]>
git.ipfire.org Git - ipfire-2.x.git/log
Stefan Schantl [Tue, 12 Dec 2017 19:15:00 +0000 (20:15 +0100)]
ids.cgi: Process enabled rulefiles in an own loop
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 12 Dec 2017 19:12:38 +0000 (20:12 +0100)]
ids.cgi: Drop enabled/disabled rules from cgiparams hash
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Tue, 12 Dec 2017 19:10:17 +0000 (20:10 +0100)]
ids.cgi: Drop enabled rulefile from cgiparams hash after processing
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Mon, 11 Dec 2017 13:22:07 +0000 (14:22 +0100)]
ids.cgi: Re-add code for enable/disable rulefiles
The enabled rulefiles (rule categories) now will be added
to an own file, which will be included by the snort main config
file.
This will allow us to update snort and push the new main config file
without loosing the activated rulesets anymore.
* Introducing snort-used-rulefiles.conf
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Mon, 11 Dec 2017 07:46:18 +0000 (08:46 +0100)]
ids.cgi: Code cleanup
* Drop a lot of unused variables and code.
* Re-ordering some code parts.
* Add a lot of comments.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Mon, 11 Dec 2017 07:33:36 +0000 (08:33 +0100)]
ids.cgi: Re-add code to save the ruleset.
The manually enabled or disabled rules by the user now will be written
to own config files, which will be used by oinkmaster to keep these rules
in the same state after a rules update has been performed.
In short words, if you adjust your ruleset, the changes will not be lost
again if you perform an update of your ruleset.
* Grabbing and storing the cgi values now in an own hash (%cgiparams)
* Introducing oinkmaster config files for enabled and disabled rules.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Sun, 10 Dec 2017 09:36:07 +0000 (10:36 +0100)]
ids.cgi: Drop unused css code
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Sun, 10 Dec 2017 09:07:41 +0000 (10:07 +0100)]
ids.cgi: Rework code for displaying the single rules
The complete ruleset will be grouped as categories by it's
corresponding rulefile and printed in hidden tables.
They easiely can be displayed by klicking on the show link and
vice-versa.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 6 Dec 2017 10:44:30 +0000 (11:44 +0100)]
ids.cgi: Always display ruleset
Display the rule categories any time and do not hide them
if no instance of snort is runing.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 6 Dec 2017 10:19:42 +0000 (11:19 +0100)]
ids.cgi: Remove comment lines for snort rules control
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Wed, 6 Dec 2017 08:51:46 +0000 (09:51 +0100)]
ids.cgi: Refactor reading-in rule files.
Move the code for reading and parsing the snort rule files
into an own subfunction.
* Drop code for reading in and modifying the snort main config file.
* Rework code for parsing and adding the snort rules to the snortrules hash.
* Drop code for gathering a description for the rule files, which does not
because of a file layout change and sadly there is not suitable description
shipped anymore by the snort team.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Sat, 2 Dec 2017 14:31:19 +0000 (15:31 +0100)]
ids.cgi: Move function to end of file
Move the function for doing the page refresh stuff to the end of the file and
do some layout changes for better reading the code.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Sat, 2 Dec 2017 14:24:12 +0000 (15:24 +0100)]
ids.cgi: Use pure perl for directory listing
Use pure perl for getting the filelist of available
rule files instead of using a sub-shell and unix commands.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Sat, 2 Dec 2017 14:17:49 +0000 (15:17 +0100)]
ids.cgi: Drop old code for uploading a ruleset
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Stefan Schantl [Sat, 21 Jul 2018 12:14:53 +0000 (14:14 +0200)]
Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next
Michael Tremer [Fri, 20 Jul 2018 15:19:46 +0000 (16:19 +0100)]
aws: Add support for a script that can be executed at first boot
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 17 Jul 2018 17:05:07 +0000 (18:05 +0100)]
aws: Always exit the init script cleanly
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 20 Jul 2018 14:21:36 +0000 (14:21 +0000)]
asterisk: Don't optimise for builder
Asterisk enables -march=native which renders the code
incompatible to most systems.
Fixes: #11793
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Fri, 20 Jul 2018 12:06:11 +0000 (12:06 +0000)]
fireinfo: Import latest patches
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Thu, 19 Jul 2018 16:10:23 +0000 (18:10 +0200)]
Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next
Arne Fitzenreiter [Thu, 19 Jul 2018 08:30:47 +0000 (09:30 +0100)]
kernel: aarch64: enable virtio drivers
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Thu, 19 Jul 2018 08:29:44 +0000 (09:29 +0100)]
u-boot: boot aarch64 kernel without -multi extension
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Thu, 19 Jul 2018 08:28:27 +0000 (09:28 +0100)]
kernel: apply multi arch patchset for aarch64
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Michael Tremer [Sat, 14 Jul 2018 14:06:39 +0000 (15:06 +0100)]
AWS: Give setup user permissions to read its own SSH keys
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 12 Jul 2018 14:37:59 +0000 (15:37 +0100)]
aws: Unlock setup account
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 12 Jul 2018 12:57:19 +0000 (13:57 +0100)]
aws: Install SSH keys only for setup user
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 12 Jul 2018 12:55:38 +0000 (13:55 +0100)]
aws: setup user should not be a system user
Login is not permitted for system users
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sat, 14 Jul 2018 12:43:13 +0000 (13:43 +0100)]
Rootfile update for aarch64 kernel
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 5 Jul 2018 22:28:15 +0000 (23:28 +0100)]
aarch64: Remove -multi suffix from kernel
This gets in the way for authoring the CD and we will
never have any other kernels but the main one.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 5 Jul 2018 22:27:24 +0000 (23:27 +0100)]
linux: Simplify compiling and installing the kernel
There was loads of duplicated code which could have been
made shorter by adding one variable.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 12 Jul 2018 09:04:37 +0000 (10:04 +0100)]
iptables: Ship all modules
These have been all disabled with the last update of
the iptables package.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 12 Jul 2018 09:03:34 +0000 (10:03 +0100)]
Rootfile update
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 12 Jul 2018 08:59:31 +0000 (09:59 +0100)]
aws: Don't start ssh right away
sshctrl calls sshd directly which won't work at time of the first boot
because no keys will be generated.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Erik Kapfer [Fri, 6 Jul 2018 03:57:59 +0000 (05:57 +0200)]
OpenVPN: Deleted mtu-disc completely since it has been dropped.
Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Matthias Fischer [Mon, 9 Jul 2018 18:53:45 +0000 (20:53 +0200)]
clamav: Update to 0.100.1
For details see:
https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 10 Jul 2018 17:32:20 +0000 (18:32 +0100)]
aws: Create "setup" user to run setup
Amazon does not permit that a user logs in as root directly.
Instead they insist on using sudo.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Sun, 8 Jul 2018 06:34:37 +0000 (08:34 +0200)]
Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next
Michael Tremer [Tue, 3 Jul 2018 19:01:46 +0000 (20:01 +0100)]
usbutils: Update rootfile
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Arne Fitzenreiter [Tue, 3 Jul 2018 15:03:37 +0000 (16:03 +0100)]
spice-protocol: rootfile update
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Arne Fitzenreiter [Tue, 3 Jul 2018 15:01:35 +0000 (16:01 +0100)]
libgcrypt: rootfile update
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Michael Tremer [Tue, 3 Jul 2018 14:33:04 +0000 (15:33 +0100)]
Update translations
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Erik Kapfer [Wed, 27 Jun 2018 07:34:21 +0000 (09:34 +0200)]
OpenVPN: x509 and DH-parameter check with Warnings and error messages in WUI
Changes includes:
Own crypto warning and error message in WUI (can be extended to configuration too).
Check if DH-parameter is < 2048 bit with an error message and howto fix it.
Check if md5 is still in use with an error message and suggestion how to proceed further to fix it.
Check for soon needed RFC3280 TLS rules compliants and suggestion how to proceed further to fix it.
Disabled 1024 bit DH-parameter upload.
Changed de and en language files for DH-parameter upload (deleted 1024 bit).
Added explanations to de and en language files for the above changes.
Fixed Typo in en language file.
Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 3 Jul 2018 14:32:42 +0000 (15:32 +0100)]
Revert "OpenVPN: Clarify fundamental crypto errors but also warnings in WUI"
This reverts commit
15a3aa45cf27c61a581f892b5f3a3905335a12b0 .
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Arne Fitzenreiter [Tue, 3 Jul 2018 13:07:41 +0000 (15:07 +0200)]
collect: fix cpufreq graph on some machines.
the file cpuinfo_cur_freq does not exist on all systems that support collect
cpufreq data.
fixes #11739
Arne Fitzenreiter [Tue, 3 Jul 2018 10:52:18 +0000 (11:52 +0100)]
Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next
Arne Fitzenreiter [Tue, 3 Jul 2018 10:52:05 +0000 (11:52 +0100)]
Merge branch 'aarch64' into next
Conflicts:
config/rootfiles/core/121/filelists/acpid
config/rootfiles/core/121/filelists/apache2
config/rootfiles/core/121/filelists/apr
config/rootfiles/core/121/filelists/aprutil
config/rootfiles/core/121/filelists/armv5tel/files
config/rootfiles/core/121/filelists/armv5tel/linux-initrd-kirkwood
config/rootfiles/core/121/filelists/armv5tel/linux-initrd-multi
config/rootfiles/core/121/filelists/armv5tel/linux-kirkwood
config/rootfiles/core/121/filelists/armv5tel/linux-multi
config/rootfiles/core/121/filelists/armv5tel/rpi-firmware
config/rootfiles/core/121/filelists/armv5tel/u-boot
config/rootfiles/core/121/filelists/armv5tel/u-boot-kirkwood
config/rootfiles/core/121/filelists/armv5tel/u-boot-mkimage
config/rootfiles/core/121/filelists/beep
config/rootfiles/core/121/filelists/cmake
config/rootfiles/core/121/filelists/crda
config/rootfiles/core/121/filelists/dhcp
config/rootfiles/core/121/filelists/flex
config/rootfiles/core/121/filelists/i586/grub
config/rootfiles/core/121/filelists/i586/intel-microcode
config/rootfiles/core/121/filelists/i586/linux
config/rootfiles/core/121/filelists/i586/linux-initrd
config/rootfiles/core/121/filelists/iw
config/rootfiles/core/121/filelists/jwhois
config/rootfiles/core/121/filelists/libidn
config/rootfiles/core/121/filelists/multipath-tools
config/rootfiles/core/121/filelists/pcre
config/rootfiles/core/121/filelists/tar
config/rootfiles/core/121/filelists/unbound
config/rootfiles/core/121/filelists/wget
config/rootfiles/core/121/filelists/x86_64/grub
config/rootfiles/core/121/filelists/x86_64/intel-microcode
config/rootfiles/core/121/filelists/x86_64/linux
config/rootfiles/core/121/filelists/x86_64/linux-initrd
config/rootfiles/core/122/filelists/aarch64/files
config/rootfiles/core/122/filelists/acpid
config/rootfiles/core/122/filelists/apache2
config/rootfiles/core/122/filelists/apr
config/rootfiles/core/122/filelists/aprutil
config/rootfiles/core/122/filelists/armv5tel/linux-initrd-kirkwood
config/rootfiles/core/122/filelists/armv5tel/linux-initrd-multi
config/rootfiles/core/122/filelists/armv5tel/linux-kirkwood
config/rootfiles/core/122/filelists/armv5tel/linux-multi
config/rootfiles/core/122/filelists/armv5tel/rpi-firmware
config/rootfiles/core/122/filelists/armv5tel/u-boot
config/rootfiles/core/122/filelists/armv5tel/u-boot-kirkwood
config/rootfiles/core/122/filelists/armv5tel/u-boot-mkimage
config/rootfiles/core/122/filelists/beep
config/rootfiles/core/122/filelists/cmake
config/rootfiles/core/122/filelists/crda
config/rootfiles/core/122/filelists/dhcp
config/rootfiles/core/122/filelists/flex
config/rootfiles/core/122/filelists/i586/grub
config/rootfiles/core/122/filelists/i586/intel-microcode
config/rootfiles/core/122/filelists/i586/linux
config/rootfiles/core/122/filelists/i586/linux-initrd
config/rootfiles/core/122/filelists/iw
config/rootfiles/core/122/filelists/jwhois
config/rootfiles/core/122/filelists/libidn
config/rootfiles/core/122/filelists/multipath-tools
config/rootfiles/core/122/filelists/pcre
config/rootfiles/core/122/filelists/tar
config/rootfiles/core/122/filelists/unbound
config/rootfiles/core/122/filelists/wget
config/rootfiles/core/122/filelists/x86_64/grub
config/rootfiles/core/122/filelists/x86_64/intel-microcode
config/rootfiles/core/122/filelists/x86_64/linux
config/rootfiles/core/122/filelists/x86_64/linux-initrd
config/rootfiles/core/123/filelists/unbound
config/rootfiles/oldcore/121/filelists/acpid
config/rootfiles/oldcore/121/filelists/apache2
config/rootfiles/oldcore/121/filelists/apr
config/rootfiles/oldcore/121/filelists/aprutil
config/rootfiles/oldcore/121/filelists/armv5tel/files
config/rootfiles/oldcore/121/filelists/armv5tel/linux-initrd-kirkwood
config/rootfiles/oldcore/121/filelists/armv5tel/linux-initrd-multi
config/rootfiles/oldcore/121/filelists/armv5tel/linux-initrd-rpi
config/rootfiles/oldcore/121/filelists/armv5tel/linux-kirkwood
config/rootfiles/oldcore/121/filelists/armv5tel/linux-multi
config/rootfiles/oldcore/121/filelists/armv5tel/linux-rpi
config/rootfiles/oldcore/121/filelists/armv5tel/rpi-firmware
config/rootfiles/oldcore/121/filelists/armv5tel/u-boot
config/rootfiles/oldcore/121/filelists/armv5tel/u-boot-kirkwood
config/rootfiles/oldcore/121/filelists/armv5tel/u-boot-mkimage
config/rootfiles/oldcore/121/filelists/beep
config/rootfiles/oldcore/121/filelists/cmake
config/rootfiles/oldcore/121/filelists/crda
config/rootfiles/oldcore/121/filelists/dhcp
config/rootfiles/oldcore/121/filelists/flex
config/rootfiles/oldcore/121/filelists/i586/grub
config/rootfiles/oldcore/121/filelists/i586/intel-microcode
config/rootfiles/oldcore/121/filelists/i586/linux
config/rootfiles/oldcore/121/filelists/i586/linux-initrd
config/rootfiles/oldcore/121/filelists/iw
config/rootfiles/oldcore/121/filelists/jwhois
config/rootfiles/oldcore/121/filelists/libidn
config/rootfiles/oldcore/121/filelists/multipath-tools
config/rootfiles/oldcore/121/filelists/pcre
config/rootfiles/oldcore/121/filelists/tar
config/rootfiles/oldcore/121/filelists/wget
config/rootfiles/oldcore/121/filelists/x86_64/grub
config/rootfiles/oldcore/121/filelists/x86_64/intel-microcode
config/rootfiles/oldcore/121/filelists/x86_64/linux
config/rootfiles/oldcore/121/filelists/x86_64/linux-initrd
make.sh
Michael Tremer [Tue, 3 Jul 2018 09:34:57 +0000 (10:34 +0100)]
Update languages
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Erik Kapfer [Thu, 21 Jun 2018 09:46:36 +0000 (11:46 +0200)]
OpenVPN: Clarify fundamental crypto errors but also warnings in WUI
Since OpenVPN-2.4.x, a lot of changes has been introduced. This patch should help the users for better understanding of errors in the cryptography.
It includes also potential warnings for upcoming changes and needed adjustments in the system.
This can also be extended in the future for upcoming configuration changes.
Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Erik Kapfer [Thu, 21 Jun 2018 09:12:53 +0000 (11:12 +0200)]
OpenVPN: Prevent internal server error cause of bad header wrapper
This fixes #11772 .
If the X509 are deleted, the openvpnctrl output generates a bad header wrapper error from the CGI
which causes an internal server error. The redirection of the openvpnctrl output fixes this.
Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Erik Kapfer [Thu, 21 Jun 2018 11:52:13 +0000 (13:52 +0200)]
hplip: Update to version 3.18.6
Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Wed, 27 Jun 2018 17:39:14 +0000 (19:39 +0200)]
guardian: Update to 2.0.2
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Wed, 27 Jun 2018 17:39:13 +0000 (19:39 +0200)]
guardian.cgi: Remove support for owncloud
Owncloud as an addon has been dropped for IPFire. As a result of this,
we do not need this code anymore.
Fixes #11572.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 3 Jul 2018 09:33:23 +0000 (10:33 +0100)]
core123: Ship updated sysctl.conf
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Sat, 30 Jun 2018 09:44:06 +0000 (11:44 +0200)]
hide kernel addresses in /proc
Make sure kernel address space is hidden from files somewhere
in /proc . This reduces attack surface and partially addresses #11659.
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 3 Jul 2018 09:32:43 +0000 (10:32 +0100)]
core123: Ship updated usbutils
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Sat, 30 Jun 2018 15:04:42 +0000 (17:04 +0200)]
usbutils: update to 010
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 3 Jul 2018 09:32:08 +0000 (10:32 +0100)]
core123: Ship updated GeoIP.dat
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Sat, 30 Jun 2018 15:10:12 +0000 (17:10 +0200)]
update GeoIP.dat database
There are two GeoIP databases used in IPFire: One for firewall
rules, which is downloaded and installed automatically, and a
second one ("GeoIP.dat") for WebUI lookups via the Perl interface.
The latter one is not updated automatically and was outdated.
libloc will make things much easier here...
Fixes #11777.
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Mon, 2 Jul 2018 18:10:36 +0000 (19:10 +0100)]
multipath-tools: Update to 0.7.7
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Arne Fitzenreiter [Mon, 2 Jul 2018 18:07:22 +0000 (19:07 +0100)]
Merge remote-tracking branch 'origin/master' into aarch64
Michael Tremer [Mon, 2 Jul 2018 17:48:50 +0000 (18:48 +0100)]
nss-myhostname: FTBFS on aarch64
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 1 Jul 2018 12:34:56 +0000 (13:34 +0100)]
core123: Ship changed vpnmain.cgi
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Sat, 30 Jun 2018 15:18:30 +0000 (17:18 +0200)]
add ChaCha20/Poly1305 to IPsec WebUI
The algorithm is selected by default since it is considered
to be both secure and state-of-the-art. This required Linux kernel
> 4.2, which is satisfied by Core Update 2.12 122.
Fixes #11549
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Sat, 30 Jun 2018 15:15:22 +0000 (17:15 +0200)]
update cryptography settings in StrongSwan LFS file
The RC2 plugin was never supported by the WebUI and is insecure,
so it became obsolete here. To support new ChaCha20/Poly1305, the
corresponding module needs to be enabled.
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 1 Jul 2018 12:34:19 +0000 (13:34 +0100)]
core123: Ship updated packages and files
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 1 Jul 2018 11:38:48 +0000 (12:38 +0100)]
proxy.cgi: The group name cannot be in quotes
Squid interprets the quotes as part of the group name, too
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Wed, 20 Jun 2018 15:00:36 +0000 (17:00 +0200)]
smartmontools: update to 6.6.
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Wed, 20 Jun 2018 15:04:26 +0000 (17:04 +0200)]
lynis: update to 2.6.4
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Sat, 30 Jun 2018 15:16:37 +0000 (17:16 +0200)]
update StrongSwan to 5.6.3
This also takes advantage of changed crypto plugins (see first
patch) and updates the rootfile.
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Sat, 30 Jun 2018 10:07:15 +0000 (12:07 +0200)]
libgcrypt: update to 1.8.3
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Matthias Fischer [Mon, 25 Jun 2018 15:31:01 +0000 (17:31 +0200)]
unbound: Update to 1.7.3
For details see:
http://www.unbound.net/download.html
Best,
Matthias
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Erik Kapfer [Thu, 21 Jun 2018 11:54:36 +0000 (13:54 +0200)]
OpenVPN: Update to version 2.4.6
Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Wed, 20 Jun 2018 15:13:01 +0000 (17:13 +0200)]
conntrack-tools: update to 1.4.5
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Wed, 20 Jun 2018 15:11:28 +0000 (17:11 +0200)]
libnetfilter_conntrack: update to 1.0.7
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Wed, 20 Jun 2018 15:09:05 +0000 (17:09 +0200)]
iptables: update to 1.6.2
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 1 Jul 2018 11:24:25 +0000 (12:24 +0100)]
vpnmain.cgi: Remove unused code that prevented the page from loading without GREEN
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 1 Jul 2018 11:21:59 +0000 (12:21 +0100)]
Don't show proxy configuration pages when GREEN is not available
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 1 Jul 2018 11:15:00 +0000 (12:15 +0100)]
AWS: Hide certain things on the web UI
Those are practically unusable on AWS.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 1 Jul 2018 10:54:51 +0000 (11:54 +0100)]
AWS: Store instance id
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 1 Jul 2018 10:52:54 +0000 (11:52 +0100)]
aws: Re-enable check if we are actually running on EC2
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 1 Jul 2018 10:51:39 +0000 (11:51 +0100)]
aws: Suppress any output from ending dhclient
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 1 Jul 2018 10:51:18 +0000 (11:51 +0100)]
aws: No need to wake up udev again
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 1 Jul 2018 10:49:57 +0000 (11:49 +0100)]
firewall: Suppress more warnings when initialising without GREEN
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 1 Jul 2018 10:44:14 +0000 (11:44 +0100)]
AWS: Rename network interfaces only when necessary
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 1 Jul 2018 10:43:35 +0000 (11:43 +0100)]
AWS: Import SSH keys before meddling with the network
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sun, 1 Jul 2018 09:32:31 +0000 (10:32 +0100)]
firewall: Allow starting without a green interface
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sat, 30 Jun 2018 19:35:29 +0000 (20:35 +0100)]
AWS: No need to restart udev any more
The renames the network interfaces itself now
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sat, 30 Jun 2018 18:58:42 +0000 (19:58 +0100)]
localnet: Don't write local hostname to /etc/hosts
This is now being provided by nss-myhostname
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sat, 30 Jun 2018 18:56:56 +0000 (19:56 +0100)]
nsswitch.conf: Use nss-myhostname to resolve local hostname
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sat, 30 Jun 2018 18:51:38 +0000 (19:51 +0100)]
nss-myhostname: New package
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sat, 30 Jun 2018 18:40:31 +0000 (19:40 +0100)]
AWS: Rename all interfaces when booting up
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sat, 30 Jun 2018 18:25:29 +0000 (19:25 +0100)]
aws: Apply SSH configuration changes
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Sat, 30 Jun 2018 18:25:15 +0000 (19:25 +0100)]
openssh: Write port 22 into the default configuration file
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Arne Fitzenreiter [Thu, 28 Jun 2018 18:36:32 +0000 (20:36 +0200)]
random: update initskript for machines with low entropy
the script wait until crng is correct initialized before restore the
random seed and make some disc io to work around low entropy at boot
on some machines. Not really a fix but it should be better than reverting
CVE-2018-1108 fixes from kernel.
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Michael Tremer [Thu, 28 Jun 2018 10:15:29 +0000 (11:15 +0100)]
AWS: Restart udev to rename network interfaces
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 28 Jun 2018 10:01:33 +0000 (11:01 +0100)]
AWS: Add support for ORANGE
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 28 Jun 2018 09:57:50 +0000 (10:57 +0100)]
AWS: Remove some debugging line
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 28 Jun 2018 09:57:13 +0000 (10:57 +0100)]
AWS: Calculate gateway and DNS IP addresses only for RED
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 28 Jun 2018 09:55:24 +0000 (10:55 +0100)]
AWS: Use correct IP address for the internal DNS
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Wed, 27 Jun 2018 17:38:41 +0000 (19:38 +0200)]
guardian: Update to 2.0.2
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>