webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-11 11:35:54 +02:00
Code Issues Packages Projects Releases Wiki Activity
12,327 Commits 2 Branches 1 Tag
f887bf5fbea267d7bbbb2e15efb24e1d14dbdac8
Commit Graph

12327 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Tremer
f887bf5fbe hostapd: Add support for 802.11ac 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:50:41 +01:00
Michael Tremer
4352b0897c core125: Update language files 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:49:47 +01:00
Peter Müller
7d5c5d11ea update OpenSSH default port in language files 
Fixes #11881

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:40:54 +01:00
Matthias Fischer
e27f2aa69a clamav: Update to 0.100.2 
Hi,

"This is a patch release to address several vulnerabilities..."

For details see:
https://blog.clamav.net/2018/10/clamav-01002-has-been-released.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:40:39 +01:00
Michael Tremer
b56a93e3c3 core125: Ship updated GnuTLS 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:36:48 +01:00
Matthias Fischer
5747b6ebfb gnutls: Update to 3.5.19 
Hi,

For changelogs since '3.5.15' see:

https://lists.gnupg.org/pipermail/gnutls-devel/2017-October/008523.html
https://lists.gnupg.org/pipermail/gnutls-devel/2018-January/008538.html
https://lists.gnupg.org/pipermail/gnutls-devel/2018-February/008540.html
https://lists.gnupg.org/pipermail/gnutls-devel/2018-July/008583.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:36:27 +01:00
Michael Tremer
86e00f68b8 core125: Apply changed sysctl.conf immediately 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:35:46 +01:00
Tim FitzGeorge
dfb985caa9 Allow kernel to swap memory on high demand 
Signed-off-by: Tim FitzGeorge <ipfr@tfitzgeorge.me.uk>
Fixes: Bug 11839
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:34:33 +01:00
Michael Tremer
7961b3c7e0 core125: Ship updated bind 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:34:00 +01:00
Matthias Fischer
f8348048ff bind: Update to 9.11.4-P2 
For details see:
http://ftp.isc.org/isc/bind9/9.11.4-P2/RELEASE-NOTES-bind-9.11.4-P2.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:33:46 +01:00
Michael Tremer
bb5f2c53ac core125: Ship updated apache 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:33:23 +01:00
Matthias Fischer
028eafe79f Apache: Update to 2.4.35 
For details see:

http://apache.mirror.digionline.de//httpd/CHANGES_2.4.35

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:30:39 +01:00
Michael Tremer
551a554db6 core125: Ship recently updated sqlite 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:30:05 +01:00
Michael Tremer
f9b7bc9259 Update list of contributors 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:29:23 +01:00
Michael Tremer
7e2d7b9837 Start Core Update 125 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:28:33 +01:00
Michael Tremer
6e386cad2d sqlite: Update to 3.25.2.0 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-10-18 14:23:29 +01:00
Arne Fitzenreiter
e3ab1962ed Merge branch 'core124' of git.ipfire.org:/pub/git/ipfire-2.x into core124 2018-09-28 18:43:15 +02:00
Arne Fitzenreiter
d435f08d9b core124: add apache initskript and nsswitch.conf to updater 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-28 18:12:12 +02:00
Arne Fitzenreiter
71954dcac4 core124: don't remove network trigger script 
this script is still needed if /var/ipfire is on an extra partition.
New installations works without this script.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-28 17:49:10 +02:00
Arne Fitzenreiter
ae61c74db9 core124: fix removing old initrd files on arm systems 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-27 21:53:53 +02:00
Arne Fitzenreiter
eaadeb5af0 kernel: update to 4.14.72 
this commit has many important driver updates so we need to ship it fast...

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-27 08:03:45 +02:00
Arne Fitzenreiter
161a5b834a Merge remote-tracking branch 'origin/master' into core124 2018-09-26 14:09:57 +02:00
Michael Tremer
0a5823db02 ssh: Revert MaxAuthTries setting 
This is entirely not practicable and should have been changed
before. I missed this when I tested the configuration.

It is common that multiple SSH keys exist and three is common
number (RSA, ECDSA & Ed25519). A key passed with ssh -i and
password authentication are not even tried.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-25 20:24:39 +01:00
Arne Fitzenreiter
46b3073242 core124: fix updater 
fix some missing files on arm
remove not needed rebuild initrd because we ship it already built

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-23 02:44:03 +02:00
Matthias Fischer
5bf8ff9fcc nano: Update to 3.1 
Hi,

This update was published just a few days after my "3.0"-commit - running.

For details see:

https://www.nano-editor.org/news.php

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-22 11:43:12 +01:00
Arne Fitzenreiter
0f2186725e core124: finish updater 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-21 15:26:52 +02:00
Arne Fitzenreiter
e2a3147fe5 arm: boot.scr: add setting to edit fdt via uEnv.txt 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-21 15:24:50 +02:00
Arne Fitzenreiter
4eedf6793b rebuild-initrd: update for grub2 
this was was not used for years because we usually ship a prebuild ramdisk
so this incompatiblity was not noticed long time...

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-20 20:03:26 +02:00
Arne Fitzenreiter
bdf9df742c kernel: update to 4.14.71 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-20 19:51:43 +02:00
Michael Tremer
5210b5879b core124: Ship updated iproute2 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-20 14:54:02 +01:00
Matthias Fischer
b1bfe61711 iproute2: Update to 4.18.0 
Triggered by https://bugzilla.ipfire.org/show_bug.cgi?id=11866 ;-)

For details see:
https://lwn.net/Articles/762515/

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-20 14:53:35 +01:00
Michael Tremer
37d7f38018 core124: Ship updated openssh package 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-20 14:52:17 +01:00
Matthias Fischer
74189c1d55 openssh: Update to 7.8p1 
For details see:
http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/ChangeLog

I didn't find an official lfs-patch for openssl-1.1-compatibility,
so I used the patch from here:
https://git.archlinux.org/svntogit/packages.git/plain/trunk/openssl-1.1.0.patch?h=packages/openssh

Building ran without any errors.

I tested with both machines (test on Core 120 - and productive - on Core 122) and found no errors so far:

...
[root@ipfiretest ~]# ssh -V
OpenSSH_7.8p1, OpenSSL 1.1.0h  27 Mar 2018
...

...
root@ipfire: / # ssh -V
OpenSSH_7.8p1, OpenSSL 1.1.0h  27 Mar 2018
...

All ssh-connections ran fine but I'm not REALLY sure if this is sufficient for anyone else.

Could someone please check and confirm!?

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Tested-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-20 14:51:44 +01:00
Michael Tremer
1d2fe90cc8 core124: Ship updated OpenSSH configuration 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-20 14:51:13 +01:00
Michael Tremer
bd0686f441 ssh: Remove AuthenticationMethods directive 
This is only setting something that is default anyways and
prevents sshd from starting if one of the listed methods
is not activated.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-20 14:50:25 +01:00
Peter Müller
07da1af688 use custom SSH server configuration in LFS file 
Include OpenSSH server configuration file during build.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-20 14:28:15 +01:00
Peter Müller
38485efafb add hardened SSH server configuration 
In order to harden OpenSSH server in IPFire, using the upstream default configuration
and edit it via sed commands in LFS file is error-prone and does not scale.

Thereof we ship a custom and more secure OpenSSH server configuration which
is copied into the image during build time.

The fourth version of this patch disables password authentication by
default, since this is required by some cloud hosters in order to apply
the image. Further, this method is less secure than pubkey
authentication.

Non-AEAD ciphers have been re-added to provide compatibility to older
RHEL systems.

Fixes #11750
Fixes #11751
Partially fixes #11538

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Cc: Marcel Lorenz <marcel.lorenz@ipfire.org>
Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-20 14:27:01 +01:00
Michael Tremer
a6c190818a backup: Fix deleting backup files 
Signed-off-by: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-20 14:21:41 +01:00
Arne Fitzenreiter
06131f41e4 kernel: arm32-bit: update rootfiles 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-17 07:44:55 +02:00
Arne Fitzenreiter
362ac1ed61 kernel: update to 4.14.70 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-16 14:29:32 +02:00
Arne Fitzenreiter
a834285d1b kernel: arm: enable chacha poly 
fixes: #11855
todo: add rootfiles for arm 32-bit

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-15 15:58:13 +02:00
Arne Fitzenreiter
276692f378 core124: add kernel files to updater 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-15 15:49:10 +02:00
Michael Tremer
088b7f4f3f core124: Ship updated unbound 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-13 15:03:59 +01:00
Matthias Fischer
76e26c7f69 unbound: Update to 1.8.0 
For details see:

  https://nlnetlabs.nl/svn/unbound/tags/release-1.8.0/doc/Changelog

and

  https://nlnetlabs.nl/projects/unbound/download/

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-13 15:03:59 +01:00
Michael Tremer
0023f8a92b core124: Ship updated backup.cgi 
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-13 15:03:59 +01:00
Michael Tremer
b8fdc7398c static-routes: Make it clear that we are reloading routes 
When RED is brought down, we will reload all static routes.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-13 15:03:59 +01:00
Michael Tremer
614764e58a backup: Sanitise content of ADDON variable 
References: #11830

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-13 15:03:59 +01:00
Michael Tremer
7f6257e0a4 backup: Sanitise FILE parameter 
This parameter was passed to some shell commands without any
sanitisation which allowed an attacker who was authenticated to
the web UI to download arbitrary files from some directories
and delete any file from the filesystem.

References: #11830

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-13 15:03:59 +01:00
Arne Fitzenreiter
924b48c789 kernel: update to 4.14.69 
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
 2018-09-12 21:04:07 +02:00
Peter Müller
eee037b890 update disclaimer in LFS files 
Most of these files still used old dates and/or domain names for contact
mail addresses. This is now replaced by an up-to-date copyright line.

Just some housekeeping... :-)

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
 2018-09-10 19:20:36 +01:00