webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-18 23:12:59 +02:00
Code Issues Packages Projects Releases Wiki Activity
12,341 Commits 2 Branches 1 Tag
d1654fd0001ae67dbd7ff52ef19cd3cf30de128f
Commit Graph

6102 Commits

Author SHA1 Message Date
Michael Tremer
f21313ccb5 e2fsprogs: Update to 1.44.4 
Fixes build with glibc >= 2.28

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-19 09:07:56 +01:00
Michael Tremer
347bbe8fb4 coreutils: Update to 8.30 
Builds with newer versions of glibc

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-19 08:57:11 +01:00
Michael Tremer
3b884ae65e core125: Ship updated SSH configuration 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:54:22 +01:00
Peter Müller
1223078cde fix broken SFTP in OpenSSH server 
Fixes #11887

The second version of this patch uses the correct path on IPFire systems
and supersedes the first one. It also referrs to the correct issue ID.

Thanks to Matthias Fischer for reporting this.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:53:11 +01:00
Michael Tremer
6096ad9a5d core125: Ship updated dhcpcd 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:52:57 +01:00
Michael Tremer
a8ae890ecd core125: Ship updated unbound 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:51:38 +01:00
Matthias Fischer
795d89e943 unbound: Update to 1.8.1 
For details see:
https://nlnetlabs.nl/projects/unbound/download/

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:50:58 +01:00
Michael Tremer
3f46fc1519 hostapd: Compile with debugging messages 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:50:45 +01:00
Michael Tremer
4352b0897c core125: Update language files 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:49:47 +01:00
Michael Tremer
b56a93e3c3 core125: Ship updated GnuTLS 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:36:48 +01:00
Matthias Fischer
5747b6ebfb gnutls: Update to 3.5.19 
Hi,

For changelogs since '3.5.15' see:

https://lists.gnupg.org/pipermail/gnutls-devel/2017-October/008523.html
https://lists.gnupg.org/pipermail/gnutls-devel/2018-January/008538.html
https://lists.gnupg.org/pipermail/gnutls-devel/2018-February/008540.html
https://lists.gnupg.org/pipermail/gnutls-devel/2018-July/008583.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:36:27 +01:00
Michael Tremer
86e00f68b8 core125: Apply changed sysctl.conf immediately 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:35:46 +01:00
Tim FitzGeorge
dfb985caa9 Allow kernel to swap memory on high demand 
Signed-off-by: Tim FitzGeorge <ipfr@tfitzgeorge.me.uk>
Fixes: Bug 11839
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:34:33 +01:00
Michael Tremer
7961b3c7e0 core125: Ship updated bind 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:34:00 +01:00
Michael Tremer
bb5f2c53ac core125: Ship updated apache 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:33:23 +01:00
Matthias Fischer
028eafe79f Apache: Update to 2.4.35 
For details see:

http://apache.mirror.digionline.de//httpd/CHANGES_2.4.35

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:30:39 +01:00
Michael Tremer
551a554db6 core125: Ship recently updated sqlite 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:30:05 +01:00
Michael Tremer
f9b7bc9259 Update list of contributors 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:29:23 +01:00
Michael Tremer
7e2d7b9837 Start Core Update 125 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:28:33 +01:00
Arne Fitzenreiter
e3ab1962ed Merge branch 'core124' of git.ipfire.org:/pub/git/ipfire-2.x into core124 2018-09-28 18:43:15 +02:00
Arne Fitzenreiter
d435f08d9b core124: add apache initskript and nsswitch.conf to updater 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-28 18:12:12 +02:00
Arne Fitzenreiter
71954dcac4 core124: don't remove network trigger script 
this script is still needed if /var/ipfire is on an extra partition.
New installations works without this script.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-28 17:49:10 +02:00
Arne Fitzenreiter
ae61c74db9 core124: fix removing old initrd files on arm systems 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-27 21:53:53 +02:00
Arne Fitzenreiter
161a5b834a Merge remote-tracking branch 'origin/master' into core124 2018-09-26 14:09:57 +02:00
Michael Tremer
0a5823db02 ssh: Revert MaxAuthTries setting 
This is entirely not practicable and should have been changed
before. I missed this when I tested the configuration.

It is common that multiple SSH keys exist and three is common
number (RSA, ECDSA & Ed25519). A key passed with ssh -i and
password authentication are not even tried.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-25 20:24:39 +01:00
Arne Fitzenreiter
46b3073242 core124: fix updater 
fix some missing files on arm
remove not needed rebuild initrd because we ship it already built

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-23 02:44:03 +02:00
Arne Fitzenreiter
0f2186725e core124: finish updater 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-21 15:26:52 +02:00
Arne Fitzenreiter
e2a3147fe5 arm: boot.scr: add setting to edit fdt via uEnv.txt 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-21 15:24:50 +02:00
Arne Fitzenreiter
bdf9df742c kernel: update to 4.14.71 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-20 19:51:43 +02:00
Michael Tremer
5210b5879b core124: Ship updated iproute2 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-20 14:54:02 +01:00
Matthias Fischer
b1bfe61711 iproute2: Update to 4.18.0 
Triggered by https://bugzilla.ipfire.org/show_bug.cgi?id=11866 ;-)

For details see:
https://lwn.net/Articles/762515/

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-20 14:53:35 +01:00
Michael Tremer
37d7f38018 core124: Ship updated openssh package 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-20 14:52:17 +01:00
Michael Tremer
1d2fe90cc8 core124: Ship updated OpenSSH configuration 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-20 14:51:13 +01:00
Michael Tremer
bd0686f441 ssh: Remove AuthenticationMethods directive 
This is only setting something that is default anyways and
prevents sshd from starting if one of the listed methods
is not activated.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-20 14:50:25 +01:00
Peter Müller
38485efafb add hardened SSH server configuration 
In order to harden OpenSSH server in IPFire, using the upstream default configuration
and edit it via sed commands in LFS file is error-prone and does not scale.

Thereof we ship a custom and more secure OpenSSH server configuration which
is copied into the image during build time.

The fourth version of this patch disables password authentication by
default, since this is required by some cloud hosters in order to apply
the image. Further, this method is less secure than pubkey
authentication.

Non-AEAD ciphers have been re-added to provide compatibility to older
RHEL systems.

Fixes #11750
Fixes #11751
Partially fixes #11538

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Cc: Marcel Lorenz <marcel.lorenz@ipfire.org>
Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-20 14:27:01 +01:00
Michael Tremer
a6c190818a backup: Fix deleting backup files 
Signed-off-by: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-20 14:21:41 +01:00
Arne Fitzenreiter
06131f41e4 kernel: arm32-bit: update rootfiles 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-17 07:44:55 +02:00
Arne Fitzenreiter
a834285d1b kernel: arm: enable chacha poly 
fixes: #11855
todo: add rootfiles for arm 32-bit

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-15 15:58:13 +02:00
Arne Fitzenreiter
276692f378 core124: add kernel files to updater 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-15 15:49:10 +02:00
Michael Tremer
088b7f4f3f core124: Ship updated unbound 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-13 15:03:59 +01:00
Matthias Fischer
76e26c7f69 unbound: Update to 1.8.0 
For details see:

  https://nlnetlabs.nl/svn/unbound/tags/release-1.8.0/doc/Changelog

and

  https://nlnetlabs.nl/projects/unbound/download/

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-13 15:03:59 +01:00
Michael Tremer
0023f8a92b core124: Ship updated backup.cgi 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-13 15:03:59 +01:00
Michael Tremer
b8fdc7398c static-routes: Make it clear that we are reloading routes 
When RED is brought down, we will reload all static routes.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-13 15:03:59 +01:00
Arne Fitzenreiter
924b48c789 kernel: update to 4.14.69 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-12 21:04:07 +02:00
Michael Tremer
063de1600b core124: Ship CA certificates 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-10 18:23:27 +01:00
Peter Müller
05a89532d7 update ca-certificates CA bundle 
Update the CA certificates list to what Mozilla NSS ships currently.

The original file can be retrieved from:
https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-10 18:22:55 +01:00
Peter Müller
edea6ec5a4 add hardened SSH client configuration 
Introduce a custom OpenSSH client configuration file for IPFire.
Some people use it as a jumping host, so applying hardening options
system-wide improves security.

Cryptography setup is the same as for OpenSSH server configuration.

The second version of this patch re-adds some non-AEAD cipher suites
which are needed for connecting to older RHEL systems.

Partially fixes #11751

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-10 16:36:39 +01:00
Michael Tremer
0762dcc4e8 core124: Ship updated unbound configuration and restart daemon 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-10 16:35:25 +01:00
Peter Müller
8a0585837c Unbound: Use aggressive NSEC 
This avoids some needless lookups to destination domains
with a very high NXDOMAIN rate and reduces load on upstream
servers.

See https://nlnetlabs.nl/documentation/unbound/unbound.conf/
for further details.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-10 16:34:30 +01:00
Peter Müller
4e4128faac Unbound: Use caps for IDs 
Attempt to detect DNS spoofing attacks by inserting 0x20-encoded
random bits into upstream queries. Upstream documentation claims
it to be an experimental implementation, it did not cause any trouble
on productive systems here.

See https://nlnetlabs.nl/documentation/unbound/unbound.conf/ for
further details.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-10 16:34:20 +01:00