ipfire-2.x.git
12 months agoMerge branch 'toolchain' into next
Michael Tremer [Mon, 29 Oct 2018 10:51:00 +0000 (10:51 +0000)] 
Merge branch 'toolchain' into next

12 months agoMerge branch 'glibc-2.28' into next
Michael Tremer [Mon, 29 Oct 2018 10:50:56 +0000 (10:50 +0000)] 
Merge branch 'glibc-2.28' into next

12 months agocore125: Ship glibc for i586
Michael Tremer [Mon, 29 Oct 2018 10:50:35 +0000 (10:50 +0000)] 
core125: Ship glibc for i586

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agoRemove removed files from rootfiles
Michael Tremer [Mon, 29 Oct 2018 10:47:10 +0000 (10:47 +0000)] 
Remove removed files from rootfiles

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agolibaio: Link against standard libraries
Michael Tremer [Fri, 26 Oct 2018 10:31:40 +0000 (11:31 +0100)] 
libaio: Link against standard libraries

This patch fixes a build error when stack smashing protecion
is being enabled and __stack_chk_fail_local needs to be pulled
from libc.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agoperl: Fix build in toolchain
Michael Tremer [Thu, 25 Oct 2018 18:50:28 +0000 (19:50 +0100)] 
perl: Fix build in toolchain

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agotoolchain: Bump version
Michael Tremer [Wed, 24 Oct 2018 16:27:55 +0000 (17:27 +0100)] 
toolchain: Bump version

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agocoreutils+gzip: Allow building with 32 bit time_t on 32 bit arches
Michael Tremer [Wed, 24 Oct 2018 16:27:38 +0000 (17:27 +0100)] 
coreutils+gzip: Allow building with 32 bit time_t on 32 bit arches

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agoConfig: Set IS_32BIT when running on 32 bit
Michael Tremer [Wed, 24 Oct 2018 16:27:10 +0000 (17:27 +0100)] 
Config: Set IS_32BIT when running on 32 bit

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agoUpdate langs
Michael Tremer [Wed, 24 Oct 2018 10:23:00 +0000 (11:23 +0100)] 
Update langs

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agopakfire: Remove option to enable/disable checks for updates
Michael Tremer [Wed, 24 Oct 2018 10:21:12 +0000 (11:21 +0100)] 
pakfire: Remove option to enable/disable checks for updates

This does not change anything

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agoglibc: Update to 2.28
Michael Tremer [Wed, 24 Oct 2018 08:30:29 +0000 (09:30 +0100)] 
glibc: Update to 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agolibvirt: Update to 4.6.0
Michael Tremer [Wed, 24 Oct 2018 08:25:57 +0000 (09:25 +0100)] 
libvirt: Update to 4.6.0

Fixes builds against glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agoparted: Fix build with glibc >= 2.28
Michael Tremer [Wed, 24 Oct 2018 08:15:28 +0000 (09:15 +0100)] 
parted: Fix build with glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agosyslinux: Fix build with glibc >= 2.28
Michael Tremer [Wed, 24 Oct 2018 08:14:43 +0000 (09:14 +0100)] 
syslinux: Fix build with glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agoinstaller: remove set of pmbr_boot on gpt partitions
Arne Fitzenreiter [Tue, 23 Oct 2018 16:58:58 +0000 (18:58 +0200)] 
installer: remove set of pmbr_boot on gpt partitions

this fix the efi boot on hdd's larger than 2TB and raid installations.

fixes: #11890

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
12 months agocollectd: Fix compiling against newer xfsprogs
Michael Tremer [Tue, 23 Oct 2018 15:45:33 +0000 (16:45 +0100)] 
collectd: Fix compiling against newer xfsprogs

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agonfs: Update to 2.3.3
Michael Tremer [Mon, 22 Oct 2018 18:52:23 +0000 (19:52 +0100)] 
nfs: Update to 2.3.3

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agokeyutils: New package
Michael Tremer [Mon, 22 Oct 2018 18:49:14 +0000 (19:49 +0100)] 
keyutils: New package

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agontfs-3g: Update to 2017.3.23
Michael Tremer [Mon, 22 Oct 2018 13:58:29 +0000 (14:58 +0100)] 
ntfs-3g: Update to 2017.3.23

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agoxfsprogs: Update to 4.18.0
Michael Tremer [Mon, 22 Oct 2018 13:56:34 +0000 (14:56 +0100)] 
xfsprogs: Update to 4.18.0

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agoreiserfsprogs: Update to 3.6.27
Michael Tremer [Mon, 22 Oct 2018 09:53:18 +0000 (10:53 +0100)] 
reiserfsprogs: Update to 3.6.27

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agoLVM2: Update to 2.02.181
Michael Tremer [Sun, 21 Oct 2018 21:18:35 +0000 (22:18 +0100)] 
LVM2: Update to 2.02.181

Update required to build against newer versions of glibc

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agolibaio: New package
Michael Tremer [Sun, 21 Oct 2018 21:14:26 +0000 (22:14 +0100)] 
libaio: New package

This library is required by newer version of LVM2

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agoppp: Build against openssl
Michael Tremer [Sun, 21 Oct 2018 21:03:21 +0000 (22:03 +0100)] 
ppp: Build against openssl

libcrypt has been removed from glibc and openssl
can be used instead for cryptographic operations.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agoBuild openssl earlier in the build process
Michael Tremer [Sun, 21 Oct 2018 21:01:28 +0000 (22:01 +0100)] 
Build openssl earlier in the build process

This is a basic library that is used by so many other packages
and more and more are being added. To have those packages take
advantage of it, we build it very early.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agocore125: Ship updated kmod
Michael Tremer [Sun, 21 Oct 2018 11:47:36 +0000 (12:47 +0100)] 
core125: Ship updated kmod

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agoudev: Migrate to eudev
Michael Tremer [Sun, 21 Oct 2018 11:43:37 +0000 (12:43 +0100)] 
udev: Migrate to eudev

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agokmod: Update to version 25
Michael Tremer [Sun, 21 Oct 2018 11:43:12 +0000 (12:43 +0100)] 
kmod: Update to version 25

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agosysvinit: Fix build with glibc >= 2.28
Michael Tremer [Sat, 20 Oct 2018 11:56:30 +0000 (12:56 +0100)] 
sysvinit: Fix build with glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agogzip: Fix build with glibc >= 2.28
Michael Tremer [Fri, 19 Oct 2018 13:20:48 +0000 (14:20 +0100)] 
gzip: Fix build with glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agofindutils: Fix building against glibc >= 2.28
Michael Tremer [Fri, 19 Oct 2018 12:39:58 +0000 (13:39 +0100)] 
findutils: Fix building against glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agoe2fsprogs: Update to 1.44.4
Michael Tremer [Fri, 19 Oct 2018 08:07:56 +0000 (09:07 +0100)] 
e2fsprogs: Update to 1.44.4

Fixes build with glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agobison: Fix building with glibc >= 2.28
Michael Tremer [Fri, 19 Oct 2018 08:00:04 +0000 (09:00 +0100)] 
bison: Fix building with glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agom4: Fix building with glibc >= 2.28
Michael Tremer [Fri, 19 Oct 2018 07:59:46 +0000 (08:59 +0100)] 
m4: Fix building with glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agogcc: Fix building with glibc >= 2.28
Michael Tremer [Fri, 19 Oct 2018 07:59:25 +0000 (08:59 +0100)] 
gcc: Fix building with glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agocoreutils: Update to 8.30
Michael Tremer [Fri, 19 Oct 2018 07:57:11 +0000 (08:57 +0100)] 
coreutils: Update to 8.30

Builds with newer versions of glibc

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agocore125: Ship updated SSH configuration
Michael Tremer [Thu, 18 Oct 2018 13:54:22 +0000 (14:54 +0100)] 
core125: Ship updated SSH configuration

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agofix broken SFTP in OpenSSH server
Peter Müller [Mon, 8 Oct 2018 17:30:09 +0000 (19:30 +0200)] 
fix broken SFTP in OpenSSH server

Fixes #11887

The second version of this patch uses the correct path on IPFire systems
and supersedes the first one. It also referrs to the correct issue ID.

Thanks to Matthias Fischer for reporting this.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agocore125: Ship updated dhcpcd
Michael Tremer [Thu, 18 Oct 2018 13:52:57 +0000 (14:52 +0100)] 
core125: Ship updated dhcpcd

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agodhcpcd: Update to 7.0.8
Matthias Fischer [Sun, 7 Oct 2018 16:27:40 +0000 (18:27 +0200)] 
dhcpcd: Update to 7.0.8

Hi,

No explicit changelog. I used:
https://roy.marples.name/search/query:dhcpcd

Running here.

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agocore125: Ship updated unbound
Michael Tremer [Thu, 18 Oct 2018 13:51:38 +0000 (14:51 +0100)] 
core125: Ship updated unbound

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agounbound: Update to 1.8.1
Matthias Fischer [Tue, 9 Oct 2018 17:03:22 +0000 (19:03 +0200)] 
unbound: Update to 1.8.1

For details see:
https://nlnetlabs.nl/projects/unbound/download/

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agohostapd: Bump package version
Michael Tremer [Sat, 6 Oct 2018 16:36:30 +0000 (17:36 +0100)] 
hostapd: Bump package version

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agohostapd: Compile with debugging messages
Michael Tremer [Sat, 6 Oct 2018 16:36:29 +0000 (17:36 +0100)] 
hostapd: Compile with debugging messages

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agohostapd: Add support for 802.11ac
Michael Tremer [Sat, 6 Oct 2018 16:36:28 +0000 (17:36 +0100)] 
hostapd: Add support for 802.11ac

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agocore125: Update language files
Michael Tremer [Thu, 18 Oct 2018 13:49:47 +0000 (14:49 +0100)] 
core125: Update language files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agoupdate OpenSSH default port in language files
Peter Müller [Thu, 4 Oct 2018 16:27:35 +0000 (18:27 +0200)] 
update OpenSSH default port in language files

Fixes #11881

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agoclamav: Update to 0.100.2
Matthias Fischer [Thu, 4 Oct 2018 03:09:36 +0000 (05:09 +0200)] 
clamav: Update to 0.100.2

Hi,

"This is a patch release to address several vulnerabilities..."

For details see:
https://blog.clamav.net/2018/10/clamav-01002-has-been-released.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agocore125: Ship updated GnuTLS
Michael Tremer [Thu, 18 Oct 2018 13:36:48 +0000 (14:36 +0100)] 
core125: Ship updated GnuTLS

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agognutls: Update to 3.5.19
Matthias Fischer [Fri, 28 Sep 2018 16:58:20 +0000 (18:58 +0200)] 
gnutls: Update to 3.5.19

Hi,

For changelogs since '3.5.15' see:

https://lists.gnupg.org/pipermail/gnutls-devel/2017-October/008523.html
https://lists.gnupg.org/pipermail/gnutls-devel/2018-January/008538.html
https://lists.gnupg.org/pipermail/gnutls-devel/2018-February/008540.html
https://lists.gnupg.org/pipermail/gnutls-devel/2018-July/008583.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agocore125: Apply changed sysctl.conf immediately
Michael Tremer [Thu, 18 Oct 2018 13:35:46 +0000 (14:35 +0100)] 
core125: Apply changed sysctl.conf immediately

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agoAllow kernel to swap memory on high demand
Tim FitzGeorge [Tue, 25 Sep 2018 17:52:30 +0000 (18:52 +0100)] 
Allow kernel to swap memory on high demand

Signed-off-by: Tim FitzGeorge <ipfr@tfitzgeorge.me.uk>
Fixes: Bug 11839
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agocore125: Ship updated bind
Michael Tremer [Thu, 18 Oct 2018 13:34:00 +0000 (14:34 +0100)] 
core125: Ship updated bind

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agobind: Update to 9.11.4-P2
Matthias Fischer [Mon, 24 Sep 2018 16:34:38 +0000 (18:34 +0200)] 
bind: Update to 9.11.4-P2

For details see:
http://ftp.isc.org/isc/bind9/9.11.4-P2/RELEASE-NOTES-bind-9.11.4-P2.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agocore125: Ship updated apache
Michael Tremer [Thu, 18 Oct 2018 13:33:23 +0000 (14:33 +0100)] 
core125: Ship updated apache

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agoApache: Update to 2.4.35
Matthias Fischer [Sun, 23 Sep 2018 17:12:06 +0000 (19:12 +0200)] 
Apache: Update to 2.4.35

For details see:

http://apache.mirror.digionline.de//httpd/CHANGES_2.4.35

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agocore125: Ship recently updated sqlite
Michael Tremer [Thu, 18 Oct 2018 13:30:05 +0000 (14:30 +0100)] 
core125: Ship recently updated sqlite

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agoUpdate list of contributors
Michael Tremer [Thu, 18 Oct 2018 13:29:23 +0000 (14:29 +0100)] 
Update list of contributors

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agoStart Core Update 125
Michael Tremer [Thu, 18 Oct 2018 13:28:33 +0000 (14:28 +0100)] 
Start Core Update 125

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
12 months agosqlite: Update to 3.25.2.0
Michael Tremer [Thu, 18 Oct 2018 13:23:29 +0000 (14:23 +0100)] 
sqlite: Update to 3.25.2.0

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
13 months agoMerge branch 'core124' of git.ipfire.org:/pub/git/ipfire-2.x into core124
Arne Fitzenreiter [Fri, 28 Sep 2018 16:43:15 +0000 (18:43 +0200)] 
Merge branch 'core124' of git.ipfire.org:/pub/git/ipfire-2.x into core124

13 months agocore124: add apache initskript and nsswitch.conf to updater
Arne Fitzenreiter [Fri, 28 Sep 2018 15:53:03 +0000 (17:53 +0200)] 
core124: add apache initskript and nsswitch.conf to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
13 months agocore124: don't remove network trigger script
Arne Fitzenreiter [Fri, 28 Sep 2018 15:49:10 +0000 (17:49 +0200)] 
core124: don't remove network trigger script

this script is still needed if /var/ipfire is on an extra partition.
New installations works without this script.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
13 months agocore124: fix removing old initrd files on arm systems
Arne Fitzenreiter [Thu, 27 Sep 2018 19:53:53 +0000 (21:53 +0200)] 
core124: fix removing old initrd files on arm systems

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
13 months agokernel: update to 4.14.72
Arne Fitzenreiter [Thu, 27 Sep 2018 06:03:45 +0000 (08:03 +0200)] 
kernel: update to 4.14.72

this commit has many important driver updates so we need to ship it fast...

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
13 months agoMerge remote-tracking branch 'origin/master' into core124
Arne Fitzenreiter [Wed, 26 Sep 2018 12:09:57 +0000 (14:09 +0200)] 
Merge remote-tracking branch 'origin/master' into core124

13 months agossh: Revert MaxAuthTries setting
Michael Tremer [Tue, 25 Sep 2018 19:24:39 +0000 (20:24 +0100)] 
ssh: Revert MaxAuthTries setting

This is entirely not practicable and should have been changed
before. I missed this when I tested the configuration.

It is common that multiple SSH keys exist and three is common
number (RSA, ECDSA & Ed25519). A key passed with ssh -i and
password authentication are not even tried.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
13 months agocore124: fix updater v2.21-core124
Arne Fitzenreiter [Sun, 23 Sep 2018 00:44:03 +0000 (02:44 +0200)] 
core124: fix updater

fix some missing files on arm
remove not needed rebuild initrd because we ship it already built

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
13 months agonano: Update to 3.1
Matthias Fischer [Sat, 22 Sep 2018 07:50:48 +0000 (09:50 +0200)] 
nano: Update to 3.1

Hi,

This update was published just a few days after my "3.0"-commit - running.

For details see:

https://www.nano-editor.org/news.php

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
13 months agocore124: finish updater
Arne Fitzenreiter [Fri, 21 Sep 2018 13:26:52 +0000 (15:26 +0200)] 
core124: finish updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
13 months agoarm: boot.scr: add setting to edit fdt via uEnv.txt
Arne Fitzenreiter [Fri, 21 Sep 2018 13:18:24 +0000 (15:18 +0200)] 
arm: boot.scr: add setting to edit fdt via uEnv.txt

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
13 months agorebuild-initrd: update for grub2
Arne Fitzenreiter [Thu, 20 Sep 2018 18:03:26 +0000 (20:03 +0200)] 
rebuild-initrd: update for grub2

this was was not used for years because we usually ship a prebuild ramdisk
so this incompatiblity was not noticed long time...

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
13 months agokernel: update to 4.14.71
Arne Fitzenreiter [Thu, 20 Sep 2018 17:51:43 +0000 (19:51 +0200)] 
kernel: update to 4.14.71

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
13 months agocore124: Ship updated iproute2
Michael Tremer [Thu, 20 Sep 2018 13:54:02 +0000 (14:54 +0100)] 
core124: Ship updated iproute2

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
13 months agoiproute2: Update to 4.18.0
Matthias Fischer [Tue, 18 Sep 2018 17:35:10 +0000 (19:35 +0200)] 
iproute2: Update to 4.18.0

Triggered by https://bugzilla.ipfire.org/show_bug.cgi?id=11866 ;-)

For details see:
https://lwn.net/Articles/762515/

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
13 months agocore124: Ship updated openssh package
Michael Tremer [Thu, 20 Sep 2018 13:52:17 +0000 (14:52 +0100)] 
core124: Ship updated openssh package

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
13 months agoopenssh: Update to 7.8p1
Matthias Fischer [Mon, 10 Sep 2018 17:38:17 +0000 (19:38 +0200)] 
openssh: Update to 7.8p1

For details see:
http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/ChangeLog

I didn't find an official lfs-patch for openssl-1.1-compatibility,
so I used the patch from here:
https://git.archlinux.org/svntogit/packages.git/plain/trunk/openssl-1.1.0.patch?h=packages/openssh

Building ran without any errors.

I tested with both machines (test on Core 120 - and productive - on Core 122) and found no errors so far:

...
[root@ipfiretest ~]# ssh -V
OpenSSH_7.8p1, OpenSSL 1.1.0h  27 Mar 2018
...

...
root@ipfire: / # ssh -V
OpenSSH_7.8p1, OpenSSL 1.1.0h  27 Mar 2018
...

All ssh-connections ran fine but I'm not REALLY sure if this is sufficient for anyone else.

Could someone please check and confirm!?

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Tested-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
13 months agocore124: Ship updated OpenSSH configuration
Michael Tremer [Thu, 20 Sep 2018 13:51:13 +0000 (14:51 +0100)] 
core124: Ship updated OpenSSH configuration

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
13 months agossh: Remove AuthenticationMethods directive
Michael Tremer [Thu, 20 Sep 2018 13:50:25 +0000 (14:50 +0100)] 
ssh: Remove AuthenticationMethods directive

This is only setting something that is default anyways and
prevents sshd from starting if one of the listed methods
is not activated.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
13 months agouse custom SSH server configuration in LFS file
Peter Müller [Mon, 10 Sep 2018 15:52:23 +0000 (17:52 +0200)] 
use custom SSH server configuration in LFS file

Include OpenSSH server configuration file during build.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
13 months agoadd hardened SSH server configuration
Peter Müller [Mon, 10 Sep 2018 15:52:22 +0000 (17:52 +0200)] 
add hardened SSH server configuration

In order to harden OpenSSH server in IPFire, using the upstream default configuration
and edit it via sed commands in LFS file is error-prone and does not scale.

Thereof we ship a custom and more secure OpenSSH server configuration which
is copied into the image during build time.

The fourth version of this patch disables password authentication by
default, since this is required by some cloud hosters in order to apply
the image. Further, this method is less secure than pubkey
authentication.

Non-AEAD ciphers have been re-added to provide compatibility to older
RHEL systems.

Fixes #11750
Fixes #11751
Partially fixes #11538

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Cc: Marcel Lorenz <marcel.lorenz@ipfire.org>
Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
13 months agobackup: Fix deleting backup files
Michael Tremer [Thu, 20 Sep 2018 13:21:41 +0000 (14:21 +0100)] 
backup: Fix deleting backup files

Signed-off-by: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
13 months agokernel: arm32-bit: update rootfiles
Arne Fitzenreiter [Mon, 17 Sep 2018 05:44:55 +0000 (07:44 +0200)] 
kernel: arm32-bit: update rootfiles

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
13 months agokernel: update to 4.14.70
Arne Fitzenreiter [Sun, 16 Sep 2018 12:28:47 +0000 (14:28 +0200)] 
kernel: update to 4.14.70

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
13 months agokernel: arm: enable chacha poly
Arne Fitzenreiter [Sat, 15 Sep 2018 13:58:13 +0000 (15:58 +0200)] 
kernel: arm: enable chacha poly

fixes: #11855
todo: add rootfiles for arm 32-bit

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
13 months agocore124: add kernel files to updater
Arne Fitzenreiter [Sat, 15 Sep 2018 13:49:10 +0000 (15:49 +0200)] 
core124: add kernel files to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
14 months agocore124: Ship updated unbound
Michael Tremer [Thu, 13 Sep 2018 13:45:05 +0000 (14:45 +0100)] 
core124: Ship updated unbound

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
14 months agounbound: Update to 1.8.0
Matthias Fischer [Tue, 11 Sep 2018 18:07:14 +0000 (20:07 +0200)] 
unbound: Update to 1.8.0

For details see:

  https://nlnetlabs.nl/svn/unbound/tags/release-1.8.0/doc/Changelog

and

  https://nlnetlabs.nl/projects/unbound/download/

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
14 months agocore124: Ship updated backup.cgi
Michael Tremer [Thu, 13 Sep 2018 13:41:21 +0000 (14:41 +0100)] 
core124: Ship updated backup.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
14 months agostatic-routes: Make it clear that we are reloading routes
Michael Tremer [Thu, 13 Sep 2018 13:37:51 +0000 (14:37 +0100)] 
static-routes: Make it clear that we are reloading routes

When RED is brought down, we will reload all static routes.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
14 months agobackup: Sanitise content of ADDON variable
Michael Tremer [Thu, 30 Aug 2018 09:28:45 +0000 (10:28 +0100)] 
backup: Sanitise content of ADDON variable

References: #11830

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
14 months agobackup: Sanitise FILE parameter
Michael Tremer [Thu, 30 Aug 2018 09:20:06 +0000 (10:20 +0100)] 
backup: Sanitise FILE parameter

This parameter was passed to some shell commands without any
sanitisation which allowed an attacker who was authenticated to
the web UI to download arbitrary files from some directories
and delete any file from the filesystem.

References: #11830

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
14 months agokernel: update to 4.14.69
Arne Fitzenreiter [Wed, 12 Sep 2018 19:04:07 +0000 (21:04 +0200)] 
kernel: update to 4.14.69

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
14 months agoupdate disclaimer in LFS files
Peter Müller [Mon, 10 Sep 2018 17:52:21 +0000 (19:52 +0200)] 
update disclaimer in LFS files

Most of these files still used old dates and/or domain names for contact
mail addresses. This is now replaced by an up-to-date copyright line.

Just some housekeeping... :-)

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
14 months agocore124: Ship CA certificates
Michael Tremer [Mon, 10 Sep 2018 17:23:27 +0000 (18:23 +0100)] 
core124: Ship CA certificates

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
14 months agoupdate ca-certificates CA bundle
Peter Müller [Mon, 10 Sep 2018 16:25:40 +0000 (18:25 +0200)] 
update ca-certificates CA bundle

Update the CA certificates list to what Mozilla NSS ships currently.

The original file can be retrieved from:
https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
14 months agouse custom SSH client configuration in LFS file
Peter Müller [Mon, 10 Sep 2018 14:29:09 +0000 (16:29 +0200)] 
use custom SSH client configuration in LFS file

Include OpenSSH client configuration file during build.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
14 months agoadd hardened SSH client configuration
Peter Müller [Mon, 10 Sep 2018 14:29:08 +0000 (16:29 +0200)] 
add hardened SSH client configuration

Introduce a custom OpenSSH client configuration file for IPFire.
Some people use it as a jumping host, so applying hardening options
system-wide improves security.

Cryptography setup is the same as for OpenSSH server configuration.

The second version of this patch re-adds some non-AEAD cipher suites
which are needed for connecting to older RHEL systems.

Partially fixes #11751

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
14 months agocore124: Ship updated unbound configuration and restart daemon
Michael Tremer [Mon, 10 Sep 2018 15:35:25 +0000 (16:35 +0100)] 
core124: Ship updated unbound configuration and restart daemon

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>