- Update from version 6.0.21 to 6.0.22
- Update of rootfile not required
Bugs fixed:
- ZBX-23417: Fixed possible memory leak when checking modbus.get[] item
New Features and Improvements:
- ZBXNEXT-6554: Increased remote command execution limits to 16MB
Full changelogs since 6.0.21:
- https://www.zabbix.com/rn/rn6.0.22
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 6.0.19 to 6.0.21
- Update of rootfile not required
Bugs fixed:
- ZBX-23097:
Fixed use of uninitialised value when verifying subject and issuer with
TLS
- ZBX-22871:
Fixed regular expression crash with invalid utf-8 sequences when pcre2
is used
- ZBX-23221:
Fixed memory leaks when using certificate-based encryption
- ZBX-18168:
Added regexp runtime error logging for log*[] items
Full changelogs since 6.0.19:
- https://www.zabbix.com/rn/rn6.0.20
- https://www.zabbix.com/rn/rn6.0.21
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 6.0.16 to 6.0.19
- Update of rootfile not required
Bugs fixed:
- ZBX-22798:
Incorrect output of vfs.file.contents when reading frequently
modified file
- ZBX-22470:
Zabbix Agent locks in tls_recv() when using DebugLevel=5
- ZBX-21892:
vfs.fs.get returns wrong data if multiple file systems have identical
mount point
Full changelogs since 6.0.16:
- https://www.zabbix.com/rn/rn6.0.17
- https://www.zabbix.com/rn/rn6.0.18
- https://www.zabbix.com/rn/rn6.0.19
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
There are no functional changes in these files, but they are however
linked against OpenSSL 1.1.1 and need to be re-shipped before we remove
the legacy library.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Configure Zabbix Agent to log to syslog instead of its own logs.
- Remove old zabbix log-dir and logrotate settings from rootfile, lfs
and install-script.
- Update log.dat to view Zabbix Agent logging from syslog.
Signed-off-by: Robin Roevens <robin.roevens@disroot.org>
Since we have extended services.cgi that it reads the Services field
from the Pakfire metadata, we will need to make sure that that metadata
is going to be on those systems.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Provide IPFire specific items for the Zabbix server to monitor:
- ipfire.net.gateway.pingtime: Internet Line Quality
- ipfire.net.gateway.ping: Internet connection
- ipfire.net.fw.hits.raw: JSON formatted list of Firewall hits/chain
- ipfire.dhcpd.clients: Number of active DHCP leases
- ipfire.captive.clients: Number of Captive Portal clients
Signed-off-by: Robin Roevens <robin.roevens@disroot.org>
- Remove sudoers file 'zabbix' in favour of new IPFire managed
'zabbix_agentd' and user managed 'zabbix_agentd_user' which is
included in the backup
- Provide migration of old sudoers file 'zabbix' or 'zabbix.user' to
new zabbix_agentd_user sudoers file if it was modified by user.
Signed-off-by: Robin Roevens <robin.roevens@disroot.org>
- Restrict default main config to only the bare minimum options
and add upstream provided config as example file.
- Remove /etc/zabbix_agentd from backup and instead add only
zabbix_agentd.conf and subdirs 'scripts' and 'zabbix_agentd.d' to
the backup.
- Move ipfire managed userparameter_pakfire.conf from
user managed dir /etc/zabbix_agentd/zabbix_agent.d to
ipfire managed dir /var/ipfire/zabbix_agentd/userparameters
- Add Include line to existing zabbix_agentd.conf to include
the new ipfire managed config dir /var/ipfire/zabbix_agentd/...
- Add and include mandatory IPFire specific agent configuration
which should never be changed by the user.
Signed-off-by: Robin Roevens <robin.roevens@disroot.org>
Lynis (rightly) complains about this directory and its contents being
world-readable on current IPFire installations. Since there is no
necessity for this, we might as well chmod them to 750 / 640.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Adolf Belka <adolf.belka@ipfire.org>
Historically, the MD5 checksums in our LFS files serve as a protection
against broken downloads, or accidentally corrupted source files.
While the sources are nowadays downloaded via HTTPS, it make sense to
beef up integrity protection for them, since transparently intercepting
TLS is believed to be feasible for more powerful actors, and the state
of the public PKI ecosystem is clearly not helping.
Therefore, this patch switches from MD5 to BLAKE2, updating all LFS
files as well as make.sh to deal with this checksum algorithm. BLAKE2 is
notably faster (and more secure) than SHA2, so the performance penalty
introduced by this patch is negligible, if noticeable at all.
In preparation of this patch, the toolchain files currently used have
been supplied with BLAKE2 checksums as well on
https://source.ipfire.org/.
Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Acked-by: Michael Tremer <michael.tremeripfire.org>
* Add a Summary and Services field to all pak lfs files
* Replace occurances of INSTALL_INITSCRIPT with new INSTALL_INITSCRIPTS
macro in all pak lfs files.
Signed-off-by: Robin Roevens <robin.roevens@disroot.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Not sure why this has ever been there. This simply makes it
nicer to read and edit because we can have line-breaks now.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Ship the UserParameter for monitoring the status of pakfire for keeping track of available updates etc.
Signed-off-by: Alexander Koch <ipfire@starkstromkonsument.de>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
