Development September 2019

development@lists.ipfire.org

13 participants
80 discussions

[PATCH 1/2] iptables: Update to 1.8.3
by Matthias Fischer 11 Sep '19

11 Sep '19

For details see: https://www.netfilter.org/projects/iptables/files/changes-iptables-1.8.3.txt --- config/rootfiles/common/iptables | 10 ++++++---- lfs/iptables | 4 ++-- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/config/rootfiles/common/iptables b/config/rootfiles/common/iptables index f1a6af00e..389518646 100644 --- a/config/rootfiles/common/iptables +++ b/config/rootfiles/common/iptables @@ -1,11 +1,11 @@ #lib/libip4tc.la lib/libip4tc.so -lib/libip4tc.so.0 -lib/libip4tc.so.0.1.0 +lib/libip4tc.so.2 +lib/libip4tc.so.2.0.0 #lib/libip6tc.la lib/libip6tc.so -lib/libip6tc.so.0 -lib/libip6tc.so.0.1.0 +lib/libip6tc.so.2 +lib/libip6tc.so.2.0.0 #lib/libipq.la lib/libipq.so lib/libipq.so.0 @@ -173,10 +173,12 @@ sbin/xtables-legacy-multi #usr/share/man/man3/libipq.3 #usr/share/man/man8/ip6tables-restore.8 #usr/share/man/man8/ip6tables-save.8 +#usr/share/man/man8/ip6tables-translate.8 #usr/share/man/man8/ip6tables.8 #usr/share/man/man8/iptables-extensions.8 #usr/share/man/man8/iptables-restore.8 #usr/share/man/man8/iptables-save.8 +#usr/share/man/man8/iptables-translate.8 #usr/share/man/man8/iptables.8 #usr/share/man/man8/nfnl_osf.8 #usr/share/man/man8/xtables-legacy.8 diff --git a/lfs/iptables b/lfs/iptables index 3716d8062..b91e41797 100644 --- a/lfs/iptables +++ b/lfs/iptables @@ -24,7 +24,7 @@ include Config -VER = 1.8.2 +VER = 1.8.3 THISAPP = iptables-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -41,7 +41,7 @@ objects = $(DL_FILE) \ $(DL_FILE) = $(DL_FROM)/$(DL_FILE) netfilter-layer7-v2.23.tar.gz = $(URL_IPFIRE)/netfilter-layer7-v2.23.tar.gz -$(DL_FILE)_MD5 = 944558e88ddcc3b9b0d9550070fa3599 +$(DL_FILE)_MD5 = 29de711d15c040c402cf3038c69ff513 netfilter-layer7-v2.23.tar.gz_MD5 = 10910b6173d18e426cb56ae7e1300eeb install : $(TARGET) -- 2.18.0

1 1

GIT sendemail not working anymore
by Matthias Fischer 09 Sep '19

09 Sep '19

Hi, could someone please give a hint? Changing to IMAP and the new MUA settings worked, but now GIT is somehow fooling me. No matter what I do, I always get an error while trying to use 'send-email': Command: git send-email --annotate -1 Results: Unable to initialize SMTP properly. Check config and use --smtp-debug. VALUES: server=submissions.ipfire.org encryption=tls hello=Devel.localdomain port=465 at /usr/lib/git-core/git-send-email line 1514. Or: Unable to initialize SMTP properly. Check config and use --smtp-debug. VALUES: server=mail01.ipfire.org encryption=tls hello=Devel.localdomain port=587 at /usr/lib/git-core/git-send-email line 1514. Using '--smtp-debug' gives me exact the same error. What am I doing wrong? Best, Matthias

2 3

firewall rules.pl - rules of forwardfw are also beeing added to inputfw / outputfw and green/blue are allays accepted on INPUT ????
by Alexander Koch 09 Sep '19

09 Sep '19

Hi, I was wondering why some hosts of my internal nets had access to some ports on my IPFire-Machine that I didn't open for them and I didn't want them to either ... Taking a closer look at the raw iptables content, I noticed that nearly all of my forwardings-rules were also added to the inputfw-chain. I tracked this behaviour down to the following lines in /usr/lib/firewall/rules.pl 503 # Handle forwarding rules and add corresponding rules for firewall access. 504 if ($chain eq $CHAIN_FORWARD) { 505 # If the firewall is part of the destination subnet and access to the destination network 506 # is granted/forbidden for any network that the firewall itself is part of, we grant/forbid access 507 # for the firewall, too. 508 if ($firewall_is_in_destination_subnet && ($target ~~ @special_input_targets)) { 509 if ($LOG && !$NAT) { 510 run("$IPTABLES -A $CHAIN_INPUT @options @source_intf_options @log_limit_options -j LOG --log-prefix '$CHAIN_INPUT '"); 511 } 512 run("$IPTABLES -A $CHAIN_INPUT @options @source_intf_options -j $target"); 513 } 514 515 # Likewise. 516 if ($firewall_is_in_source_subnet && ($target ~~ @special_output_targets)) { 517 if ($LOG && !$NAT) { 518 run("$IPTABLES -A $CHAIN_OUTPUT @options @destination_intf_options @log_limit_options -j LOG --log-prefix '$CHAIN_OUTPUT '"); 519 } 520 run("$IPTABLES -A $CHAIN_OUTPUT @options @destination_intf_options -j $target"); 521 } 522 } What is the goal of doing this? I was not aware of this and it's certainly nothing I expected to happen. I didn't read anything about it in the wiki either. I usually set up different rules for input and forwarding. After figuring this out, I found some policies completely opening input for green and blue in /usr/sbin/firewall-policy 72 # Allow access from GREEN 73 if [ -n "${GREEN_DEV}" ]; then 74 iptables -A POLICYIN -i "${GREEN_DEV}" -j ACCEPT 75 fi 76 77 # Allow access from BLUE 78 if [ "${HAVE_BLUE}" = "true" ] && [ -n "${BLUE_DEV}" ]; then 79 iptables -A POLICYIN -i "${BLUE_DEV}" -j ACCEPT 80 fi I want to be able to configure this the way I want to too. blue is my guest network. It should not have access to anything but dhcp, dns, ntp etc. on my firewall! Is this an issue of me misunderstanding the way the firewall is supposed to work or something that should be patched asap? I would like to understand the reason for this being done this way ... thank you! Regards, Alex

2 1

Testing report regarding image: next-suricata-rust/7808a8a2-dirty
by peter.mueller＠ipfire.org 09 Sep '19

09 Sep '19

Hello Stefan, hello Peter, hello *, @Stefan: Thank you again for building the ISO with Suricata 5.0.0-beta1, Rust and current libhtp. @Peter: Sorry for having not answered your question: The problem is not only related to DNS traffic, but to new connections in general (no matter if they are encrypted or plain text) - see below for details. Initially, Suricata refuses to start: > Sep 8 11:59:43 maverick suricata: [ERRCODE: SC_WARN_NO_STATS_LOGGERS(261)] - stats are enabled but no loggers are active > Sep 8 11:59:43 maverick suricata: [ERRCODE: SC_ERR_NFQ_OPEN(68)] - no queue for given index > Sep 8 11:59:43 maverick suricata: [ERRCODE: SC_ERR_NFQ_THREAD_INIT(78)] - nfq thread failed to initialize Although statistics are disabled in /etc/suricata/suricata.yaml , enabling the statistics logger was necessary. Perhaps a glitch in the beta version, as the statistics log file is empty. Instead of passing the NFQ indices one by one ("-q 0 -q 1 -q 2 -q 3"), Suricata now likes them as a range: "-q 0:3" After changing this in the initscript and deleting orphaned PID file, Suricata starts correctly. Initialisation procedure takes 87 seconds on my testing hardware, which is approximately two times faster compared to Suricata 4.x. Rule parsing works, all tested attacks were successfully detected. Resource consumption of Suricata 5.x is a bit lower compared to 4.x . Unfortunately, both of my problems can be reproduced with that image: (a) Poor OpenVPN throughput. This has improved a bit to 1.2 MB/sec peak, but still is lower than the 2.1 MB/sec I observe on another productive machine. (b) Establishing connections and DNS resolutions takes age Regardless of SSH, HTTP, HTTPS, SMTPS or IMAPS, establishing a new connection takes 1-2 seconds due to massive packet loss. Resolving DNS records using "dig" or "host" is fast, but using "wget" or "curl" is slow. Increasing memory allocations or "max-pending-packets" did not help again. That being said, I think we can be more generous regarding our memory allocations, as most RAM of my testing hardware stayed unallocated. :-) As Eric Leblond already mentioned on the OISF mailing list, the actual problem seems to be something else (netfilter/iptables/?). Version commands for reference: > [root@maverick ~]# suricata -V > This is Suricata version 5.0.0-beta1 RELEASE > [root@maverick ~]# uname -a > Linux maverick 4.14.138-ipfire #1 SMP Sat Sep 7 06:27:36 GMT 2019 x86_64 Intel(R) Celeron(R) CPU N3150 @ 1.60GHz GenuineIntel GNU/Linux > [root@maverick ~]# suricata --build-info > This is Suricata version 5.0.0-beta1 RELEASE > Features: NFQ PCAP_SET_BUFF AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT HAVE_LIBJANSSON TLS MAGIC RUST > SIMD support: none > Atomic intrisics: 1 2 4 8 byte(s) > 64-bits, Little-endian architecture > GCC version 8.3.0, C version 199901 > compiled with _FORTIFY_SOURCE=2 > L1 cache line size (CLS)=64 > thread local storage method: __thread > compiled with LibHTP v0.5.30, linked against LibHTP v0.5.30 > > Suricata Configuration: > AF_PACKET support: yes > eBPF support: no > XDP support: no > PF_RING support: no > NFQueue support: yes > NFLOG support: no > IPFW support: no > Netmap support: no > DAG enabled: no > Napatech enabled: no > WinDivert enabled: no > > Unix socket enabled: yes > Detection enabled: yes > > Libmagic support: yes > libnss support: yes > libnspr support: yes > libjansson support: yes > liblzma support: yes > hiredis support: no > hiredis async with libevent: no > Prelude support: no > PCRE jit: yes > LUA support: no > libluajit: no > libgeoip: no > Non-bundled htp: yes > Old barnyard2 support: no > Hyperscan support: yes > Libnet support: yes > liblz4 support: no > > Rust support: yes > Rust strict mode: no > Rust debug mode: no > Rust compiler: rustc 1.37.0 (eae3437df 2019-08-13) > Rust cargo: cargo 1.37.0 (9edd08916 2019-08-02) > > Python support: no > Python path: not set > Python version: not set > Python distutils no > Python yaml no > Install suricatactl: requires python > Install suricatasc: requires python > Install suricata-update: not bundled > > Profiling enabled: no > Profiling locks enabled: no > > Development settings: > Coccinelle / spatch: no > Unit tests enabled: no > Debug output enabled: no > Debug validation enabled: no > > Generic build parameters: > Installation prefix: /usr > Configuration directory: /etc/suricata/ > Log directory: /var/log/suricata/ > > --prefix /usr > --sysconfdir /etc > --localstatedir /var > --datarootdir /usr/share > > Host: x86_64-pc-linux-gnu > Compiler: gcc (exec name) / gcc (real) > GCC Protect enabled: yes > GCC march native enabled: no > GCC Profile enabled: no > Position Independent Executable enabled: no > CFLAGS -O2 -pipe -Wall -fexceptions -fPIC -m64 -mindirect-branch=thunk -mfunction-return=thunk -mtune=generic -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fstack-protector-strong -I${srcdir}/../rust/gen/c-headers > PCAP_CFLAGS -I/usr/include > SECCFLAGS -fstack-protector -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security Thanks, and best regards, Peter Müller

2 2

Current 'next' branch fails to compile grub
by peter.mueller＠ipfire.org 09 Sep '19

09 Sep '19

Hello *, the current 'next' branch of IPFire 2.x fails to compile grub: > grub (2.02) [ 34 ][ FAIL ] > > config.status: creating config-util.h > config.status: linking include/grub/x86_64 to include/grub/cpu > config.status: linking include/grub/x86_64/efi to include/grub/machine > config.status: executing depfiles commands > config.status: executing po-directories commands > config.status: creating po/POTFILES > config.status: creating po/Makefile > ******************************************************* > GRUB2 will be compiled with following components: > Platform: x86_64-efi > With devmapper support: Yes > With memory debugging: No > With disk cache statistics: No > With boot time statistics: No > efiemu runtime: No (not available on efi) > grub-mkfont: Yes > grub-mount: No (need FUSE library) > starfield theme: No (No DejaVu found) > With libzfs support: No (need zfs library) > Build-time grub-mkfont: Yes > With unifont from ./unifont.pcf.gz > With liblzma from -llzma (support for XZ-compressed mips images) > ******************************************************* > cd /usr/src/grub-2.02-efi && make -j5 > make[1]: Entering directory '/usr/src/grub-2.02-efi' > python gentpl.py Makefile.util.def Makefile.utilgcry.def > Makefile.util.am.new || (rm -f Makefile.util.am.new; exit 1) > /bin/sh: python: command not found > make[1]: *** [Makefile:12159: Makefile.util.am] Error 1 > make[1]: Leaving directory '/usr/src/grub-2.02-efi' > make: *** [grub:108: /usr/src/log/grub-2.02] Error 2 > > ERROR: Building grub [ FAIL ] > Check /home/pmu/working/ipfire-2.x/log/_build.ipfire.log for errors if applicable [ FAIL ] Anything I am doing wrong? Anybody else experiencing this error? Footnote: Intention was to update Tor, iptables and libnetfilter_queue. Just in case anybody else is currently at these, too. iproute2 also needs a major update, but that will be a second step. Thanks, and best regards, Peter Müller

2 1

Core 128 => 129 - iptables not shipped?
by Matthias Fischer 09 Sep '19

09 Sep '19

Hi, In Core update 128 => Core 129 the 'iptables'-udpdate from 1.6.2 to 1.8.2 is missing: https://git.ipfire.org/?p=ipfire-2.x.git;a=tree;f=config/rootfiles/core/129… The former update from 1.4.21 (Core 122 => Core 123) to 1.6.2 was ok: https://git.ipfire.org/?p=ipfire-2.x.git;a=tree;f=config/rootfiles/core/123… This would mean that machines, which were updated through Pakfire from Core 128 to Core 129 didn't get this update. So did mine. Found per chance today. Can someone confirm? Best, Matthias

2 1

[PATCH] libnetfilter_queue: Update to 1.0.4
by Stefan Schantl 09 Sep '19

09 Sep '19

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- config/rootfiles/common/libnetfilter_queue | 2 +- lfs/libnetfilter_queue | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/libnetfilter_queue b/config/rootfiles/common/libnetfilter_queue index 418a5df89..087223033 100644 --- a/config/rootfiles/common/libnetfilter_queue +++ b/config/rootfiles/common/libnetfilter_queue @@ -10,5 +10,5 @@ #usr/lib/libnetfilter_queue.la #usr/lib/libnetfilter_queue.so usr/lib/libnetfilter_queue.so.1 -usr/lib/libnetfilter_queue.so.1.3.0 +usr/lib/libnetfilter_queue.so.1.4.0 #usr/lib/pkgconfig/libnetfilter_queue.pc diff --git a/lfs/libnetfilter_queue b/lfs/libnetfilter_queue index 688f5702d..bb22a7f16 100644 --- a/lfs/libnetfilter_queue +++ b/lfs/libnetfilter_queue @@ -24,7 +24,7 @@ include Config -VER = 1.0.2 +VER = 1.0.3 THISAPP = libnetfilter_queue-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = df09befac35cb215865b39a36c96a3fa +$(DL_FILE)_MD5 = 700ce0ae4784257ab5abe6fd1802f366 install : $(TARGET) -- 2.20.1

2 1

[PATCH] iproute2: Update to 5.2.0
by Matthias Fischer 09 Sep '19

09 Sep '19

For details see: https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/log/ Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/iproute2 | 8 ++++++-- lfs/iproute2 | 6 +++--- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/config/rootfiles/common/iproute2 b/config/rootfiles/common/iproute2 index cf9a5c456..0de39e781 100644 --- a/config/rootfiles/common/iproute2 +++ b/config/rootfiles/common/iproute2 @@ -40,9 +40,7 @@ usr/share/bash-completion/completions/tc #usr/share/doc/iproute2/examples/README.cbq #usr/share/doc/iproute2/examples/README.iproute2+tc #usr/share/doc/iproute2/examples/SYN-DoS.rate.limit -#usr/share/doc/iproute2/examples/cbq.init-v0.7.3 #usr/share/doc/iproute2/examples/cbqinit.eth1 -#usr/share/doc/iproute2/examples/dhcp-client-script #usr/share/doc/iproute2/examples/diffserv #usr/share/doc/iproute2/examples/diffserv/Edge1 #usr/share/doc/iproute2/examples/diffserv/Edge2 @@ -63,8 +61,10 @@ usr/share/bash-completion/completions/tc #usr/share/man/man8/bridge.8 #usr/share/man/man8/ctstat.8 #usr/share/man/man8/devlink-dev.8 +#usr/share/man/man8/devlink-health.8 #usr/share/man/man8/devlink-monitor.8 #usr/share/man/man8/devlink-port.8 +#usr/share/man/man8/devlink-region.8 #usr/share/man/man8/devlink-resource.8 #usr/share/man/man8/devlink-sb.8 #usr/share/man/man8/devlink.8 @@ -111,6 +111,7 @@ usr/share/bash-completion/completions/tc #usr/share/man/man8/tc-basic.8 #usr/share/man/man8/tc-bfifo.8 #usr/share/man/man8/tc-bpf.8 +#usr/share/man/man8/tc-cake.8 #usr/share/man/man8/tc-cbq-details.8 #usr/share/man/man8/tc-cbq.8 #usr/share/man/man8/tc-cbs.8 @@ -121,6 +122,7 @@ usr/share/bash-completion/completions/tc #usr/share/man/man8/tc-csum.8 #usr/share/man/man8/tc-drr.8 #usr/share/man/man8/tc-ematch.8 +#usr/share/man/man8/tc-etf.8 #usr/share/man/man8/tc-flow.8 #usr/share/man/man8/tc-flower.8 #usr/share/man/man8/tc-fq.8 @@ -148,7 +150,9 @@ usr/share/bash-completion/completions/tc #usr/share/man/man8/tc-simple.8 #usr/share/man/man8/tc-skbedit.8 #usr/share/man/man8/tc-skbmod.8 +#usr/share/man/man8/tc-skbprio.8 #usr/share/man/man8/tc-stab.8 +#usr/share/man/man8/tc-taprio.8 #usr/share/man/man8/tc-tbf.8 #usr/share/man/man8/tc-tcindex.8 #usr/share/man/man8/tc-tunnel_key.8 diff --git a/lfs/iproute2 b/lfs/iproute2 index 4d2a6f4d7..27e0744d1 100644 --- a/lfs/iproute2 +++ b/lfs/iproute2 @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 4.18.0 +VER = 5.2.0 THISAPP = iproute2-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 8b8680e91390c57cab788fbf8e929479 +$(DL_FILE)_MD5 = 0cb2736e7bc2f56254a363d3d23703b7 install : $(TARGET) -- 2.18.0

2 1

[PATCH] iptables: Update to 1.8.3
by Matthias Fischer 09 Sep '19

09 Sep '19

For details see: https://www.netfilter.org/projects/iptables/files/changes-iptables-1.8.3.txt Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/iptables | 10 ++++++---- lfs/iptables | 4 ++-- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/config/rootfiles/common/iptables b/config/rootfiles/common/iptables index f1a6af00e..389518646 100644 --- a/config/rootfiles/common/iptables +++ b/config/rootfiles/common/iptables @@ -1,11 +1,11 @@ #lib/libip4tc.la lib/libip4tc.so -lib/libip4tc.so.0 -lib/libip4tc.so.0.1.0 +lib/libip4tc.so.2 +lib/libip4tc.so.2.0.0 #lib/libip6tc.la lib/libip6tc.so -lib/libip6tc.so.0 -lib/libip6tc.so.0.1.0 +lib/libip6tc.so.2 +lib/libip6tc.so.2.0.0 #lib/libipq.la lib/libipq.so lib/libipq.so.0 @@ -173,10 +173,12 @@ sbin/xtables-legacy-multi #usr/share/man/man3/libipq.3 #usr/share/man/man8/ip6tables-restore.8 #usr/share/man/man8/ip6tables-save.8 +#usr/share/man/man8/ip6tables-translate.8 #usr/share/man/man8/ip6tables.8 #usr/share/man/man8/iptables-extensions.8 #usr/share/man/man8/iptables-restore.8 #usr/share/man/man8/iptables-save.8 +#usr/share/man/man8/iptables-translate.8 #usr/share/man/man8/iptables.8 #usr/share/man/man8/nfnl_osf.8 #usr/share/man/man8/xtables-legacy.8 diff --git a/lfs/iptables b/lfs/iptables index 3716d8062..b91e41797 100644 --- a/lfs/iptables +++ b/lfs/iptables @@ -24,7 +24,7 @@ include Config -VER = 1.8.2 +VER = 1.8.3 THISAPP = iptables-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -41,7 +41,7 @@ objects = $(DL_FILE) \ $(DL_FILE) = $(DL_FROM)/$(DL_FILE) netfilter-layer7-v2.23.tar.gz = $(URL_IPFIRE)/netfilter-layer7-v2.23.tar.gz -$(DL_FILE)_MD5 = 944558e88ddcc3b9b0d9550070fa3599 +$(DL_FILE)_MD5 = 29de711d15c040c402cf3038c69ff513 netfilter-layer7-v2.23.tar.gz_MD5 = 10910b6173d18e426cb56ae7e1300eeb install : $(TARGET) -- 2.18.0

3 2

[PATCH] Tor: fix permission of /var/ipfire/tor/settings
by peter.mueller＠ipfire.org 07 Sep '19

07 Sep '19

The settings file must be writeable for group "nobody" so users can change their Tor settings via WebUI. Since other files in /var/ipfire/tor/ does not need this workaround, only the settings file permissions are changed. Sorry for the late fix; this was reported by various people in the forum, too (I was unaware of so many Tor users in our community). Fixes #12117 Reported-by: Erik Kapfer <erik.kapfer(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- lfs/tor | 2 +- src/paks/tor/install.sh | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/lfs/tor b/lfs/tor index d918910d4..1e234e0ab 100644 --- a/lfs/tor +++ b/lfs/tor @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = tor -PAK_VER = 40 +PAK_VER = 41 DEPS = "libseccomp" diff --git a/src/paks/tor/install.sh b/src/paks/tor/install.sh index 1659871b6..4d0353155 100644 --- a/src/paks/tor/install.sh +++ b/src/paks/tor/install.sh @@ -38,4 +38,8 @@ restore_backup ${NAME} # Adjust some folder permission for new UID/GID chown -R tor:tor /var/lib/tor /var/ipfire/tor +# Tor settings file needs to be writeable by nobody group for WebUI +chown tor:nobody /var/ipfire/tor/settings +chmod 664 /var/ipfire/tor/settings + start_service --background ${NAME} -- 2.16.4

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development September 2019