backup(.pl): Replace OpenVPN DH parameter with ffdhe4096

This ensures restoring a backup won't silently bring back an insecure
Diffie-Hellman parameter (which could also not be inspected through the
web interface anymore).

Reported-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>

diff --git a/config/backup/backup.pl b/config/backup/backup.pl
index 6fd9e45bb1f5e4f517d52a82732236b1986ab7a7..96e794439fedfdb52362e62d6abf2e1052681b27 100644 (file)
--- a/config/backup/backup.pl
+++ b/config/backup/backup.pl
@@ -184,6 +184,9 @@ restore_backup() {
        # move nobeeps if exist
        [ -e "/var/ipfire/ppp/nobeeps" ] && mv /var/ipfire/ppp/nobeeps /var/ipfire/red/nobeeps
 
+       # Replace previously used OpenVPN Diffie-Hellman parameter by ffdhe4096
+       sed -i 's|/var/ipfire/ovpn/ca/dh1024.pem|/etc/ssl/ffdhe4096.pem|' /var/ipfire/ovpn/server.conf /var/ipfire/ovpn/n2nconf/*/*.conf
+
        # Update OpenVPN CRL
        /etc/fcron.daily/openvpn-crl-updater