Michael Tremer [Tue, 25 Sep 2018 19:24:39 +0000 (20:24 +0100)]
ssh: Revert MaxAuthTries setting
This is entirely not practicable and should have been changed
before. I missed this when I tested the configuration.
It is common that multiple SSH keys exist and three is common
number (RSA, ECDSA & Ed25519). A key passed with ssh -i and
password authentication are not even tried.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
For details see:
http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/ChangeLog
I didn't find an official lfs-patch for openssl-1.1-compatibility,
so I used the patch from here:
https://git.archlinux.org/svntogit/packages.git/plain/trunk/openssl-1.1.0.patch?h=packages/openssh
Building ran without any errors.
I tested with both machines (test on Core 120 - and productive - on Core 122) and found no errors so far:
Peter Müller [Mon, 10 Sep 2018 15:52:22 +0000 (17:52 +0200)]
add hardened SSH server configuration
In order to harden OpenSSH server in IPFire, using the upstream default configuration
and edit it via sed commands in LFS file is error-prone and does not scale.
Thereof we ship a custom and more secure OpenSSH server configuration which
is copied into the image during build time.
The fourth version of this patch disables password authentication by
default, since this is required by some cloud hosters in order to apply
the image. Further, this method is less secure than pubkey
authentication.
Non-AEAD ciphers have been re-added to provide compatibility to older
RHEL systems.
Fixes #11750
Fixes #11751
Partially fixes #11538
Signed-off-by: Peter Müller <peter.mueller@link38.eu> Cc: Marcel Lorenz <marcel.lorenz@ipfire.org> Cc: Michael Tremer <michael.tremer@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Thu, 30 Aug 2018 09:20:06 +0000 (10:20 +0100)]
backup: Sanitise FILE parameter
This parameter was passed to some shell commands without any
sanitisation which allowed an attacker who was authenticated to
the web UI to download arbitrary files from some directories
and delete any file from the filesystem.
References: #11830
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Mon, 10 Sep 2018 14:29:08 +0000 (16:29 +0200)]
add hardened SSH client configuration
Introduce a custom OpenSSH client configuration file for IPFire.
Some people use it as a jumping host, so applying hardening options
system-wide improves security.
Cryptography setup is the same as for OpenSSH server configuration.
The second version of this patch re-adds some non-AEAD cipher suites
which are needed for connecting to older RHEL systems.
Partially fixes #11751
Signed-off-by: Peter Müller <peter.mueller@link38.eu> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Mon, 10 Sep 2018 14:21:25 +0000 (16:21 +0200)]
Unbound: Use caps for IDs
Attempt to detect DNS spoofing attacks by inserting 0x20-encoded
random bits into upstream queries. Upstream documentation claims
it to be an experimental implementation, it did not cause any trouble
on productive systems here.
See https://nlnetlabs.nl/documentation/unbound/unbound.conf/ for
further details.
Signed-off-by: Peter Müller <peter.mueller@link38.eu> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Mon, 10 Sep 2018 14:21:24 +0000 (16:21 +0200)]
Unbound: Enable DNS cache poisoning mitigation
By default, Unbound neither keeps track of the number of unwanted
replies nor initiates countermeasures if they become too large (DNS
cache poisoning).
This sets the maximum number of tolerated unwanted replies to
1M, causing the cache to be flushed afterwards. (Upstream documentation
recommends 10M as a threshold, but this turned out to be ineffective
against attacks in the wild.)
See https://nlnetlabs.nl/documentation/unbound/unbound.conf/ for
details. This version of the patch uses 1M as threshold instead of
5M and supersedes the first and second version.
Signed-off-by: Peter Müller <peter.mueller@link38.eu> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Mon, 10 Sep 2018 14:15:44 +0000 (16:15 +0200)]
embed background image in redirect template
Embed the IPFire background image into the redirect template
directly via CSS instead of loading it from somewhere else.
This is necessary because of Content Security Policy (CSP).
This patch inserts the base64 encoded image during build so
nothing needs to be updated twice in case background image
changes.
It supersedes first to fourth version of this patch and has
been successfully tested during a clean build.
Fixes #11650
Signed-off-by: Peter Müller <peter.mueller@link38.eu> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Mon, 27 Aug 2018 06:23:03 +0000 (07:23 +0100)]
pakfire: Remove mirror health check
This is not really necessary because pakfire will automatically
failover to the next mirror anyways and that a mirror responds
to an ICMP echo request doesn't necessarily mean that it can
deliver the requested file.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Alexander Marx [Fri, 24 Aug 2018 08:06:30 +0000 (10:06 +0200)]
BUG11825: firewall: Renaming a network/host group doesn't update rules
Code only changed field 6 of hash (target group) and not field 4 (source group).
Also if using geoip it was only field 4 of hash (source group) and not field 6 of hash (target group)
Added new code that changes both fields to reflect the change in the firewallrules immediately.
fixes: #11825
Signed-off-by: Alexander Marx <alexander.marx@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
xtables are build for installed iptables version so we need
to ship it even if it was not updated.
Also clean /lib/xtables because some modules are renamed.
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Peter Müller [Thu, 16 Aug 2018 15:08:04 +0000 (17:08 +0200)]
Postfix: update to 3.3.1
This updates Postfix to recent 3.3.x series, which contains
some new features. Release announcement available at
http://www.postfix.org/announcements/postfix-3.3.1.html
The third version of this patch superseds the first and
second one which were broken due to bugs in the MUAs GPG
implementation.
Signed-off-by: Peter Müller <peter.mueller@link38.eu> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
projects / ipfire-2.x.git / log
