IPFire-SCM

ipfire-scm@lists.ipfire.org

1 participants
7854 discussions

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 37533b0deabab9f1e44ac8d710c9cd6f1e4570f7
by Arne Fitzenreiter 30 Mar '20

30 Mar '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 37533b0deabab9f1e44ac8d710c9cd6f1e4570f7 (commit) via 29a8992b7228771fb2cfc68679596598fb01105a (commit) from 6075720c481ee58367d06088c18739e26b768201 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 37533b0deabab9f1e44ac8d710c9cd6f1e4570f7 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Mon Mar 30 17:09:34 2020 +0000 core143: apply changed sysctl settings Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 29a8992b7228771fb2cfc68679596598fb01105a Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Thu Jan 23 21:28:00 2020 +0000 sysctl.conf: Turn on hard- and symlink protection Cc: Michael Tremer <michael.tremer(a)ipfire.org> Cc: Arne Fitzenreiter <arne_f(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> Acked-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/etc/sysctl.conf | 4 ++++ config/rootfiles/core/143/update.sh | 3 +++ 2 files changed, 7 insertions(+) Difference in files: diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf index d11e53c88..7e7ebee44 100644 --- a/config/etc/sysctl.conf +++ b/config/etc/sysctl.conf @@ -45,6 +45,10 @@ kernel.kptr_restrict = 2 # Avoid kernel memory address exposures via dmesg. kernel.dmesg_restrict = 1 +# Turn on hard- and symlink protection +fs.protected_symlinks = 1 +fs.protected_hardlinks = 1 + # Minimal preemption granularity for CPU-bound tasks: # (default: 1 msec# (1 + ilog(ncpus)), units: nanoseconds) kernel.sched_min_granularity_ns = 10000000 diff --git a/config/rootfiles/core/143/update.sh b/config/rootfiles/core/143/update.sh index bc28f7de7..51c4557bd 100644 --- a/config/rootfiles/core/143/update.sh +++ b/config/rootfiles/core/143/update.sh @@ -68,6 +68,9 @@ chown cron:cron /var/spool/cron # restart init after glibc replace telinit u +# Apply changed sysctl settings +/etc/init.d/sysctl start + # Apply local configuration to sshd_config /usr/local/bin/sshctrl hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 6075720c481ee58367d06088c18739e26b768201
by Arne Fitzenreiter 30 Mar '20

30 Mar '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 6075720c481ee58367d06088c18739e26b768201 (commit) via d07286de4633212dea8cf21253314d007ac36825 (commit) via 59b2a70f7a483b4b63ff7d33fba42bb6eb35eda6 (commit) via 2d599cca34e8228b1cfa639ea9ddbabf51498361 (commit) via 1d84b352dfc6275dfefb8645b54ed2f0fa350524 (commit) via 2480c416d61a21320e7728786310028cee75c3b0 (commit) via e4a0b558815c07f934c135374cd077c2c0fabf0a (commit) via 8f4ed62fa87ef4d1125cc2326a6461c8b0ba018f (commit) via fa4dbe2745d2f7b025c524003adeb9be6f039c78 (commit) from 5192ceae53acc7549e78942254d48fcb5b464270 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 6075720c481ee58367d06088c18739e26b768201 Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Mon Feb 3 18:35:00 2020 +0000 update language files for mail.cgi changes Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit d07286de4633212dea8cf21253314d007ac36825 Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Mon Feb 3 18:35:00 2020 +0000 mail.cgi: add support for implicit TLS usage The second version of this patchset fixes reading empty configuration files and superseds the first version (duh!). Fixes #12161 Reported-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> Tested-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 59b2a70f7a483b4b63ff7d33fba42bb6eb35eda6 Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Sat Feb 1 20:26:00 2020 +0000 dma: update to 0.12 All of the dma patches in src/patches/ were merged into its upstream repository by now, thus becoming obsolete and deleted by this patch. Cc: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 2d599cca34e8228b1cfa639ea9ddbabf51498361 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Mon Mar 30 16:43:50 2020 +0000 core143: add oinkmaster.conf Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 1d84b352dfc6275dfefb8645b54ed2f0fa350524 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Thu Jan 30 13:58:16 2020 +0100 oinkmaster: Do not skip threshold.conf Fixes #12096. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 2480c416d61a21320e7728786310028cee75c3b0 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Mon Mar 30 16:39:06 2020 +0000 core143: set user of /var/spool/cron to cron Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit e4a0b558815c07f934c135374cd077c2c0fabf0a Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Feb 5 11:23:34 2020 +0000 fcron: Fix reloading crontab fcrontab -z fails on a freshly installed system since /var/spool/cron is now owned by cron:cron and a temporary file cannot be created. This will have to be manually changed in the updater by calling: chown cron:cron /var/spool/cron Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 8f4ed62fa87ef4d1125cc2326a6461c8b0ba018f Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Sat Mar 21 19:40:00 2020 +0000 spectre-meltdown-checker: update to 0.43 Please refer to https://github.com/speed47/spectre-meltdown-checker/releases/tag/v0.43 for release notes. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit fa4dbe2745d2f7b025c524003adeb9be6f039c78 Author: Erik Kapfer <ummeegge(a)ipfire.org> Date: Sat Mar 28 09:32:24 2020 +0100 OpenVPN: Delete RRD dir if connection is deleted Signed-off-by: Erik Kapfer <ummeegge(a)ipfire.org> Reviewed-by: Peter Müller <peter.mueller(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/oinkmaster/oinkmaster.conf | 2 +- config/rootfiles/common/fcron | 2 +- config/rootfiles/core/143/filelists/files | 1 + config/rootfiles/core/143/update.sh | 3 + html/cgi-bin/mail.cgi | 20 +- html/cgi-bin/ovpnmain.cgi | 2 +- langs/de/cgi-bin/de.pl | 6 +- langs/en/cgi-bin/en.pl | 4 +- lfs/dma | 9 +- lfs/spectre-meltdown-checker | 8 +- src/patches/dma-0.10-better-authentication.patch | 373 ----------------------- src/patches/dma-0.10-better-tls.patch | 26 -- src/patches/dma-0.11-compile-fixes.patch | 29 -- 13 files changed, 34 insertions(+), 451 deletions(-) delete mode 100644 src/patches/dma-0.10-better-authentication.patch delete mode 100644 src/patches/dma-0.10-better-tls.patch delete mode 100644 src/patches/dma-0.11-compile-fixes.patch Difference in files: diff --git a/config/oinkmaster/oinkmaster.conf b/config/oinkmaster/oinkmaster.conf index a04e32987..57c328139 100644 --- a/config/oinkmaster/oinkmaster.conf +++ b/config/oinkmaster/oinkmaster.conf @@ -222,7 +222,7 @@ skipfile deleted.rules # local thresholding/suppressing in some local file and still update # and use the official one though, in case important stuff is added to # it some day. We do update it by default, but it's your call. -# skipfile threshold.conf +skipfile threshold.conf # If you update from multiple URLs at the same time you may need to # ignore the sid-msg.map (and generate it yourself if you need one) as diff --git a/config/rootfiles/common/fcron b/config/rootfiles/common/fcron index d37541b95..fb4410f4d 100644 --- a/config/rootfiles/common/fcron +++ b/config/rootfiles/common/fcron @@ -93,6 +93,6 @@ usr/sbin/fcron #usr/share/man/man5/fcron.conf.5 #usr/share/man/man5/fcrontab.5 #usr/share/man/man8/fcron.8 -#var/spool/cron +var/spool/cron var/spool/cron/new.root var/spool/cron/root.orig diff --git a/config/rootfiles/core/143/filelists/files b/config/rootfiles/core/143/filelists/files index c82f67734..4f8f7cddf 100644 --- a/config/rootfiles/core/143/filelists/files +++ b/config/rootfiles/core/143/filelists/files @@ -10,3 +10,4 @@ srv/web/ipfire/cgi-bin/netother.cgi srv/web/ipfire/cgi-bin/ovpnmain.cgi usr/lib/firewall/rules.pl var/ipfire/backup/bin/backup.pl +var/ipfire/suricata/oinkmaster.conf diff --git a/config/rootfiles/core/143/update.sh b/config/rootfiles/core/143/update.sh index cb7f57914..bc28f7de7 100644 --- a/config/rootfiles/core/143/update.sh +++ b/config/rootfiles/core/143/update.sh @@ -62,6 +62,9 @@ ldconfig # remove wrong vnstat tag file rm -f /var/log/vnstat/tag +# set /var/spool/cron to cron user +chown cron:cron /var/spool/cron + # restart init after glibc replace telinit u diff --git a/html/cgi-bin/mail.cgi b/html/cgi-bin/mail.cgi index 25589046e..7865a1da6 100755 --- a/html/cgi-bin/mail.cgi +++ b/html/cgi-bin/mail.cgi @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2015 IPFire Team <alexander.marx(a)ipfire.org> # +# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -110,8 +110,8 @@ if ($cgiparams{'ACTION'} eq "$Lang::tr{'save'}"){ #SaveButton on configsite $dma{'SMARTHOST'} = $cgiparams{'txt_mailserver'}; $dma{'PORT'} = $cgiparams{'txt_mailport'}; - $dma{'STARTTLS'} = '' if ($cgiparams{'mail_tls'}); - $dma{'SECURETRANSFER'} = '' if exists $dma{'STARTTLS'}; + $dma{'STARTTLS'} = '' if ($cgiparams{'mail_tls'} eq 'explicit'); + $dma{'SECURETRANSFER'} = '' if ($cgiparams{'mail_tls'} eq 'explicit' || $cgiparams{'mail_tls'} eq 'implicit'); $dma{'SPOOLDIR'} = "/var/spool/dma"; $dma{'FULLBOUNCE'} = ''; $dma{'MAILNAME'} = "$mainsettings{'HOSTNAME'}.$mainsettings{DOMAINNAME}"; @@ -140,8 +140,6 @@ if ($cgiparams{'ACTION'} eq "$Lang::tr{'email testmail'}"){ #Testmail button on #FUNCTIONS sub configsite{ - - #If update set fieldvalues new if($cgiparams{'update'} eq 'on'){ $mail{'USEMAIL'} = 'on'; @@ -156,7 +154,9 @@ sub configsite{ } #find preselections $checked{'usemail'}{$mail{'USEMAIL'}} = 'CHECKED'; - $checked{'mail_tls'}{'on'} = 'CHECKED' if exists $dma{'STARTTLS'}; + $selected{'mail_tls'}{'explicit'} = 'selected' if exists $dma{'STARTTLS'}; + $selected{'mail_tls'}{'implicit'} = 'selected' if (exists $dma{'SECURETRANSFER'}) and (not exists $dma{'STARTTLS'}); + $selected{'mail_tls'}{'disabled'} = 'selected' if (not exists $dma{'SECURETRANSFER'}) and (not exists $dma{'STARTTLS'}); #Open site &Header::openpage($Lang::tr{'email settings'}, 1, ''); @@ -226,7 +226,13 @@ END </tr> <tr> <td>$Lang::tr{'email tls'}</td> - <td><input type='checkbox' name='mail_tls' $checked{'mail_tls'}{'on'}></td> + <td> + <select name='mail_tls'> + <option value='implicit' $selected{'mail_tls'}{'implicit'}>$Lang::tr{'email tls implicit'}</option> + <option value='explicit' $selected{'mail_tls'}{'explicit'}>$Lang::tr{'email tls explicit'}</option> + <option value='disabled' $selected{'mail_tls'}{'disabled'}>$Lang::tr{'disabled'}</option> + </select> + </td> </tr> END if (! -z $dmafile && $mail{'USEMAIL'} eq 'on' && !$errormessage){ diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index ce9524df7..00ecd77a0 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -2513,7 +2513,7 @@ else # CCD end # Update collectd configuration and delete all RRD files of the removed connection &writecollectdconf(); - system ("/usr/local/bin/openvpnctrl -drrd $confighash{$cgiparams{'KEY'}}[1]"); + system ('/usr/local/bin/openvpnctrl', '-drrd', $confighash{$cgiparams{'KEY'}}[1]); delete $confighash{$cgiparams{'KEY'}}; my $temp2 = `/usr/bin/openssl ca -gencrl -out ${General::swroot}/ovpn/crls/cacrl.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`; diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index be6daa3ea..fb676b868 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -953,8 +953,10 @@ 'email subject' => 'IPFire Test-E-Mail', 'email success' => 'Test-E-Mail erfolgreich versendet', 'email testmail' => 'Testnachricht senden', -'email text' => 'Testnachricht vom IPFire Mailversand.', -'email tls' => 'TLS aktivieren', +'email text' => 'Testnachricht vom IPFire-Mailversandsystem.', +'email tls' => 'Transportverschlüsselungsmodus', +'email tls explicit' => 'explizit (STARTTLS)', +'email tls implicit' => 'implizit (TLS)', 'email usemail' => 'Mailversand aktivieren', 'emailreportlevel' => 'E-Mail-Reportlevel', 'emerging pro rules' => 'Emergingthreats.net Pro-Regelsatz', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 1e1aed53c..3f3e46641 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -975,7 +975,9 @@ 'email success' => 'Test message successfully sent', 'email testmail' => 'Send test mail', 'email text' => 'Test mail from IPFire Mail Service', -'email tls' => 'Use TLS', +'email tls' => 'TLS mode', +'email tls explicit' => 'explicit (STARTTLS)', +'email tls implicit' => 'implicit (TLS)', 'email usemail' => 'Activate Mail Service', 'emailreportlevel' => 'E-mailreportlevel', 'emerging pro rules' => 'Emergingthreats.net Pro Rules', diff --git a/lfs/dma b/lfs/dma index 2b89bcc6e..aceb2704e 100644 --- a/lfs/dma +++ b/lfs/dma @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 0.11 +VER = 0.12 THISAPP = dma-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 4090572921fc33be0977f4010881b501 +$(DL_FILE)_MD5 = 58cb2a286995381c92dc557e639622d6 install : $(TARGET) @@ -73,9 +73,6 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) mkdir -pv /var/ipfire/dma touch /var/ipfire/dma/mail.conf - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dma-0.10-better-authentication.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dma-0.10-better-tls.patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/dma-0.11-compile-fixes.patch cd $(DIR_APP) && sed -i '/PREFIX/s/usr\/local/usr/g' Makefile cd $(DIR_APP) && sed -i '/CONFDIR/s/etc\/dma/var\/ipfire\/dma/g' Makefile cd $(DIR_APP) && make diff --git a/lfs/spectre-meltdown-checker b/lfs/spectre-meltdown-checker index c05c5fead..2bf34f590 100644 --- a/lfs/spectre-meltdown-checker +++ b/lfs/spectre-meltdown-checker @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 0.42 +VER = 0.43 THISAPP = spectre-meltdown-checker-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = spectre-meltdown-checker -PAK_VER = 3 +PAK_VER = 4 DEPS = @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = c8aca684284d604adb67cb6d9d07ce70 +$(DL_FILE)_MD5 = 05cd2e53edbdcccfc072a66fafa4ea38 install : $(TARGET) diff --git a/src/patches/dma-0.10-better-authentication.patch b/src/patches/dma-0.10-better-authentication.patch deleted file mode 100644 index 596168d2a..000000000 --- a/src/patches/dma-0.10-better-authentication.patch +++ /dev/null @@ -1,373 +0,0 @@ -From 1fa7a882dd22d5f619b3645c6597a419034e9b4e Mon Sep 17 00:00:00 2001 -From: Michael Tremer <michael.tremer(a)ipfire.org> -Date: Mon, 9 Nov 2015 21:52:08 +0000 -Subject: [PATCH] Implement better authentication - -DMA tries to authenticate by simply trying various authentication -mechanisms. This is obviously not conforming to RFC and some mail -providers detect this is spam and reject all emails. - -This patch parses the EHLO response and reads various keywords -from it that can then later in the program be used to jump into -certain code paths. - -Currently this is used to only authenticate with CRAM-MD5 and/or -LOGIN if the server supports one or both of these. The -implementation can be easily be extended though. - -Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ---- - crypto.c | 6 +- - dma.h | 13 +++- - net.c | 219 +++++++++++++++++++++++++++++++++++++++++++++++---------------- - 3 files changed, 181 insertions(+), 57 deletions(-) - -diff --git a/crypto.c b/crypto.c -index 897b55b..8048f20 100644 ---- a/crypto.c -+++ b/crypto.c -@@ -77,7 +77,7 @@ init_cert_file(SSL_CTX *ctx, const char *path) - } - - int --smtp_init_crypto(int fd, int feature) -+smtp_init_crypto(int fd, int feature, struct smtp_features* features) - { - SSL_CTX *ctx = NULL; - #if (OPENSSL_VERSION_NUMBER >= 0x00909000L) -@@ -118,8 +118,7 @@ smtp_init_crypto(int fd, int feature) - /* TLS init phase, disable SSL_write */ - config.features |= NOSSL; - -- send_remote_command(fd, "EHLO %s", hostname()); -- if (read_remote(fd, 0, NULL) == 2) { -+ if (perform_server_greeting(fd, features) == 0) { - send_remote_command(fd, "STARTTLS"); - if (read_remote(fd, 0, NULL) != 2) { - if ((feature & TLS_OPP) == 0) { -@@ -131,6 +130,7 @@ smtp_init_crypto(int fd, int feature) - } - } - } -+ - /* End of TLS init phase, enable SSL_write/read */ - config.features &= ~NOSSL; - } -diff --git a/dma.h b/dma.h -index acf5e44..ee749d8 100644 ---- a/dma.h -+++ b/dma.h -@@ -51,6 +51,7 @@ - #define BUF_SIZE 2048 - #define ERRMSG_SIZE 200 - #define USERNAME_SIZE 50 -+#define EHLO_RESPONSE_SIZE BUF_SIZE - #define MIN_RETRY 300 /* 5 minutes */ - #define MAX_RETRY (3*60*60) /* retry at least every 3 hours */ - #define MAX_TIMEOUT (5*24*60*60) /* give up after 5 days */ -@@ -160,6 +161,15 @@ struct mx_hostentry { - struct sockaddr_storage sa; - }; - -+struct smtp_auth_mechanisms { -+ int cram_md5; -+ int login; -+}; -+ -+struct smtp_features { -+ struct smtp_auth_mechanisms auth; -+ int starttls; -+}; - - /* global variables */ - extern struct aliases aliases; -@@ -187,7 +197,7 @@ void parse_authfile(const char *); - /* crypto.c */ - void hmac_md5(unsigned char *, int, unsigned char *, int, unsigned char *); - int smtp_auth_md5(int, char *, char *); --int smtp_init_crypto(int, int); -+int smtp_init_crypto(int, int, struct smtp_features*); - - /* dns.c */ - int dns_get_mx_list(const char *, int, struct mx_hostentry **, int); -@@ -196,6 +206,7 @@ int dns_get_mx_list(const char *, int, struct mx_hostentry **, int); - char *ssl_errstr(void); - int read_remote(int, int, char *); - ssize_t send_remote_command(int, const char*, ...) __attribute__((__nonnull__(2), __format__ (__printf__, 2, 3))); -+int perform_server_greeting(int, struct smtp_features*); - int deliver_remote(struct qitem *); - - /* base64.c */ -diff --git a/net.c b/net.c -index 26935a8..33ff8f5 100644 ---- a/net.c -+++ b/net.c -@@ -247,64 +247,70 @@ read_remote(int fd, int extbufsize, char *extbuf) - * Handle SMTP authentication - */ - static int --smtp_login(int fd, char *login, char* password) -+smtp_login(int fd, char *login, char* password, const struct smtp_features* features) - { - char *temp; - int len, res = 0; - -- res = smtp_auth_md5(fd, login, password); -- if (res == 0) { -- return (0); -- } else if (res == -2) { -- /* -- * If the return code is -2, then then the login attempt failed, -- * do not try other login mechanisms -- */ -- return (1); -- } -- -- if ((config.features & INSECURE) != 0 || -- (config.features & SECURETRANS) != 0) { -- /* Send AUTH command according to RFC 2554 */ -- send_remote_command(fd, "AUTH LOGIN"); -- if (read_remote(fd, 0, NULL) != 3) { -- syslog(LOG_NOTICE, "remote delivery deferred:" -- " AUTH login not available: %s", -- neterr); -+ // CRAM-MD5 -+ if (features->auth.cram_md5) { -+ res = smtp_auth_md5(fd, login, password); -+ if (res == 0) { -+ return (0); -+ } else if (res == -2) { -+ /* -+ * If the return code is -2, then then the login attempt failed, -+ * do not try other login mechanisms -+ */ - return (1); - } -+ } - -- len = base64_encode(login, strlen(login), &temp); -- if (len < 0) { -+ // LOGIN -+ if (features->auth.login) { -+ if ((config.features & INSECURE) != 0 || -+ (config.features & SECURETRANS) != 0) { -+ /* Send AUTH command according to RFC 2554 */ -+ send_remote_command(fd, "AUTH LOGIN"); -+ if (read_remote(fd, 0, NULL) != 3) { -+ syslog(LOG_NOTICE, "remote delivery deferred:" -+ " AUTH login not available: %s", -+ neterr); -+ return (1); -+ } -+ -+ len = base64_encode(login, strlen(login), &temp); -+ if (len < 0) { - encerr: -- syslog(LOG_ERR, "can not encode auth reply: %m"); -- return (1); -- } -+ syslog(LOG_ERR, "can not encode auth reply: %m"); -+ return (1); -+ } - -- send_remote_command(fd, "%s", temp); -- free(temp); -- res = read_remote(fd, 0, NULL); -- if (res != 3) { -- syslog(LOG_NOTICE, "remote delivery %s: AUTH login failed: %s", -- res == 5 ? "failed" : "deferred", neterr); -- return (res == 5 ? -1 : 1); -- } -+ send_remote_command(fd, "%s", temp); -+ free(temp); -+ res = read_remote(fd, 0, NULL); -+ if (res != 3) { -+ syslog(LOG_NOTICE, "remote delivery %s: AUTH login failed: %s", -+ res == 5 ? "failed" : "deferred", neterr); -+ return (res == 5 ? -1 : 1); -+ } - -- len = base64_encode(password, strlen(password), &temp); -- if (len < 0) -- goto encerr; -- -- send_remote_command(fd, "%s", temp); -- free(temp); -- res = read_remote(fd, 0, NULL); -- if (res != 2) { -- syslog(LOG_NOTICE, "remote delivery %s: Authentication failed: %s", -- res == 5 ? "failed" : "deferred", neterr); -- return (res == 5 ? -1 : 1); -+ len = base64_encode(password, strlen(password), &temp); -+ if (len < 0) -+ goto encerr; -+ -+ send_remote_command(fd, "%s", temp); -+ free(temp); -+ res = read_remote(fd, 0, NULL); -+ if (res != 2) { -+ syslog(LOG_NOTICE, "remote delivery %s: Authentication failed: %s", -+ res == 5 ? "failed" : "deferred", neterr); -+ return (res == 5 ? -1 : 1); -+ } -+ } else { -+ syslog(LOG_WARNING, "non-encrypted SMTP login is disabled in config, so skipping it. "); -+ return (1); - } -- } else { -- syslog(LOG_WARNING, "non-encrypted SMTP login is disabled in config, so skipping it. "); -- return (1); - } - - return (0); -@@ -348,10 +354,115 @@ close_connection(int fd) - close(fd); - } - -+static void parse_auth_line(char* line, struct smtp_auth_mechanisms* auth) { -+ // Skip the auth prefix -+ line += strlen("AUTH "); -+ -+ char* method = strtok(line, " "); -+ while (method) { -+ if (strcmp(method, "CRAM-MD5") == 0) -+ auth->cram_md5 = 1; -+ -+ else if (strcmp(method, "LOGIN") == 0) -+ auth->login = 1; -+ -+ method = strtok(NULL, " "); -+ } -+} -+ -+int perform_server_greeting(int fd, struct smtp_features* features) { -+ /* -+ Send EHLO -+ XXX allow HELO fallback -+ */ -+ send_remote_command(fd, "EHLO %s", hostname()); -+ -+ char buffer[EHLO_RESPONSE_SIZE]; -+ memset(buffer, 0, sizeof(buffer)); -+ -+ int res = read_remote(fd, sizeof(buffer) - 1, buffer); -+ -+ // Got an unexpected response -+ if (res != 2) -+ return -1; -+ -+ // Reset all features -+ memset(features, 0, sizeof(*features)); -+ -+ // Run through the buffer line by line -+ char linebuffer[EHLO_RESPONSE_SIZE]; -+ char* p = buffer; -+ -+ while (*p) { -+ char* line = linebuffer; -+ while (*p && *p != '\n') { -+ *line++ = *p++; -+ } -+ -+ // p should never point to NULL after the loop -+ // above unless we reached the end of the buffer. -+ // In that case we will raise an error. -+ if (!*p) { -+ return -1; -+ } -+ -+ // Otherwise p points to the newline character which -+ // we will skip. -+ p++; -+ -+ // Terminte the string (and remove the carriage-return character) -+ *--line = '\0'; -+ line = linebuffer; -+ -+ // End main loop for empty lines -+ if (*line == '\0') -+ break; -+ -+ // Process the line -+ // - Must start with 250, followed by dash or space -+ // - We won't check for the correct usage of space and dash because -+ // that is already done in read_remote(). -+ if ((strncmp(line, "250-", 4) != 0) && (strncmp(line, "250 ", 4) != 0)) { -+ syslog(LOG_ERR, "Invalid line: %s\n", line); -+ return -1; -+ } -+ -+ // Skip the prefix -+ line += 4; -+ -+ // Check for STARTTLS -+ if (strcmp(line, "STARTTLS") == 0) -+ features->starttls = 1; -+ -+ // Parse authentication mechanisms -+ else if (strncmp(line, "AUTH ", 5) == 0) -+ parse_auth_line(line, &features->auth); -+ } -+ -+ syslog(LOG_DEBUG, "Server greeting successfully completed"); -+ -+ // STARTTLS -+ if (features->starttls) -+ syslog(LOG_DEBUG, " Server supports STARTTLS"); -+ else -+ syslog(LOG_DEBUG, " Server does not support STARTTLS"); -+ -+ // Authentication -+ if (features->auth.cram_md5) { -+ syslog(LOG_DEBUG, " Server supports CRAM-MD5 authentication"); -+ } -+ if (features->auth.login) { -+ syslog(LOG_DEBUG, " Server supports LOGIN authentication"); -+ } -+ -+ return 0; -+} -+ - static int - deliver_to_host(struct qitem *it, struct mx_hostentry *host) - { - struct authuser *a; -+ struct smtp_features features; - char line[1000]; - size_t linelen; - int fd, error = 0, do_auth = 0, res = 0; -@@ -389,7 +500,7 @@ deliver_to_host(struct qitem *it, struct mx_hostentry *host) - } - - if ((config.features & SECURETRANS) != 0) { -- error = smtp_init_crypto(fd, config.features); -+ error = smtp_init_crypto(fd, config.features, &features); - if (error == 0) - syslog(LOG_DEBUG, "SSL initialization successful"); - else -@@ -399,10 +510,12 @@ deliver_to_host(struct qitem *it, struct mx_hostentry *host) - READ_REMOTE_CHECK("connect", 2); - } - -- /* XXX allow HELO fallback */ -- /* XXX record ESMTP keywords */ -- send_remote_command(fd, "EHLO %s", hostname()); -- READ_REMOTE_CHECK("EHLO", 2); -+ // Say EHLO -+ if (perform_server_greeting(fd, &features) != 0) { -+ syslog(LOG_ERR, "Could not perform server greeting at %s [%s]: %s", -+ host->host, host->addr, neterr); -+ return -1; -+ } - - /* - * Use SMTP authentication if the user defined an entry for the remote -@@ -421,7 +534,7 @@ deliver_to_host(struct qitem *it, struct mx_hostentry *host) - * encryption. - */ - syslog(LOG_INFO, "using SMTP authentication for user %s", a->login); -- error = smtp_login(fd, a->login, a->password); -+ error = smtp_login(fd, a->login, a->password, &features); - if (error < 0) { - syslog(LOG_ERR, "remote delivery failed:" - " SMTP login failed: %m"); diff --git a/src/patches/dma-0.10-better-tls.patch b/src/patches/dma-0.10-better-tls.patch deleted file mode 100644 index 8f60fdd04..000000000 --- a/src/patches/dma-0.10-better-tls.patch +++ /dev/null @@ -1,26 +0,0 @@ -commit e94f50bbbe7318eec5b6b165ff73d94bbc9d20b0 -Author: Michael Tremer <michael.tremer(a)ipfire.org> -Date: Sun Feb 11 11:05:43 2018 +0000 - - crypto: Don't limit to TLSv1 only - - Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> - -diff --git a/crypto.c b/crypto.c -index 897b55bfdcfc..440c882880b5 100644 ---- a/crypto.c -+++ b/crypto.c -@@ -93,7 +93,12 @@ smtp_init_crypto(int fd, int feature) - SSL_library_init(); - SSL_load_error_strings(); - -- meth = TLSv1_client_method(); -+ // Allow any possible version -+#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) -+ meth = TLS_client_method(); -+#else -+ meth = SSLv23_client_method(); -+#endif - - ctx = SSL_CTX_new(meth); - if (ctx == NULL) { diff --git a/src/patches/dma-0.11-compile-fixes.patch b/src/patches/dma-0.11-compile-fixes.patch deleted file mode 100644 index a6e5165c9..000000000 --- a/src/patches/dma-0.11-compile-fixes.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 60cf6f03a4b13ec0e491a282ab5233a1619a7a66 Mon Sep 17 00:00:00 2001 -From: Michael Tremer <michael.tremer(a)ipfire.org> -Date: Tue, 24 Apr 2018 12:30:13 +0100 -Subject: [PATCH] net.c: Include string.h - -Various functions that have been used come from string.h. GCC compiled -dma without this header, but unfortunately the binary segfaulted at random -times. - -Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ---- - net.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/net.c b/net.c -index a1cc3e3bfd79..221dda131a23 100644 ---- a/net.c -+++ b/net.c -@@ -53,6 +53,7 @@ - #include <netdb.h> - #include <setjmp.h> - #include <signal.h> -+#include <string.h> - #include <syslog.h> - #include <unistd.h> - --- -2.14.3 - hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 5192ceae53acc7549e78942254d48fcb5b464270
by Arne Fitzenreiter 29 Mar '20

29 Mar '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 5192ceae53acc7549e78942254d48fcb5b464270 (commit) via 54e6ded41782f444b501161b404cb41acc5c2e00 (commit) via 454c77d4c48192184c52dca34e4b4e58c3449741 (commit) from 41ac6f547e06ded7339c1530d02c0893e94feb8a (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 5192ceae53acc7549e78942254d48fcb5b464270 Merge: 54e6ded41 41ac6f547 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sun Mar 29 06:35:21 2020 +0000 Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next commit 54e6ded41782f444b501161b404cb41acc5c2e00 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sun Mar 29 06:34:18 2020 +0000 smartmontools: update rootfile Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 454c77d4c48192184c52dca34e4b4e58c3449741 Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Wed Mar 25 12:33:49 2020 +0100 bind: Update to 9.11.17 For details see: https://downloads.isc.org/isc/bind9/9.11.17/RELEASE-NOTES-bind-9.11.17.html "Notes for BIND 9.11.17 Feature Changes The configure option --with-libxml2 now uses pkg-config to detect libxml2 library availability. You will either have to install pkg-config or specify the exact path where libxml2 has been installed on your system. [GL #1635] Bug Fixes Fixed re-signing issues with inline zones which resulted in records being re-signed late or not at all." Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/bind | 11 ++++++----- config/rootfiles/common/smartmontools | 6 +----- lfs/bind | 6 +++--- 3 files changed, 10 insertions(+), 13 deletions(-) Difference in files: diff --git a/config/rootfiles/common/bind b/config/rootfiles/common/bind index df6bbf4b6..3a306bf9e 100644 --- a/config/rootfiles/common/bind +++ b/config/rootfiles/common/bind @@ -198,6 +198,7 @@ usr/bin/nsupdate #usr/include/isc/socket.h #usr/include/isc/stat.h #usr/include/isc/stats.h +#usr/include/isc/stdatomic.h #usr/include/isc/stdio.h #usr/include/isc/stdlib.h #usr/include/isc/stdtime.h @@ -271,12 +272,12 @@ usr/lib/libbind9.so.161 usr/lib/libbind9.so.161.0.4 #usr/lib/libdns.la #usr/lib/libdns.so -usr/lib/libdns.so.1107 -usr/lib/libdns.so.1107.1.0 +usr/lib/libdns.so.1110 +usr/lib/libdns.so.1110.0.0 #usr/lib/libisc.la #usr/lib/libisc.so -usr/lib/libisc.so.1104 -usr/lib/libisc.so.1104.0.0 +usr/lib/libisc.so.1105 +usr/lib/libisc.so.1105.0.1 #usr/lib/libisccc.la #usr/lib/libisccc.so usr/lib/libisccc.so.161 @@ -284,7 +285,7 @@ usr/lib/libisccc.so.161.0.1 #usr/lib/libisccfg.la #usr/lib/libisccfg.so usr/lib/libisccfg.so.163 -usr/lib/libisccfg.so.163.0.4 +usr/lib/libisccfg.so.163.0.6 #usr/lib/liblwres.la #usr/lib/liblwres.so usr/lib/liblwres.so.161 diff --git a/config/rootfiles/common/smartmontools b/config/rootfiles/common/smartmontools index 9f03226be..6b3f923b1 100644 --- a/config/rootfiles/common/smartmontools +++ b/config/rootfiles/common/smartmontools @@ -1,7 +1,3 @@ -#usr/etc -#usr/etc/rc.d -#usr/etc/rc.d/init.d -#usr/etc/rc.d/init.d/smartd #usr/etc/smartd.conf #usr/etc/smartd_warning.d #usr/etc/smartd_warning.sh @@ -12,7 +8,7 @@ usr/sbin/update-smart-drivedb #usr/share/doc/smartmontools/AUTHORS #usr/share/doc/smartmontools/COPYING #usr/share/doc/smartmontools/ChangeLog -#usr/share/doc/smartmontools/ChangeLog-5.0-6.0 +#usr/share/doc/smartmontools/ChangeLog-6.0-7.0 #usr/share/doc/smartmontools/INSTALL #usr/share/doc/smartmontools/NEWS #usr/share/doc/smartmontools/README diff --git a/lfs/bind b/lfs/bind index 6bb23a143..80207f4dc 100644 --- a/lfs/bind +++ b/lfs/bind @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -25,7 +25,7 @@ include Config -VER = 9.11.13 +VER = 9.11.17 THISAPP = bind-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 17de0d024ab1eac377f1c2854dc25057 +$(DL_FILE)_MD5 = ceab137e8e7ce3b356be95f505abf737 install : $(TARGET) hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 41ac6f547e06ded7339c1530d02c0893e94feb8a
by Arne Fitzenreiter 28 Mar '20

28 Mar '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 41ac6f547e06ded7339c1530d02c0893e94feb8a (commit) via 1b8a5da550a8918832064067ef157b4cd8b20ddc (commit) from 0b1f09d581cb93f316e00f5983c27275ab681ff1 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 41ac6f547e06ded7339c1530d02c0893e94feb8a Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sat Mar 28 09:42:20 2020 +0100 Revert "core143: add dhcp" This reverts commit 804deb1b23f24daa35d0cf052d8d0eac82c3319f. commit 1b8a5da550a8918832064067ef157b4cd8b20ddc Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sat Mar 28 09:40:21 2020 +0100 Revert "dhcp: Update to 4.4.2" dhcp 4.4.2 internally includes bind 9.11.14 this version not work on arm 32bit. This reverts commit 417fd66045433d8101c11bea669e14a39af4db13. ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/143/filelists/dhcp | 1 - lfs/dhcp | 6 +++--- 2 files changed, 3 insertions(+), 4 deletions(-) delete mode 120000 config/rootfiles/core/143/filelists/dhcp Difference in files: diff --git a/config/rootfiles/core/143/filelists/dhcp b/config/rootfiles/core/143/filelists/dhcp deleted file mode 120000 index 32d8da443..000000000 --- a/config/rootfiles/core/143/filelists/dhcp +++ /dev/null @@ -1 +0,0 @@ -../../../common/dhcp \ No newline at end of file diff --git a/lfs/dhcp b/lfs/dhcp index 8c64ae899..4c01428f5 100644 --- a/lfs/dhcp +++ b/lfs/dhcp @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 4.4.2 +VER = 4.4.1 THISAPP = dhcp-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 2afdaf8498dc1edaf3012efdd589b3e1 +$(DL_FILE)_MD5 = 18c7f4dcbb0a63df25098216d47b1ede install : $(TARGET) hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 0b1f09d581cb93f316e00f5983c27275ab681ff1
by Arne Fitzenreiter 26 Mar '20

26 Mar '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 0b1f09d581cb93f316e00f5983c27275ab681ff1 (commit) from 9db0d4db5f3a973f4ac73f71e3bee38f450f33c6 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 0b1f09d581cb93f316e00f5983c27275ab681ff1 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Thu Mar 26 18:26:07 2020 +0000 core143: update local openssh config Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/143/update.sh | 3 +++ 1 file changed, 3 insertions(+) Difference in files: diff --git a/config/rootfiles/core/143/update.sh b/config/rootfiles/core/143/update.sh index 90d3f72fc..cb7f57914 100644 --- a/config/rootfiles/core/143/update.sh +++ b/config/rootfiles/core/143/update.sh @@ -65,6 +65,9 @@ rm -f /var/log/vnstat/tag # restart init after glibc replace telinit u +# Apply local configuration to sshd_config +/usr/local/bin/sshctrl + # remove dropped packages for package in bluetooth; do if [ -e /opt/pakfire/db/installed/meta-$package ]; then hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 9db0d4db5f3a973f4ac73f71e3bee38f450f33c6
by Arne Fitzenreiter 26 Mar '20

26 Mar '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 9db0d4db5f3a973f4ac73f71e3bee38f450f33c6 (commit) from 5562f26f6979c2d60202eafe32469989c0878f20 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 9db0d4db5f3a973f4ac73f71e3bee38f450f33c6 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Thu Mar 26 18:03:19 2020 +0000 core143: add backup.pl Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/143/filelists/files | 1 + 1 file changed, 1 insertion(+) Difference in files: diff --git a/config/rootfiles/core/143/filelists/files b/config/rootfiles/core/143/filelists/files index b571b41bd..c82f67734 100644 --- a/config/rootfiles/core/143/filelists/files +++ b/config/rootfiles/core/143/filelists/files @@ -9,3 +9,4 @@ srv/web/ipfire/cgi-bin/fireinfo.cgi srv/web/ipfire/cgi-bin/netother.cgi srv/web/ipfire/cgi-bin/ovpnmain.cgi usr/lib/firewall/rules.pl +var/ipfire/backup/bin/backup.pl hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 5562f26f6979c2d60202eafe32469989c0878f20
by Arne Fitzenreiter 26 Mar '20

26 Mar '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 5562f26f6979c2d60202eafe32469989c0878f20 (commit) via d2738c4c3c8daab35958c41380c9b3673b341866 (commit) via 7ad653cc09409c4e23885bf89279bd8458189f11 (commit) via 5c1c9938ebcd5b2cde8e159424d17de849c12ef8 (commit) via 5dba838282f23954a1cfeb4586b1cabc294a9b32 (commit) via 5d957b01c98157e29675d61c2d3118d0be18a00f (commit) via ff3c71fb48bbc4ad15e22a7417f6b8adbd39b423 (commit) via 804deb1b23f24daa35d0cf052d8d0eac82c3319f (commit) via 417fd66045433d8101c11bea669e14a39af4db13 (commit) from 0167befa0a83baa7d774ae0a93db5d05608c310e (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 5562f26f6979c2d60202eafe32469989c0878f20 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Thu Mar 26 17:56:23 2020 +0000 vnstat: remove wrong tag file fixes #12305 I had created this tag file to ship the folder but vnstat doesn't like empty files. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit d2738c4c3c8daab35958c41380c9b3673b341866 Author: Markus Untersee <m.untersee(a)buerliag.ch> Date: Thu Jan 30 13:41:36 2020 +0100 vnstat: Add restart command. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 7ad653cc09409c4e23885bf89279bd8458189f11 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Tue Jan 28 11:51:50 2020 +0100 ovpnmain.cgi: Validate CCDNet name when renaming it. Fixes #12282 Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 5c1c9938ebcd5b2cde8e159424d17de849c12ef8 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Thu Mar 26 17:50:26 2020 +0000 core143: add firewall initskript Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 5dba838282f23954a1cfeb4586b1cabc294a9b32 Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Mon Jan 27 15:04:00 2020 +0000 avoid emitting VPN traffic to the internet if the IPS crashed Due to strange NFQUEUE behaviour, traffic to remote VPN (IPsec or OpenVPN) destinations was emitted to the internet (ppp0 or red0 interface) directly if the IPS was enabled but crashed during operation. This patch places the IPSECBLOCK and OVPNBLOCK chains before the ones responsible for forwarding traffic into the IPS. Thanks to Michael for his debugging effort. Partially fixes #12257 Cc: Michael Tremer <michael.tremer(a)ipfire.org> Cc: Stefan Schantl <stefan.schantl(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> Acked-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 5d957b01c98157e29675d61c2d3118d0be18a00f Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Thu Mar 26 17:48:18 2020 +0000 core143: add libtool Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit ff3c71fb48bbc4ad15e22a7417f6b8adbd39b423 Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Sat Jan 25 20:13:06 2020 +0100 libtool: Update 2.4.6 For details see: https://savannah.gnu.org/forum/forum.php?forum_id=8210 Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 804deb1b23f24daa35d0cf052d8d0eac82c3319f Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Thu Mar 26 17:46:05 2020 +0000 core143: add dhcp Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 417fd66045433d8101c11bea669e14a39af4db13 Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Sat Jan 25 20:04:26 2020 +0100 dhcp: Update to 4.4.2 For details see: https://downloads.isc.org/isc/dhcp/4.4.2/dhcp-4.4.2-RELNOTES Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/backup/backup.pl | 3 +++ config/rootfiles/common/vnstat | 3 +-- .../rootfiles/{oldcore/111 => core/143}/filelists/dhcp | 0 config/rootfiles/core/143/filelists/files | 1 + .../rootfiles/{oldcore/66 => core/143}/filelists/libtool | 0 config/rootfiles/core/143/update.sh | 3 +++ html/cgi-bin/ovpnmain.cgi | 7 +++++++ lfs/dhcp | 6 +++--- lfs/libtool | 6 +++--- lfs/vnstat | 3 +-- src/initscripts/system/firewall | 16 ++++++++-------- src/initscripts/system/vnstat | 8 ++++++-- 12 files changed, 36 insertions(+), 20 deletions(-) copy config/rootfiles/{oldcore/111 => core/143}/filelists/dhcp (100%) copy config/rootfiles/{oldcore/66 => core/143}/filelists/libtool (100%) Difference in files: diff --git a/config/backup/backup.pl b/config/backup/backup.pl index 9a92a9d9f..e08d8de84 100644 --- a/config/backup/backup.pl +++ b/config/backup/backup.pl @@ -76,6 +76,9 @@ restore_backup() { /bin/kill -HUP `cat /var/run/suricata.pid 2> /dev/null` 2> /dev/null /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null + # remove wrong vnstat tag file + rm -f /var/log/vnstat/tag + # Run converters # Outgoing Firewall diff --git a/config/rootfiles/common/vnstat b/config/rootfiles/common/vnstat index d5b56a679..42e00ed2a 100644 --- a/config/rootfiles/common/vnstat +++ b/config/rootfiles/common/vnstat @@ -9,5 +9,4 @@ usr/bin/vnstati #usr/share/man/man1/vnstati.1 #usr/share/man/man1/vnstat.1 #var/lib/vnstat -#var/log/vnstat -var/log/vnstat/tag +var/log/vnstat diff --git a/config/rootfiles/core/143/filelists/dhcp b/config/rootfiles/core/143/filelists/dhcp new file mode 120000 index 000000000..32d8da443 --- /dev/null +++ b/config/rootfiles/core/143/filelists/dhcp @@ -0,0 +1 @@ +../../../common/dhcp \ No newline at end of file diff --git a/config/rootfiles/core/143/filelists/files b/config/rootfiles/core/143/filelists/files index e5edae10f..b571b41bd 100644 --- a/config/rootfiles/core/143/filelists/files +++ b/config/rootfiles/core/143/filelists/files @@ -2,6 +2,7 @@ etc/system-release etc/issue srv/web/ipfire/cgi-bin/credits.cgi var/ipfire/langs +etc/rc.d/init.d/firewall etc/rc.d/init.d/localnet srv/web/ipfire/cgi-bin/dhcp.cgi srv/web/ipfire/cgi-bin/fireinfo.cgi diff --git a/config/rootfiles/core/143/filelists/libtool b/config/rootfiles/core/143/filelists/libtool new file mode 120000 index 000000000..54f5666f8 --- /dev/null +++ b/config/rootfiles/core/143/filelists/libtool @@ -0,0 +1 @@ +../../../common/libtool \ No newline at end of file diff --git a/config/rootfiles/core/143/update.sh b/config/rootfiles/core/143/update.sh index 092b9c399..90d3f72fc 100644 --- a/config/rootfiles/core/143/update.sh +++ b/config/rootfiles/core/143/update.sh @@ -59,6 +59,9 @@ extract_files # update linker config ldconfig +# remove wrong vnstat tag file +rm -f /var/log/vnstat/tag + # restart init after glibc replace telinit u diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index a6fdd6d75..ce9524df7 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -490,6 +490,13 @@ sub modccdnet my $oldname=$_[1]; my %ccdconfhash=(); my %ccdhash=(); + + # Check if the new name is valid. + if(!&General::validhostname($newname)) { + $errormessage=$Lang::tr{'ccd err invalidname'}; + return; + } + &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash); foreach my $key (keys %ccdconfhash) { if ($ccdconfhash{$key}[0] eq $oldname) { diff --git a/lfs/dhcp b/lfs/dhcp index 4c01428f5..8c64ae899 100644 --- a/lfs/dhcp +++ b/lfs/dhcp @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 4.4.1 +VER = 4.4.2 THISAPP = dhcp-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 18c7f4dcbb0a63df25098216d47b1ede +$(DL_FILE)_MD5 = 2afdaf8498dc1edaf3012efdd589b3e1 install : $(TARGET) diff --git a/lfs/libtool b/lfs/libtool index 90dae11e8..e769a10d0 100644 --- a/lfs/libtool +++ b/lfs/libtool @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2.4.4 +VER = 2.4.6 THISAPP = libtool-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -42,7 +42,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 51bf400de3354687d68dfa2392506b7e +$(DL_FILE)_MD5 = 1bfb9b923f2c1339b4d2ce1807064aa5 install : $(TARGET) diff --git a/lfs/vnstat b/lfs/vnstat index b1a17ce1f..27189126b 100644 --- a/lfs/vnstat +++ b/lfs/vnstat @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -87,7 +87,6 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) sed -i 's|/var/run/vnstat/vnstat.pid|/var/run/vnstat.pid|g' /etc/vnstat.conf mkdir -p /var/log/vnstat - touch /var/log/vnstat/tag @rm -rf $(DIR_APP) @$(POSTBUILD) diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index ec396c708..ab144ea18 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -185,14 +185,6 @@ iptables_init() { iptables -A INPUT -j GUARDIAN iptables -A FORWARD -j GUARDIAN - # IPS (suricata) chains - iptables -N IPS_INPUT - iptables -N IPS_FORWARD - iptables -N IPS_OUTPUT - iptables -A INPUT -j IPS_INPUT - iptables -A FORWARD -j IPS_FORWARD - iptables -A OUTPUT -j IPS_OUTPUT - # Block non-established IPsec networks iptables -N IPSECBLOCK iptables -A FORWARD -m policy --dir out --pol none -j IPSECBLOCK @@ -204,6 +196,14 @@ iptables_init() { iptables -A FORWARD -i tun+ -j OVPNBLOCK iptables -A FORWARD -o tun+ -j OVPNBLOCK + # IPS (suricata) chains + iptables -N IPS_INPUT + iptables -N IPS_FORWARD + iptables -N IPS_OUTPUT + iptables -A INPUT -j IPS_INPUT + iptables -A FORWARD -j IPS_FORWARD + iptables -A OUTPUT -j IPS_OUTPUT + # OpenVPN transfer network translation iptables -t nat -N OVPNNAT iptables -t nat -A POSTROUTING -j OVPNNAT diff --git a/src/initscripts/system/vnstat b/src/initscripts/system/vnstat index 518b2d7c6..363307013 100755 --- a/src/initscripts/system/vnstat +++ b/src/initscripts/system/vnstat @@ -21,7 +21,11 @@ case "$1" in stop) umount_ramdisk "${VNSTATLOG}" ;; - + restart) + ${0} stop + sleep 1 + ${0} start + ;; backup) # Backup all data if ramdisk is used if mountpoint "${RRDLOG}" &>/dev/null; then @@ -30,7 +34,7 @@ case "$1" in ;; *) - echo "Usage: $0 {start|stop|backup}" + echo "Usage: $0 {start|stop|restart|backup}" exit 1 ;; esac hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 0167befa0a83baa7d774ae0a93db5d05608c310e
by Arne Fitzenreiter 26 Mar '20

26 Mar '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 0167befa0a83baa7d774ae0a93db5d05608c310e (commit) via cd9fc42d96888d5d95c4edc6ef7a01269e79b805 (commit) from 67345f56657db75e6ec6c0ea1ba21c3bc03acaef (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 0167befa0a83baa7d774ae0a93db5d05608c310e Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Thu Mar 26 17:44:08 2020 +0000 core143: add logwatch Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit cd9fc42d96888d5d95c4edc6ef7a01269e79b805 Author: Matthias Fischer <matthias.fischer(a)ipfire.org> Date: Sat Jan 25 19:57:24 2020 +0100 logwatch: Update to 7.5.3 For details see: https://sourceforge.net/p/logwatch/activity/?page=0&limit=100#5e27da933241d… Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/{oldcore/111 => core/143}/filelists/logwatch | 0 lfs/logwatch | 4 ++-- 2 files changed, 2 insertions(+), 2 deletions(-) copy config/rootfiles/{oldcore/111 => core/143}/filelists/logwatch (100%) Difference in files: diff --git a/config/rootfiles/core/143/filelists/logwatch b/config/rootfiles/core/143/filelists/logwatch new file mode 120000 index 000000000..f14eabda9 --- /dev/null +++ b/config/rootfiles/core/143/filelists/logwatch @@ -0,0 +1 @@ +../../../common/logwatch \ No newline at end of file diff --git a/lfs/logwatch b/lfs/logwatch index eb576717c..a980b1b40 100644 --- a/lfs/logwatch +++ b/lfs/logwatch @@ -24,7 +24,7 @@ include Config -VER = 7.5.2 +VER = 7.5.3 THISAPP = logwatch-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 634b2ac423b77b809d400cc6085db49d +$(DL_FILE)_MD5 = 8bcf3edc5a4687c8aad1b9c01e2be54b install : $(TARGET) hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 67345f56657db75e6ec6c0ea1ba21c3bc03acaef
by Arne Fitzenreiter 26 Mar '20

26 Mar '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 67345f56657db75e6ec6c0ea1ba21c3bc03acaef (commit) via 0017b688e88a7ef89161ba8a803990b02ff05413 (commit) via 57302eeb16c73fdbebc23c5cd58c042fc2d77f9b (commit) via 3fd3f4de44df53d631937ec137078eb8c0328bd4 (commit) from a48d35f3ff4ff0651ea155bfc5ffabfc85cc7978 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 67345f56657db75e6ec6c0ea1ba21c3bc03acaef Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Thu Mar 26 17:41:57 2020 +0000 core143: add openssh Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 0017b688e88a7ef89161ba8a803990b02ff05413 Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Mon Jan 20 20:05:00 2020 +0000 ssh_config: Do not set defaults explicitly Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 57302eeb16c73fdbebc23c5cd58c042fc2d77f9b Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Mon Jan 20 20:04:00 2020 +0000 sshd_config: Do not set defaults explicitly In order to keep configurations as small as possible and to make them easier to read/audit, this patch omits all default configuration in the OpenSSH server configuration file. Further, it mentions where to refer for the full documentation. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> commit 3fd3f4de44df53d631937ec137078eb8c0328bd4 Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Sat Mar 21 20:08:00 2020 +0000 OpenSSH: update to 8.2p1 Please refer to https://www.openssh.com/txt/release-8.2 for release announcements. Since glibc < 2.31 is used, no additional patching was required in order to restore correct login functionality. Cc: Marcel Lorenz <marcel.lorenz(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/openssh | 2 + .../{oldcore/100 => core/143}/filelists/openssh | 0 config/ssh/ssh_config | 27 +++++----- config/ssh/sshd_config | 62 +++++++--------------- lfs/openssh | 6 +-- 5 files changed, 38 insertions(+), 59 deletions(-) copy config/rootfiles/{oldcore/100 => core/143}/filelists/openssh (100%) Difference in files: diff --git a/config/rootfiles/common/openssh b/config/rootfiles/common/openssh index b41190a47..f2f8ea6c5 100644 --- a/config/rootfiles/common/openssh +++ b/config/rootfiles/common/openssh @@ -21,6 +21,7 @@ usr/bin/ssh-keyscan usr/lib/openssh/sftp-server usr/lib/openssh/ssh-keysign usr/lib/openssh/ssh-pkcs11-helper +usr/lib/openssh/ssh-sk-helper usr/sbin/sshd #usr/share/man/man1/scp.1 #usr/share/man/man1/sftp.1 @@ -35,4 +36,5 @@ usr/sbin/sshd #usr/share/man/man8/sftp-server.8 #usr/share/man/man8/ssh-keysign.8 #usr/share/man/man8/ssh-pkcs11-helper.8 +#usr/share/man/man8/ssh-sk-helper.8 #usr/share/man/man8/sshd.8 diff --git a/config/rootfiles/core/143/filelists/openssh b/config/rootfiles/core/143/filelists/openssh new file mode 120000 index 000000000..d8c77fd8e --- /dev/null +++ b/config/rootfiles/core/143/filelists/openssh @@ -0,0 +1 @@ +../../../common/openssh \ No newline at end of file diff --git a/config/ssh/ssh_config b/config/ssh/ssh_config index 2abfae6d1..2e2ee60c3 100644 --- a/config/ssh/ssh_config +++ b/config/ssh/ssh_config @@ -1,33 +1,32 @@ -# OpenSSH client configuration +# OpenSSH client configuration file for IPFire # -# set some basic hardening options for all connections +# The full documentation is available at: https://man.openbsd.org/ssh_config +# + +# Set some basic hardening options for all connections Host * - # disable Roaming as it is known to be vulnerable + # Disable Roaming as it is known to be vulnerable UseRoaming no - # only use secure crypto algorithm + # Only use secure crypto algorithms KexAlgorithms curve25519-sha256(a)libssh.org,diffie-hellman-group-exchange-sha256 Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com - # always visualise server host keys (has no technical - # effect, but helps to identify key based MITM attacks) + # Always visualise server host keys (but helps to identify key based MITM attacks) VisualHostKey yes - # use SSHFP (might work on some up-to-date networks) to look up host keys + # Use SSHFP (might work on some up-to-date networks) to look up host keys VerifyHostKeyDNS yes # send keep-alive messages to connected server to avoid broken connections ServerAliveInterval 10 ServerAliveCountMax 6 - # disable X11 forwarding (security risk) - ForwardX11 no - - # always check server IP address - CheckHostIP yes - - # ensure only allowed authentication methods are used + # Ensure only allowed authentication methods are used PreferredAuthentications publickey,keyboard-interactive,password + # Prevent information leak by hashing ~/.ssh/known_hosts + HashKnownHosts yes + # EOF diff --git a/config/ssh/sshd_config b/config/ssh/sshd_config index a248c4906..bea5cee53 100644 --- a/config/ssh/sshd_config +++ b/config/ssh/sshd_config @@ -1,81 +1,59 @@ -# ultra-secure OpenSSH server configuration +# OpenSSH server configuration file for IPFire +# +# The full documentation is available at: https://man.openbsd.org/sshd_config +# -# only allow version 2 of SSH protocol +# Only allow version 2 of SSH protocol Protocol 2 -# listen on port 22 by default +# Listen on port 22 by default Port 22 -# listen on these interfaces and protocols -AddressFamily any +# Listen on every interface and IPv4 only +AddressFamily inet ListenAddress 0.0.0.0 -# limit authentication thresholds +# Limit authentication timeout to 30 seconds LoginGraceTime 30s -MaxAuthTries 6 -# limit maximum instanctes to prevent DoS +# Limit maximum instanctes to prevent DoS MaxStartups 5 -# ensure proper logging -SyslogFacility AUTH -LogLevel INFO - -# enforce permission checks before a login is accepted -# (prevents damage because of hacked systems with world-writeable -# home directories or similar) -StrictModes yes - -# only allow safe crypto algorithms (may break some _very_ outdated clients) -# see also: https://stribika.github.io/2015/01/04/secure-secure-shell.html +# Only allow safe crypto algorithms (may break some _very_ outdated clients) +# See also: https://stribika.github.io/2015/01/04/secure-secure-shell.html KexAlgorithms curve25519-sha256(a)libssh.org,diffie-hellman-group-exchange-sha256 Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com -# enable data compression after successful login only -Compression delayed - -# only allow cryptographically safe SSH host keys (adjust paths if needed) +# Only allow cryptographically safe SSH host keys (adjust paths if needed) HostKey /etc/ssh/ssh_host_ed25519_key HostKey /etc/ssh/ssh_host_ecdsa_key HostKey /etc/ssh/ssh_host_rsa_key -# only allow login via public key by default +# Only allow login via public key by default PubkeyAuthentication yes PasswordAuthentication no ChallengeResponseAuthentication no -PermitEmptyPasswords no -# permit root login as there is no other user in IPFire 2.x +# Permit root login as there is no other user in IPFire 2.x PermitRootLogin yes -# ignore user ~/.rhost* files -IgnoreRhosts yes - -# ignore user known hosts file +# Ignore user ~/.ssh/known_hosts file IgnoreUserKnownHosts yes -# ignore user environments -PermitUserEnvironment no - -# do not allow any kind of forwarding (provides only low security) +# Do not allow any kind of forwarding (provides only low security); # some of them might need to be re-enabled if SSH server is a jump platform -X11Forwarding no AllowTcpForwarding no AllowAgentForwarding no -PermitTunnel no -GatewayPorts no PermitOpen none -# detect broken sessions by sending keep-alive messages to -# clients (both via TCP and SSH) -TCPKeepAlive yes +# Detect broken sessions by sending keep-alive messages to clients via SSH connection ClientAliveInterval 10 -# close unresponsive SSH sessions which fail to answer keep-alive +# Close unresponsive SSH sessions which fail to answer keep-alive ClientAliveCountMax 6 -# add support for SFTP +# Add support for SFTP Subsystem sftp /usr/lib/openssh/sftp-server # EOF diff --git a/lfs/openssh b/lfs/openssh index 64e72d654..68a7d63cd 100644 --- a/lfs/openssh +++ b/lfs/openssh @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 8.1p1 +VER = 8.2p1 THISAPP = openssh-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 513694343631a99841e815306806edf0 +$(DL_FILE)_MD5 = 3076e6413e8dbe56d33848c1054ac091 install : $(TARGET) hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. a48d35f3ff4ff0651ea155bfc5ffabfc85cc7978
by Arne Fitzenreiter 26 Mar '20

26 Mar '20

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via a48d35f3ff4ff0651ea155bfc5ffabfc85cc7978 (commit) from f64ce4966bd33c4c574697e4f3f114b70ffdb5c0 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit a48d35f3ff4ff0651ea155bfc5ffabfc85cc7978 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Thu Mar 26 17:38:32 2020 +0000 smartmontools: update rootfile Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/smartmontools | 2 ++ 1 file changed, 2 insertions(+) Difference in files: diff --git a/config/rootfiles/common/smartmontools b/config/rootfiles/common/smartmontools index dceb1d707..9f03226be 100644 --- a/config/rootfiles/common/smartmontools +++ b/config/rootfiles/common/smartmontools @@ -24,6 +24,8 @@ usr/sbin/update-smart-drivedb #usr/share/doc/smartmontools/examplescripts/Example4 #usr/share/doc/smartmontools/examplescripts/Example5 #usr/share/doc/smartmontools/examplescripts/Example6 +#usr/share/doc/smartmontools/examplescripts/Example7 +#usr/share/doc/smartmontools/examplescripts/Example8 #usr/share/doc/smartmontools/examplescripts/README #usr/share/doc/smartmontools/smartd.conf #usr/share/man/man5/smartd.conf.5 hooks/post-receive -- IPFire 2.x development tree

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

IPFire-SCM