ipfire-2.x.git
15 months agoupdate disclaimer in LFS files
Peter Müller [Mon, 10 Sep 2018 17:52:21 +0000 (19:52 +0200)] 
update disclaimer in LFS files

Most of these files still used old dates and/or domain names for contact
mail addresses. This is now replaced by an up-to-date copyright line.

Just some housekeeping... :-)

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agocore124: Ship CA certificates
Michael Tremer [Mon, 10 Sep 2018 17:23:27 +0000 (18:23 +0100)] 
core124: Ship CA certificates

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agoupdate ca-certificates CA bundle
Peter Müller [Mon, 10 Sep 2018 16:25:40 +0000 (18:25 +0200)] 
update ca-certificates CA bundle

Update the CA certificates list to what Mozilla NSS ships currently.

The original file can be retrieved from:
https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agouse custom SSH client configuration in LFS file
Peter Müller [Mon, 10 Sep 2018 14:29:09 +0000 (16:29 +0200)] 
use custom SSH client configuration in LFS file

Include OpenSSH client configuration file during build.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agoadd hardened SSH client configuration
Peter Müller [Mon, 10 Sep 2018 14:29:08 +0000 (16:29 +0200)] 
add hardened SSH client configuration

Introduce a custom OpenSSH client configuration file for IPFire.
Some people use it as a jumping host, so applying hardening options
system-wide improves security.

Cryptography setup is the same as for OpenSSH server configuration.

The second version of this patch re-adds some non-AEAD cipher suites
which are needed for connecting to older RHEL systems.

Partially fixes #11751

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agocore124: Ship updated unbound configuration and restart daemon
Michael Tremer [Mon, 10 Sep 2018 15:35:25 +0000 (16:35 +0100)] 
core124: Ship updated unbound configuration and restart daemon

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agoUnbound: Use aggressive NSEC
Peter Müller [Mon, 10 Sep 2018 14:21:26 +0000 (16:21 +0200)] 
Unbound: Use aggressive NSEC

This avoids some needless lookups to destination domains
with a very high NXDOMAIN rate and reduces load on upstream
servers.

See https://nlnetlabs.nl/documentation/unbound/unbound.conf/
for further details.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agoUnbound: Use caps for IDs
Peter Müller [Mon, 10 Sep 2018 14:21:25 +0000 (16:21 +0200)] 
Unbound: Use caps for IDs

Attempt to detect DNS spoofing attacks by inserting 0x20-encoded
random bits into upstream queries. Upstream documentation claims
it to be an experimental implementation, it did not cause any trouble
on productive systems here.

See https://nlnetlabs.nl/documentation/unbound/unbound.conf/ for
further details.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agoUnbound: Enable DNS cache poisoning mitigation
Peter Müller [Mon, 10 Sep 2018 14:21:24 +0000 (16:21 +0200)] 
Unbound: Enable DNS cache poisoning mitigation

By default, Unbound neither keeps track of the number of unwanted
replies nor initiates countermeasures if they become too large (DNS
cache poisoning).

This sets the maximum number of tolerated unwanted replies to
1M, causing the cache to be flushed afterwards. (Upstream documentation
recommends 10M as a threshold, but this turned out to be ineffective
against attacks in the wild.)

See https://nlnetlabs.nl/documentation/unbound/unbound.conf/ for
details. This version of the patch uses 1M as threshold instead of
5M and supersedes the first and second version.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agocore124: Ship updated redirect page template
Michael Tremer [Mon, 10 Sep 2018 15:30:52 +0000 (16:30 +0100)] 
core124: Ship updated redirect page template

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agoembed background image in redirect template
Peter Müller [Mon, 10 Sep 2018 14:15:44 +0000 (16:15 +0200)] 
embed background image in redirect template

Embed the IPFire background image into the redirect template
directly via CSS instead of loading it from somewhere else.
This is necessary because of Content Security Policy (CSP).

This patch inserts the base64 encoded image during build so
nothing needs to be updated twice in case background image
changes.

It supersedes first to fourth version of this patch and has
been successfully tested during a clean build.

Fixes #11650

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agocore124: Rebuild initrd
Michael Tremer [Sun, 9 Sep 2018 17:27:56 +0000 (18:27 +0100)] 
core124: Rebuild initrd

This script was missing in the last update and therefore
no microcodes were included.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agocore124: Apply changed sysctl.conf
Michael Tremer [Sun, 9 Sep 2018 16:48:14 +0000 (17:48 +0100)] 
core124: Apply changed sysctl.conf

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agodo not expose kernel address spaces even to privileged users
Peter Müller [Thu, 16 Aug 2018 15:29:58 +0000 (17:29 +0200)] 
do not expose kernel address spaces even to privileged users

Change this setting from 1 to 2 so kernel addresses are not
displayed even if a user has CAPS_SYSLOG privileges.

See also:
- https://lwn.net/Articles/420403/
- https://tails.boum.org/contribute/design/kernel_hardening/

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agocore124: Ship updated rng-tools
Michael Tremer [Sun, 9 Sep 2018 16:43:53 +0000 (17:43 +0100)] 
core124: Ship updated rng-tools

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agorng-tools: Update to 6.4
Michael Tremer [Sun, 9 Sep 2018 16:42:17 +0000 (17:42 +0100)] 
rng-tools: Update to 6.4

Also add a patch that keeps RDRAND enabled on i586

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Fixes: #11853

15 months agoaws: Don't update the system on first boot
Michael Tremer [Fri, 31 Aug 2018 10:08:53 +0000 (11:08 +0100)] 
aws: Don't update the system on first boot

This will violate AWS policy and therefore had to be removed.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agoMerge branch 'master' into next
Arne Fitzenreiter [Wed, 29 Aug 2018 05:43:06 +0000 (07:43 +0200)] 
Merge branch 'master' into next

15 months agokernel: fix dtb handling core123 v2.21-core123
Arne Fitzenreiter [Tue, 28 Aug 2018 10:39:08 +0000 (12:39 +0200)] 
kernel: fix dtb handling

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
15 months agocore124: Ship latest pakfire changes
Michael Tremer [Mon, 27 Aug 2018 06:34:28 +0000 (07:34 +0100)] 
core124: Ship latest pakfire changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agopakfire: Remove any reference to counter.py
Michael Tremer [Mon, 27 Aug 2018 06:29:19 +0000 (07:29 +0100)] 
pakfire: Remove any reference to counter.py

The concept has been retired a very log time ago
and the web service only responds with 200 what ever
it is being sent.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agopakfire: Remove mirror health check
Michael Tremer [Mon, 27 Aug 2018 06:23:03 +0000 (07:23 +0100)] 
pakfire: Remove mirror health check

This is not really necessary because pakfire will automatically
failover to the next mirror anyways and that a mirror responds
to an ICMP echo request doesn't necessarily mean that it can
deliver the requested file.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agoMerge branch 'core123' of git.ipfire.org:/pub/git/ipfire-2.x into core123
Arne Fitzenreiter [Fri, 24 Aug 2018 18:22:05 +0000 (20:22 +0200)] 
Merge branch 'core123' of git.ipfire.org:/pub/git/ipfire-2.x into core123

15 months agointel-microcode: update to 20180807a
Arne Fitzenreiter [Fri, 24 Aug 2018 18:19:29 +0000 (20:19 +0200)] 
intel-microcode: update to 20180807a

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
15 months agocore124: Ship updated ntp package
Michael Tremer [Fri, 24 Aug 2018 11:25:59 +0000 (12:25 +0100)] 
core124: Ship updated ntp package

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agontp: Update to 4.2.8p12
Matthias Fischer [Thu, 23 Aug 2018 19:07:04 +0000 (21:07 +0200)] 
ntp: Update to 4.2.8p12

For details see:
http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agocore124: Ship updated fwhosts.cgi
Michael Tremer [Fri, 24 Aug 2018 10:45:44 +0000 (11:45 +0100)] 
core124: Ship updated fwhosts.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agoBUG11825: firewall: Renaming a network/host group doesn't update rules
Alexander Marx [Fri, 24 Aug 2018 08:06:30 +0000 (10:06 +0200)] 
BUG11825: firewall: Renaming a network/host group doesn't update rules

Code only changed field 6 of hash (target group) and not field 4 (source group).
Also if using geoip it was only field 4 of hash (source group) and not field 6 of hash (target group)
Added new code that changes both fields to reflect the change in the firewallrules immediately.

fixes: #11825

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agoIPsec: Show connected status for waiting connections that are active
Michael Tremer [Thu, 23 Aug 2018 16:34:50 +0000 (17:34 +0100)] 
IPsec: Show connected status for waiting connections that are active

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agosetup: Don't write any mount errors over the GUI
Michael Tremer [Thu, 23 Aug 2018 10:17:23 +0000 (11:17 +0100)] 
setup: Don't write any mount errors over the GUI

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agolocalnet: Set FQDN without using domainname command
Michael Tremer [Wed, 22 Aug 2018 12:36:23 +0000 (13:36 +0100)] 
localnet: Set FQDN without using domainname command

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agocore124: Ship updated firewall.cgi
Michael Tremer [Wed, 22 Aug 2018 13:46:53 +0000 (14:46 +0100)] 
core124: Ship updated firewall.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agoBUG11805: Firewall rule with source orange and target firewall-interface-orange not...
Alexander Marx [Wed, 22 Aug 2018 09:23:16 +0000 (11:23 +0200)] 
BUG11805: Firewall rule with source orange and target firewall-interface-orange not possible

Now its possible to create a rule with orange source and target orange interface of the firewall.

Fixes: #11805

Signed-off-by: Alexander Marx <alexander.marx@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agocore124: Fix typo in rootfile
Michael Tremer [Wed, 22 Aug 2018 13:17:15 +0000 (14:17 +0100)] 
core124: Fix typo in rootfile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agocore124: Ship updated AWS setup scripts
Michael Tremer [Wed, 22 Aug 2018 13:06:53 +0000 (14:06 +0100)] 
core124: Ship updated AWS setup scripts

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agoDrop the network-trigger script
Michael Tremer [Wed, 22 Aug 2018 13:05:43 +0000 (14:05 +0100)] 
Drop the network-trigger script

This is done at boot time and doesn't normally need to be done again.

On AWS or in the setup, renaming any network interfaces is being
handled automatically.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agofirstsetup: There is no need to restart udev here
Michael Tremer [Wed, 22 Aug 2018 13:02:43 +0000 (14:02 +0100)] 
firstsetup: There is no need to restart udev here

All network interfaces are renamed accordingly in setup

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agoaws: Let udev rename all network interfaces
Michael Tremer [Wed, 22 Aug 2018 13:00:39 +0000 (14:00 +0100)] 
aws: Let udev rename all network interfaces

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agonano: Update to 2.9.8
Matthias Fischer [Tue, 21 Aug 2018 16:27:02 +0000 (18:27 +0200)] 
nano: Update to 2.9.8

For details see:
https://www.nano-editor.org/news.php

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agocore124: Ship updated backup include/exclude files
Michael Tremer [Tue, 21 Aug 2018 14:06:22 +0000 (15:06 +0100)] 
core124: Ship updated backup include/exclude files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agobackup: Add root's SSH keys and settings
Michael Tremer [Tue, 21 Aug 2018 14:05:40 +0000 (15:05 +0100)] 
backup: Add root's SSH keys and settings

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agobackup: Add custom squid configuration files
Michael Tremer [Tue, 21 Aug 2018 14:05:13 +0000 (15:05 +0100)] 
backup: Add custom squid configuration files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agobackup: Order incldue/exclude alphabetically
Michael Tremer [Tue, 21 Aug 2018 10:32:04 +0000 (11:32 +0100)] 
backup: Order incldue/exclude alphabetically

Nothing has been added or removed

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agogcc: x86_64 add libspp to rootfile
Arne Fitzenreiter [Mon, 20 Aug 2018 14:22:20 +0000 (16:22 +0200)] 
gcc: x86_64 add libspp to rootfile

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
15 months agocore123: ship libssp (was missing on x86_64)
Arne Fitzenreiter [Mon, 20 Aug 2018 14:23:49 +0000 (16:23 +0200)] 
core123: ship libssp (was missing on x86_64)

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
15 months agogcc: x86_64 add libspp to rootfile
Arne Fitzenreiter [Mon, 20 Aug 2018 14:22:20 +0000 (16:22 +0200)] 
gcc: x86_64 add libspp to rootfile

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
15 months agocore123: ship xtables-addons.
Arne Fitzenreiter [Fri, 17 Aug 2018 18:30:17 +0000 (20:30 +0200)] 
core123: ship xtables-addons.

xtables are build for installed iptables version so we need
to ship it even if it was not updated.
Also clean /lib/xtables because some modules are renamed.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
15 months agocore123: ship openssl sse2 version on i586
Arne Fitzenreiter [Fri, 17 Aug 2018 05:06:45 +0000 (07:06 +0200)] 
core123: ship openssl sse2 version on i586

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
15 months agobind: Update to 9.11.4-P1
Matthias Fischer [Thu, 16 Aug 2018 18:56:03 +0000 (20:56 +0200)] 
bind: Update to 9.11.4-P1

Fixes CVE-2018-5740 and CVE-2018-5738.

For details see:
http://ftp.isc.org/isc/bind9/9.11.4-P1/RELEASE-NOTES-bind-9.11.4-P1.html

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agocore124: Ship updated pciutils
Michael Tremer [Thu, 16 Aug 2018 17:55:49 +0000 (18:55 +0100)] 
core124: Ship updated pciutils

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agopciutils: update to 3.5.6
Peter Müller [Thu, 16 Aug 2018 15:10:58 +0000 (17:10 +0200)] 
pciutils: update to 3.5.6

The third version of this patch superseds the first and
second one which were broken due to bugs in the MUAs GPG
implementation.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agocore124: Ship updated ids.cgi
Michael Tremer [Thu, 16 Aug 2018 17:54:41 +0000 (18:54 +0100)] 
core124: Ship updated ids.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agodownload ET IDS rules via HTTPS
Peter Müller [Thu, 16 Aug 2018 15:09:41 +0000 (17:09 +0200)] 
download ET IDS rules via HTTPS

The Emerging Threats ruleset server supports HTTPS. It should
be used for downloading the ruleset in IPFire, too.

This also needs to be applied on the upcoming ids.cgi file for Suricata
which I will do in a second patch.

The third version of this patch superseds the first and
second one which were broken due to bugs in the MUAs GPG
implementation.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agoPostfix: update to 3.3.1
Peter Müller [Thu, 16 Aug 2018 15:08:04 +0000 (17:08 +0200)] 
Postfix: update to 3.3.1

This updates Postfix to recent 3.3.x series, which contains
some new features. Release announcement available at
http://www.postfix.org/announcements/postfix-3.3.1.html

The third version of this patch superseds the first and
second one which were broken due to bugs in the MUAs GPG
implementation.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agocore124: Ship updated bind
Michael Tremer [Thu, 16 Aug 2018 12:05:47 +0000 (13:05 +0100)] 
core124: Ship updated bind

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agobind: Update to 9.11.4
Matthias Fischer [Sun, 22 Jul 2018 15:11:53 +0000 (17:11 +0200)] 
bind: Update to 9.11.4

For details see:
http://ftp.isc.org/isc/bind9/9.11.4/RELEASE-NOTES-bind-9.11.4.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agocore124: Don't re-generate the initrd
Michael Tremer [Thu, 16 Aug 2018 12:02:56 +0000 (13:02 +0100)] 
core124: Don't re-generate the initrd

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agocore124: Re-install bootloader during update
Michael Tremer [Thu, 16 Aug 2018 12:02:37 +0000 (13:02 +0100)] 
core124: Re-install bootloader during update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agocore124: Ship EFI changes
Michael Tremer [Thu, 16 Aug 2018 12:01:01 +0000 (13:01 +0100)] 
core124: Ship EFI changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agoMerge remote-tracking branch 'origin/efi' into next
Michael Tremer [Thu, 16 Aug 2018 11:49:13 +0000 (12:49 +0100)] 
Merge remote-tracking branch 'origin/efi' into next

15 months agocore124: Ship update localnet init script
Michael Tremer [Thu, 16 Aug 2018 11:47:55 +0000 (12:47 +0100)] 
core124: Ship update localnet init script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agoStart Core Update 124
Michael Tremer [Thu, 16 Aug 2018 11:47:06 +0000 (12:47 +0100)] 
Start Core Update 124

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agolocalnet: Properly format and quote variables
Michael Tremer [Thu, 16 Aug 2018 11:42:25 +0000 (12:42 +0100)] 
localnet: Properly format and quote variables

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agolocalnet: Correctly set domain name
Michael Tremer [Thu, 16 Aug 2018 11:41:52 +0000 (12:41 +0100)] 
localnet: Correctly set domain name

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agocore123: ship updated unbound initskript
Arne Fitzenreiter [Wed, 15 Aug 2018 11:30:07 +0000 (13:30 +0200)] 
core123: ship updated unbound initskript

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
15 months agoaws: Hide pakfire update output
Michael Tremer [Wed, 15 Aug 2018 10:50:14 +0000 (11:50 +0100)] 
aws: Hide pakfire update output

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agoaws: Write user-data log to file only
Michael Tremer [Wed, 15 Aug 2018 10:49:30 +0000 (11:49 +0100)] 
aws: Write user-data log to file only

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agoaws: Execute reboot when an update requires one
Michael Tremer [Wed, 15 Aug 2018 10:45:27 +0000 (11:45 +0100)] 
aws: Execute reboot when an update requires one

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agoFix typo in unbound initscript
Michael Tremer [Wed, 15 Aug 2018 10:25:38 +0000 (11:25 +0100)] 
Fix typo in unbound initscript

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agoaws: Set PATH to search in /usr/local/(s)bin
Michael Tremer [Wed, 15 Aug 2018 10:11:56 +0000 (11:11 +0100)] 
aws: Set PATH to search in /usr/local/(s)bin

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agoaws: Import pakfire keys before the first launch
Michael Tremer [Wed, 15 Aug 2018 10:10:59 +0000 (11:10 +0100)] 
aws: Import pakfire keys before the first launch

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agoaws: Log output of user-data script to /root/user-data.log
Michael Tremer [Wed, 15 Aug 2018 10:09:55 +0000 (11:09 +0100)] 
aws: Log output of user-data script to /root/user-data.log

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agocore123: ship updated logs.cgi/ids.dat
Arne Fitzenreiter [Wed, 15 Aug 2018 10:19:29 +0000 (12:19 +0200)] 
core123: ship updated logs.cgi/ids.dat

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
15 months agoaws: Install all available updates first
Michael Tremer [Wed, 15 Aug 2018 09:11:08 +0000 (10:11 +0100)] 
aws: Install all available updates first

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agoaws: Setup DNS during init phase
Michael Tremer [Wed, 15 Aug 2018 09:10:13 +0000 (10:10 +0100)] 
aws: Setup DNS during init phase

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agocore123: set pakfire version
Arne Fitzenreiter [Wed, 15 Aug 2018 05:30:53 +0000 (07:30 +0200)] 
core123: set pakfire version

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
15 months agocore123: Ship updated backup.pl
Michael Tremer [Tue, 14 Aug 2018 19:39:17 +0000 (20:39 +0100)] 
core123: Ship updated backup.pl

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agoFixes for 'backup.pl' (Bug #11816)
Matthias Fischer [Tue, 14 Aug 2018 19:34:38 +0000 (21:34 +0200)] 
Fixes for 'backup.pl' (Bug #11816)

Hi,

Fixes #11816
(https://bugzilla.ipfire.org/show_bug.cgi?id=11816 and
https://bugzilla.ipfire.org/attachment.cgi?id=608):

"[root@ipfire ~]# backupctrl exclude
...
tar: The following options were used after any non-optional arguments in
archive create or update mode.  These options are positional and affect
only arguments that follow them.  Please, rearrange them properly.
tar: --exclude-from '/var/ipfire/backup/exclude.user' has no effect
tar: Exiting with failure status due to previous errors"

Please test - I got no errors anymore.

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agocore123: Ship openssl-compat, too
Michael Tremer [Tue, 14 Aug 2018 19:37:54 +0000 (20:37 +0100)] 
core123: Ship openssl-compat, too

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agocore123: Ship updated openssl
Arne Fitzenreiter [Tue, 14 Aug 2018 18:29:03 +0000 (20:29 +0200)] 
core123: Ship updated openssl

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
15 months agoMerge remote-tracking branch 'ms/aws-cli' into next
Michael Tremer [Tue, 14 Aug 2018 18:14:58 +0000 (19:14 +0100)] 
Merge remote-tracking branch 'ms/aws-cli' into next

15 months agoopenssl: Update to 1.1.0i and 1.0.2p
Michael Tremer [Tue, 14 Aug 2018 18:12:53 +0000 (19:12 +0100)] 
openssl: Update to 1.1.0i and 1.0.2p

 Changes between 1.1.0h and 1.1.0i [14 Aug 2018]

  *) Client DoS due to large DH parameter

     During key agreement in a TLS handshake using a DH(E) based ciphersuite a
     malicious server can send a very large prime value to the client. This will
     cause the client to spend an unreasonably long period of time generating a
     key for this prime resulting in a hang until the client has finished. This
     could be exploited in a Denial Of Service attack.

     This issue was reported to OpenSSL on 5th June 2018 by Guido Vranken
     (CVE-2018-0732)
     [Guido Vranken]

  *) Cache timing vulnerability in RSA Key Generation

     The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to
     a cache timing side channel attack. An attacker with sufficient access to
     mount cache timing attacks during the RSA key generation process could
     recover the private key.

     This issue was reported to OpenSSL on 4th April 2018 by Alejandro Cabrera
     Aldaya, Billy Brumley, Cesar Pereida Garcia and Luis Manuel Alvarez Tapia.
     (CVE-2018-0737)
     [Billy Brumley]

  *) Make EVP_PKEY_asn1_new() a bit stricter about its input.  A NULL pem_str
     parameter is no longer accepted, as it leads to a corrupt table.  NULL
     pem_str is reserved for alias entries only.
     [Richard Levitte]

  *) Revert blinding in ECDSA sign and instead make problematic addition
     length-invariant. Switch even to fixed-length Montgomery multiplication.
     [Andy Polyakov]

  *) Change generating and checking of primes so that the error rate of not
     being prime depends on the intended use based on the size of the input.
     For larger primes this will result in more rounds of Miller-Rabin.
     The maximal error rate for primes with more than 1080 bits is lowered
     to 2^-128.
     [Kurt Roeckx, Annie Yousar]

  *) Increase the number of Miller-Rabin rounds for DSA key generating to 64.
     [Kurt Roeckx]

  *) Add blinding to ECDSA and DSA signatures to protect against side channel
     attacks discovered by Keegan Ryan (NCC Group).
     [Matt Caswell]

  *) When unlocking a pass phrase protected PEM file or PKCS#8 container, we
     now allow empty (zero character) pass phrases.
     [Richard Levitte]

  *) Certificate time validation (X509_cmp_time) enforces stricter
     compliance with RFC 5280. Fractional seconds and timezone offsets
     are no longer allowed.
     [Emilia Käsper]

  *) Fixed a text canonicalisation bug in CMS

     Where a CMS detached signature is used with text content the text goes
     through a canonicalisation process first prior to signing or verifying a
     signature. This process strips trailing space at the end of lines, converts
     line terminators to CRLF and removes additional trailing line terminators
     at the end of a file. A bug in the canonicalisation process meant that
     some characters, such as form-feed, were incorrectly treated as whitespace
     and removed. This is contrary to the specification (RFC5485). This fix
     could mean that detached text data signed with an earlier version of
     OpenSSL 1.1.0 may fail to verify using the fixed version, or text data
     signed with a fixed OpenSSL may fail to verify with an earlier version of
     OpenSSL 1.1.0. A workaround is to only verify the canonicalised text data
     and use the "-binary" flag (for the "cms" command line application) or set
     the SMIME_BINARY/PKCS7_BINARY/CMS_BINARY flags (if using CMS_verify()).
     [Matt Caswell]

 Changes between 1.0.2o and 1.0.2p [14 Aug 2018]

  *) Client DoS due to large DH parameter

     During key agreement in a TLS handshake using a DH(E) based ciphersuite a
     malicious server can send a very large prime value to the client. This will
     cause the client to spend an unreasonably long period of time generating a
     key for this prime resulting in a hang until the client has finished. This
     could be exploited in a Denial Of Service attack.

     This issue was reported to OpenSSL on 5th June 2018 by Guido Vranken
     (CVE-2018-0732)
     [Guido Vranken]

  *) Cache timing vulnerability in RSA Key Generation

     The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to
     a cache timing side channel attack. An attacker with sufficient access to
     mount cache timing attacks during the RSA key generation process could
     recover the private key.

     This issue was reported to OpenSSL on 4th April 2018 by Alejandro Cabrera
     Aldaya, Billy Brumley, Cesar Pereida Garcia and Luis Manuel Alvarez Tapia.
     (CVE-2018-0737)
     [Billy Brumley]

  *) Make EVP_PKEY_asn1_new() a bit stricter about its input.  A NULL pem_str
     parameter is no longer accepted, as it leads to a corrupt table.  NULL
     pem_str is reserved for alias entries only.
     [Richard Levitte]

  *) Revert blinding in ECDSA sign and instead make problematic addition
     length-invariant. Switch even to fixed-length Montgomery multiplication.
     [Andy Polyakov]

  *) Change generating and checking of primes so that the error rate of not
     being prime depends on the intended use based on the size of the input.
     For larger primes this will result in more rounds of Miller-Rabin.
     The maximal error rate for primes with more than 1080 bits is lowered
     to 2^-128.
     [Kurt Roeckx, Annie Yousar]

  *) Increase the number of Miller-Rabin rounds for DSA key generating to 64.
     [Kurt Roeckx]

  *) Add blinding to ECDSA and DSA signatures to protect against side channel
     attacks discovered by Keegan Ryan (NCC Group).
     [Matt Caswell]

  *) When unlocking a pass phrase protected PEM file or PKCS#8 container, we
     now allow empty (zero character) pass phrases.
     [Richard Levitte]

  *) Certificate time validation (X509_cmp_time) enforces stricter
     compliance with RFC 5280. Fractional seconds and timezone offsets
     are no longer allowed.
     [Emilia Käsper]

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agopython3-s3transfer: Fix rootfile
Michael Tremer [Tue, 14 Aug 2018 14:13:24 +0000 (15:13 +0100)] 
python3-s3transfer: Fix rootfile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agopython3-pyasn1: New package as required by aws-cli
Michael Tremer [Tue, 14 Aug 2018 13:52:33 +0000 (14:52 +0100)] 
python3-pyasn1: New package as required by aws-cli

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agopython3-rsa: New package as required by aws-cli
Michael Tremer [Tue, 14 Aug 2018 13:44:30 +0000 (14:44 +0100)] 
python3-rsa: New package as required by aws-cli

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agopython3-s3transfer: New package as required by aws-cli
Michael Tremer [Tue, 14 Aug 2018 13:38:11 +0000 (14:38 +0100)] 
python3-s3transfer: New package as required by aws-cli

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agopython3-yaml: New paclage as required by aws-cli
Michael Tremer [Tue, 14 Aug 2018 13:19:33 +0000 (14:19 +0100)] 
python3-yaml: New paclage as required by aws-cli

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agopython3-docutils: New package as required by aws-cli
Michael Tremer [Tue, 14 Aug 2018 13:11:38 +0000 (14:11 +0100)] 
python3-docutils: New package as required by aws-cli

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agopython3-colorama: New package as required by aws-cli
Michael Tremer [Tue, 14 Aug 2018 13:04:03 +0000 (14:04 +0100)] 
python3-colorama: New package as required by aws-cli

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agopython3-jmespath: New package as required by python3-botocore
Michael Tremer [Tue, 14 Aug 2018 12:57:02 +0000 (13:57 +0100)] 
python3-jmespath: New package as required by python3-botocore

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agopython3-six: New package as required by python3-dateutil
Michael Tremer [Tue, 14 Aug 2018 12:18:00 +0000 (13:18 +0100)] 
python3-six: New package as required by python3-dateutil

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agopython3-dateutil: New package required by python3-botocore
Michael Tremer [Tue, 14 Aug 2018 12:13:07 +0000 (13:13 +0100)] 
python3-dateutil: New package required by python3-botocore

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agopython3-botocore: Required by aws-cli
Michael Tremer [Tue, 14 Aug 2018 11:54:23 +0000 (12:54 +0100)] 
python3-botocore: Required by aws-cli

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agoaws-cli: New package
Michael Tremer [Tue, 14 Aug 2018 11:45:38 +0000 (12:45 +0100)] 
aws-cli: New package

Needed to communicate with AWS services like EC2, S3, etc...

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agologs.cgi/ids.dat: Rework linking to external rule documentation.
Stefan Schantl [Tue, 14 Aug 2018 10:01:53 +0000 (12:01 +0200)] 
logs.cgi/ids.dat: Rework linking to external rule documentation.

Check if the sid of a rule belongs to sourcefire and link to the
changed URL for gathering more details. If the sid of the rule belongs
to emergingthreads now link to the emergingthreads documentation.

Fixes #11806.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
15 months agoRootfile update
Michael Tremer [Tue, 14 Aug 2018 07:36:19 +0000 (08:36 +0100)] 
Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agoRevert "usbutils: update to 010"
Michael Tremer [Mon, 13 Aug 2018 18:50:06 +0000 (19:50 +0100)] 
Revert "usbutils: update to 010"

This reverts commit b07b1bef22eae7038e7d0fcba0bfd53813f85258.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agoRevert "core123: Ship updated usbutils"
Michael Tremer [Mon, 13 Aug 2018 18:49:58 +0000 (19:49 +0100)] 
Revert "core123: Ship updated usbutils"

This reverts commit a65d07ec6d36a712882294b608e718db2d56b24e.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agoRevert "usbutils: Update rootfile"
Michael Tremer [Mon, 13 Aug 2018 18:49:48 +0000 (19:49 +0100)] 
Revert "usbutils: Update rootfile"

This reverts commit 9aefd1ed07eee7d83e5b274d4a83240811f9e091.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
16 months agoRevert "avahi: Build without dbus"
Michael Tremer [Mon, 13 Aug 2018 17:59:10 +0000 (18:59 +0100)] 
Revert "avahi: Build without dbus"

This reverts commit 5221a852e80526d188306b05202e595616f0c065.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>