webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-14 04:52:59 +02:00
Code Issues Packages Projects Releases Wiki Activity
12,290 Commits 2 Branches 1 Tag
a6c190818a15342db5d91f4219587aa08f692173
Commit Graph

6067 Commits

Author SHA1 Message Date
Michael Tremer
a6c190818a backup: Fix deleting backup files 
Signed-off-by: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-20 14:21:41 +01:00
Arne Fitzenreiter
06131f41e4 kernel: arm32-bit: update rootfiles 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-17 07:44:55 +02:00
Arne Fitzenreiter
a834285d1b kernel: arm: enable chacha poly 
fixes: #11855
todo: add rootfiles for arm 32-bit

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-15 15:58:13 +02:00
Arne Fitzenreiter
276692f378 core124: add kernel files to updater 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-15 15:49:10 +02:00
Michael Tremer
088b7f4f3f core124: Ship updated unbound 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-13 15:03:59 +01:00
Matthias Fischer
76e26c7f69 unbound: Update to 1.8.0 
For details see:

  https://nlnetlabs.nl/svn/unbound/tags/release-1.8.0/doc/Changelog

and

  https://nlnetlabs.nl/projects/unbound/download/

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-13 15:03:59 +01:00
Michael Tremer
0023f8a92b core124: Ship updated backup.cgi 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-13 15:03:59 +01:00
Michael Tremer
b8fdc7398c static-routes: Make it clear that we are reloading routes 
When RED is brought down, we will reload all static routes.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-13 15:03:59 +01:00
Arne Fitzenreiter
924b48c789 kernel: update to 4.14.69 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-12 21:04:07 +02:00
Michael Tremer
063de1600b core124: Ship CA certificates 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-10 18:23:27 +01:00
Peter Müller
05a89532d7 update ca-certificates CA bundle 
Update the CA certificates list to what Mozilla NSS ships currently.

The original file can be retrieved from:
https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-10 18:22:55 +01:00
Peter Müller
edea6ec5a4 add hardened SSH client configuration 
Introduce a custom OpenSSH client configuration file for IPFire.
Some people use it as a jumping host, so applying hardening options
system-wide improves security.

Cryptography setup is the same as for OpenSSH server configuration.

The second version of this patch re-adds some non-AEAD cipher suites
which are needed for connecting to older RHEL systems.

Partially fixes #11751

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-10 16:36:39 +01:00
Michael Tremer
0762dcc4e8 core124: Ship updated unbound configuration and restart daemon 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-10 16:35:25 +01:00
Peter Müller
8a0585837c Unbound: Use aggressive NSEC 
This avoids some needless lookups to destination domains
with a very high NXDOMAIN rate and reduces load on upstream
servers.

See https://nlnetlabs.nl/documentation/unbound/unbound.conf/
for further details.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-10 16:34:30 +01:00
Peter Müller
4e4128faac Unbound: Use caps for IDs 
Attempt to detect DNS spoofing attacks by inserting 0x20-encoded
random bits into upstream queries. Upstream documentation claims
it to be an experimental implementation, it did not cause any trouble
on productive systems here.

See https://nlnetlabs.nl/documentation/unbound/unbound.conf/ for
further details.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-10 16:34:20 +01:00
Peter Müller
ffba3c98ba Unbound: Enable DNS cache poisoning mitigation 
By default, Unbound neither keeps track of the number of unwanted
replies nor initiates countermeasures if they become too large (DNS
cache poisoning).

This sets the maximum number of tolerated unwanted replies to
1M, causing the cache to be flushed afterwards. (Upstream documentation
recommends 10M as a threshold, but this turned out to be ineffective
against attacks in the wild.)

See https://nlnetlabs.nl/documentation/unbound/unbound.conf/ for
details. This version of the patch uses 1M as threshold instead of
5M and supersedes the first and second version.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-10 16:34:18 +01:00
Michael Tremer
4ca0cb3354 core124: Ship updated redirect page template 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-10 16:30:52 +01:00
Michael Tremer
a0d612be7a core124: Rebuild initrd 
This script was missing in the last update and therefore
no microcodes were included.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-09 18:27:56 +01:00
Michael Tremer
505b886d0d core124: Apply changed sysctl.conf 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-09 17:48:14 +01:00
Peter Müller
d5fe332283 do not expose kernel address spaces even to privileged users 
Change this setting from 1 to 2 so kernel addresses are not
displayed even if a user has CAPS_SYSLOG privileges.

See also:
- https://lwn.net/Articles/420403/
- https://tails.boum.org/contribute/design/kernel_hardening/

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-09 17:47:08 +01:00
Michael Tremer
65ae069c21 core124: Ship updated rng-tools 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-09 17:43:53 +01:00
Arne Fitzenreiter
fd313a1ae6 Merge branch 'master' into next 2018-08-29 07:44:59 +02:00
Michael Tremer
aa61d769b7 core124: Ship latest pakfire changes 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-08-27 07:34:28 +01:00
Michael Tremer
973ffc2987 core124: Ship updated ntp package 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-08-24 12:25:59 +01:00
Michael Tremer
b31d55a79d core124: Ship updated fwhosts.cgi 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-08-24 11:45:44 +01:00
Michael Tremer
aec1925bea IPsec: Show connected status for waiting connections that are active 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-08-23 17:34:50 +01:00
Michael Tremer
702f0ba835 core124: Ship updated firewall.cgi 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-08-22 14:46:53 +01:00
Michael Tremer
7141cb1ee4 core124: Fix typo in rootfile 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-08-22 14:17:15 +01:00
Michael Tremer
8e11e1e869 core124: Ship updated AWS setup scripts 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-08-22 14:06:53 +01:00
Michael Tremer
84cd9b9162 Drop the network-trigger script 
This is done at boot time and doesn't normally need to be done again.

On AWS or in the setup, renaming any network interfaces is being
handled automatically.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-08-22 14:05:43 +01:00
Michael Tremer
0ff9099443 core124: Ship updated backup include/exclude files 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-08-21 15:06:22 +01:00
Michael Tremer
f868ccb763 backup: Add root's SSH keys and settings 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-08-21 15:05:40 +01:00
Michael Tremer
9b0618c09f backup: Add custom squid configuration files 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-08-21 15:05:13 +01:00
Michael Tremer
7486e30eeb backup: Order incldue/exclude alphabetically 
Nothing has been added or removed

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-08-21 11:32:04 +01:00
Arne Fitzenreiter
3b81e38a08 gcc: x86_64 add libspp to rootfile 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-08-20 17:38:31 +02:00
Arne Fitzenreiter
a019c963a2 core123: ship libssp (was missing on x86_64) 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-08-20 17:05:10 +02:00
Arne Fitzenreiter
66c449c053 gcc: x86_64 add libspp to rootfile 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-08-20 16:22:20 +02:00
Arne Fitzenreiter
b38239f907 core123: ship xtables-addons. 
xtables are build for installed iptables version so we need
to ship it even if it was not updated.
Also clean /lib/xtables because some modules are renamed.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-08-17 22:24:32 +02:00
Arne Fitzenreiter
ee84b26a27 core123: ship openssl sse2 version on i586 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-08-17 07:06:45 +02:00
Michael Tremer
c6b97a0681 core124: Ship updated pciutils 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-08-16 18:55:49 +01:00
Peter Müller
70e4a5b276 pciutils: update to 3.5.6 
The third version of this patch superseds the first and
second one which were broken due to bugs in the MUAs GPG
implementation.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-08-16 18:55:13 +01:00
Michael Tremer
c708276290 core124: Ship updated ids.cgi 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-08-16 18:54:41 +01:00
Michael Tremer
8098a76b52 core124: Ship updated bind 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-08-16 13:05:47 +01:00
Michael Tremer
1233d81f21 core124: Don't re-generate the initrd 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-08-16 13:02:56 +01:00
Michael Tremer
4c01f489f6 core124: Re-install bootloader during update 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-08-16 13:02:37 +01:00
Michael Tremer
de0566323f core124: Ship EFI changes 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-08-16 13:01:42 +01:00
Michael Tremer
046ef135e6 Merge remote-tracking branch 'origin/efi' into next 2018-08-16 12:49:13 +01:00
Michael Tremer
d5461580a5 core124: Ship update localnet init script 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-08-16 12:47:55 +01:00
Michael Tremer
264f34546f Start Core Update 124 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-08-16 12:47:06 +01:00
Arne Fitzenreiter
b211357dae core123: ship updated unbound initskript 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-08-15 13:30:07 +02:00