ipfire-2.x.git
2 months agoIDS: Rename sourcefire VRT rulesets to Talos VRT rulesets
Stefan Schantl [Mon, 1 Apr 2019 15:32:34 +0000 (17:32 +0200)]
IDS: Rename sourcefire VRT rulesets to Talos VRT rulesets

Fixes #12019

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 months agoMerge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next
Arne Fitzenreiter [Sun, 31 Mar 2019 16:36:44 +0000 (18:36 +0200)]
Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

2 months agoUpdate borgbackup to version 1.1.9
Jonatan Schlag [Sun, 31 Mar 2019 12:29:45 +0000 (13:29 +0100)]
Update borgbackup to version 1.1.9

Fixes: #12016

Signed-off-by: Jonatan Schlag <jonatan.schlag@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 months agokernel: update to 4.14.109
Arne Fitzenreiter [Sun, 31 Mar 2019 09:46:34 +0000 (11:46 +0200)]
kernel: update to 4.14.109

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 months agokernel: update user regd patch from openwrt
Arne Fitzenreiter [Sat, 30 Mar 2019 15:56:56 +0000 (16:56 +0100)]
kernel: update user regd patch from openwrt

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 months agoMerge remote-tracking branch 'ms/dfs' into next
Arne Fitzenreiter [Sat, 30 Mar 2019 15:55:35 +0000 (16:55 +0100)]
Merge remote-tracking branch 'ms/dfs' into next

2 months agofreeradius: Update to version 3.0.18
Erik Kapfer [Fri, 29 Mar 2019 09:44:43 +0000 (10:44 +0100)]
freeradius: Update to version 3.0.18

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 months agoclamav: Update to 0.101.2
Matthias Fischer [Wed, 27 Mar 2019 19:54:10 +0000 (20:54 +0100)]
clamav: Update to 0.101.2

For details see:
https://blog.clamav.net/2019/03/clamav-01012-and-01003-patches-have.html

"ClamAV 0.101.2 is a patch release to address a handful of security related bugs."

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 months agounbound-dhcp-leases-bridge: Replace leases file atomically
Michael Tremer [Thu, 28 Mar 2019 12:51:06 +0000 (12:51 +0000)]
unbound-dhcp-leases-bridge: Replace leases file atomically

When there is a large number of leases, writing the file may
take a long time. When unbound is re-reading its configuration
in that time, the file might syntactically incorrect.

This change writes the file first and then moves it
to the right place in one transaction.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 months agosuricata: Enable CPU affinity
Michael Tremer [Tue, 26 Mar 2019 21:58:01 +0000 (21:58 +0000)]
suricata: Enable CPU affinity

This will tie the detection threads to a certain CPU and
slightly increases throughput on my system.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 months agosuricata: Tie queues to a CPU core
Michael Tremer [Tue, 26 Mar 2019 21:18:45 +0000 (21:18 +0000)]
suricata: Tie queues to a CPU core

This should improve performance by a small margin

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 months agonginx: Update to 1.15.9
Erik Kapfer [Tue, 26 Mar 2019 06:15:16 +0000 (07:15 +0100)]
nginx: Update to 1.15.9

Fixes #12023 .
Added support for http2.

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 months agofreeradius: Bump version because package is linked against old version of OpenSSL
Michael Tremer [Fri, 22 Mar 2019 07:28:23 +0000 (07:28 +0000)]
freeradius: Bump version because package is linked against old version of OpenSSL

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 months agoDHCP: Remove double colon
Michael Tremer [Fri, 22 Mar 2019 03:28:23 +0000 (03:28 +0000)]
DHCP: Remove double colon

In some languages, there were double colons in the DNS Update section

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 months agoGeoIP: Do not crash when locations database does not exist
Michael Tremer [Fri, 22 Mar 2019 02:58:57 +0000 (02:58 +0000)]
GeoIP: Do not crash when locations database does not exist

Fixes: #12021
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 months agomake.sh: Build libedit very early
Michael Tremer [Thu, 21 Mar 2019 20:50:30 +0000 (20:50 +0000)]
make.sh: Build libedit very early

Many packages can make use of this

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 months agocore130: Ship updated lua
Michael Tremer [Thu, 21 Mar 2019 20:48:39 +0000 (20:48 +0000)]
core130: Ship updated lua

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 months agolua: Update to 5.3.5
Matthias Fischer [Sun, 24 Mar 2019 17:34:37 +0000 (18:34 +0100)]
lua: Update to 5.3.5

For details see:

http://www.lua.org/bugs.html

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 months agocore130: Ship rrdtool and collectd
Michael Tremer [Thu, 21 Mar 2019 20:39:51 +0000 (20:39 +0000)]
core130: Ship rrdtool and collectd

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 months agorrdtool: Update to 1.7.1
Matthias Fischer [Sun, 24 Mar 2019 17:21:20 +0000 (18:21 +0100)]
rrdtool: Update to 1.7.1

Disabled 'lua' because otherwise building failed.

I didn't find any place or reason where 'lua' was used by 'rrdtool', so it
was deactivated.

Disabling had no noticeable effects by now. Running.

Please note:
'/usr/lib/collectd/rrdcached.so' and '/usr/lib/collectd/rrdtool.so' have to
be updated, too.

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 months agoopenvpn: Remove subnet check for static pools
Michael Tremer [Fri, 22 Mar 2019 15:22:43 +0000 (15:22 +0000)]
openvpn: Remove subnet check for static pools

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agodnsdist: Update to 1.3.3
Michael Tremer [Mon, 18 Mar 2019 04:38:41 +0000 (04:38 +0000)]
dnsdist: Update to 1.3.3

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agodnsdist: Install some symlinks to start the service
Michael Tremer [Mon, 18 Mar 2019 02:54:37 +0000 (02:54 +0000)]
dnsdist: Install some symlinks to start the service

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agodnsdist: Add backup include
Michael Tremer [Mon, 18 Mar 2019 02:54:15 +0000 (02:54 +0000)]
dnsdist: Add backup include

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agoRootfile update
Michael Tremer [Sat, 16 Mar 2019 23:09:11 +0000 (23:09 +0000)]
Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agoCore 130: Remove files after convert-snort has been launched
Stefan Schantl [Mon, 18 Mar 2019 19:33:28 +0000 (20:33 +0100)]
Core 130: Remove files after convert-snort has been launched

The converter requires /etc/snort/snort.conf to grab the used rule files
(categories). After all settings have been converted, we are fine to delete all
snort related files, because none of them is needed anymore.

Also the /var/ipfire/snort directory needs to be deleted. If it will be left on the
system and at any later time a backup will get restored, the converter will be
started by the backup script, because it detects that a snort settins dir exists
and would be restore the old snort settings and replaces all current IPS settings.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agodnsforward.cgi: Add DNSSEC option to legend
Michael Tremer [Mon, 18 Mar 2019 17:26:16 +0000 (17:26 +0000)]
dnsforward.cgi: Add DNSSEC option to legend

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agodnsforward.cgi: Check DISABLE_DNSSEC checkbox when editing
Michael Tremer [Mon, 18 Mar 2019 15:35:29 +0000 (15:35 +0000)]
dnsforward.cgi: Check DISABLE_DNSSEC checkbox when editing

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agoipsec-interfaces: Apply static routes (again) after creating IPsec interfaces
Michael Tremer [Mon, 18 Mar 2019 15:24:56 +0000 (15:24 +0000)]
ipsec-interfaces: Apply static routes (again) after creating IPsec interfaces

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agohostapd: Always enable 80 MHz channel width for 802.11ac
Michael Tremer [Wed, 13 Mar 2019 17:37:28 +0000 (18:37 +0100)]
hostapd: Always enable 80 MHz channel width for 802.11ac

This is mandatory to support by all hardware and works well.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agohostapd: Automatically disassociate any clients with high error rates
Michael Tremer [Wed, 13 Mar 2019 17:24:01 +0000 (18:24 +0100)]
hostapd: Automatically disassociate any clients with high error rates

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agokernel: Enable debugging for Atheros drivers
Michael Tremer [Thu, 14 Mar 2019 13:07:11 +0000 (13:07 +0000)]
kernel: Enable debugging for Atheros drivers

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agokernel: Enable DFS support for ath*k drivers
Michael Tremer [Fri, 8 Mar 2019 11:05:26 +0000 (11:05 +0000)]
kernel: Enable DFS support for ath*k drivers

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agohostapd: Bump package version
Michael Tremer [Sat, 16 Mar 2019 12:34:19 +0000 (12:34 +0000)]
hostapd: Bump package version

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agohostapd: make client isolation configurable via WebUI
Peter Müller [Sat, 16 Mar 2019 14:20:00 +0000 (14:20 +0000)]
hostapd: make client isolation configurable via WebUI

hostapd supports client-isolation, but this feature could
not be configured via the WebUI so far. Since it might be
desired in public wireless networks, or even private ones,
it makes sense to provide a radio button to let the user
decide on.

Fixes #11974.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agoensure Tor daemon files have correct permissions
Peter Müller [Fri, 15 Mar 2019 17:00:00 +0000 (17:00 +0000)]
ensure Tor daemon files have correct permissions

Set permissions for /var/lib/tor and /var/ipfire/tor to
tor:tor, regardless whether Tor user has been created before
or not.

This ensures Tor starts properly on existing systems after
reinstallation of the add-on. Thanks to Michael for the hint.

Further, a comment for new Tor user in /etc/passwd has been added.

Fixes #11779.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agocore130: Ship updated unbound
Michael Tremer [Sat, 16 Mar 2019 12:32:10 +0000 (12:32 +0000)]
core130: Ship updated unbound

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agounbound: Update to 1.9.1
Matthias Fischer [Fri, 15 Mar 2019 18:15:19 +0000 (19:15 +0100)]
unbound: Update to 1.9.1

For details see:
https://nlnetlabs.nl/pipermail/unbound-users/2019-March/011415.html

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agocore130: Ship updated ntp
Michael Tremer [Sat, 16 Mar 2019 12:30:22 +0000 (12:30 +0000)]
core130: Ship updated ntp

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agontp: Update to 4.2.8p13
Matthias Fischer [Fri, 15 Mar 2019 18:10:11 +0000 (19:10 +0100)]
ntp: Update to 4.2.8p13

For details see:
http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agosuricata: Fix ownership and file permissions of files inside /var/lib/suricata.
Stefan Schantl [Sat, 16 Mar 2019 12:04:18 +0000 (13:04 +0100)]
suricata: Fix ownership and file permissions of files inside /var/lib/suricata.

These files needs to have nobody.nobody as owner but requires read-acces from everyone
to allow the suricata user reading-in this files during startup.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agologs.cgi/ids.dat: Fixup processing dates from logfiles which contains a year
Stefan Schantl [Sat, 16 Mar 2019 11:57:25 +0000 (12:57 +0100)]
logs.cgi/ids.dat: Fixup processing dates from logfiles which contains a year

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agoFix python3-yaml rootfile
Michael Tremer [Sat, 16 Mar 2019 10:00:19 +0000 (10:00 +0000)]
Fix python3-yaml rootfile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agocore130: Fix another error in rootfile
Stefan Schantl [Fri, 15 Mar 2019 14:33:29 +0000 (15:33 +0100)]
core130: Fix another error in rootfile

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agocore130: Fix errors in rootfile
Michael Tremer [Fri, 15 Mar 2019 13:20:23 +0000 (13:20 +0000)]
core130: Fix errors in rootfile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agoUpdate IPS translation
Michael Tremer [Thu, 14 Mar 2019 16:52:38 +0000 (16:52 +0000)]
Update IPS translation

* Fix typos
* Fix compound nouns (especially in German)
* Remove unused strings

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agonut: Disable parallel build
Michael Tremer [Thu, 14 Mar 2019 14:01:45 +0000 (14:01 +0000)]
nut: Disable parallel build

nut just fails to build when running in parallel

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agocore130: Ship suricata
Michael Tremer [Thu, 14 Mar 2019 13:48:25 +0000 (13:48 +0000)]
core130: Ship suricata

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agoUpdate contributors
Michael Tremer [Thu, 14 Mar 2019 13:20:56 +0000 (13:20 +0000)]
Update contributors

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agoUpdate translations
Michael Tremer [Thu, 14 Mar 2019 13:20:22 +0000 (13:20 +0000)]
Update translations

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agoMerge remote-tracking branch 'stevee/next-suricata' into next
Michael Tremer [Thu, 14 Mar 2019 13:19:35 +0000 (13:19 +0000)]
Merge remote-tracking branch 'stevee/next-suricata' into next

3 months agocore130: Ship updated firewall script
Michael Tremer [Thu, 14 Mar 2019 13:16:33 +0000 (13:16 +0000)]
core130: Ship updated firewall script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agoadd IPtables chain for outgoing Tor traffic
Peter Müller [Mon, 11 Mar 2019 20:07:00 +0000 (20:07 +0000)]
add IPtables chain for outgoing Tor traffic

If Tor is operating in relay mode, it has to open a lot of outgoing
TCP connections. These should be separated from any other outgoing
connections, as allowing _all_ outgoing traffic will be unwanted and
risky in most cases.

Thereof, Tor will be running as a dedicated user (see second patch),
allowing usage of user-based IPtables rulesets.

Partially fixes #11779.

Singed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agorun Tor under dedicated user
Peter Müller [Mon, 11 Mar 2019 20:07:00 +0000 (20:07 +0000)]
run Tor under dedicated user

This allows more-fine granular firewall rules (see first patch for
further information). Further, it prevents other services running as
"nobody" (Apache, ...) from reading Tor relay keys.

Fixes #11779.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agoStart Core Update 130
Michael Tremer [Thu, 14 Mar 2019 13:15:03 +0000 (13:15 +0000)]
Start Core Update 130

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agosuricata: Fix amount of listened nfqueues
Stefan Schantl [Wed, 13 Mar 2019 11:14:30 +0000 (12:14 +0100)]
suricata: Fix amount of listened nfqueues

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
3 months agoamavisd: update to 2.11.1
Peter Müller [Mon, 11 Mar 2019 19:35:00 +0000 (19:35 +0000)]
amavisd: update to 2.11.1

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agoPostfix: update to 3.4.3
Peter Müller [Mon, 11 Mar 2019 19:28:00 +0000 (19:28 +0000)]
Postfix: update to 3.4.3

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agoinstaller: Set the clock correctly when installing over network
Michael Tremer [Wed, 13 Mar 2019 08:05:27 +0000 (08:05 +0000)]
installer: Set the clock correctly when installing over network

If a system has a not very up to date clock, downloading files
over HTTPS is impossible.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agocore129: finish update
Arne Fitzenreiter [Wed, 13 Mar 2019 14:18:52 +0000 (15:18 +0100)]
core129: finish update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
3 months agou-boot: try to boot without ramdisk if the system cannot load it
Arne Fitzenreiter [Wed, 13 Mar 2019 14:17:28 +0000 (15:17 +0100)]
u-boot: try to boot without ramdisk if the system cannot load it

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
3 months agoknot: update to 2.8.0 and build/install only kdig
Arne Fitzenreiter [Wed, 13 Mar 2019 14:06:23 +0000 (15:06 +0100)]
knot: update to 2.8.0 and build/install only kdig

This fix compile errors on small arm boards. (cc1 internal error)

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
3 months agogroff: update to 1.22.4
Arne Fitzenreiter [Wed, 13 Mar 2019 14:04:40 +0000 (15:04 +0100)]
groff: update to 1.22.4

This fix compile problems on small arm boards. (cc1 internal error)

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
3 months agosuricata: Remove unneeded stuff during build
Stefan Schantl [Wed, 13 Mar 2019 09:03:48 +0000 (10:03 +0100)]
suricata: Remove unneeded stuff during build

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
3 months agoRevert "kernel: cleanup unused rpi patch"
Arne Fitzenreiter [Wed, 13 Mar 2019 08:38:21 +0000 (09:38 +0100)]
Revert "kernel: cleanup unused rpi patch"

This reverts commit a2d49659f3947e5a5a77cbc1bf384eb0b2760ca9.

The patch is still needed to prevent strange crashes

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
3 months agoUpdate list of contributors
Michael Tremer [Mon, 11 Mar 2019 15:58:45 +0000 (15:58 +0000)]
Update list of contributors

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agocore129: Ship updated dnsforward.cgi
Michael Tremer [Mon, 11 Mar 2019 15:58:04 +0000 (15:58 +0000)]
core129: Ship updated dnsforward.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agoMerge remote-tracking branch 'ms/dns-forwarding' into next
Michael Tremer [Mon, 11 Mar 2019 15:57:15 +0000 (15:57 +0000)]
Merge remote-tracking branch 'ms/dns-forwarding' into next

3 months agocore129: Ship updated dhcp.cgi
Michael Tremer [Mon, 11 Mar 2019 09:54:19 +0000 (09:54 +0000)]
core129: Ship updated dhcp.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agoMerge remote-tracking branch 'ms/dhcp' into next
Michael Tremer [Mon, 11 Mar 2019 09:53:56 +0000 (09:53 +0000)]
Merge remote-tracking branch 'ms/dhcp' into next

3 months agoTor WebUI: drop relay bandwith options < 1 MBit/s
Peter Müller [Fri, 8 Mar 2019 19:17:00 +0000 (19:17 +0000)]
Tor WebUI: drop relay bandwith options < 1 MBit/s

Tor requires at least 1 MBit/s in order to participate.

Fixes #12001

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agodnsdist: Limit to fewer concurrent build processes
Michael Tremer [Mon, 11 Mar 2019 09:38:56 +0000 (09:38 +0000)]
dnsdist: Limit to fewer concurrent build processes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agocore129: Ship updated less
Michael Tremer [Sun, 10 Mar 2019 18:23:22 +0000 (18:23 +0000)]
core129: Ship updated less

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agoless: update to 530
Peter Müller [Fri, 8 Mar 2019 19:19:00 +0000 (19:19 +0000)]
less: update to 530

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agoPostfix: update to 3.4.1
Peter Müller [Fri, 8 Mar 2019 19:22:00 +0000 (19:22 +0000)]
Postfix: update to 3.4.1

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agoslang: revert parallelized build
Matthias Fischer [Sun, 10 Mar 2019 17:04:31 +0000 (18:04 +0100)]
slang: revert parallelized build

This partially reverts https://git.ipfire.org/?p=ipfire-2.x.git;a=blob;f=lfs/slang;h=217e74c77317d4c829913f934458779fd278bf29;hb=23164efba5f57b3d8ccb07a166b613f2f951e1b6

'slang 2.3.0' doesn't like "$(MAKETUNING)"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agoIDS: Set owner of suricata logging directory to correct user
Stefan Schantl [Sun, 10 Mar 2019 17:52:40 +0000 (18:52 +0100)]
IDS: Set owner of suricata logging directory to correct user

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
3 months agoRename snort user and group to suricata
Stefan Schantl [Sun, 10 Mar 2019 17:50:37 +0000 (18:50 +0100)]
Rename snort user and group to suricata

This only affects new installations.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
3 months agosuricata: Run as non-root user
Michael Tremer [Sat, 2 Mar 2019 17:26:34 +0000 (17:26 +0000)]
suricata: Run as non-root user

This patch does not have any effect (yet) and is untested
because suricata needs to be built against libcap-ng which
is currently not being packaged for IPFire.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
3 months agosuricata: Update to 4.1.3
Stefan Schantl [Sun, 10 Mar 2019 16:34:03 +0000 (17:34 +0100)]
suricata: Update to 4.1.3

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
3 months agoMove IDS/IPS menu entry to firewall section
Stefan Schantl [Sun, 10 Mar 2019 12:27:52 +0000 (13:27 +0100)]
Move IDS/IPS menu entry to firewall section

Fixes #12011.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
3 months ago/etc/group: Order groups by ID
Michael Tremer [Fri, 8 Mar 2019 10:11:23 +0000 (10:11 +0000)]
/etc/group: Order groups by ID

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months ago/etc/passwd: Order users by ID
Michael Tremer [Fri, 8 Mar 2019 10:08:02 +0000 (10:08 +0000)]
/etc/passwd: Order users by ID

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agozabbix_agent: Create /var/run/zabbix in initscript
Michael Tremer [Fri, 8 Mar 2019 10:04:28 +0000 (10:04 +0000)]
zabbix_agent: Create /var/run/zabbix in initscript

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agozabbix_agent: Ensure that the user exists on all systems
Michael Tremer [Fri, 8 Mar 2019 09:58:56 +0000 (09:58 +0000)]
zabbix_agent: Ensure that the user exists on all systems

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agozabbix_agentd: New addon
Alexander Koch [Wed, 13 Feb 2019 23:06:19 +0000 (00:06 +0100)]
zabbix_agentd: New addon

New addon for monitoring IPFire by Zabbix Monitoring (https://www.zabbix.com/features).
See https://forum.ipfire.org/viewtopic.php?f=52&t=22039 and https://lists.ipfire.org/pipermail/development/2019-February/005324.html for further details.

Best regards,
Alex

Signed-off-by: Alexander Koch <ipfire@starkstromkonsument.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agoiptables: Commented legacy ip(6)tables entries from ROOTFILE
Erik Kapfer [Fri, 8 Mar 2019 04:51:55 +0000 (05:51 +0100)]
iptables: Commented legacy ip(6)tables entries from ROOTFILE

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agoinstaller: Download ISO via HTTPS
Michael Tremer [Thu, 7 Mar 2019 11:27:19 +0000 (11:27 +0000)]
installer: Download ISO via HTTPS

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agoRevert "boost: Build with -O2 only"
Michael Tremer [Thu, 7 Mar 2019 10:29:31 +0000 (10:29 +0000)]
Revert "boost: Build with -O2 only"

This reverts commit 9ff5b381eb8a4e129978c34f969e312c302ea7b1.

Boost wants to build with -O3 no matter what

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agounbound: Mark domains as insecure from DNS forwarding
Michael Tremer [Tue, 5 Mar 2019 16:58:29 +0000 (16:58 +0000)]
unbound: Mark domains as insecure from DNS forwarding

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agoDNS Forwarding: Add UI to Allow to disable DNSSEC for a zone
Michael Tremer [Tue, 5 Mar 2019 16:10:17 +0000 (16:10 +0000)]
DNS Forwarding: Add UI to Allow to disable DNSSEC for a zone

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agoMerge branch 'ipsec-on-demand' into next
Michael Tremer [Tue, 5 Mar 2019 15:25:36 +0000 (15:25 +0000)]
Merge branch 'ipsec-on-demand' into next

3 months agovpnmain.cgi: Make on-demand mode default for IPsec VPNs
Michael Tremer [Tue, 5 Mar 2019 15:24:19 +0000 (15:24 +0000)]
vpnmain.cgi: Make on-demand mode default for IPsec VPNs

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agovpnmain.cgi: Carry over START_ACTION attribute correctly
Michael Tremer [Tue, 5 Mar 2019 15:23:33 +0000 (15:23 +0000)]
vpnmain.cgi: Carry over START_ACTION attribute correctly

This setting was not carried correctly and therefore the default was ignored.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agomake.sh: Fit more processes into memory
Michael Tremer [Mon, 4 Mar 2019 17:21:15 +0000 (17:21 +0000)]
make.sh: Fit more processes into memory

Because we have a good way to limit processes now, we should
increase the default size a little bit

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agoboost: Build with -O2 only
Michael Tremer [Mon, 4 Mar 2019 17:20:52 +0000 (17:20 +0000)]
boost: Build with -O2 only

This should increase build speed

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agoConfig: Builds don't seem to like the space
Michael Tremer [Mon, 4 Mar 2019 11:57:22 +0000 (11:57 +0000)]
Config: Builds don't seem to like the space

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agoperl: Limit build to 23 parallel processes
Michael Tremer [Mon, 4 Mar 2019 11:52:34 +0000 (11:52 +0000)]
perl: Limit build to 23 parallel processes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agomake.sh: Introduce MAX_PARALLELISM
Michael Tremer [Mon, 4 Mar 2019 11:51:08 +0000 (11:51 +0000)]
make.sh: Introduce MAX_PARALLELISM

This will now adjust MAKETUNING to not launch more processes
than MAX_PARALLELISM. Handy to limit builds that use a lot of memory.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
3 months agomake.sh: Drop MAKETUNING
Michael Tremer [Mon, 4 Mar 2019 11:45:30 +0000 (11:45 +0000)]
make.sh: Drop MAKETUNING

This is now set in lfs/Config

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>