Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix DNS config, expired certificates, and missing requirements #94

Merged
merged 18 commits into from
Oct 31, 2024
Merged

Conversation

Maspital
Copy link
Collaborator

@Maspital Maspital commented Oct 28, 2024

This addresses a couple of small issues:

  • The attacker did not have internet access post-provisioning due to missing DNS config
    • I opted to simply set it directly via /etc/resolv.conf, aka, without systemd-resolved
  • The attacker couldn't access package repositories due to expired certificates
    • Fixed by adding the current keychain during the post-boot command
  • The external mail handler running on the attacker is missing the aiosmtpd package
    • This change is recent, I simply forgot to also add this packet when updating from the deprecated smtpd
    • After fixing this, I've noticed that using input() within a service isn't a good idea, so I changed the service to simply run forever. It can still be restarted etc. with systemctl
  • Sometimes, the Internet Router is unable to provide internet access to the rest of the network (and itself) for a short period of time
    • Bumping to the latest 2.x core version does not solve this
    • Seems to work reliably when explicitly setting DNS in /var/ipfire/dns/servers (I chose quad8)
    • On the same note, while upgrading from core141 to 157 on the internet router works without problems, it messes up the provisioning on the company router by preventing ansible from reconnecting after a restart (see here). We could still upgrade by running pakfire update/pakfire upgrade as the last provisioning step, but this takes quite a while, so I've opted to leave it at 141.

Resolves #93
Resolves #92
Also related to the mail handler issue mentioned in #80, but no longer relevant as the "buggy" part of the code has been replaced when switching to aiosmtpd

@Maspital
Copy link
Collaborator Author

Regarding upgrading IPFire on the Company Router:
If we want to do so in the future, remember that this also requires slight modifications to the boot command due to a layout change in IPFires menus (see commit).

@Maspital Maspital marked this pull request as ready for review October 28, 2024 15:42
@darshjain
Copy link

Hello, can you check up on this missing package as well
Pasted image

Copy link
Collaborator

@ru37z ru37z left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Discussion required

@ru37z ru37z merged commit a24ecbb into dev Oct 31, 2024
1 check passed
@ru37z ru37z deleted the hotfix branch October 31, 2024 15:04
@Maspital Maspital mentioned this pull request Nov 4, 2024
@1ncludeSteven
Copy link

If you want to upgrade company router from IPFire2.25 to IPFire2.29, then current packetbeat version can not be executed correctly with error message runtime/cgo: pthread_create failed: Operation not permitted

@Maspital
Copy link
Collaborator Author

If you want to upgrade company router from IPFire2.25 to IPFire2.29, then current packetbeat version can not be executed correctly with error message runtime/cgo: pthread_create failed: Operation not permitted

We've decided to not upgrade the company router for now since the current older version works fine. But thank you for the heads-up!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants