This is potentially dangerous to set larger than zero.
Authentication is perfomed on basis of IP addresses which is
not a good idea at all.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This is the authentication againt NT 4.0 style domain controllers.
squid has dropped support for this in the 4.5 release and nobody
should be using these old domain controllers any more.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
I added a function to determine the number of cores.
Now the number of squid processes will be equal to the number of logical cores.
Further I removed the possibility of changing the number
of squid processes in the proxy.cgi
Signed-off-by: Daniel Weismüller <daniel.weismueller@ipfire.org>
Signed-off-by: root <root@ipfire.test>
Fixes#11904
Since OpenSSL-1.1.0x the database attribute file for IPSec and OpenVPN wasn´t created while initial PKI generation.
OpenVPN delivered an error message but IPSec did crashed within the first attempt.
This problem persists also after X509 deletion and new generation.
index.txt.attr will now be delivered by the system but also deleted and recreated while setting up a new x509.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This function is used to write the corresponding file which
tells oinkmaster to alter the whole ruleset and finally
switches suricata into an IPS or IDS.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
This hack is needed because "red" is used as "internet" in the language files
and "red1" contains the correct "red" translations.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Now each of both have their own corresponding configuration areas.
The taken settings will be saved in "/var/ipfire/suricata/settings" for
all IDS/IPS related settings and in "/var/ipfire/suricata/rules-settings" for
ruleset related settings.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
I do not know why I forgot this. Now it is how it was intended
in the first place.
This commit removes all email addresses because people keep
emailing me for private support. Use the forum guys!
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Currently, the wget call only uses proxy information for HTTP.
Since rulesets are downloaded via HTTPS now, the same information
also needs to be applied for HTTPS.
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
this may violate regulatory rules because 40Mhz channels should disabled
if there are other networks but nearly every commercial router ignore this.
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
This parameter was passed to some shell commands without any
sanitisation which allowed an attacker who was authenticated to
the web UI to download arbitrary files from some directories
and delete any file from the filesystem.
References: #11830
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Only set the state of a used rulefile to "on" if it is present in
the %idsrules hash. This happens if it contains at least one rule.
This prevents from showing a rulefile in the ruleset section if, it
does not exist anymore or does not contains any rules at all.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
If an IP-address has been added to the whitelist, any traffic from
this host will not longer inspected by suricata.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Embed the IPFire background image into the redirect template
directly via CSS instead of loading it from somewhere else.
This is necessary because of Content Security Policy (CSP).
This patch inserts the base64 encoded image during build so
nothing needs to be updated twice in case background image
changes.
It supersedes first to fourth version of this patch and has
been successfully tested during a clean build.
Fixes#11650
Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
As default show the events generated by suricata and if
for a certain selected date no suricata log is available
try to fall-back to read the events from the old snort
alert files (if available).
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
