webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-15 05:22:59 +02:00
Code Issues Packages Projects Releases Wiki Activity
12,864 Commits 2 Branches 1 Tag
8076deba79f9bbd4e551fdfe1eb49e8a77b2c19e
Commit Graph

12864 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Matthias Fischer
028eafe79f Apache: Update to 2.4.35 
For details see:

http://apache.mirror.digionline.de//httpd/CHANGES_2.4.35

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:30:39 +01:00
Michael Tremer
551a554db6 core125: Ship recently updated sqlite 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:30:05 +01:00
Michael Tremer
f9b7bc9259 Update list of contributors 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:29:23 +01:00
Michael Tremer
7e2d7b9837 Start Core Update 125 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:28:33 +01:00
Michael Tremer
6e386cad2d sqlite: Update to 3.25.2.0 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:23:29 +01:00
Stefan Schantl
8cf04a1656 ids-functions.pl: Rework &_cleanup_rulesdir() function 
* Use a directory listing and delete the files.
* Keep files with "config" as file extension.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2018-10-12 15:43:16 +02:00
Stefan Schantl
4ce4248849 ids-functions.pl: Fix typo 
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2018-10-12 15:18:38 +02:00
Stefan Schantl
883820bdcb ids-functions.pl: Call &_cleanup_rulesdir() function before calling oinkmaster. 
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2018-10-12 15:16:32 +02:00
Stefan Schantl
b59cdbeea5 ids-functions.pl: Add private function to cleanup the rules directory. 
This private function is used to remove any files which are stored in the
IDS rules directory and prevent from any old (unneeded or conflicting) files
after an update or complete change of the ruleset source.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2018-10-12 15:12:10 +02:00
Stefan Schantl
5d3b16c6df suricata: Rootfile update 
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2018-10-12 13:08:35 +02:00
Stefan Schantl
8d087d0391 Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next-suricata 2018-10-02 07:35:13 +02:00
Stefan Schantl
89a12b3843 suricata: Set correct ownership for /var/lib/suricata 
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2018-10-01 20:14:00 +02:00
Arne Fitzenreiter
e3ab1962ed Merge branch 'core124' of git.ipfire.org:/pub/git/ipfire-2.x into core124 2018-09-28 18:43:15 +02:00
Arne Fitzenreiter
d435f08d9b core124: add apache initskript and nsswitch.conf to updater 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-28 18:12:12 +02:00
Arne Fitzenreiter
71954dcac4 core124: don't remove network trigger script 
this script is still needed if /var/ipfire is on an extra partition.
New installations works without this script.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-28 17:49:10 +02:00
Arne Fitzenreiter
ae61c74db9 core124: fix removing old initrd files on arm systems 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-27 21:53:53 +02:00
Arne Fitzenreiter
eaadeb5af0 kernel: update to 4.14.72 
this commit has many important driver updates so we need to ship it fast...

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-27 08:03:45 +02:00
Stefan Schantl
2d475a3c6c Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next-suricata 2018-09-26 14:49:34 +02:00
Stefan Schantl
eadad5fda6 ids.cgi: Add support for autoupdate of the IDS ruleset 
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2018-09-26 14:43:09 +02:00
Stefan Schantl
6c9458342b IDS: Update language files 
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2018-09-26 14:42:47 +02:00
Stefan Schantl
3aadbbca38 stage2: Rootfile update for update-ids-ruleset script 
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2018-09-26 14:38:46 +02:00
Stefan Schantl
82979dec36 IDS: Introduce update-ids-ruleset 
This script periodly will be called by fcron
and is responsible for downloading and altering
the ruleset, if autoupdate of the configured ruleset is
enabled.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2018-09-26 14:11:31 +02:00
Arne Fitzenreiter
161a5b834a Merge remote-tracking branch 'origin/master' into core124 2018-09-26 14:09:57 +02:00
Stefan Schantl
ed06bc811f ids-functions.pl: Add backend code to handle the "cron" function of suricatactrl 
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2018-09-26 14:09:53 +02:00
Stefan Schantl
6ce504a2f2 suricatactrl: Add "cron" command 
This command allows to enable the automatic update
of the used IDS ruleset and to specify the update interval.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2018-09-26 13:54:14 +02:00
Stefan Schantl
dae534f2ca ids.cgi: Only write oinkmaster-modify-sids.conf if neccessary. 
Only write to the file if the runmode of the IDS has been changed.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
 2018-09-26 13:02:28 +02:00
Michael Tremer
0a5823db02 ssh: Revert MaxAuthTries setting 
This is entirely not practicable and should have been changed
before. I missed this when I tested the configuration.

It is common that multiple SSH keys exist and three is common
number (RSA, ECDSA & Ed25519). A key passed with ssh -i and
password authentication are not even tried.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-25 20:24:39 +01:00
Arne Fitzenreiter
46b3073242 core124: fix updater 
fix some missing files on arm
remove not needed rebuild initrd because we ship it already built

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-23 02:44:03 +02:00
Matthias Fischer
5bf8ff9fcc nano: Update to 3.1 
Hi,

This update was published just a few days after my "3.0"-commit - running.

For details see:

https://www.nano-editor.org/news.php

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-22 11:43:12 +01:00
Arne Fitzenreiter
0f2186725e core124: finish updater 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-21 15:26:52 +02:00
Arne Fitzenreiter
e2a3147fe5 arm: boot.scr: add setting to edit fdt via uEnv.txt 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-21 15:24:50 +02:00
Arne Fitzenreiter
4eedf6793b rebuild-initrd: update for grub2 
this was was not used for years because we usually ship a prebuild ramdisk
so this incompatiblity was not noticed long time...

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-20 20:03:26 +02:00
Arne Fitzenreiter
bdf9df742c kernel: update to 4.14.71 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-20 19:51:43 +02:00
Michael Tremer
5210b5879b core124: Ship updated iproute2 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-20 14:54:02 +01:00
Matthias Fischer
b1bfe61711 iproute2: Update to 4.18.0 
Triggered by https://bugzilla.ipfire.org/show_bug.cgi?id=11866 ;-)

For details see:
https://lwn.net/Articles/762515/

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-20 14:53:35 +01:00
Michael Tremer
37d7f38018 core124: Ship updated openssh package 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-20 14:52:17 +01:00
Matthias Fischer
74189c1d55 openssh: Update to 7.8p1 
For details see:
http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/ChangeLog

I didn't find an official lfs-patch for openssl-1.1-compatibility,
so I used the patch from here:
https://git.archlinux.org/svntogit/packages.git/plain/trunk/openssl-1.1.0.patch?h=packages/openssh

Building ran without any errors.

I tested with both machines (test on Core 120 - and productive - on Core 122) and found no errors so far:

...
[root@ipfiretest ~]# ssh -V
OpenSSH_7.8p1, OpenSSL 1.1.0h  27 Mar 2018
...

...
root@ipfire: / # ssh -V
OpenSSH_7.8p1, OpenSSL 1.1.0h  27 Mar 2018
...

All ssh-connections ran fine but I'm not REALLY sure if this is sufficient for anyone else.

Could someone please check and confirm!?

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Tested-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-20 14:51:44 +01:00
Michael Tremer
1d2fe90cc8 core124: Ship updated OpenSSH configuration 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-20 14:51:13 +01:00
Michael Tremer
bd0686f441 ssh: Remove AuthenticationMethods directive 
This is only setting something that is default anyways and
prevents sshd from starting if one of the listed methods
is not activated.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-20 14:50:25 +01:00
Peter Müller
07da1af688 use custom SSH server configuration in LFS file 
Include OpenSSH server configuration file during build.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-20 14:28:15 +01:00
Peter Müller
38485efafb add hardened SSH server configuration 
In order to harden OpenSSH server in IPFire, using the upstream default configuration
and edit it via sed commands in LFS file is error-prone and does not scale.

Thereof we ship a custom and more secure OpenSSH server configuration which
is copied into the image during build time.

The fourth version of this patch disables password authentication by
default, since this is required by some cloud hosters in order to apply
the image. Further, this method is less secure than pubkey
authentication.

Non-AEAD ciphers have been re-added to provide compatibility to older
RHEL systems.

Fixes #11750
Fixes #11751
Partially fixes #11538

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Cc: Marcel Lorenz <marcel.lorenz@ipfire.org>
Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-20 14:27:01 +01:00
Michael Tremer
a6c190818a backup: Fix deleting backup files 
Signed-off-by: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-20 14:21:41 +01:00
Arne Fitzenreiter
06131f41e4 kernel: arm32-bit: update rootfiles 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-17 07:44:55 +02:00
Arne Fitzenreiter
362ac1ed61 kernel: update to 4.14.70 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-16 14:29:32 +02:00
Arne Fitzenreiter
a834285d1b kernel: arm: enable chacha poly 
fixes: #11855
todo: add rootfiles for arm 32-bit

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-15 15:58:13 +02:00
Arne Fitzenreiter
276692f378 core124: add kernel files to updater 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-15 15:49:10 +02:00
Michael Tremer
088b7f4f3f core124: Ship updated unbound 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-13 15:03:59 +01:00
Matthias Fischer
76e26c7f69 unbound: Update to 1.8.0 
For details see:

  https://nlnetlabs.nl/svn/unbound/tags/release-1.8.0/doc/Changelog

and

  https://nlnetlabs.nl/projects/unbound/download/

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-13 15:03:59 +01:00
Michael Tremer
0023f8a92b core124: Ship updated backup.cgi 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-13 15:03:59 +01:00
Michael Tremer
b8fdc7398c static-routes: Make it clear that we are reloading routes 
When RED is brought down, we will reload all static routes.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-13 15:03:59 +01:00