[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 6c75a5eee22ddd0e3fbff58677f7a6a3c19d2c64

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 6c75a5eee22ddd0e3fbff58677f7a6a3c19d2c64

[Michael Tremer]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, next has been updated
       via  6c75a5eee22ddd0e3fbff58677f7a6a3c19d2c64 (commit)
       via  91ed071a0b98087afe37b8e93149afa298518d50 (commit)
       via  6a3fe52cc0303b128899995e10c9d1804468fda9 (commit)
       via  c77440a3b1279d215a551d146140754d6f064253 (commit)
      from  a565452c975fb9567c6bc85c8a32eec872d47d78 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 6c75a5eee22ddd0e3fbff58677f7a6a3c19d2c64
Author: Robin Roevens <robin.roevens@disroot.org>
Date:   Thu Mar 27 23:45:52 2025 +0100

    zabbix_agentd: Disable passive checks by default on new installations.
    
    Zabbix Agent by default normally forks 10 instances to listen for incoming (passive) checks.
    I, however, recommend only using active checks on an IPFire instance, so that the agent on the instance will only actively contact the Zabbix server to request a list of checks to perform instead of waiting for the server to contact the agent for every check.
    This frees up some resources valuable to smaller systems and makes the agent not to listen on any TCP port, which is a possible attack surface less.
    
    Users with an existing installation will have to manually add the parameter to their config. This will be documented in the wiki.
    
    Signed-off-by: Robin Roevens <robin.roevens@disroot.org>
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit 91ed071a0b98087afe37b8e93149afa298518d50
Author: Robin Roevens <robin.roevens@disroot.org>
Date:   Thu Mar 27 23:45:51 2025 +0100

    zabbix_agentd: Update to 7.0.11 (LTS)
    
    - Update from version 6.0.33 to 7.0.11
    - Update of rootfile not required
    
    This is a major release update to the next LTS version and breaks compatibility with Zabbix Server 6.x.
    A survey on the forum resulted in nobody claiming to still use Zabbix Server v6.x.
    
    Full changelogs:
    - https://www.zabbix.com/rn/rn7.0.0
    - https://www.zabbix.com/rn/rn7.0.1
    - https://www.zabbix.com/rn/rn7.0.2
    - https://www.zabbix.com/rn/rn7.0.3
    - https://www.zabbix.com/rn/rn7.0.4
    - https://www.zabbix.com/rn/rn7.0.5
    - https://www.zabbix.com/rn/rn7.0.6
    - https://www.zabbix.com/rn/rn7.0.7
    - https://www.zabbix.com/rn/rn7.0.8
    - https://www.zabbix.com/rn/rn7.0.9
    - https://www.zabbix.com/rn/rn7.0.10
    - https://www.zabbix.com/rn/rn7.0.11
    
    Signed-off-by: Robin Roevens <robin.roevens@disroot.org>
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit 6a3fe52cc0303b128899995e10c9d1804468fda9
Author: Michael Tremer <michael.tremer@ipfire.org>
Date:   Fri Mar 28 11:45:38 2025 +0000

    core194: Ship strongswan
    
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit c77440a3b1279d215a551d146140754d6f064253
Author: Michael Tremer <michael.tremer@ipfire.org>
Date:   Fri Mar 28 11:44:01 2025 +0000

    strongswan: Update to 6.0.1
    
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 .../rootfiles/{oldcore/106 => core/194}/filelists/strongswan  |  0
 config/rootfiles/core/194/update.sh                           |  1 +
 config/zabbix_agentd/zabbix_agentd.conf                       | 11 ++++++++++-
 lfs/strongswan                                                |  4 ++--
 lfs/zabbix_agentd                                             |  6 +++---
 5 files changed, 16 insertions(+), 6 deletions(-)
 copy config/rootfiles/{oldcore/106 => core/194}/filelists/strongswan (100%)

Difference in files:
diff --git a/config/rootfiles/core/194/filelists/strongswan b/config/rootfiles/core/194/filelists/strongswan
new file mode 120000
index 0000000000..90c727e265
--- /dev/null
+++ b/config/rootfiles/core/194/filelists/strongswan
@@ -0,0 +1 @@
+../../../common/strongswan
\ No newline at end of file
diff --git a/config/rootfiles/core/194/update.sh b/config/rootfiles/core/194/update.sh
index 2d14ec8a33..6c72dbd545 100644
--- a/config/rootfiles/core/194/update.sh
+++ b/config/rootfiles/core/194/update.sh
@@ -52,6 +52,7 @@ ldconfig
 /usr/local/bin/filesystem-cleanup
 
 # Start services
+/etc/init.d/ipsec restart
 /etc/init.d/suricata restart
 
 # This update needs a reboot...
diff --git a/config/zabbix_agentd/zabbix_agentd.conf b/config/zabbix_agentd/zabbix_agentd.conf
index 4480e43f2b..a5a608d83c 100644
--- a/config/zabbix_agentd/zabbix_agentd.conf
+++ b/config/zabbix_agentd/zabbix_agentd.conf
@@ -13,7 +13,16 @@
 Server=127.0.0.1
 ServerActive=127.0.0.1
 
-# List of comma delimited IP addresses that the agent should listen on.
+# Number of pre-forked instances of zabbix_agentd that process passive checks.
+# On IPFire this is set to 0 to disable passive checks and only allow active
+# checks by default.
+# Set this value in a range of 1-100 to enable passive checks or comment it
+# out to revert to the Zabbix agent default (10).
+StartAgents=0
+
+# List of comma delimited IP addresses that the agent should listen on
+# for passive checks. 
+# The agent will not listen on any TCP port when StartAgents is set to 0.
 ListenIP=GREEN_ADDRESS
 
 # This line activates IPFire specific userparameters. 
diff --git a/lfs/strongswan b/lfs/strongswan
index 4241bf0cac..f3fe35ff52 100644
--- a/lfs/strongswan
+++ b/lfs/strongswan
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 6.0.0
+VER        = 6.0.1
 
 THISAPP    = strongswan-$(VER)
 DL_FILE    = $(THISAPP).tar.bz2
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = acb7c76dd3f4ce88ddc9d81c1f831d37c1975441f73af4025049d495c4103e3d4bf132fce4dd85b148cc58e130dd9609383c8eae569f4a3cb55c56f0ac03f9da
+$(DL_FILE)_BLAKE2 = 5c751073412ce25dd06400043b8daaa9751052b7f686c46ef7b6fc8e8e4f622dd58e30b1eed634a75174a8032a1ece2c24bf5809689152927539c12e2d25edbf
 
 install : $(TARGET)
 
diff --git a/lfs/zabbix_agentd b/lfs/zabbix_agentd
index bd81dba227..dbe2088fbd 100644
--- a/lfs/zabbix_agentd
+++ b/lfs/zabbix_agentd
@@ -26,7 +26,7 @@ include Config
 
 SUMMARY    = Zabbix Agent
 
-VER        = 6.0.37
+VER        = 7.0.11
 
 THISAPP    = zabbix-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -34,7 +34,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = zabbix_agentd
-PAK_VER    = 16
+PAK_VER    = 17
 
 DEPS       = fping
 
@@ -48,7 +48,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 6bf65efe59963294699d8fc6b6456167ae035c075f057c6ca85c612cc41f3f812b14189ed7e03ab2446e751720f8908f8e098fc0fd7335f95251b221b66b674a
+$(DL_FILE)_BLAKE2 = 0c6544c64febc51e6fc153863b46e333d9d5564c83f40b71362a15c0533d48e50e5c340b35b2ca0dd1d776d0452f4aae42dc44d4e0e4b2c5949df02efbc7fc06
 
 install : $(TARGET)
 


hooks/post-receive
--
IPFire 2.x development tree