ipfire-2.x.git
23 months agomake.sh: Add ids-ruleset-source
Stefan Schantl [Thu, 2 Aug 2018 17:58:41 +0000 (19:58 +0200)] 
make.sh: Add ids-ruleset-source

I accidently forgot to commit this file in 1d9b87914053e54550c6f2a76377a8001bbf1da6

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agosuricata: Introduce basic initscript
Stefan Schantl [Thu, 2 Aug 2018 17:54:22 +0000 (19:54 +0200)] 
suricata: Introduce basic initscript

Add a very basic initscript, which currently allows to start/stop/restart suricata and
check if the daemon is running.

The script will detect when starting suricata how many CPU cores are present on the system and
will launch suricata in inline mode (NFQUEUE) and listen to as much queues as CPU cores are
detected.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids-ruleset-sources: Update download URL for snort rules
Stefan Schantl [Thu, 2 Aug 2018 17:33:37 +0000 (19:33 +0200)] 
ids-ruleset-sources: Update download URL for snort rules

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids-functions.pl: Rename ruleset-sources.list to ruleset-sources
Stefan Schantl [Thu, 2 Aug 2018 17:31:52 +0000 (19:31 +0200)] 
ids-functions.pl: Rename ruleset-sources.list to ruleset-sources

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids-ruleset-sources: New package
Stefan Schantl [Thu, 2 Aug 2018 17:29:36 +0000 (19:29 +0200)] 
ids-ruleset-sources: New package

Move the file which contains the download URL's for the IDS rulesets
into an own common package. This will allow us in future to easily ship
a changed file with a core update.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoconfigroot: Move from snort to suricata
Stefan Schantl [Thu, 2 Aug 2018 13:47:31 +0000 (15:47 +0200)] 
configroot: Move from snort to suricata

Create /var/ipfire/suricata and /var/ipfire/suricata/settings instead of
/var/ipfire/snort and /var/ipfire/snort/settings.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agosuricata: Install very basic config file
Stefan Schantl [Thu, 2 Aug 2018 07:10:25 +0000 (09:10 +0200)] 
suricata: Install very basic config file

This config file is mostly based on the example configuration shipped
by the suricata project and needs to be enhanched.

See #11808.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Generate suricata compatiple used-rulefiles file
Stefan Schantl [Thu, 2 Aug 2018 07:07:12 +0000 (09:07 +0200)] 
ids.cgi: Generate suricata compatiple used-rulefiles file

 * Rename filename to suricata-used-rulefiles.yaml
 * Adjust file generation as a yaml file to be compatible with suricata
 * Adjust code to correctly read-in and parse the changed file

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids-functions.pl: Move path details from snort to suricata
Stefan Schantl [Mon, 30 Jul 2018 19:36:07 +0000 (21:36 +0200)] 
ids-functions.pl: Move path details from snort to suricata

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoMerge branch 'next-new-ids.cgi' into next-suricata-and-cgi
Stefan Schantl [Mon, 30 Jul 2018 19:33:25 +0000 (21:33 +0200)] 
Merge branch 'next-new-ids.cgi' into next-suricata-and-cgi

23 months agosuricata: New package
Stefan Schantl [Mon, 23 Jul 2018 18:21:38 +0000 (20:21 +0200)] 
suricata: New package

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agolibhtp: New package
Stefan Schantl [Mon, 23 Jul 2018 18:20:29 +0000 (20:20 +0200)] 
libhtp: New package

This is build and runtime dependency for suricata.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoyaml: New package
Stefan Schantl [Mon, 23 Jul 2018 18:19:19 +0000 (20:19 +0200)] 
yaml: New package

This is a build and runtime dependency for suricata.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoIDS: Rework error and log handling in ids-functions.pl
Stefan Schantl [Sat, 28 Jul 2018 14:34:50 +0000 (16:34 +0200)] 
IDS: Rework error and log handling in ids-functions.pl

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoIDS: Introduce settingsdir variable
Stefan Schantl [Fri, 27 Jul 2018 05:58:23 +0000 (07:58 +0200)] 
IDS: Introduce settingsdir variable

The $settingsdir variable is declared in the ids-functions.pl and used to to
store the path where the various files which contains the settings for the IDS and
oinkmaster is located.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoIDS: Move rulepath declaration to ids-functions.pl
Stefan Schantl [Thu, 26 Jul 2018 13:56:47 +0000 (15:56 +0200)] 
IDS: Move rulepath declaration to ids-functions.pl

This will help if the path ever changed. Also remove hard coded rulepath
from oinkmaster call.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Rename snortrules hash to idsrules.
Stefan Schantl [Thu, 26 Jul 2018 13:51:15 +0000 (15:51 +0200)] 
ids.cgi: Rename snortrules hash to idsrules.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Drop code which is detecting if oinkmaster is running
Stefan Schantl [Wed, 14 Feb 2018 13:08:29 +0000 (14:08 +0100)] 
ids.cgi: Drop code which is detecting if oinkmaster is running

This code is not longer required and therefore can be dropped.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Reimplement function to lock page and show working notice
Stefan Schantl [Wed, 14 Feb 2018 13:03:08 +0000 (14:03 +0100)] 
ids.cgi: Reimplement function to lock page and show working notice

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids-functions.pl: Also log errors to syslog
Stefan Schantl [Wed, 14 Feb 2018 13:01:50 +0000 (14:01 +0100)] 
ids-functions.pl: Also log errors to syslog

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids-functions.pl: Use pure perl to log oinkmaster result to syslog
Stefan Schantl [Wed, 14 Feb 2018 13:00:57 +0000 (14:00 +0100)] 
ids-functions.pl: Use pure perl to log oinkmaster result to syslog

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids-functions.pl: Make variables globally accessible
Stefan Schantl [Wed, 14 Feb 2018 11:14:06 +0000 (12:14 +0100)] 
ids-functions.pl: Make variables globally accessible

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Rework CGI logic to download a new ruleset
Stefan Schantl [Wed, 14 Feb 2018 09:20:23 +0000 (10:20 +0100)] 
ids.cgi: Rework CGI logic to download a new ruleset

* Drop function to show a notice about snort is working.
* Introduce the log_error function which is responsible for log any
  error messages. Currently it writes it to a tempory file, which will
  be read by the WUI, the message will be displayed and the temporary file
  will be released again.
* Introduce a tiny function to easily perform a reload of the generated
  webpage.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Use tarball information from ids-functions.pl
Stefan Schantl [Wed, 14 Feb 2018 09:15:39 +0000 (10:15 +0100)] 
ids.cgi: Use tarball information from ids-functions.pl

Directly use the value from the ids-functions.pl for the
location and filename of the tarball which includes the snort ruleset.

This will save to declare this information twice and prevents from any
failures if the location of filname every changes.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Drop dirty hook for updating the ruleset
Stefan Schantl [Wed, 14 Feb 2018 08:00:03 +0000 (09:00 +0100)] 
ids.cgi: Drop dirty hook for updating the ruleset

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Move function to call oinkmaster to ids-functions.pl
Stefan Schantl [Wed, 14 Feb 2018 07:58:18 +0000 (08:58 +0100)] 
ids.cgi: Move function to call oinkmaster to ids-functions.pl

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Move downloader code to ids-functions.pl
Stefan Schantl [Wed, 14 Feb 2018 07:52:21 +0000 (08:52 +0100)] 
ids.cgi: Move downloader code to ids-functions.pl

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Use ids-functions.pl for checking available discspace
Stefan Schantl [Wed, 14 Feb 2018 07:20:50 +0000 (08:20 +0100)] 
ids.cgi: Use ids-functions.pl for checking available discspace

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoIDS: Introduce ids-functions.pl.
Stefan Schantl [Wed, 14 Feb 2018 07:18:15 +0000 (08:18 +0100)] 
IDS: Introduce ids-functions.pl.

This library will contain a set of functions used by the IDS CGI script
and the planned update script for auto-updating the snort ruleset.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Drop loading of File::Copy module.
Stefan Schantl [Mon, 12 Feb 2018 14:38:25 +0000 (15:38 +0100)] 
ids.cgi: Drop loading of File::Copy module.

This is not required, at any time by the script.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agologs.cgi/log.dat: Add support for oinkmaster
Stefan Schantl [Tue, 19 Dec 2017 10:57:19 +0000 (11:57 +0100)] 
logs.cgi/log.dat: Add support for oinkmaster

This will allow to display the logged output of oinkmaster
via the webinterface.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Rework snort configuration area
Stefan Schantl [Tue, 19 Dec 2017 10:56:04 +0000 (11:56 +0100)] 
ids.cgi: Rework snort configuration area

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Pipe the oinkmaster output to the logger binary
Stefan Schantl [Sun, 17 Dec 2017 18:10:21 +0000 (19:10 +0100)] 
ids.cgi: Pipe the oinkmaster output to the logger binary

This will allow anybody, to access the log of oinkmaster and
get detailed information about any changes which have been done
on the ruleset.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Rework downloader for rulesets
Stefan Schantl [Sun, 17 Dec 2017 18:08:25 +0000 (19:08 +0100)] 
ids.cgi: Rework downloader for rulesets

Doing the rules download in pure perl instead of using
the external wget.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Drop old control code
Stefan Schantl [Thu, 14 Dec 2017 07:31:41 +0000 (08:31 +0100)] 
ids.cgi: Drop old control code

The control file are not longer required, because the
initscript uses the settings file to determine if snort
should be started and binded to which interfaches.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agosnort: Introduce ruleset-sources.list
Stefan Schantl [Wed, 13 Dec 2017 14:06:42 +0000 (15:06 +0100)] 
snort: Introduce ruleset-sources.list

This file contains the ruleset vendors and download urls and
will be used by the ids.cgi.

If an url or filename changes, we easily can adjust this file. In most
cases this will be needed when performing a snort update.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agogeneral-functions.pl: readhash() Add code to handle optional comments in files
Stefan Schantl [Wed, 13 Dec 2017 13:53:51 +0000 (14:53 +0100)] 
general-functions.pl: readhash() Add code to handle optional comments in files

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Call oinkmaster without a log target
Stefan Schantl [Wed, 13 Dec 2017 13:50:12 +0000 (14:50 +0100)] 
ids.cgi: Call oinkmaster without a log target

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Introduce ruleset-source.list
Stefan Schantl [Wed, 13 Dec 2017 13:45:27 +0000 (14:45 +0100)] 
ids.cgi: Introduce ruleset-source.list

This new file will contain the vendor information and url
for downloading their ruleset. In future if the download location
or filename changes, we only need to adjust this one file and ship
it via a core update.

Also extend the downloadrulesfile to be able to directly call the
subfunction.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Adjust code for saving snort settings
Stefan Schantl [Wed, 13 Dec 2017 13:40:47 +0000 (14:40 +0100)] 
ids.cgi: Adjust code for saving snort settings

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Remove logfile after wget has successfully downloaded the ruleset
Stefan Schantl [Wed, 13 Dec 2017 10:53:44 +0000 (11:53 +0100)] 
ids.cgi: Remove logfile after wget has successfully downloaded the ruleset

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Rework code which shows if oinkmaster is working
Stefan Schantl [Wed, 13 Dec 2017 10:51:08 +0000 (11:51 +0100)] 
ids.cgi: Rework code which shows if oinkmaster is working

Move the code for displaying a notice that snort currently is working
into an own subfunction which will be called if oinkmaster currently
is started.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Drop old code for debuging purposes
Stefan Schantl [Wed, 13 Dec 2017 10:50:01 +0000 (11:50 +0100)] 
ids.cgi: Drop old code for debuging purposes

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Add check when altering the ruleset
Stefan Schantl [Wed, 13 Dec 2017 10:46:40 +0000 (11:46 +0100)] 
ids.cgi: Add check when altering the ruleset

Add a check if the currently processing sid is nummeric, otherwise skip it.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Rework code for downloading/updating the ruleset
Stefan Schantl [Tue, 12 Dec 2017 19:24:50 +0000 (20:24 +0100)] 
ids.cgi: Rework code for downloading/updating the ruleset

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Move call of oinkmaster to an own subfunction
Stefan Schantl [Tue, 12 Dec 2017 19:24:11 +0000 (20:24 +0100)] 
ids.cgi: Move call of oinkmaster to an own subfunction

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Always write config files for enabled/disabled rule files
Stefan Schantl [Tue, 12 Dec 2017 19:16:26 +0000 (20:16 +0100)] 
ids.cgi: Always write config files for enabled/disabled rule files

If a single sid has been activated and then disabled without doing
any other ruleset modifications only one of the oinkmaster files
for enabled / disabled rules has been modified.

In this case it was possible, that the same sid, was part of the
file for enabled rules and part of the file for disabled rules at the
same time.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Process enabled rulefiles in an own loop
Stefan Schantl [Tue, 12 Dec 2017 19:15:00 +0000 (20:15 +0100)] 
ids.cgi: Process enabled rulefiles in an own loop

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Drop enabled/disabled rules from cgiparams hash
Stefan Schantl [Tue, 12 Dec 2017 19:12:38 +0000 (20:12 +0100)] 
ids.cgi: Drop enabled/disabled rules from cgiparams hash

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Drop enabled rulefile from cgiparams hash after processing
Stefan Schantl [Tue, 12 Dec 2017 19:10:17 +0000 (20:10 +0100)] 
ids.cgi: Drop enabled rulefile from cgiparams hash after processing

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Re-add code for enable/disable rulefiles
Stefan Schantl [Mon, 11 Dec 2017 13:22:07 +0000 (14:22 +0100)] 
ids.cgi: Re-add code for enable/disable rulefiles

The enabled rulefiles (rule categories) now will be added
to an own file, which will be included by the snort main config
file.

This will allow us to update snort and push the new main config file
without loosing the activated rulesets anymore.

* Introducing snort-used-rulefiles.conf

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Code cleanup
Stefan Schantl [Mon, 11 Dec 2017 07:46:18 +0000 (08:46 +0100)] 
ids.cgi: Code cleanup

* Drop a lot of unused variables and code.
* Re-ordering some code parts.
* Add a lot of comments.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Re-add code to save the ruleset.
Stefan Schantl [Mon, 11 Dec 2017 07:33:36 +0000 (08:33 +0100)] 
ids.cgi: Re-add code to save the ruleset.

The manually enabled or disabled rules by the user now will be written
to own config files, which will be used by oinkmaster to keep these rules
in the same state after a rules update has been performed.

In short words, if you adjust your ruleset, the changes will not be lost
again if you perform an update of your ruleset.

* Grabbing and storing the cgi values now in an own hash (%cgiparams)
* Introducing oinkmaster config files for enabled and disabled rules.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Drop unused css code
Stefan Schantl [Sun, 10 Dec 2017 09:36:07 +0000 (10:36 +0100)] 
ids.cgi: Drop unused css code

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Rework code for displaying the single rules
Stefan Schantl [Sun, 10 Dec 2017 09:07:41 +0000 (10:07 +0100)] 
ids.cgi: Rework code for displaying the single rules

The complete ruleset will be grouped as categories by it's
corresponding rulefile and printed in hidden tables.

They easiely can be displayed by klicking on the show link and
vice-versa.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Always display ruleset
Stefan Schantl [Wed, 6 Dec 2017 10:44:30 +0000 (11:44 +0100)] 
ids.cgi: Always display ruleset

Display the rule categories any time and do not hide them
if no instance of snort is runing.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Remove comment lines for snort rules control
Stefan Schantl [Wed, 6 Dec 2017 10:19:42 +0000 (11:19 +0100)] 
ids.cgi: Remove comment lines for snort rules control

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Refactor reading-in rule files.
Stefan Schantl [Wed, 6 Dec 2017 08:51:46 +0000 (09:51 +0100)] 
ids.cgi: Refactor reading-in rule files.

Move the code for reading and parsing the snort rule files
into an own subfunction.

* Drop code for reading in and modifying the snort main config file.
* Rework code for parsing and adding the snort rules to the snortrules hash.
* Drop code for gathering a description for the rule files, which does not
  because of a file layout change and sadly there is not suitable description
  shipped anymore by the snort team.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Move function to end of file
Stefan Schantl [Sat, 2 Dec 2017 14:31:19 +0000 (15:31 +0100)] 
ids.cgi: Move function to end of file

Move the function for doing the page refresh stuff to the end of the file and
do some layout changes for better reading the code.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Use pure perl for directory listing
Stefan Schantl [Sat, 2 Dec 2017 14:24:12 +0000 (15:24 +0100)] 
ids.cgi: Use pure perl for directory listing

Use pure perl for getting the filelist of available
rule files instead of using a sub-shell and unix commands.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoids.cgi: Drop old code for uploading a ruleset
Stefan Schantl [Sat, 2 Dec 2017 14:17:49 +0000 (15:17 +0100)] 
ids.cgi: Drop old code for uploading a ruleset

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
23 months agoMerge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next
Stefan Schantl [Sat, 21 Jul 2018 12:14:53 +0000 (14:14 +0200)] 
Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next

23 months agoaws: Add support for a script that can be executed at first boot
Michael Tremer [Fri, 20 Jul 2018 15:19:46 +0000 (16:19 +0100)] 
aws: Add support for a script that can be executed at first boot

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
23 months agoaws: Always exit the init script cleanly
Michael Tremer [Tue, 17 Jul 2018 17:05:07 +0000 (18:05 +0100)] 
aws: Always exit the init script cleanly

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
23 months agoasterisk: Don't optimise for builder
Michael Tremer [Fri, 20 Jul 2018 14:21:36 +0000 (14:21 +0000)] 
asterisk: Don't optimise for builder

Asterisk enables -march=native which renders the code
incompatible to most systems.

Fixes: #11793

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
23 months agofireinfo: Import latest patches
Michael Tremer [Fri, 20 Jul 2018 12:06:11 +0000 (12:06 +0000)] 
fireinfo: Import latest patches

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
23 months agoMerge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next
Stefan Schantl [Thu, 19 Jul 2018 16:10:23 +0000 (18:10 +0200)] 
Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next

23 months agokernel: aarch64: enable virtio drivers
Arne Fitzenreiter [Thu, 19 Jul 2018 08:30:47 +0000 (09:30 +0100)] 
kernel: aarch64: enable virtio drivers

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
23 months agou-boot: boot aarch64 kernel without -multi extension
Arne Fitzenreiter [Thu, 19 Jul 2018 08:29:44 +0000 (09:29 +0100)] 
u-boot: boot aarch64 kernel without -multi extension

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
23 months agokernel: apply multi arch patchset for aarch64
Arne Fitzenreiter [Thu, 19 Jul 2018 08:28:27 +0000 (09:28 +0100)] 
kernel: apply multi arch patchset for aarch64

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
23 months agoAWS: Give setup user permissions to read its own SSH keys
Michael Tremer [Sat, 14 Jul 2018 14:06:39 +0000 (15:06 +0100)] 
AWS: Give setup user permissions to read its own SSH keys

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
23 months agoaws: Unlock setup account
Michael Tremer [Thu, 12 Jul 2018 14:37:59 +0000 (15:37 +0100)] 
aws: Unlock setup account

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
23 months agoaws: Install SSH keys only for setup user
Michael Tremer [Thu, 12 Jul 2018 12:57:19 +0000 (13:57 +0100)] 
aws: Install SSH keys only for setup user

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
23 months agoaws: setup user should not be a system user
Michael Tremer [Thu, 12 Jul 2018 12:55:38 +0000 (13:55 +0100)] 
aws: setup user should not be a system user

Login is not permitted for system users

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
23 months agoRootfile update for aarch64 kernel
Michael Tremer [Sat, 14 Jul 2018 12:43:13 +0000 (13:43 +0100)] 
Rootfile update for aarch64 kernel

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
23 months agoaarch64: Remove -multi suffix from kernel
Michael Tremer [Thu, 5 Jul 2018 22:28:15 +0000 (23:28 +0100)] 
aarch64: Remove -multi suffix from kernel

This gets in the way for authoring the CD and we will
never have any other kernels but the main one.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
23 months agolinux: Simplify compiling and installing the kernel
Michael Tremer [Thu, 5 Jul 2018 22:27:24 +0000 (23:27 +0100)] 
linux: Simplify compiling and installing the kernel

There was loads of duplicated code which could have been
made shorter by adding one variable.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoiptables: Ship all modules
Michael Tremer [Thu, 12 Jul 2018 09:04:37 +0000 (10:04 +0100)] 
iptables: Ship all modules

These have been all disabled with the last update of
the iptables package.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoRootfile update
Michael Tremer [Thu, 12 Jul 2018 09:03:34 +0000 (10:03 +0100)] 
Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoaws: Don't start ssh right away
Michael Tremer [Thu, 12 Jul 2018 08:59:31 +0000 (09:59 +0100)] 
aws: Don't start ssh right away

sshctrl calls sshd directly which won't work at time of the first boot
because no keys will be generated.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoOpenVPN: Deleted mtu-disc completely since it has been dropped.
Erik Kapfer [Fri, 6 Jul 2018 03:57:59 +0000 (05:57 +0200)] 
OpenVPN: Deleted mtu-disc completely since it has been dropped.

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoclamav: Update to 0.100.1
Matthias Fischer [Mon, 9 Jul 2018 18:53:45 +0000 (20:53 +0200)] 
clamav: Update to 0.100.1

For details see:
https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoaws: Create "setup" user to run setup
Michael Tremer [Tue, 10 Jul 2018 17:32:20 +0000 (18:32 +0100)] 
aws: Create "setup" user to run setup

Amazon does not permit that a user logs in as root directly.
Instead they insist on using sudo.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoMerge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next
Stefan Schantl [Sun, 8 Jul 2018 06:34:37 +0000 (08:34 +0200)] 
Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next

2 years agousbutils: Update rootfile
Michael Tremer [Tue, 3 Jul 2018 19:01:46 +0000 (20:01 +0100)] 
usbutils: Update rootfile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agospice-protocol: rootfile update
Arne Fitzenreiter [Tue, 3 Jul 2018 15:03:37 +0000 (16:03 +0100)] 
spice-protocol: rootfile update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 years agolibgcrypt: rootfile update
Arne Fitzenreiter [Tue, 3 Jul 2018 15:01:35 +0000 (16:01 +0100)] 
libgcrypt: rootfile update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2 years agoUpdate translations
Michael Tremer [Tue, 3 Jul 2018 14:33:04 +0000 (15:33 +0100)] 
Update translations

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoOpenVPN: x509 and DH-parameter check with Warnings and error messages in WUI
Erik Kapfer [Wed, 27 Jun 2018 07:34:21 +0000 (09:34 +0200)] 
OpenVPN: x509 and DH-parameter check with Warnings and error messages in WUI

Changes includes:
Own crypto warning and error message in WUI (can be extended to configuration too).
Check if DH-parameter is < 2048 bit with an error message and howto fix it.
Check if md5 is still in use with an error message and suggestion how to proceed further to fix it.
Check for soon needed RFC3280 TLS rules compliants and suggestion how to proceed further to fix it.
Disabled 1024 bit DH-parameter upload.
Changed de and en language files for DH-parameter upload (deleted 1024 bit).
Added explanations to de and en language files for the above changes.
Fixed Typo in en language file.

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoRevert "OpenVPN: Clarify fundamental crypto errors but also warnings in WUI"
Michael Tremer [Tue, 3 Jul 2018 14:32:42 +0000 (15:32 +0100)] 
Revert "OpenVPN: Clarify fundamental crypto errors but also warnings in WUI"

This reverts commit 15a3aa45cf27c61a581f892b5f3a3905335a12b0.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agocollect: fix cpufreq graph on some machines.
Arne Fitzenreiter [Tue, 3 Jul 2018 13:07:41 +0000 (15:07 +0200)] 
collect: fix cpufreq graph on some machines.

the file cpuinfo_cur_freq does not exist on all systems that support collect
cpufreq data.

fixes #11739

2 years agoMerge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next
Arne Fitzenreiter [Tue, 3 Jul 2018 10:52:18 +0000 (11:52 +0100)] 
Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

2 years agoMerge branch 'aarch64' into next
Arne Fitzenreiter [Tue, 3 Jul 2018 10:52:05 +0000 (11:52 +0100)] 
Merge branch 'aarch64' into next

Conflicts:
config/rootfiles/core/121/filelists/acpid
config/rootfiles/core/121/filelists/apache2
config/rootfiles/core/121/filelists/apr
config/rootfiles/core/121/filelists/aprutil
config/rootfiles/core/121/filelists/armv5tel/files
config/rootfiles/core/121/filelists/armv5tel/linux-initrd-kirkwood
config/rootfiles/core/121/filelists/armv5tel/linux-initrd-multi
config/rootfiles/core/121/filelists/armv5tel/linux-kirkwood
config/rootfiles/core/121/filelists/armv5tel/linux-multi
config/rootfiles/core/121/filelists/armv5tel/rpi-firmware
config/rootfiles/core/121/filelists/armv5tel/u-boot
config/rootfiles/core/121/filelists/armv5tel/u-boot-kirkwood
config/rootfiles/core/121/filelists/armv5tel/u-boot-mkimage
config/rootfiles/core/121/filelists/beep
config/rootfiles/core/121/filelists/cmake
config/rootfiles/core/121/filelists/crda
config/rootfiles/core/121/filelists/dhcp
config/rootfiles/core/121/filelists/flex
config/rootfiles/core/121/filelists/i586/grub
config/rootfiles/core/121/filelists/i586/intel-microcode
config/rootfiles/core/121/filelists/i586/linux
config/rootfiles/core/121/filelists/i586/linux-initrd
config/rootfiles/core/121/filelists/iw
config/rootfiles/core/121/filelists/jwhois
config/rootfiles/core/121/filelists/libidn
config/rootfiles/core/121/filelists/multipath-tools
config/rootfiles/core/121/filelists/pcre
config/rootfiles/core/121/filelists/tar
config/rootfiles/core/121/filelists/unbound
config/rootfiles/core/121/filelists/wget
config/rootfiles/core/121/filelists/x86_64/grub
config/rootfiles/core/121/filelists/x86_64/intel-microcode
config/rootfiles/core/121/filelists/x86_64/linux
config/rootfiles/core/121/filelists/x86_64/linux-initrd
config/rootfiles/core/122/filelists/aarch64/files
config/rootfiles/core/122/filelists/acpid
config/rootfiles/core/122/filelists/apache2
config/rootfiles/core/122/filelists/apr
config/rootfiles/core/122/filelists/aprutil
config/rootfiles/core/122/filelists/armv5tel/linux-initrd-kirkwood
config/rootfiles/core/122/filelists/armv5tel/linux-initrd-multi
config/rootfiles/core/122/filelists/armv5tel/linux-kirkwood
config/rootfiles/core/122/filelists/armv5tel/linux-multi
config/rootfiles/core/122/filelists/armv5tel/rpi-firmware
config/rootfiles/core/122/filelists/armv5tel/u-boot
config/rootfiles/core/122/filelists/armv5tel/u-boot-kirkwood
config/rootfiles/core/122/filelists/armv5tel/u-boot-mkimage
config/rootfiles/core/122/filelists/beep
config/rootfiles/core/122/filelists/cmake
config/rootfiles/core/122/filelists/crda
config/rootfiles/core/122/filelists/dhcp
config/rootfiles/core/122/filelists/flex
config/rootfiles/core/122/filelists/i586/grub
config/rootfiles/core/122/filelists/i586/intel-microcode
config/rootfiles/core/122/filelists/i586/linux
config/rootfiles/core/122/filelists/i586/linux-initrd
config/rootfiles/core/122/filelists/iw
config/rootfiles/core/122/filelists/jwhois
config/rootfiles/core/122/filelists/libidn
config/rootfiles/core/122/filelists/multipath-tools
config/rootfiles/core/122/filelists/pcre
config/rootfiles/core/122/filelists/tar
config/rootfiles/core/122/filelists/unbound
config/rootfiles/core/122/filelists/wget
config/rootfiles/core/122/filelists/x86_64/grub
config/rootfiles/core/122/filelists/x86_64/intel-microcode
config/rootfiles/core/122/filelists/x86_64/linux
config/rootfiles/core/122/filelists/x86_64/linux-initrd
config/rootfiles/core/123/filelists/unbound
config/rootfiles/oldcore/121/filelists/acpid
config/rootfiles/oldcore/121/filelists/apache2
config/rootfiles/oldcore/121/filelists/apr
config/rootfiles/oldcore/121/filelists/aprutil
config/rootfiles/oldcore/121/filelists/armv5tel/files
config/rootfiles/oldcore/121/filelists/armv5tel/linux-initrd-kirkwood
config/rootfiles/oldcore/121/filelists/armv5tel/linux-initrd-multi
config/rootfiles/oldcore/121/filelists/armv5tel/linux-initrd-rpi
config/rootfiles/oldcore/121/filelists/armv5tel/linux-kirkwood
config/rootfiles/oldcore/121/filelists/armv5tel/linux-multi
config/rootfiles/oldcore/121/filelists/armv5tel/linux-rpi
config/rootfiles/oldcore/121/filelists/armv5tel/rpi-firmware
config/rootfiles/oldcore/121/filelists/armv5tel/u-boot
config/rootfiles/oldcore/121/filelists/armv5tel/u-boot-kirkwood
config/rootfiles/oldcore/121/filelists/armv5tel/u-boot-mkimage
config/rootfiles/oldcore/121/filelists/beep
config/rootfiles/oldcore/121/filelists/cmake
config/rootfiles/oldcore/121/filelists/crda
config/rootfiles/oldcore/121/filelists/dhcp
config/rootfiles/oldcore/121/filelists/flex
config/rootfiles/oldcore/121/filelists/i586/grub
config/rootfiles/oldcore/121/filelists/i586/intel-microcode
config/rootfiles/oldcore/121/filelists/i586/linux
config/rootfiles/oldcore/121/filelists/i586/linux-initrd
config/rootfiles/oldcore/121/filelists/iw
config/rootfiles/oldcore/121/filelists/jwhois
config/rootfiles/oldcore/121/filelists/libidn
config/rootfiles/oldcore/121/filelists/multipath-tools
config/rootfiles/oldcore/121/filelists/pcre
config/rootfiles/oldcore/121/filelists/tar
config/rootfiles/oldcore/121/filelists/wget
config/rootfiles/oldcore/121/filelists/x86_64/grub
config/rootfiles/oldcore/121/filelists/x86_64/intel-microcode
config/rootfiles/oldcore/121/filelists/x86_64/linux
config/rootfiles/oldcore/121/filelists/x86_64/linux-initrd
make.sh

2 years agoUpdate languages
Michael Tremer [Tue, 3 Jul 2018 09:34:57 +0000 (10:34 +0100)] 
Update languages

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoOpenVPN: Clarify fundamental crypto errors but also warnings in WUI
Erik Kapfer [Thu, 21 Jun 2018 09:46:36 +0000 (11:46 +0200)] 
OpenVPN: Clarify fundamental crypto errors but also warnings in WUI

Since OpenVPN-2.4.x, a lot of changes has been introduced. This patch should help the users for better understanding of errors in the cryptography.
It includes also potential warnings for upcoming changes and needed adjustments in the system.
This can also be extended in the future for upcoming configuration changes.

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoOpenVPN: Prevent internal server error cause of bad header wrapper
Erik Kapfer [Thu, 21 Jun 2018 09:12:53 +0000 (11:12 +0200)] 
OpenVPN: Prevent internal server error cause of bad header wrapper

This fixes #11772 .

If the X509 are deleted, the openvpnctrl output generates a bad header wrapper error from the CGI
which causes an internal server error. The redirection of the openvpnctrl output fixes this.

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agohplip: Update to version 3.18.6
Erik Kapfer [Thu, 21 Jun 2018 11:52:13 +0000 (13:52 +0200)] 
hplip: Update to version 3.18.6

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoguardian: Update to 2.0.2
Stefan Schantl [Wed, 27 Jun 2018 17:39:14 +0000 (19:39 +0200)] 
guardian: Update to 2.0.2

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agoguardian.cgi: Remove support for owncloud
Stefan Schantl [Wed, 27 Jun 2018 17:39:13 +0000 (19:39 +0200)] 
guardian.cgi: Remove support for owncloud

Owncloud as an addon has been dropped for IPFire. As a result of this,
we do not need this code anymore.

Fixes #11572.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2 years agocore123: Ship updated sysctl.conf
Michael Tremer [Tue, 3 Jul 2018 09:33:23 +0000 (10:33 +0100)] 
core123: Ship updated sysctl.conf

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>