This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, next has been updated
via 820e90db0f2cd2ee81a3e978a2c9315e08307ac2 (commit)
via 7471256910d6dfdfcfc9c73f79afde3236443376 (commit)
via 693208bf63671ec9d6f345e858b0bd6d0ebec064 (commit)
from 32405d88b0ac820ae74c0a15cc2f805cdcb63a6a (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 820e90db0f2cd2ee81a3e978a2c9315e08307ac2
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Thu Jul 12 10:04:37 2018 +0100
iptables: Ship all modules
These have been all disabled with the last update of
the iptables package.
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 7471256910d6dfdfcfc9c73f79afde3236443376
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Thu Jul 12 10:03:34 2018 +0100
Rootfile update
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 693208bf63671ec9d6f345e858b0bd6d0ebec064
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Thu Jul 12 09:59:31 2018 +0100
aws: Don't start ssh right away
sshctrl calls sshd directly which won't work at time of the first boot
because no keys will be generated.
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
-----------------------------------------------------------------------
Summary of changes:
config/rootfiles/common/hwdata | 3 +-
config/rootfiles/common/iptables | 232 +++++++++++++++++++--------------------
config/rootfiles/common/setup | 1 +
config/rootfiles/common/sudo | 1 -
src/initscripts/helper/aws-setup | 7 +-
5 files changed, 123 insertions(+), 121 deletions(-)
Difference in files:
diff --git a/config/rootfiles/common/hwdata b/config/rootfiles/common/hwdata
index 30d51a2d0..db268e887 100644
--- a/config/rootfiles/common/hwdata
+++ b/config/rootfiles/common/hwdata
@@ -1,2 +1,3 @@
-usr/share/hwdata/usb.ids
+#usr/share/hwdata
usr/share/hwdata/pci.ids
+usr/share/hwdata/usb.ids
diff --git a/config/rootfiles/common/iptables b/config/rootfiles/common/iptables
index d0c1065cb..d7584c0ad 100644
--- a/config/rootfiles/common/iptables
+++ b/config/rootfiles/common/iptables
@@ -19,122 +19,122 @@ lib/libxtables.so
lib/libxtables.so.12
lib/libxtables.so.12.0.0
#lib/xtables
-#lib/xtables/libebt_802_3.so
-#lib/xtables/libebt_ip.so
-#lib/xtables/libebt_log.so
-#lib/xtables/libebt_mark_m.so
-#lib/xtables/libip6t_DNAT.so
-#lib/xtables/libip6t_DNPT.so
-#lib/xtables/libip6t_HL.so
-#lib/xtables/libip6t_LOG.so
-#lib/xtables/libip6t_MASQUERADE.so
-#lib/xtables/libip6t_NETMAP.so
-#lib/xtables/libip6t_REDIRECT.so
-#lib/xtables/libip6t_REJECT.so
-#lib/xtables/libip6t_SNAT.so
-#lib/xtables/libip6t_SNPT.so
-#lib/xtables/libip6t_ah.so
-#lib/xtables/libip6t_dst.so
-#lib/xtables/libip6t_eui64.so
-#lib/xtables/libip6t_frag.so
-#lib/xtables/libip6t_hbh.so
-#lib/xtables/libip6t_hl.so
-#lib/xtables/libip6t_icmp6.so
-#lib/xtables/libip6t_ipv6header.so
-#lib/xtables/libip6t_mh.so
-#lib/xtables/libip6t_rt.so
-#lib/xtables/libip6t_srh.so
-#lib/xtables/libipt_CLUSTERIP.so
-#lib/xtables/libipt_DNAT.so
-#lib/xtables/libipt_ECN.so
-#lib/xtables/libipt_LOG.so
-#lib/xtables/libipt_MASQUERADE.so
-#lib/xtables/libipt_NETMAP.so
-#lib/xtables/libipt_REDIRECT.so
-#lib/xtables/libipt_REJECT.so
-#lib/xtables/libipt_SNAT.so
-#lib/xtables/libipt_TTL.so
-#lib/xtables/libipt_ULOG.so
-#lib/xtables/libipt_ah.so
-#lib/xtables/libipt_icmp.so
-#lib/xtables/libipt_realm.so
-#lib/xtables/libipt_ttl.so
-#lib/xtables/libxt_AUDIT.so
-#lib/xtables/libxt_CHECKSUM.so
-#lib/xtables/libxt_CLASSIFY.so
-#lib/xtables/libxt_CONNMARK.so
-#lib/xtables/libxt_CONNSECMARK.so
-#lib/xtables/libxt_CT.so
-#lib/xtables/libxt_DSCP.so
-#lib/xtables/libxt_HMARK.so
-#lib/xtables/libxt_IDLETIMER.so
-#lib/xtables/libxt_IMQ.so
-#lib/xtables/libxt_LED.so
-#lib/xtables/libxt_MARK.so
-#lib/xtables/libxt_NFLOG.so
-#lib/xtables/libxt_NFQUEUE.so
-#lib/xtables/libxt_NOTRACK.so
-#lib/xtables/libxt_RATEEST.so
-#lib/xtables/libxt_SECMARK.so
-#lib/xtables/libxt_SET.so
-#lib/xtables/libxt_SYNPROXY.so
-#lib/xtables/libxt_TCPMSS.so
-#lib/xtables/libxt_TCPOPTSTRIP.so
-#lib/xtables/libxt_TEE.so
-#lib/xtables/libxt_TOS.so
-#lib/xtables/libxt_TPROXY.so
-#lib/xtables/libxt_TRACE.so
-#lib/xtables/libxt_addrtype.so
-#lib/xtables/libxt_bpf.so
-#lib/xtables/libxt_cgroup.so
-#lib/xtables/libxt_cluster.so
-#lib/xtables/libxt_comment.so
-#lib/xtables/libxt_connbytes.so
-#lib/xtables/libxt_connlabel.so
-#lib/xtables/libxt_connlimit.so
-#lib/xtables/libxt_connmark.so
-#lib/xtables/libxt_conntrack.so
-#lib/xtables/libxt_cpu.so
-#lib/xtables/libxt_dccp.so
-#lib/xtables/libxt_devgroup.so
-#lib/xtables/libxt_dscp.so
-#lib/xtables/libxt_ecn.so
-#lib/xtables/libxt_esp.so
-#lib/xtables/libxt_hashlimit.so
-#lib/xtables/libxt_helper.so
-#lib/xtables/libxt_ipcomp.so
-#lib/xtables/libxt_iprange.so
-#lib/xtables/libxt_ipvs.so
-#lib/xtables/libxt_layer7.so
-#lib/xtables/libxt_length.so
-#lib/xtables/libxt_limit.so
-#lib/xtables/libxt_mac.so
-#lib/xtables/libxt_mangle.so
-#lib/xtables/libxt_mark.so
-#lib/xtables/libxt_multiport.so
-#lib/xtables/libxt_nfacct.so
-#lib/xtables/libxt_osf.so
-#lib/xtables/libxt_owner.so
-#lib/xtables/libxt_physdev.so
-#lib/xtables/libxt_pkttype.so
-#lib/xtables/libxt_policy.so
-#lib/xtables/libxt_quota.so
-#lib/xtables/libxt_rateest.so
-#lib/xtables/libxt_recent.so
-#lib/xtables/libxt_rpfilter.so
-#lib/xtables/libxt_sctp.so
-#lib/xtables/libxt_set.so
-#lib/xtables/libxt_socket.so
-#lib/xtables/libxt_standard.so
-#lib/xtables/libxt_state.so
-#lib/xtables/libxt_statistic.so
-#lib/xtables/libxt_string.so
-#lib/xtables/libxt_tcp.so
-#lib/xtables/libxt_tcpmss.so
-#lib/xtables/libxt_time.so
-#lib/xtables/libxt_tos.so
-#lib/xtables/libxt_u32.so
-#lib/xtables/libxt_udp.so
+lib/xtables/libebt_802_3.so
+lib/xtables/libebt_ip.so
+lib/xtables/libebt_log.so
+lib/xtables/libebt_mark_m.so
+lib/xtables/libip6t_DNAT.so
+lib/xtables/libip6t_DNPT.so
+lib/xtables/libip6t_HL.so
+lib/xtables/libip6t_LOG.so
+lib/xtables/libip6t_MASQUERADE.so
+lib/xtables/libip6t_NETMAP.so
+lib/xtables/libip6t_REDIRECT.so
+lib/xtables/libip6t_REJECT.so
+lib/xtables/libip6t_SNAT.so
+lib/xtables/libip6t_SNPT.so
+lib/xtables/libip6t_ah.so
+lib/xtables/libip6t_dst.so
+lib/xtables/libip6t_eui64.so
+lib/xtables/libip6t_frag.so
+lib/xtables/libip6t_hbh.so
+lib/xtables/libip6t_hl.so
+lib/xtables/libip6t_icmp6.so
+lib/xtables/libip6t_ipv6header.so
+lib/xtables/libip6t_mh.so
+lib/xtables/libip6t_rt.so
+lib/xtables/libip6t_srh.so
+lib/xtables/libipt_CLUSTERIP.so
+lib/xtables/libipt_DNAT.so
+lib/xtables/libipt_ECN.so
+lib/xtables/libipt_LOG.so
+lib/xtables/libipt_MASQUERADE.so
+lib/xtables/libipt_NETMAP.so
+lib/xtables/libipt_REDIRECT.so
+lib/xtables/libipt_REJECT.so
+lib/xtables/libipt_SNAT.so
+lib/xtables/libipt_TTL.so
+lib/xtables/libipt_ULOG.so
+lib/xtables/libipt_ah.so
+lib/xtables/libipt_icmp.so
+lib/xtables/libipt_realm.so
+lib/xtables/libipt_ttl.so
+lib/xtables/libxt_AUDIT.so
+lib/xtables/libxt_CHECKSUM.so
+lib/xtables/libxt_CLASSIFY.so
+lib/xtables/libxt_CONNMARK.so
+lib/xtables/libxt_CONNSECMARK.so
+lib/xtables/libxt_CT.so
+lib/xtables/libxt_DSCP.so
+lib/xtables/libxt_HMARK.so
+lib/xtables/libxt_IDLETIMER.so
+lib/xtables/libxt_IMQ.so
+lib/xtables/libxt_LED.so
+lib/xtables/libxt_MARK.so
+lib/xtables/libxt_NFLOG.so
+lib/xtables/libxt_NFQUEUE.so
+lib/xtables/libxt_NOTRACK.so
+lib/xtables/libxt_RATEEST.so
+lib/xtables/libxt_SECMARK.so
+lib/xtables/libxt_SET.so
+lib/xtables/libxt_SYNPROXY.so
+lib/xtables/libxt_TCPMSS.so
+lib/xtables/libxt_TCPOPTSTRIP.so
+lib/xtables/libxt_TEE.so
+lib/xtables/libxt_TOS.so
+lib/xtables/libxt_TPROXY.so
+lib/xtables/libxt_TRACE.so
+lib/xtables/libxt_addrtype.so
+lib/xtables/libxt_bpf.so
+lib/xtables/libxt_cgroup.so
+lib/xtables/libxt_cluster.so
+lib/xtables/libxt_comment.so
+lib/xtables/libxt_connbytes.so
+lib/xtables/libxt_connlabel.so
+lib/xtables/libxt_connlimit.so
+lib/xtables/libxt_connmark.so
+lib/xtables/libxt_conntrack.so
+lib/xtables/libxt_cpu.so
+lib/xtables/libxt_dccp.so
+lib/xtables/libxt_devgroup.so
+lib/xtables/libxt_dscp.so
+lib/xtables/libxt_ecn.so
+lib/xtables/libxt_esp.so
+lib/xtables/libxt_hashlimit.so
+lib/xtables/libxt_helper.so
+lib/xtables/libxt_ipcomp.so
+lib/xtables/libxt_iprange.so
+lib/xtables/libxt_ipvs.so
+lib/xtables/libxt_layer7.so
+lib/xtables/libxt_length.so
+lib/xtables/libxt_limit.so
+lib/xtables/libxt_mac.so
+lib/xtables/libxt_mangle.so
+lib/xtables/libxt_mark.so
+lib/xtables/libxt_multiport.so
+lib/xtables/libxt_nfacct.so
+lib/xtables/libxt_osf.so
+lib/xtables/libxt_owner.so
+lib/xtables/libxt_physdev.so
+lib/xtables/libxt_pkttype.so
+lib/xtables/libxt_policy.so
+lib/xtables/libxt_quota.so
+lib/xtables/libxt_rateest.so
+lib/xtables/libxt_recent.so
+lib/xtables/libxt_rpfilter.so
+lib/xtables/libxt_sctp.so
+lib/xtables/libxt_set.so
+lib/xtables/libxt_socket.so
+lib/xtables/libxt_standard.so
+lib/xtables/libxt_state.so
+lib/xtables/libxt_statistic.so
+lib/xtables/libxt_string.so
+lib/xtables/libxt_tcp.so
+lib/xtables/libxt_tcpmss.so
+lib/xtables/libxt_time.so
+lib/xtables/libxt_tos.so
+lib/xtables/libxt_u32.so
+lib/xtables/libxt_udp.so
sbin/ip6tables
sbin/ip6tables-restore
sbin/ip6tables-save
diff --git a/config/rootfiles/common/setup b/config/rootfiles/common/setup
index 5da99c1cf..45e529806 100644
--- a/config/rootfiles/common/setup
+++ b/config/rootfiles/common/setup
@@ -1,3 +1,4 @@
+#etc/sudoers.d
etc/sudoers.d/setup
usr/bin/probenic.sh
usr/bin/run-setup
diff --git a/config/rootfiles/common/sudo b/config/rootfiles/common/sudo
index d6ac72d4f..860981890 100644
--- a/config/rootfiles/common/sudo
+++ b/config/rootfiles/common/sudo
@@ -1,5 +1,4 @@
etc/sudoers
-etc/sudoers.d
usr/bin/sudo
usr/bin/sudoedit
usr/bin/sudoreplay
diff --git a/src/initscripts/helper/aws-setup b/src/initscripts/helper/aws-setup
index 0ae727c3f..a273aff7d 100644
--- a/src/initscripts/helper/aws-setup
+++ b/src/initscripts/helper/aws-setup
@@ -226,15 +226,16 @@ import_aws_configuration() {
# Enable SSH
sed -e "s/ENABLE_SSH=.*/ENABLE_SSH=on/g" -i /var/ipfire/remote/settings
- touch /var/ipfire/remote/enablessh
- chown nobody:nobody /var/ipfire/remote/enablessh
-
# Enable SSH key authentication
sed -e "s/^ENABLE_SSH_KEYS=.*/ENABLE_SSH_KEYS=on/" -i /var/ipfire/remote/settings
# Apply SSH settings
/usr/local/bin/sshctrl
+ # Mark SSH to start immediately (but not right now)
+ touch /var/ipfire/remote/enablessh
+ chown nobody:nobody /var/ipfire/remote/enablessh
+
# Firewall rules for SSH and WEBIF
(
echo "1,ACCEPT,INPUTFW,ON,std_net_src,ALL,ipfire,RED1,,TCP,,,ON,,,cust_srv,SSH,,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second"
hooks/post-receive
--
IPFire 2.x development tree