Merge branch 'glibc-2.28' into next

Update langs

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

pakfire: Remove option to enable/disable checks for updates

This does not change anything

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

glibc: Update to 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libvirt: Update to 4.6.0

Fixes builds against glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

parted: Fix build with glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

syslinux: Fix build with glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

installer: remove set of pmbr_boot on gpt partitions

this fix the efi boot on hdd's larger than 2TB and raid installations.

fixes: #11890

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

collectd: Fix compiling against newer xfsprogs

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

nfs: Update to 2.3.3

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

keyutils: New package

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ntfs-3g: Update to 2017.3.23

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

xfsprogs: Update to 4.18.0

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

reiserfsprogs: Update to 3.6.27

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

LVM2: Update to 2.02.181

Update required to build against newer versions of glibc

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libaio: New package

This library is required by newer version of LVM2

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ppp: Build against openssl

libcrypt has been removed from glibc and openssl
can be used instead for cryptographic operations.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Build openssl earlier in the build process

This is a basic library that is used by so many other packages
and more and more are being added. To have those packages take
advantage of it, we build it very early.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core125: Ship updated kmod

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

udev: Migrate to eudev

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kmod: Update to version 25

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

sysvinit: Fix build with glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gzip: Fix build with glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

findutils: Fix building against glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

e2fsprogs: Update to 1.44.4

Fixes build with glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bison: Fix building with glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

m4: Fix building with glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gcc: Fix building with glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

coreutils: Update to 8.30

Builds with newer versions of glibc

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core125: Ship updated SSH configuration

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

fix broken SFTP in OpenSSH server

Fixes #11887

The second version of this patch uses the correct path on IPFire systems
and supersedes the first one. It also referrs to the correct issue ID.

Thanks to Matthias Fischer for reporting this.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core125: Ship updated dhcpcd

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dhcpcd: Update to 7.0.8

Hi,

No explicit changelog. I used:
https://roy.marples.name/search/query:dhcpcd

Running here.

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core125: Ship updated unbound

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Update to 1.8.1

For details see:
https://nlnetlabs.nl/projects/unbound/download/

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hostapd: Bump package version

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hostapd: Compile with debugging messages

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hostapd: Add support for 802.11ac

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core125: Update language files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

update OpenSSH default port in language files

Fixes #11881

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

clamav: Update to 0.100.2

Hi,

"This is a patch release to address several vulnerabilities..."

For details see:
https://blog.clamav.net/2018/10/clamav-01002-has-been-released.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core125: Ship updated GnuTLS

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gnutls: Update to 3.5.19

Hi,

For changelogs since '3.5.15' see:

https://lists.gnupg.org/pipermail/gnutls-devel/2017-October/008523.html
https://lists.gnupg.org/pipermail/gnutls-devel/2018-January/008538.html
https://lists.gnupg.org/pipermail/gnutls-devel/2018-February/008540.html
https://lists.gnupg.org/pipermail/gnutls-devel/2018-July/008583.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core125: Apply changed sysctl.conf immediately

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Allow kernel to swap memory on high demand

Signed-off-by: Tim FitzGeorge <ipfr@tfitzgeorge.me.uk>
Fixes: Bug 11839
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core125: Ship updated bind

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bind: Update to 9.11.4-P2

For details see:
http://ftp.isc.org/isc/bind9/9.11.4-P2/RELEASE-NOTES-bind-9.11.4-P2.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core125: Ship updated apache

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Apache: Update to 2.4.35

For details see:

http://apache.mirror.digionline.de//httpd/CHANGES_2.4.35

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core125: Ship recently updated sqlite

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update list of contributors

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Start Core Update 125

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

sqlite: Update to 3.25.2.0

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge branch 'core124' of git.ipfire.org:/pub/git/ipfire-2.x into core124

core124: add apache initskript and nsswitch.conf to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core124: don't remove network trigger script

this script is still needed if /var/ipfire is on an extra partition.
New installations works without this script.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core124: fix removing old initrd files on arm systems

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.72

this commit has many important driver updates so we need to ship it fast...

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge remote-tracking branch 'origin/master' into core124

ssh: Revert MaxAuthTries setting

This is entirely not practicable and should have been changed
before. I missed this when I tested the configuration.

It is common that multiple SSH keys exist and three is common
number (RSA, ECDSA & Ed25519). A key passed with ssh -i and
password authentication are not even tried.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core124: fix updater

fix some missing files on arm
remove not needed rebuild initrd because we ship it already built

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

nano: Update to 3.1

Hi,

This update was published just a few days after my "3.0"-commit - running.

For details see:

https://www.nano-editor.org/news.php

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core124: finish updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

arm: boot.scr: add setting to edit fdt via uEnv.txt

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

rebuild-initrd: update for grub2

this was was not used for years because we usually ship a prebuild ramdisk
so this incompatiblity was not noticed long time...

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.71

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core124: Ship updated iproute2

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

iproute2: Update to 4.18.0

Triggered by https://bugzilla.ipfire.org/show_bug.cgi?id=11866 ;-)

For details see:
https://lwn.net/Articles/762515/

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core124: Ship updated openssh package

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openssh: Update to 7.8p1

For details see:
http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/ChangeLog

I didn't find an official lfs-patch for openssl-1.1-compatibility,
so I used the patch from here:
https://git.archlinux.org/svntogit/packages.git/plain/trunk/openssl-1.1.0.patch?h=packages/openssh

Building ran without any errors.

I tested with both machines (test on Core 120 - and productive - on Core 122) and found no errors so far:

...
[root@ipfiretest ~]# ssh -V
OpenSSH_7.8p1, OpenSSL 1.1.0h  27 Mar 2018
...

...
root@ipfire: / # ssh -V
OpenSSH_7.8p1, OpenSSL 1.1.0h  27 Mar 2018
...

All ssh-connections ran fine but I'm not REALLY sure if this is sufficient for anyone else.

Could someone please check and confirm!?

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Tested-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core124: Ship updated OpenSSH configuration

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ssh: Remove AuthenticationMethods directive

This is only setting something that is default anyways and
prevents sshd from starting if one of the listed methods
is not activated.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

use custom SSH server configuration in LFS file

Include OpenSSH server configuration file during build.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

add hardened SSH server configuration

In order to harden OpenSSH server in IPFire, using the upstream default configuration
and edit it via sed commands in LFS file is error-prone and does not scale.

Thereof we ship a custom and more secure OpenSSH server configuration which
is copied into the image during build time.

The fourth version of this patch disables password authentication by
default, since this is required by some cloud hosters in order to apply
the image. Further, this method is less secure than pubkey
authentication.

Non-AEAD ciphers have been re-added to provide compatibility to older
RHEL systems.

Fixes #11750
Fixes #11751
Partially fixes #11538

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Cc: Marcel Lorenz <marcel.lorenz@ipfire.org>
Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

backup: Fix deleting backup files

Signed-off-by: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: arm32-bit: update rootfiles

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.70

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: arm: enable chacha poly

fixes: #11855
todo: add rootfiles for arm 32-bit

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core124: add kernel files to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core124: Ship updated unbound

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Update to 1.8.0

For details see:

  https://nlnetlabs.nl/svn/unbound/tags/release-1.8.0/doc/Changelog

and

  https://nlnetlabs.nl/projects/unbound/download/

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core124: Ship updated backup.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

static-routes: Make it clear that we are reloading routes

When RED is brought down, we will reload all static routes.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

backup: Sanitise content of ADDON variable

References: #11830

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

backup: Sanitise FILE parameter

This parameter was passed to some shell commands without any
sanitisation which allowed an attacker who was authenticated to
the web UI to download arbitrary files from some directories
and delete any file from the filesystem.

References: #11830

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: update to 4.14.69

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

update disclaimer in LFS files

Most of these files still used old dates and/or domain names for contact
mail addresses. This is now replaced by an up-to-date copyright line.

Just some housekeeping... :-)

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core124: Ship CA certificates

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

update ca-certificates CA bundle

Update the CA certificates list to what Mozilla NSS ships currently.

The original file can be retrieved from:
https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

use custom SSH client configuration in LFS file

Include OpenSSH client configuration file during build.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

add hardened SSH client configuration

Introduce a custom OpenSSH client configuration file for IPFire.
Some people use it as a jumping host, so applying hardening options
system-wide improves security.

Cryptography setup is the same as for OpenSSH server configuration.

The second version of this patch re-adds some non-AEAD cipher suites
which are needed for connecting to older RHEL systems.

Partially fixes #11751

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core124: Ship updated unbound configuration and restart daemon

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Unbound: Use aggressive NSEC

This avoids some needless lookups to destination domains
with a very high NXDOMAIN rate and reduces load on upstream
servers.

See https://nlnetlabs.nl/documentation/unbound/unbound.conf/
for further details.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Unbound: Use caps for IDs

Attempt to detect DNS spoofing attacks by inserting 0x20-encoded
random bits into upstream queries. Upstream documentation claims
it to be an experimental implementation, it did not cause any trouble
on productive systems here.

See https://nlnetlabs.nl/documentation/unbound/unbound.conf/ for
further details.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Unbound: Enable DNS cache poisoning mitigation

By default, Unbound neither keeps track of the number of unwanted
replies nor initiates countermeasures if they become too large (DNS
cache poisoning).

This sets the maximum number of tolerated unwanted replies to
1M, causing the cache to be flushed afterwards. (Upstream documentation
recommends 10M as a threshold, but this turned out to be ineffective
against attacks in the wild.)

See https://nlnetlabs.nl/documentation/unbound/unbound.conf/ for
details. This version of the patch uses 1M as threshold instead of
5M and supersedes the first and second version.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core124: Ship updated redirect page template

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

embed background image in redirect template

Embed the IPFire background image into the redirect template
directly via CSS instead of loading it from somewhere else.
This is necessary because of Content Security Policy (CSP).

This patch inserts the base64 encoded image during build so
nothing needs to be updated twice in case background image
changes.

It supersedes first to fourth version of this patch and has
been successfully tested during a clean build.

Fixes #11650

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core124: Rebuild initrd

This script was missing in the last update and therefore
no microcodes were included.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core124: Apply changed sysctl.conf

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

do not expose kernel address spaces even to privileged users

Change this setting from 1 to 2 so kernel addresses are not
displayed even if a user has CAPS_SYSLOG privileges.

See also:
- https://lwn.net/Articles/420403/
- https://tails.boum.org/contribute/design/kernel_hardening/

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>