]> git.ipfire.org Git - ipfire-2.x.git/blobdiff - lfs/configroot
projects / ipfire-2.x.git / blobdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | inline | side by side
firewall: Make logging of conntrack INVALIDs configureable
[ipfire-2.x.git] / lfs / configroot
diff --git a/lfs/configroot b/lfs/configroot
index 6f4dbd459667f76c2ddfbef304c3436e88abb58f..ed264e72ba31cb10cf60ca37f3d6427243169ed1 100644 (file)
--- a/lfs/configroot
+++ b/lfs/configroot
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2018  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2021  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -55,7 +55,7 @@ $(TARGET) :
                        menu.d modem optionsfw \
                        ovpn patches pakfire portfw ppp private proxy/advanced/cre \
                        proxy/calamaris/bin qos/bin red remote sensors suricata time \
-                       updatexlrator/bin updatexlrator/autocheck urlfilter/autoupdate urlfilter/bin upnp vpn \
+                       updatexlrator/bin updatexlrator/autocheck urlfilter/autoupdate urlfilter/bin vpn \
                        wakeonlan wireless ; do \
                mkdir -p $(CONFIG_ROOT)/$$i; \
        done
@@ -63,13 +63,13 @@ $(TARGET) :
        # Touch empty files
        for i in auth/users backup/include.user backup/exclude.user \
            captive/settings captive/agb.txt captive/clients captive/voucher_out certs/index.txt certs/index.txt.attr ddns/config ddns/settings ddns/ipcache dhcp/settings \
-           dhcp/fixleases dhcp/advoptions dhcp/dhcpd.conf.local dns/settings dnsforward/config ethernet/aliases ethernet/settings ethernet/known_nics ethernet/scanned_nics \
-           ethernet/wireless extrahd/scan extrahd/devices extrahd/partitions extrahd/settings firewall/settings firewall/config firewall/geoipblock firewall/input firewall/outgoing \
-           fwhosts/customnetworks fwhosts/customhosts fwhosts/customgroups fwhosts/customservicegrp fwhosts/customgeoipgrp fwlogs/ipsettings fwlogs/portsettings \
-           isdn/settings mac/settings main/hosts main/routing main/settings optionsfw/settings \
+           dhcp/fixleases dhcp/advoptions dhcp/dhcpd.conf.local dns/settings dns/servers dnsforward/config ethernet/aliases ethernet/settings ethernet/known_nics ethernet/scanned_nics \
+           ethernet/wireless extrahd/scan extrahd/devices extrahd/partitions extrahd/settings firewall/settings firewall/config firewall/locationblock firewall/input firewall/outgoing \
+           fwhosts/customnetworks fwhosts/customhosts fwhosts/customgroups fwhosts/customservicegrp fwhosts/customlocationgrp fwlogs/ipsettings fwlogs/portsettings \
+           isdn/settings mac/settings main/hosts main/routing main/security main/settings optionsfw/settings \
            ovpn/ccd.conf ovpn/ccdroute ovpn/ccdroute2 pakfire/settings portfw/config ppp/settings-1 ppp/settings-2 ppp/settings-3 ppp/settings-4 \
            ppp/settings-5 ppp/settings proxy/settings proxy/squid.conf proxy/advanced/settings proxy/advanced/cre/enable remote/settings qos/settings qos/classes qos/subclasses qos/level7config qos/portconfig \
-           qos/tosconfig suricata/settings upnp/settings vpn/config vpn/settings vpn/ipsec.conf \
+           qos/tosconfig suricata/settings vpn/config vpn/settings vpn/ipsec.conf \
            vpn/ipsec.secrets vpn/caconfig wakeonlan/clients.conf wireless/config wireless/settings; do \
            touch $(CONFIG_ROOT)/$$i; \
        done
@@ -78,8 +78,7 @@ $(TARGET) :
        cp $(DIR_SRC)/config/cfgroot/header.pl                  $(CONFIG_ROOT)/
        cp $(DIR_SRC)/config/cfgroot/general-functions.pl       $(CONFIG_ROOT)/
        cp $(DIR_SRC)/config/cfgroot/network-functions.pl       $(CONFIG_ROOT)/
-       cp $(DIR_SRC)/config/cfgroot/geoip-functions.pl         $(CONFIG_ROOT)/
-       cp $(DIR_SRC)/config/cfgroot/aws-functions.pl           $(CONFIG_ROOT)/
+       cp $(DIR_SRC)/config/cfgroot/location-functions.pl              $(CONFIG_ROOT)/
        cp $(DIR_SRC)/config/cfgroot/ids-functions.pl           $(CONFIG_ROOT)/
        cp $(DIR_SRC)/config/cfgroot/lang.pl                    $(CONFIG_ROOT)/
        cp $(DIR_SRC)/config/cfgroot/countries.pl               $(CONFIG_ROOT)/
@@ -96,6 +95,7 @@ $(TARGET) :
        cp $(DIR_SRC)/config/cfgroot/proxy-acl                  $(CONFIG_ROOT)/proxy/acl-1.4
        cp $(DIR_SRC)/config/qos/*                                              $(CONFIG_ROOT)/qos/bin/
        cp $(DIR_SRC)/config/cfgroot/main-settings              $(CONFIG_ROOT)/main/settings
+       cp $(DIR_SRC)/config/cfgroot/manualpages                $(CONFIG_ROOT)/main/
        cp $(DIR_SRC)/config/cfgroot/ssh-settings               $(CONFIG_ROOT)/remote/settings
        cp $(DIR_SRC)/config/cfgroot/time-settings              $(CONFIG_ROOT)/time/settings
        cp $(DIR_SRC)/config/cfgroot/logging-settings   $(CONFIG_ROOT)/logging/settings
@@ -112,10 +112,9 @@ $(TARGET) :
        cp $(DIR_SRC)/config/fwhosts/customservices             $(CONFIG_ROOT)/fwhosts/customservices.default
        # Oneliner configfiles
        echo  "ENABLED=off"             > $(CONFIG_ROOT)/vpn/settings
-       echo  "VPN_DELAYED_START=0"     >>$(CONFIG_ROOT)/vpn/settings
        echo  "01"                      > $(CONFIG_ROOT)/certs/serial
        echo  "nameserver    1.2.3.4"   > $(CONFIG_ROOT)/ppp/fake-resolv.conf
-       echo  "DROPNEWNOTSYN=on"                >> $(CONFIG_ROOT)/optionsfw/settings
+       echo  "DROPNEWNOTSYN=on"        >> $(CONFIG_ROOT)/optionsfw/settings
        echo  "DROPINPUT=on"            >> $(CONFIG_ROOT)/optionsfw/settings
        echo  "DROPFORWARD=on"          >> $(CONFIG_ROOT)/optionsfw/settings
        echo  "FWPOLICY=DROP"           >> $(CONFIG_ROOT)/optionsfw/settings
@@ -131,25 +130,25 @@ $(TARGET) :
        echo  "SHOWDROPDOWN=off"        >> $(CONFIG_ROOT)/optionsfw/settings
        echo  "DROPWIRELESSINPUT=on"    >> $(CONFIG_ROOT)/optionsfw/settings
        echo  "DROPWIRELESSFORWARD=on"  >> $(CONFIG_ROOT)/optionsfw/settings
+       echo  "DROPSPOOFEDMARTIAN=on"   >> $(CONFIG_ROOT)/optionsfw/settings
+       echo  "DROPHOSTILE=on"          >> $(CONFIG_ROOT)/optionsfw/settings
+       echo  "LOGDROPCTINVALID=on"     >> $(CONFIG_ROOT)/optionsfw/settings
        echo  "POLICY=MODE2"            >> $(CONFIG_ROOT)/firewall/settings
        echo  "POLICY1=MODE2"           >> $(CONFIG_ROOT)/firewall/settings
+       echo  "USE_ISP_NAMESERVERS=on"  >> $(CONFIG_ROOT)/dns/settings
+       echo  "TREE=$(PAKFIRE_TREE)"    >> $(CONFIG_ROOT)/pakfire/settings
 
        # Install snort to suricata converter.
        cp $(DIR_SRC)/config/suricata/convert-snort     /usr/sbin/convert-snort
-
-       # Add conntrack helper default settings
-       for proto in FTP H323 IRC SIP TFTP; do \
-               echo "CONNTRACK_$${proto}=on" >> $(CONFIG_ROOT)/optionsfw/settings; \
-       done
-
-       # Do not enable these by default because these are broken
-       for proto in AMANDA PPTP; do \
-               echo "CONNTRACK_$${proto}=off" >> $(CONFIG_ROOT)/optionsfw/settings; \
-       done
+       cp $(DIR_SRC)/config/suricata/convert-ids-modifysids-file   /usr/sbin/convert-ids-modifysids-file
+       cp $(DIR_SRC)/config/suricata/convert-ids-multiple-providers /usr/sbin/convert-ids-multiple-providers
 
        # set converters executable
        chmod 755 /usr/sbin/convert-*
 
+       # Make extrahd.pl executable
+       chmod 755 /var/ipfire/extrahd/bin/extrahd.pl
+
        # Modify variables in header.pl
        sed -i -e "s+CONFIG_ROOT+$(CONFIG_ROOT)+g" \
            -e "s+VERSION+$(VERSION)+g" \
@@ -170,7 +169,7 @@ $(TARGET) :
        # Configroot permissions
        chown -R nobody:nobody $(CONFIG_ROOT)
        chown      root:root   $(CONFIG_ROOT)
-       for i in backup/ header.pl general-functions.pl graphs.pl lang.pl addon-lang/ langs/ red/ ; do \
+       for i in backup/ *.pl addon-lang/ langs/ ; do \
             chown -R root:root $(CONFIG_ROOT)/$$i; \
        done
        chown -Rv root:root $(CONFIG_ROOT)/*/bin
IPFire 2.x development tree