcEAQAAAYcEop+ENYcQJgZH AEcAAAAAAAAAAAAREYcQJgZHAEcAAAAAAAAAAAAQAYcQJgZHAEcAAAAAAAAAAAAA ZIcQJgZHAEcAAAAAAAAAAABkAIcEop8kAYcEop8uATAOBgNVHQ8BAf8EBAMCB4Aw HQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMGkGA1UdHwRiMGAwLqAsoCqG KGh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9zc2NhLWVjYy1nMS5jcmwwLqAsoCqG KGh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9zc2NhLWVjYy1nMS5jcmwwTAYDVR0g BEUwQzA3BglghkgBhv1sAQEwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGln aWNlcnQuY29tL0NQUzAIBgZngQwBAgIwewYIKwYBBQUHAQEEbzBtMCQGCCsGAQUF BzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wRQYIKwYBBQUHMAKGOWh0dHA6 Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEVDQ1NlY3VyZVNlcnZlckNB LmNydDAMBgNVHRMBAf8EAjAAMIIBfgYKKwYBBAHWeQIEAgSCAW4EggFqAWgAdgCk uQmQtBhYFIe7E6LMZ3AKPDWYBPkb37jjd80OyA3cEAAAAWiVHhSLAAAEAwBHMEUC IQDlnoPeMXtFkRsy3Vs0eovk3ILKt01x6bgUdMlmQTFIvAIgcAn0lFSjiGzHm2eO jDZJzMiP5Uaj0Jwub9GO8RkxkkoAdQCHdb/nWXz4jEOZX73zbv9WjUdWNv9KtWDB tOr/XqCDDwAAAWiVHhVsAAAEAwBGMEQCIFC0n0JModeol8b/Qicxd5Blf/o7xOs/ Bk0j9hdc5N7jAiAQocYnHL9iMqTtFkh0vmSsII5NbiakM/2yDEXnwkPRvAB3ALvZ 37wfinG1k5Qjl6qSe0c4V5UKq1LoGpCWZDaOHtGFAAABaJUeFJEAAAQDAEgwRgIh AL3OPTBzOZpS5rS/uLzqMOiACCFQyY+mTJ+L0I9TcB3RAiEA4+SiPz0/5kFxvrk7 AKYKdvelgV1hiiPbM2YHY+/0BIkwCgYIKoZIzj0EAwIDaAAwZQIwez76hX2HTMur /I3XRuwfdmVoa8J6ZVEVq+AZsE7DyQh7AV4WNLU+092BrPbnyVUFAjEAzUf5jdz1 pyc74lgOunC7LBE6cPtWbzfGpJiYyT/T+c5eIAwRYziKT0DKbaql7tiZ -----END CERTIFICATE----- subject=C = US, ST = California, L = San Francisco, O = "Cloudflare, Inc.", CN = cloudflare-dns.com issuer=C = US, O = DigiCert Inc, CN = DigiCert ECC Secure Server CA --- No client certificate CA names sent Peer signing digest: SHA256 Peer signature type: ECDSA Server Temp Key: X25519, 253 bits --- SSL handshake has read 2787 bytes and written 421 bytes Verification: OK --- New, TLSv1.3, Cipher is TLS_CHACHA20_POLY1305_SHA256 Server public key is 256 bit Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated Early data was not sent Verify return code: 0 (ok) --- --- Post-Handshake New Session Ticket arrived: SSL-Session: Protocol : TLSv1.3 Cipher : TLS_CHACHA20_POLY1305_SHA256 Session-ID: FAA394DF4959235034E350399A968F5C945D413F68CC5D29191B209900735C01 Session-ID-ctx: Resumption PSK: 414F9C16B3D4845BC0592B35CC2D28DBD9B807BCBCB95125870379E1AAA480C7 PSK identity: None PSK identity hint: None TLS session ticket lifetime hint: 21600 (seconds) TLS session ticket: 0000 - 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0010 - 8f 9b bb d1 0a 9e a6 0d-df d3 9d 7d 8f c1 f1 6b ...........}...k 0020 - 00 80 31 55 77 a3 b3 5c-fe 90 11 fb 8c ef b1 23 ..1Uw..\.......# 0030 - 9c 88 83 b0 33 5d 84 d6-1a 75 db 68 67 fb 57 3d ....3]...u.hg.W= 0040 - ef 71 6b 7f 22 ae fa bf-d7 0d 12 37 62 69 01 ff .qk."......7bi.. 0050 - 5a 78 29 97 8e ab a4 8e-e0 83 ab 0f 63 fa b4 d9 Zx).........c... 0060 - 3b 08 70 38 56 db 6a 43-8c d3 e4 de 5d 1e 7e cb ;.p8V.jC....].~. 0070 - 82 63 08 cd 31 71 61 17-44 a1 98 87 8a a5 43 06 .c..1qa.D.....C. 0080 - d1 f8 aa a7 ba 3e 99 32-a9 f8 a6 14 46 bd a2 0e .....>.2....F... 0090 - 74 79 fa 24 c5 5c a2 12-81 cb 2c 85 4b 91 c1 1b ty.$.\....,.K... 00a0 - 7d c3 3d c9 6a 58 12 4e-41 b7 eb 29 9e b6 90 07 }.=.jX.NA..).... 00b0 - e1 92 dd 8d 44 69 ....Di Start Time: 1549799117 Timeout : 7200 (sec) Verify return code: 0 (ok) Extended master secret: no Max Early Data: 0 --- read R BLOCK closed Which seems strange to me since Cloudflair offers TLSv1.3 but unbound initializes only TLSv1.2 . Have check all working DoT servers from here --> https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Test+Servers too, but no TLSv1.3 at all... Did someone have similar behaviors ? Best, Erik

3 19

Logwatch (randomly) skipping days => Feature!?
by Matthias Fischer 01 Apr '19

01 Apr '19

Hi, I discovered something weird: >From time to time 'logwatch' does not create a daily log. E.g.: The file '/var/log/logwatch/2019-14-26' exists, but size = 0 Bytes. The same happened yesterday with '/var/log/logwatch/2019-02-16': 0 Bytes. After running... /usr/local/bin/logwatch > /var/log/logwatch/`date -I -d yesterday`; \ LOGWATCH_KEEP=$(sed -ne 's/^LOGWATCH_KEEP=$[0-9]\+$$/\1/p' /var/ipfire/logging/settings); \ find /var/log/logwatch/ -ctime +${LOGWATCH_KEEP=56} -exec rm -f '{}' ';' ...manually from console, file was created, everything looks ok. 1. Can anyone confirm? 2. With which parameter could I change the starting time "01 0 * * *" so that this doesn't happen again? I'm searching, but can't find a grip on this... Best, Matthias

4 10

Re: Status emails and IP Blocklists
by Michael Tremer 01 Apr '19

01 Apr '19

Hey, > On 1 Dec 2018, at 18:20, Tim FitzGeorge <ipfr(a)tfitzgeorge.me.uk> wrote: > > Hi, > > On 30/11/2018 11:04, Michael Tremer wrote: >> Hey Tim, >> >> thanks for your email! >> >> Those addons look great. Quite neat and tidy code and probably they are >> scratching an itch for some people. >> >> On Thu, 2018-11-29 at 21:11 +0000, Tim FitzGeorge wrote: >>> I've written a couple of addons for my installations of IPFire. They're >>> available on github and some other people have tried them; they seem to >>> be fairly well received and it's been suggested that it may be worth >>> making them available through pakfire as official addons. >> Where did you publish them before? > I've not published them before - I didn't even announce them on the > forums, but someone must have looked around after looking at the IDS > rule updater. Well, I guess great software finds its users on its own... >>> The first addon provides the ability to send status emails. You can >>> define multiple schedules and the items to be included in each email. >>> By choosing parameters carefully it's possible to get it to send emails >>> on some error conditions. The emails can be encrypted with GPG. The >>> architecture makes it easy to add further items to be reported on. >> Could you send an example email what it looks like? I do not see any reason why >> this should not be part of the distribution and would like to ask you to submit >> this as a patch that can be merged into mainline. > > I've attached a jpeg of the HTML version of a test email. It's had > certain information redacted. I don't include quite so much information > in my normal reports. It's also capable of some additional information > (for example errors) which only show up when necessary. Wow this is a lot. As in an overwhelming amount of graphs and data. I am not sure if this is useful when its altogether, but I guess that can be decided by each user… About the UI: I guess that could be a lot shorter. I find it quite logical that when someone wants a weekly report, the graphs should show the whole week and not only the last day. So that can be a single switch that makes many of the other options further done redundant. > The text emails can contain everything except the graphs. I've got my > systems set up to send an HTML email at midnight with a summary of the > previous day's information including some graphs, plus a text email of > error conditions every hour - this only gets sent if there are errors. > > > This one just turned up: > > Error check report > > > System > ------ > > SSH > > Logins > > User From Count > root 192.168.999.999 2 > > > I'll start working on a patch. I think my one question at this point is > where should it go in the menus? I put it under 'IPFire' since that > seems to be where miscellaneous addons go, but is there a better place > for it? Good questions. I am not very happy with the IPFire sub-menu because there is no point in it. This is a left-over from about 15 years ago when we used IPCop as a base. I think this could even be part of the email settings CGI; or it should go into logging. >> >> Maybe we can extend this over time and have it send more information if there >> are any requests. > Yes, it's got a plug-in architecture and in most cases adding more > information is quite easy. The main code takes care of formatting, > whether for HTML or Text, so a table can be added with one function call > which is passed an array of arrays. >> >> Would you be up for maintaining this long-term? > Yes. Great! >> >> Did you develop this for yourself or for work or has this been sponsored by >> someone else? > > I did it for myself. As well as my home system, I've got another one > set up at a small charity, and I wanted a way to see its status without > having to go over there. I didn't want to set up a VPN just for logging > in and checking status. Looks like a lot of work as a workaround to not set up a VPN. >>> The second addon handles the setting up and updating of IP Address >>> Blocklists in the firewall. It includes options to select which lists >>> to use, and some control over how frequently to check for updates. >> I guess Peter might be quite excited about this :) >> >> I personally do not have much use for this, but again, why should this not >> become part of IPFire? >> >> I did not install any of these yet, so could you maybe excuse lazy me and send >> screenshots? :) > Attached. The WUI for this is fairly simple. There's also a logwatch > plug in so that a summary of the update status appears in the log summary. See my comments above. I also have some other probably minor questions regarding some things on here, but I guess that can wait… >>> Both include WUI pages for configuration and language files. They're >>> fully functional, but would require some checking and minor updates. >>> The source can be seen at https://github.com/timfprogs . >> I have seen a third one which updates Snort rules. I am sure that you have heard >> about us changing to suricata soon (test images are available). However, the >> rules are roughly the same and the same update tools can be used. So, again, >> would you be interested to have this in the distribution and maintain it? > Definitely. I believe that there's already an automatic updater > provided, but I think mine has more facilities. I'm planning to install > the suricata test image in the next few weeks and have a good look at it. Yes, we should work on one thing after the other. Great that you join testing. Potentially we should think about working on this first now, so that suricata can go out as soon as possible with as many features as possible. Would you be okay with that? >>> I'm aware that there other people have made addons for both these >>> purposes, which maybe suggests that it's functionality that is worth adding. >> Best, >> -Michael >> >> P.S. Did you get any help building these or do you speak four languages? > > Alas, I only really speak English (although I do have some limited > knowledge of French and Latin). I used Google translate, so I expect > some errors - hopefully amusing ones rather than insulting. Good question. I have no idea. We can check with a speaker of any of those languages or ship it English-only. Best, -Michael > > > Tim > > > > <statusmail_email.jpeg><statusmail_wui.jpeg><blocklist-wui.png>

2 2

IPFire-3.x Images
by Jonatan Schlag 21 Mar '19

21 Mar '19

Hi list, I want to inform you all that new images for IPFire-3.x are available. See this wiki page for more information: https://wiki.ipfire.org/devel/get_image/start I also want to use this E-Mail as a reminder that we not only have IPFire-2.x. I have worked with IPFire-3.x a lot and compared to IPFire- 2.x this version makes a lot of things better than IPFire-2.x A lot of things are very limited in IPFire-2.x. For example, the network in IPFire-2.x does not support IPv6. It is not productive to implement IPv6 in IPFire-2.x. and that's why we build IPFire-3.x from scratch. That means unfortunately that the effort for IPFire-2.x cannot or only partly reused iPFire-3.x. IPFire-3.x is build to support IPv6 and if we want to support this we need IPFire-3.x. Currently, the development work is done by Michael Tremer, Arne Fitzenreiten, Peter Müller, Stefan Schantl and me. My time is very limited at this moment and the other 4 have to work also on IPFire-2.x. As stated time is limited and 4 persons are not enough to build IPFire- 3.x. To push the development of IPFire-3.x it would be cool If everybody would thinking about working on this next major version too. A good starting point is the IPFire-3.x step by step guide here https://wiki.ipfire.org/devel/start So thank you all for your efforts and maybe we can increase the speed of IPFire-3.x development a little bit. :-) Greetings Jonatan

5 5

New addon: zabbix_agentd
by Alexander Koch 11 Mar '19

11 Mar '19

Hello, I would like to contribute a new addon for monitoring hosts running IPFire by Zabbix Monitoring (https://www.zabbix.com/features) to IPFire. Topic in the forum: https://forum.ipfire.org/viewtopic.php?f=52&t=22039 I'm not a professional software developer and this is going to be my first patch for IPFire. I hope I did not make any stupid mistakes and I'm not wasting you're time. I've built and tested (only for/on x86_64) this package for/with core126, core127 (testing) and core128 (Development Build: zabbix_agentd/b72540bc) so far. Before I finally submit this as a Patch, I've got two questions I could not figure out reading the wiki/forum: 1: How are logfiles (/var/log/zabbix) supposed to be treated by the backup- and uninstall-scripts of an addon? Are logs supposed to be included in the addon-backup? Is the log-directory supposed to be deleted by the uninstall.sh of the addon? If I do not include them in the backup, but delete the log-directory in uninstall.sh, the logs will be flushed on every update of the addon. This is probably not what the users expects to happen. 2: How is the original source-code of zabbix (https://www.zabbix.com/download_sources) supposed to be shipped with the patch? A patch only includes the lfs, config etc. and I did not find a place to provide a download URL for it. Did I miss something? Best, Alex P.S. Just in case you want to check what I achieved so far, I attached my current patchfile below: Subject: [PATCH] zabbix_agentd: New addon for monitoring IPFire Hosts by Zabbix Monitoring (https://www.zabbix.com/features). See https://forum.ipfire.org/viewtopic.php?f=52&t=22039 for further details. Signed-off-by: Alexander Koch <ipfire(a)starkstromkonsument.de> --- config/backup/includes/zabbix_agentd | 3 + config/rootfiles/packages/zabbix_agentd | 21 ++ config/zabbix_agentd/logrotate | 9 + config/zabbix_agentd/pakfire_updates.pl | 100 ++++++ config/zabbix_agentd/sudoers | 17 + config/zabbix_agentd/userparameter_pakfire.conf | 4 + config/zabbix_agentd/zabbix_agentd.conf | 394 ++++++++++++++++++++++++ lfs/zabbix_agentd | 128 ++++++++ make.sh | 1 + src/initscripts/packages/zabbix_agentd | 61 ++++ src/paks/zabbix_agentd/install.sh | 45 +++ src/paks/zabbix_agentd/uninstall.sh | 38 +++ src/paks/zabbix_agentd/update.sh | 26 ++ 13 files changed, 847 insertions(+) create mode 100644 config/backup/includes/zabbix_agentd create mode 100644 config/rootfiles/packages/zabbix_agentd create mode 100644 config/zabbix_agentd/logrotate create mode 100644 config/zabbix_agentd/pakfire_updates.pl create mode 100644 config/zabbix_agentd/sudoers create mode 100644 config/zabbix_agentd/userparameter_pakfire.conf create mode 100644 config/zabbix_agentd/zabbix_agentd.conf create mode 100755 lfs/zabbix_agentd create mode 100755 src/initscripts/packages/zabbix_agentd create mode 100644 src/paks/zabbix_agentd/install.sh create mode 100644 src/paks/zabbix_agentd/uninstall.sh create mode 100644 src/paks/zabbix_agentd/update.sh diff --git a/config/backup/includes/zabbix_agentd b/config/backup/includes/zabbix_agentd new file mode 100644 index 0000000..d6a2b49 --- /dev/null +++ b/config/backup/includes/zabbix_agentd @@ -0,0 +1,3 @@ +/etc/sudoers.d/zabbix +/etc/zabbix/zabbix_agentd.* +/etc/zabbix/scripts diff --git a/config/rootfiles/packages/zabbix_agentd b/config/rootfiles/packages/zabbix_agentd new file mode 100644 index 0000000..f12c46d --- /dev/null +++ b/config/rootfiles/packages/zabbix_agentd @@ -0,0 +1,21 @@ +#etc/group- +etc/logrotate.d/zabbix_agentd +etc/rc.d/init.d/zabbix_agentd +etc/sudoers.d/zabbix +#etc/zabbix +#etc/zabbix/scripts +etc/zabbix/scripts/pakfire_updates.pl +etc/zabbix/zabbix_agentd.conf +#etc/zabbix/zabbix_agentd.conf.d +#etc/zabbix/zabbix_agentd.d +etc/zabbix/zabbix_agentd.d/userparameter_pakfire.conf +etc/zabbix/zabbix_agentd.psk +usr/bin/zabbix_get +usr/bin/zabbix_sender +#usr/lib/modules +usr/sbin/zabbix_agentd +#usr/share/man/man1/zabbix_get.1 +#usr/share/man/man1/zabbix_sender.1 +#usr/share/man/man8/zabbix_agentd.8 +var/ipfire/backup/addons/includes/zabbix_agentd +#var/log/zabbix diff --git a/config/zabbix_agentd/logrotate b/config/zabbix_agentd/logrotate new file mode 100644 index 0000000..83bbca9 --- /dev/null +++ b/config/zabbix_agentd/logrotate @@ -0,0 +1,9 @@ +/var/log/zabbix/zabbix_agentd.log { + monthly + rotate 12 + compress + delaycompress + missingok + notifempty + create 0640 zabbix zabbix +} diff --git a/config/zabbix_agentd/pakfire_updates.pl b/config/zabbix_agentd/pakfire_updates.pl new file mode 100644 index 0000000..875df40 --- /dev/null +++ b/config/zabbix_agentd/pakfire_updates.pl @@ -0,0 +1,100 @@ +#!/usr/bin/perl +# +# Script for fetching available updates and "need reboot"-status for userparameter of zabbix_agentd +# +# This script is based on /opt/pakfire/lib/functions.pl +# +# Created on 09.07.2017 by Alexander Koch (ipfire(a)starkstromkonsument.de) +# Last modified on 24.01.19 by Alexander Koch (ipfire(a)starkstromkonsument.de) +# + +# Inculde Pakfire-Functions +require "/opt/pakfire/lib/functions.pl"; + +# Check for passed options +unless (@ARGV) { + print "No options given!\n"; + print "Possible options: updatescount, coreupdate_avail, need_reboot\n"; + exit 2; +} + +# Count packets +if ("$ARGV[0]" eq "updatescount") { + + # The following lines have been copied from /opt/pakfire/lib/functions.pl with minor modifications. + my @meta; + my $file; + my $line; + my $prog; + my ($name, $version, $release); + my @templine; + my $updatecount = 0; + + # Get list of packets + open(FILE, "<$Conf::dbdir/lists/packages_list.db"); + my @db = <FILE>; + close(FILE); + + # Get installed addons + opendir(DIR,"$Conf::dbdir/installed"); + my @files = readdir(DIR); + closedir(DIR); + foreach $file (@files) { + next if ( $file eq "." ); + next if ( $file eq ".." ); + next if ( $file =~ /^old/ ); + open(FILE, "<$Conf::dbdir/installed/$file"); + @meta = <FILE>; + close(FILE); + foreach $line (@meta) { + @templine = split(/\: /,$line); + if ("$templine[0]" eq "Name") { + $name = $templine[1]; + chomp($name); + } elsif ("$templine[0]" eq "ProgVersion") { + $version = $templine[1]; + chomp($version); + } elsif ("$templine[0]" eq "Release") { + $release = $templine[1]; + chomp($release); + } + } + foreach $prog (@db) { + @templine = split(/\;/,$prog); + if (("$name" eq "$templine[0]") && ("$release" < "$templine[2]")) { + $updatecount++; + } + } + } + print $updatecount; + exit 0; +} + +elsif ("$ARGV[0]" eq "coreupdate_avail") { + eval(`grep "core_" $Conf::dbdir/lists/core-list.db`); + if ("$core_release" > "$Conf::core_mine") { + print 1; + exit 0; + } + else { + print 0; + exit 0; + } +} + +elsif ("$ARGV[0]" eq "need_reboot") { + if ( -e "/var/run/need_reboot" ) { + print 1; + exit 0; + } + else { + print 0; + exit 0; + } +} + +else { + print "Wrong options!\n"; + print "Possible options: updatescount, coreupdate_avail, need_reboot\n"; + exit 2; +} diff --git a/config/zabbix_agentd/sudoers b/config/zabbix_agentd/sudoers new file mode 100644 index 0000000..d6049f3 --- /dev/null +++ b/config/zabbix_agentd/sudoers @@ -0,0 +1,17 @@ +# Include file for sudoers file +# +# This is needed for some userparameters to be able to execute commands that only run as root (using sudo) +# e.g. /usr/bin/openssl or /usr/sbin/smartctl +# +# USE AT YOU'RE OWN RISK. USING THIS WRONG CAN RESULT IN A SECURITY BREACH! +# +# Some hints: +# - It is strongly recommended to edit this file only using the visudo -f <filename> command. If you mess up this file, +# you might end up locking yourself out of your system! +# - Append the full path to each command, using "," as separator. +# - Only add commands you really need. Zabbix should not have more rights than it has to. +# +# Uncomment the following two lines and edit the example of commands to fit your needs: +# +#Defaults:zabbix !requiretty +#zabbix ALL=(ALL) NOPASSWD: /usr/bin/openssl, /usr/sbin/smartctl diff --git a/config/zabbix_agentd/userparameter_pakfire.conf b/config/zabbix_agentd/userparameter_pakfire.conf new file mode 100644 index 0000000..4fc4265 --- /dev/null +++ b/config/zabbix_agentd/userparameter_pakfire.conf @@ -0,0 +1,4 @@ +# Provide additional items for Pakfire-Updates +UserParameter=pakfire.updatescount,/etc/zabbix/scripts/pakfire_updates.pl updatescount +UserParameter=pakfire.coreupdate_avail,/etc/zabbix/scripts/pakfire_updates.pl coreupdate_avail +UserParameter=pakfire.need_reboot,/etc/zabbix/scripts/pakfire_updates.pl need_reboot diff --git a/config/zabbix_agentd/zabbix_agentd.conf b/config/zabbix_agentd/zabbix_agentd.conf new file mode 100644 index 0000000..e60af19 --- /dev/null +++ b/config/zabbix_agentd/zabbix_agentd.conf @@ -0,0 +1,394 @@ +# This is a configuration file for Zabbix agent daemon (Unix) +# To get more information about Zabbix, visit http://www.zabbix.com + +############ GENERAL PARAMETERS ################# + +### Option: PidFile +# Name of PID file. +# +# Mandatory: no +# Default: +# PidFile=/tmp/zabbix_agentd.pid + +PidFile=/var/run/zabbix/zabbix_agentd.pid + +### Option: LogType +# Specifies where log messages are written to: +# system - syslog +# file - file specified with LogFile parameter +# console - standard output +# +# Mandatory: no +# Default: +# LogType=file + +### Option: LogFile +# Log file name for LogType 'file' parameter. +# +# Mandatory: yes, if LogType is set to file, otherwise no +# Default: +# LogFile= + +LogFile=/var/log/zabbix/zabbix_agentd.log + +### Option: LogFileSize +# Maximum size of log file in MB. +# 0 - disable automatic log rotation. +# +# Mandatory: no +# Range: 0-1024 +# Default: +# LogFileSize=1 + +### Option: DebugLevel +# Specifies debug level: +# 0 - basic information about starting and stopping of Zabbix processes +# 1 - critical information +# 2 - error information +# 3 - warnings +# 4 - for debugging (produces lots of information) +# 5 - extended debugging (produces even more information) +# +# Mandatory: no +# Range: 0-5 +# Default: +# DebugLevel=3 + +### Option: SourceIP +# Source IP address for outgoing connections. +# +# Mandatory: no +# Default: +# SourceIP= + +### Option: EnableRemoteCommands +# Whether remote commands from Zabbix server are allowed. +# 0 - not allowed +# 1 - allowed +# +# Mandatory: no +# Default: +# EnableRemoteCommands=0 + +### Option: LogRemoteCommands +# Enable logging of executed shell commands as warnings. +# 0 - disabled +# 1 - enabled +# +# Mandatory: no +# Default: +# LogRemoteCommands=0 + +##### Passive checks related + +### Option: Server +# List of comma delimited IP addresses, optionally in CIDR notation, or DNS names of Zabbix servers and Zabbix proxies. +# Incoming connections will be accepted only from the hosts listed here. +# If IPv6 support is enabled then '127.0.0.1', '::127.0.0.1', '::ffff:127.0.0.1' are treated equally +# and '::/0' will allow any IPv4 or IPv6 address. +# '0.0.0.0/0' can be used to allow any IPv4 address. +# Example: Server=127.0.0.1,192.168.1.0/24,::1,2001:db8::/32,zabbix.example.com +# +# Mandatory: yes, if StartAgents is not explicitly set to 0 +# Default: +# Server= + +Server=127.0.0.1 + +### Option: ListenPort +# Agent will listen on this port for connections from the server. +# +# Mandatory: no +# Range: 1024-32767 +# Default: +# ListenPort=10050 + +### Option: ListenIP +# List of comma delimited IP addresses that the agent should listen on. +# First IP address is sent to Zabbix server if connecting to it to retrieve list of active checks. +# +# Mandatory: no +# Default: +# ListenIP=0.0.0.0 + +### Option: StartAgents +# Number of pre-forked instances of zabbix_agentd that process passive checks. +# If set to 0, disables passive checks and the agent will not listen on any TCP port. +# +# Mandatory: no +# Range: 0-100 +# Default: +# StartAgents=3 + +##### Active checks related + +### Option: ServerActive +# List of comma delimited IP:port (or DNS name:port) pairs of Zabbix servers and Zabbix proxies for active checks. +# If port is not specified, default port is used. +# IPv6 addresses must be enclosed in square brackets if port for that host is specified. +# If port is not specified, square brackets for IPv6 addresses are optional. +# If this parameter is not specified, active checks are disabled. +# Example: ServerActive=127.0.0.1:20051,zabbix.domain,[::1]:30051,::1,[12fc::1] +# +# Mandatory: no +# Default: +# ServerActive= + +ServerActive=127.0.0.1 + +### Option: Hostname +# Unique, case sensitive hostname. +# Required for active checks and must match hostname as configured on the server. +# Value is acquired from HostnameItem if undefined. +# +# Mandatory: no +# Default: +# Hostname= + +### Option: HostnameItem +# Item used for generating Hostname if it is undefined. Ignored if Hostname is defined. +# Does not support UserParameters or aliases. +# +# Mandatory: no +# Default: +# HostnameItem=system.hostname + +### Option: HostMetadata +# Optional parameter that defines host metadata. +# Host metadata is used at host auto-registration process. +# An agent will issue an error and not start if the value is over limit of 255 characters. +# If not defined, value will be acquired from HostMetadataItem. +# +# Mandatory: no +# Range: 0-255 characters +# Default: +# HostMetadata= + +### Option: HostMetadataItem +# Optional parameter that defines an item used for getting host metadata. +# Host metadata is used at host auto-registration process. +# During an auto-registration request an agent will log a warning message if +# the value returned by specified item is over limit of 255 characters. +# This option is only used when HostMetadata is not defined. +# +# Mandatory: no +# Default: +# HostMetadataItem= + +### Option: RefreshActiveChecks +# How often list of active checks is refreshed, in seconds. +# +# Mandatory: no +# Range: 60-3600 +# Default: +# RefreshActiveChecks=120 + +### Option: BufferSend +# Do not keep data longer than N seconds in buffer. +# +# Mandatory: no +# Range: 1-3600 +# Default: +# BufferSend=5 + +### Option: BufferSize +# Maximum number of values in a memory buffer. The agent will send +# all collected data to Zabbix Server or Proxy if the buffer is full. +# +# Mandatory: no +# Range: 2-65535 +# Default: +# BufferSize=100 + +### Option: MaxLinesPerSecond +# Maximum number of new lines the agent will send per second to Zabbix Server +# or Proxy processing 'log' and 'logrt' active checks. +# The provided value will be overridden by the parameter 'maxlines', +# provided in 'log' or 'logrt' item keys. +# +# Mandatory: no +# Range: 1-1000 +# Default: +# MaxLinesPerSecond=20 + +############ ADVANCED PARAMETERS ################# + +### Option: Alias +# Sets an alias for an item key. It can be used to substitute long and complex item key with a smaller and simpler one. +# Multiple Alias parameters may be present. Multiple parameters with the same Alias key are not allowed. +# Different Alias keys may reference the same item key. +# For example, to retrieve the ID of user 'zabbix': +# Alias=zabbix.userid:vfs.file.regexp[/etc/passwd,^zabbix:.:([0-9]+),,,,\1] +# Now shorthand key zabbix.userid may be used to retrieve data. +# Aliases can be used in HostMetadataItem but not in HostnameItem parameters. +# +# Mandatory: no +# Range: +# Default: + +### Option: Timeout +# Spend no more than Timeout seconds on processing +# +# Mandatory: no +# Range: 1-30 +# Default: +# Timeout=3 + +### Option: AllowRoot +# Allow the agent to run as 'root'. If disabled and the agent is started by 'root', the agent +# will try to switch to the user specified by the User configuration option instead. +# Has no effect if started under a regular user. +# 0 - do not allow +# 1 - allow +# +# Mandatory: no +# Default: +# AllowRoot=0 + +### Option: User +# Drop privileges to a specific, existing user on the system. +# Only has effect if run as 'root' and AllowRoot is disabled. +# +# Mandatory: no +# Default: +# User=zabbix + +### Option: Include +# You may include individual files or all files in a directory in the configuration file. +# Installing Zabbix will create include directory in /usr/local/etc, unless modified during the compile time. +# +# Mandatory: no +# Default: +# Include= + +Include=/etc/zabbix/zabbix_agentd.d/*.conf + + +####### USER-DEFINED MONITORED PARAMETERS ####### + +### Option: UnsafeUserParameters +# Allow all characters to be passed in arguments to user-defined parameters. +# The following characters are not allowed: +# \ ' " ` * ? [ ] { } ~ $ ! & ; ( ) < > | # @ +# Additionally, newline characters are not allowed. +# 0 - do not allow +# 1 - allow +# +# Mandatory: no +# Range: 0-1 +# Default: +# UnsafeUserParameters=0 + +### Option: UserParameter +# User-defined parameter to monitor. There can be several user-defined parameters. +# Format: UserParameter=<key>,<shell command> +# See 'zabbix_agentd' directory for examples. +# +# Mandatory: no +# Default: +# UserParameter= + +####### LOADABLE MODULES ####### + +### Option: LoadModulePath +# Full path to location of agent modules. +# Default depends on compilation options. +# To see the default path run command "zabbix_agentd --help". +# +# Mandatory: no +# Default: +# LoadModulePath=/usr/lib/modules + +### Option: LoadModule +# Module to load at agent startup. Modules are used to extend functionality of the agent. +# Format: LoadModule=<module.so> +# The modules must be located in directory specified by LoadModulePath. +# It is allowed to include multiple LoadModule parameters. +# +# Mandatory: no +# Default: +# LoadModule= + +####### TLS-RELATED PARAMETERS ####### + +### Option: TLSConnect +# How the agent should connect to server or proxy. Used for active checks. +# Only one value can be specified: +# unencrypted - connect without encryption +# psk - connect using TLS and a pre-shared key +# cert - connect using TLS and a certificate +# +# Mandatory: yes, if TLS certificate or PSK parameters are defined (even for 'unencrypted' connection) +# Default: +# TLSConnect=unencrypted + +### Option: TLSAccept +# What incoming connections to accept. +# Multiple values can be specified, separated by comma: +# unencrypted - accept connections without encryption +# psk - accept connections secured with TLS and a pre-shared key +# cert - accept connections secured with TLS and a certificate +# +# Mandatory: yes, if TLS certificate or PSK parameters are defined (even for 'unencrypted' connection) +# Default: +# TLSAccept=unencrypted + +### Option: TLSCAFile +# Full pathname of a file containing the top-level CA(s) certificates for +# peer certificate verification. +# +# Mandatory: no +# Default: +# TLSCAFile= + +### Option: TLSCRLFile +# Full pathname of a file containing revoked certificates. +# +# Mandatory: no +# Default: +# TLSCRLFile= + +### Option: TLSServerCertIssuer +# Allowed server certificate issuer. +# +# Mandatory: no +# Default: +# TLSServerCertIssuer= + +### Option: TLSServerCertSubject +# Allowed server certificate subject. +# +# Mandatory: no +# Default: +# TLSServerCertSubject= + +### Option: TLSCertFile +# Full pathname of a file containing the agent certificate or certificate chain. +# +# Mandatory: no +# Default: +# TLSCertFile= + +### Option: TLSKeyFile +# Full pathname of a file containing the agent private key. +# +# Mandatory: no +# Default: +# TLSKeyFile= + +### Option: TLSPSKIdentity +# Unique, case sensitive string used to identify the pre-shared key. +# +# Mandatory: no +# Default: +# TLSPSKIdentity= + +### Option: TLSPSKFile +# Full pathname of a file containing the pre-shared key. +# +# Mandatory: no +# Default: +# TLSPSKFile= + +#TLSPSKFile=/etc/zabbix/zabbix_agentd.psk + diff --git a/lfs/zabbix_agentd b/lfs/zabbix_agentd new file mode 100755 index 0000000..fba24f1 --- /dev/null +++ b/lfs/zabbix_agentd @@ -0,0 +1,128 @@ +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +############################################################################### +# Definitions +############################################################################### + +include Config + +VER = 4.0.3 + +THISAPP = zabbix-$(VER) +DL_FILE = $(THISAPP).tar.gz +DL_FROM = $(URL_IPFIRE) +DIR_APP = $(DIR_SRC)/$(THISAPP) +TARGET = $(DIR_INFO)/$(THISAPP) +PROG = zabbix_agentd +PAK_VER = 0.4 +DEPS = "" + +############################################################################### +# Top-level Rules +############################################################################### + +objects = $(DL_FILE) + +$(DL_FILE) = $(DL_FROM)/$(DL_FILE) + +$(DL_FILE)_MD5 = 917d7303c248a9d1c49b8883c01ab2d9 + +install : $(TARGET) + +check : $(patsubst %,$(DIR_CHK)/%,$(objects)) + +download :$(patsubst %,$(DIR_DL)/%,$(objects)) + +md5 : $(subst %,%_MD5,$(objects)) + +dist: + @$(PAK) + +############################################################################### +# Downloading, checking, md5sum +############################################################################### + +$(patsubst %,$(DIR_CHK)/%,$(objects)) : + @$(CHECK) + +$(patsubst %,$(DIR_DL)/%,$(objects)) : + @$(LOAD) + +$(subst %,%_MD5,$(objects)) : + @$(MD5) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) + @$(PREBUILD) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axvf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && ./configure \ + --prefix=/usr \ + --enable-agent \ + --sysconfdir="/etc/zabbix" \ + --with-openssl + + cd $(DIR_APP) && make + cd $(DIR_APP) && make install + + # Add User Zabbix if it does not exist + id -u zabbix &>/dev/null || useradd -r -U -s /bin/false -M -d /var/empty -c "Zabbix Monitoring" zabbix + + # Create config directory and create files. + -rmdir zabbix_agentd.conf.d + -mkdir -pv /etc/zabbix/zabbix_agentd.d + -mkdir -pv /etc/zabbix/scripts + install -v -m 644 $(DIR_SRC)/config/zabbix_agentd/zabbix_agentd.conf \ + /etc/zabbix/zabbix_agentd.conf + install -v -m 644 $(DIR_SRC)/config/zabbix_agentd/userparameter_pakfire.conf \ + /etc/zabbix/zabbix_agentd.d/userparameter_pakfire.conf + install -v -m 754 -g zabbix $(DIR_SRC)/config/zabbix_agentd/pakfire_updates.pl \ + /etc/zabbix/scripts/pakfire_updates.pl + touch /etc/zabbix/zabbix_agentd.psk + + # Create directory and file for logging. + -mkdir -pv /var/log/zabbix + chown zabbix.zabbix /var/log/zabbix -R + + # Create directory for pid. + -mkdir -pv /var/run/zabbix + chown zabbix.zabbix /var/run/zabbix + + # Install initscripts + $(call INSTALL_INITSCRIPT,zabbix_agentd) + + # Install sudoers include file + install -v -m 440 $(DIR_SRC)/config/zabbix_agentd/sudoers \ + /etc/sudoers.d/zabbix + + # Install include file for backup + install -v -m 644 $(DIR_SRC)/config/backup/includes/zabbix_agentd \ + /var/ipfire/backup/addons/includes/zabbix_agentd + + # Install include file for Logrotate + -mkdir -pv /etc/logrotate.d + install -v -m 644 $(DIR_SRC)/config/zabbix_agentd/logrotate \ + /etc/logrotate.d/zabbix_agentd + + @rm -rf $(DIR_APP) + @$(POSTBUILD) diff --git a/make.sh b/make.sh index f96b74b..dadae3c 100755 --- a/make.sh +++ b/make.sh @@ -1588,6 +1588,7 @@ buildipfire() { lfsmake2 dehydrated lfsmake2 shairport-sync lfsmake2 borgbackup + lfsmake2 zabbix_agentd } buildinstaller() { diff --git a/src/initscripts/packages/zabbix_agentd b/src/initscripts/packages/zabbix_agentd new file mode 100755 index 0000000..e50b56c --- /dev/null +++ b/src/initscripts/packages/zabbix_agentd @@ -0,0 +1,61 @@ +#!/bin/sh +######################################################################## +# Begin $rc_base/init.d/zabbix_agentd +# +# Description : This is a script that starts zabbix_agent as deamon +# +# Authors : Alexander Koch (ipfire(a)starkstromkonsument.de) +# +# Version : 01.00 +# +# Notes : +# +######################################################################## + +. /etc/sysconfig/rc +. ${rc_functions} + +NAME=zabbix_agentd +DAEMON=/usr/sbin/$NAME +DESC="Zabbix agent" +RUNDIR=/var/run/zabbix +CONF=/etc/zabbix/zabbix_agentd.conf + +test -x $DAEMON || exit 0 + +case "${1}" in + start) + # Make sure RUNDIR exists + if [ ! -d $RUNDIR ]; then + boot_mesg "Creating Directory $RUNDIR ..." + mkdir $RUNDIR + chown zabbix.zabbix $RUNDIR + fi + + boot_mesg "Starting $NAME ..." + loadproc $DAEMON -c $CONF > /dev/null + evaluate_retval + ;; + + stop) + boot_mesg "Stopping $NAME ..." + killproc $DAEMON + ;; + + restart) + ${0} stop + sleep 1 + ${0} start + ;; + + status) + statusproc $DAEMON + ;; + + *) + echo "Usage: ${0} {start|stop|restart|status}" + exit 1 + ;; +esac + +# End $rc_base/init.d/zabbix_agentd diff --git a/src/paks/zabbix_agentd/install.sh b/src/paks/zabbix_agentd/install.sh new file mode 100644 index 0000000..7264a08 --- /dev/null +++ b/src/paks/zabbix_agentd/install.sh @@ -0,0 +1,45 @@ +#!/bin/bash +############################################################################ +# # +# This file is part of the IPFire Firewall. # +# # +# IPFire is free software; you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation; either version 2 of the License, or # +# (at your option) any later version. # +# # +# IPFire is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with IPFire; if not, write to the Free Software # +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # +# # +# Copyright (C) 2007 IPFire-Team <info(a)ipfire.org>. # +# # +############################################################################ +# +. /opt/pakfire/lib/functions.sh + +# Add User Zabbix if it does not exist +id -u zabbix &>/dev/null || useradd -r -U -s /bin/false -M -d /var/empty -c "Zabbix Monitoring" zabbix + +extract_files + +# Create additonal Directories and set permissions +mkdir -pv /etc/zabbix/zabbix_agentd.d +mkdir -pv /etc/zabbix/scripts +mkdir -pv /var/run/zabbix +chown zabbix.zabbix /var/run/zabbix +mkdir -pv /var/log/zabbix +chown zabbix.zabbix /var/log/zabbix -R + +# Create symlinks for runlevel interaction. +ln -sf ../init.d/zabbix_agentd /etc/rc.d/rc3.d/S14zabbix_agentd +ln -sf ../init.d/zabbix_agentd /etc/rc.d/rc0.d/K71zabbix_agentd +ln -sf ../init.d/zabbix_agentd /etc/rc.d/rc6.d/K71zabbix_agentd + +restore_backup ${NAME} +start_service --background ${NAME} diff --git a/src/paks/zabbix_agentd/uninstall.sh b/src/paks/zabbix_agentd/uninstall.sh new file mode 100644 index 0000000..ae8f815 --- /dev/null +++ b/src/paks/zabbix_agentd/uninstall.sh @@ -0,0 +1,38 @@ +#!/bin/bash +############################################################################ +# # +# This file is part of the IPFire Firewall. # +# # +# IPFire is free software; you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation; either version 2 of the License, or # +# (at your option) any later version. # +# # +# IPFire is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with IPFire; if not, write to the Free Software # +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # +# # +# Copyright (C) 2007 IPFire-Team <info(a)ipfire.org>. # +# # +############################################################################ +# +. /opt/pakfire/lib/functions.sh +stop_service ${NAME} +make_backup ${NAME} +remove_files + +# Remove init-scripts and symlinks +rm -rfv /etc/rc.d/rc*.d/*zabbix_agentd + +# Remove directorys +rm -rfv /etc/zabbix +rm -rfv /var/log/zabbix +rm -rfv /var/run/zabbix + +# Remove user and group +userdel zabbix diff --git a/src/paks/zabbix_agentd/update.sh b/src/paks/zabbix_agentd/update.sh new file mode 100644 index 0000000..89c40d0 --- /dev/null +++ b/src/paks/zabbix_agentd/update.sh @@ -0,0 +1,26 @@ +#!/bin/bash +############################################################################ +# # +# This file is part of the IPFire Firewall. # +# # +# IPFire is free software; you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation; either version 2 of the License, or # +# (at your option) any later version. # +# # +# IPFire is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with IPFire; if not, write to the Free Software # +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # +# # +# Copyright (C) 2007 IPFire-Team <info(a)ipfire.org>. # +# # +############################################################################ +# +. /opt/pakfire/lib/functions.sh +./uninstall.sh +./install.sh -- 2.7.4

2 9

Re: [PATCH 0/1] Parallelized build for several packages
by Wolfgang Apolinarski 08 Mar '19

08 Mar '19

Hi Arne, of course I did delete the ccache between my multiple builds to verify the commit. To play it safe, I hard reset using git, checked that all folders (build, ccache, etc.) are gone and restarted the build after gettoolchain and downloadsrc. Sorry, I did not know that there are still a lot of machines with low ram that we are using to build ipfire. My hope was that these machines have disappeared over the last years. Additionally, I do not have the ability to test all ipfire arches, as mentioned, the patch needs testing by others. I also thought of adding a manual parameter for developers that somehow manually sets the parameters for parallel build, but since the MAKETUNING parameter already exists and is used with other packages this would just somehow mess everything up. For my builds, I can just manually apply the patch to speed up the full build. My thought was that sharing the patch would make sense for others. > -----Ursprüngliche Nachricht----- > Von: Arne Fitzenreiter <Arne.Fitzenreiter(a)ipfire.org> > Gesendet: Donnerstag, 21. Februar 2019 09:44 > An: Wolfgang Apolinarski <wolfgang.apolinarski(a)ipfire.org> > Cc: development(a)lists.ipfire.org > Betreff: Re: [PATCH 0/1] Parallelized build for several packages > > On the most of this packages (eg. boot and cmake) i have disabled > parallel build because it fails on machines with low ram (less than 2GB) > or on arm. > So such changes need tested on an 1GB machine, on all architectures and > build two times after deleting ccache. Because the build need much lower > resources if it has the file already prebuilt in cache.

3 4

Release planning for Core Update 127/128 and beyond...
by Michael Tremer 08 Mar '19

08 Mar '19

Hello, I would like to break the wintery silence on this list and give you a little update on the upcoming Core Updates: We consider Core Update 127 ready for release after rebuilding it a couple of times and fixing some bugs that unfortunately made it into the image. We are going to release it next Wednesday. On the same day (or preferably earlier), I would like to close Core Update 128 and upload it into testing. It does not have any new features, but brings a new kernel and OpenSSL 1.1.1. For TLSv1.3 to work on the web UI, we still need the latest version of Apache and as far as I am aware of it Matthias is supposed to submit a patch for that, am I right? As soon as that is in, the update is ready to be closed from my point of view. Please let me know if you have any further patches. Then, Core Update 129 will be open for patches. I have a branch that adds support for GRE/VTI routed IPsec tunnels. This is probably a little bit of a niche feature and only relevant for some people who use dynamic routing on IPFire, but it will be a headline feature nevertheless. This is also working very nicely on IPFire 3 for some time :) Suricata is now tentatively scheduled for Core Update 130. I would have liked to have it in 129, but we still are not done testing. Feedback is a little bit slow and hopefully, we will see a fresh image this week to kick things off again. I have tested a little bit and it works a lot better than snort. It blocks more precisely, it makes good use of the hardware and therefore is a lot faster than snort and that is all in all a really nice thing. Please keep an eye open for this and help us testing. We also need to work on documentation together and make some benchmarks on various hardware to get a good feeling about the performance impact it has. Best, -Michael

3 6

Strongswan and auto=start
by Tom Rymes 05 Mar '19

05 Mar '19

A while back, I made a feature request to allow configuration of the Strongswan “auto” parameter via the WUI. This made its way into the WUI as the “On-Demand” feature a while back (thank you!!!) https://bugzilla.ipfire.org/show_bug.cgi?id=10733 At the time, I had posted a few links to messages on the StrongSwan mailing list that indicated that auto=route results in superior reliability, and our experience bears this out, but the default remains “auto=start”. In order to support Windows roadwarrior connections, IPFire’s host cert needs a dns Subject Alt Name, so I had to delete all of our tunnels and certs, then recreate them. This meant that I had to change both sides of ~20 tunnels from the default “Always On” (auto=start) to “On Demand” (auto=route). Coincidentally, this message from one of the developers came across the StrongSwan Users list tonight, which basically makes clear that auto=start should not be used: https://lists.strongswan.org/pipermail/users/2019-February/013373.html The relevant quotation: “Use auto=route. Auto=start is not reliable.” This raises the question as to why auto=start is still the default in IPFire. Thoughts? Tom

2 7

IPFire meets Suricata - Call for tester
by Stefan Schantl 05 Mar '19

05 Mar '19

Hello list followers, some time ago development for the new implementation of the Intrusion Detection functionality in IPFire has been started. The main goal, in a nutshell, was to give IPFire a modern, feature-rich and user-friendly Intrusion Detection Engine. During this progress, the detection framework has been replaced - now suricata is used instead of snort. Suricata uses a very modern and multi-threaded detection engine with support to perform actions on malicious traffic. So it provides the functionality of detecting any kind of intrusion attempts and the ability of guardian to block them under the same hood. It was a lot of work, but finaly I'm happy to announce the first test version. It is almost feature complete and without any kind of bigger issues. Because Intrusion Detection is a key feature of a firewall system, a lot of testing is required until the new implementation can become part of IPFire - therefore we need your help! Download the test image ( https://people.ipfire.org/~stevee/suricata/Images/), do a lot of hard testing and provide your feedback or suggestions on the develoment mailing list (https://lists.ipfire.org/mailman/listinfo/development). If you find any bugs please file them in the IPFire Bugtracker ( https://bugzilla.ipfire.org/). Many thanks in advance, -Stefan

7 49

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development February 2019