Message ID | c4d400d7-1321-bd08-1019-3732a9e887d1@ipfire.org |
---|---|
State | Superseded |
Headers |
Return-Path: <development-bounces@lists.ipfire.org> Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4NWjZ85gswz3wfW for <patchwork@web04.haj.ipfire.org>; Tue, 13 Dec 2022 15:48:00 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4NWjZ7219YzQS; Tue, 13 Dec 2022 15:47:59 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4NWjZ70ngdz2yF3; Tue, 13 Dec 2022 15:47:59 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4NWjZ50TCDz2xSf for <development@lists.ipfire.org>; Tue, 13 Dec 2022 15:47:57 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4NWjZ32qT4zQS for <development@lists.ipfire.org>; Tue, 13 Dec 2022 15:47:54 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1670946476; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=QBZ2/H6Hjfbm5m9gcnnTY995SSPG0562ozckqss0zJ4=; b=d2GYkTV84ZR/UNC5wFFHYA7OLgReXw75Et7F13i76AsYK3IkUIlRXMpwmRcFFHDLM9wzRU jVHxBEGbOL6BWDCA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1670946476; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=QBZ2/H6Hjfbm5m9gcnnTY995SSPG0562ozckqss0zJ4=; b=envkKkGmdtBV4bA/haIwUAa4hOo82l7rra/of9iTPTn5cADEJypXtumlPIs9s1HeDgXEha hIYJINUS8N8NgRs1nEbvc8mUV3p8+LYMc6cOEf2P1Tunvq3pwQA1qpULQnGC4+AvU/+vI1 RFxSVTMPaH/hlIdyRunFipcng7GYEuQMjn+NREsZoy9b605OTpG33QwTiPm2Y75NBoAsvd pIRyCTTlgNMl9XLYa69Q+5VWEPl1Jd4b13dCN/WPDr2EA4Q8ztpFzmVn+xys0ABhcyImvg z93X8691BUv5ZbphsZSXQAPMJ4A33Zd8FHxIPPooixy6DaKjCBfXpK4k6/NFcQ== Message-ID: <c4d400d7-1321-bd08-1019-3732a9e887d1@ipfire.org> Date: Tue, 13 Dec 2022 15:47:49 +0000 MIME-Version: 1.0 Content-Language: en-US To: "IPFire: Development" <development@lists.ipfire.org> From: =?utf-8?q?Peter_M=C3=BCller?= <peter.mueller@ipfire.org> Subject: [PATCH] backup(.pl): Replace OpenVPN DH parameter with ffdhe4096 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk <development.lists.ipfire.org> List-Unsubscribe: <https://lists.ipfire.org/mailman/options/development>, <mailto:development-request@lists.ipfire.org?subject=unsubscribe> List-Archive: <http://lists.ipfire.org/pipermail/development/> List-Post: <mailto:development@lists.ipfire.org> List-Help: <mailto:development-request@lists.ipfire.org?subject=help> List-Subscribe: <https://lists.ipfire.org/mailman/listinfo/development>, <mailto:development-request@lists.ipfire.org?subject=subscribe> Errors-To: development-bounces@lists.ipfire.org Sender: "Development" <development-bounces@lists.ipfire.org> |
Series |
backup(.pl): Replace OpenVPN DH parameter with ffdhe4096
|
|
Commit Message
Peter Müller
Dec. 13, 2022, 3:47 p.m. UTC
This ensures restoring a backup won't silently bring back an insecure
Diffie-Hellman parameter (which could also not be inspected through the
web interface anymore).
Reported-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
---
config/backup/backup.pl | 9 +++++++++
1 file changed, 9 insertions(+)
Comments
Also, backup.pl is actually a shell script, so it should either go as "backup.sh" or without any file suffix whatsoever. :-) > This ensures restoring a backup won't silently bring back an insecure > Diffie-Hellman parameter (which could also not be inspected through the > web interface anymore). > > Reported-by: Michael Tremer <michael.tremer@ipfire.org> > Signed-off-by: Peter Müller <peter.mueller@ipfire.org> > --- > config/backup/backup.pl | 9 +++++++++ > 1 file changed, 9 insertions(+) > > diff --git a/config/backup/backup.pl b/config/backup/backup.pl > index 6fd9e45bb..520d9315d 100644 > --- a/config/backup/backup.pl > +++ b/config/backup/backup.pl > @@ -187,6 +187,15 @@ restore_backup() { > # Update OpenVPN CRL > /etc/fcron.daily/openvpn-crl-updater > > + # Replace previously used OpenVPN Diffie-Hellman parameter by ffdhe4096 > + if [ -f /var/ipfire/ovpn/server.conf ]; then > + sed -i 's|/var/ipfire/ovpn/ca/dh1024.pem|/etc/ssl/ffdhe4096.pem|' /var/ipfire/ovpn/server.conf > + fi > + > + if [ -f "/var/ipfire/ovpn/n2nconf/*/*.conf" ]; then > + sed -i 's|/var/ipfire/ovpn/ca/dh1024.pem|/etc/ssl/ffdhe4096.pem|' /var/ipfire/ovpn/n2nconf/*/*.conf > + fi > + > return 0 > } >
Hello Peter, > On 13 Dec 2022, at 15:47, Peter Müller <peter.mueller@ipfire.org> wrote: > > This ensures restoring a backup won't silently bring back an insecure > Diffie-Hellman parameter (which could also not be inspected through the > web interface anymore). > > Reported-by: Michael Tremer <michael.tremer@ipfire.org> > Signed-off-by: Peter Müller <peter.mueller@ipfire.org> > --- > config/backup/backup.pl | 9 +++++++++ > 1 file changed, 9 insertions(+) > > diff --git a/config/backup/backup.pl b/config/backup/backup.pl > index 6fd9e45bb..520d9315d 100644 > --- a/config/backup/backup.pl > +++ b/config/backup/backup.pl > @@ -187,6 +187,15 @@ restore_backup() { > # Update OpenVPN CRL > /etc/fcron.daily/openvpn-crl-updater > > + # Replace previously used OpenVPN Diffie-Hellman parameter by ffdhe4096 > + if [ -f /var/ipfire/ovpn/server.conf ]; then > + sed -i 's|/var/ipfire/ovpn/ca/dh1024.pem|/etc/ssl/ffdhe4096.pem|' /var/ipfire/ovpn/server.conf > + fi > + > + if [ -f "/var/ipfire/ovpn/n2nconf/*/*.conf" ]; then > + sed -i 's|/var/ipfire/ovpn/ca/dh1024.pem|/etc/ssl/ffdhe4096.pem|' /var/ipfire/ovpn/n2nconf/*/*.conf > + fi The second command will never be executed because "/var/ipfire/ovpn/n2nconf/*/*.conf” will never exist. Because the string is quoted, the shell won’t conduct any path expansion. What could work is running the sed command on all files simultaneously and if there is nothing to change, it won’t do anything. Passing server.conf and n2nconfig/*/*.conf will never fail if there is no N2N configuration. server.conf should always exist. Best, -Michael > + > return 0 > } > > -- > 2.35.3
Alternatively we could just not change anything and add a smiling from the old path to the new one. > On 14 Dec 2022, at 18:02, Michael Tremer <michael.tremer@ipfire.org> wrote: > > Hello Peter, > >> On 13 Dec 2022, at 15:47, Peter Müller <peter.mueller@ipfire.org> wrote: >> >> This ensures restoring a backup won't silently bring back an insecure >> Diffie-Hellman parameter (which could also not be inspected through the >> web interface anymore). >> >> Reported-by: Michael Tremer <michael.tremer@ipfire.org> >> Signed-off-by: Peter Müller <peter.mueller@ipfire.org> >> --- >> config/backup/backup.pl | 9 +++++++++ >> 1 file changed, 9 insertions(+) >> >> diff --git a/config/backup/backup.pl b/config/backup/backup.pl >> index 6fd9e45bb..520d9315d 100644 >> --- a/config/backup/backup.pl >> +++ b/config/backup/backup.pl >> @@ -187,6 +187,15 @@ restore_backup() { >> # Update OpenVPN CRL >> /etc/fcron.daily/openvpn-crl-updater >> >> + # Replace previously used OpenVPN Diffie-Hellman parameter by ffdhe4096 >> + if [ -f /var/ipfire/ovpn/server.conf ]; then >> + sed -i 's|/var/ipfire/ovpn/ca/dh1024.pem|/etc/ssl/ffdhe4096.pem|' /var/ipfire/ovpn/server.conf >> + fi >> + >> + if [ -f "/var/ipfire/ovpn/n2nconf/*/*.conf" ]; then >> + sed -i 's|/var/ipfire/ovpn/ca/dh1024.pem|/etc/ssl/ffdhe4096.pem|' /var/ipfire/ovpn/n2nconf/*/*.conf >> + fi > > The second command will never be executed because "/var/ipfire/ovpn/n2nconf/*/*.conf” will never exist. > > Because the string is quoted, the shell won’t conduct any path expansion. > > What could work is running the sed command on all files simultaneously and if there is nothing to change, it won’t do anything. Passing server.conf and n2nconfig/*/*.conf will never fail if there is no N2N configuration. server.conf should always exist. > > Best, > -Michael > >> + >> return 0 >> } >> >> -- >> 2.35.3
This used to be a Perl script, but got rewritten. And it would have been a pain to change it since it is located in /var/ipfire and so on. So I left the extension. > On 13 Dec 2022, at 15:48, Peter Müller <peter.mueller@ipfire.org> wrote: > > Also, backup.pl is actually a shell script, so it should either go as "backup.sh" > or without any file suffix whatsoever. :-) > >> This ensures restoring a backup won't silently bring back an insecure >> Diffie-Hellman parameter (which could also not be inspected through the >> web interface anymore). >> >> Reported-by: Michael Tremer <michael.tremer@ipfire.org> >> Signed-off-by: Peter Müller <peter.mueller@ipfire.org> >> --- >> config/backup/backup.pl | 9 +++++++++ >> 1 file changed, 9 insertions(+) >> >> diff --git a/config/backup/backup.pl b/config/backup/backup.pl >> index 6fd9e45bb..520d9315d 100644 >> --- a/config/backup/backup.pl >> +++ b/config/backup/backup.pl >> @@ -187,6 +187,15 @@ restore_backup() { >> # Update OpenVPN CRL >> /etc/fcron.daily/openvpn-crl-updater >> >> + # Replace previously used OpenVPN Diffie-Hellman parameter by ffdhe4096 >> + if [ -f /var/ipfire/ovpn/server.conf ]; then >> + sed -i 's|/var/ipfire/ovpn/ca/dh1024.pem|/etc/ssl/ffdhe4096.pem|' /var/ipfire/ovpn/server.conf >> + fi >> + >> + if [ -f "/var/ipfire/ovpn/n2nconf/*/*.conf" ]; then >> + sed -i 's|/var/ipfire/ovpn/ca/dh1024.pem|/etc/ssl/ffdhe4096.pem|' /var/ipfire/ovpn/n2nconf/*/*.conf >> + fi >> + >> return 0 >> } >>
Hello Michael, thanks for your reply, and apologies for the belated one of mine. > Hello Peter, > >> On 13 Dec 2022, at 15:47, Peter Müller <peter.mueller@ipfire.org> wrote: >> >> This ensures restoring a backup won't silently bring back an insecure >> Diffie-Hellman parameter (which could also not be inspected through the >> web interface anymore). >> >> Reported-by: Michael Tremer <michael.tremer@ipfire.org> >> Signed-off-by: Peter Müller <peter.mueller@ipfire.org> >> --- >> config/backup/backup.pl | 9 +++++++++ >> 1 file changed, 9 insertions(+) >> >> diff --git a/config/backup/backup.pl b/config/backup/backup.pl >> index 6fd9e45bb..520d9315d 100644 >> --- a/config/backup/backup.pl >> +++ b/config/backup/backup.pl >> @@ -187,6 +187,15 @@ restore_backup() { >> # Update OpenVPN CRL >> /etc/fcron.daily/openvpn-crl-updater >> >> + # Replace previously used OpenVPN Diffie-Hellman parameter by ffdhe4096 >> + if [ -f /var/ipfire/ovpn/server.conf ]; then >> + sed -i 's|/var/ipfire/ovpn/ca/dh1024.pem|/etc/ssl/ffdhe4096.pem|' /var/ipfire/ovpn/server.conf >> + fi >> + >> + if [ -f "/var/ipfire/ovpn/n2nconf/*/*.conf" ]; then >> + sed -i 's|/var/ipfire/ovpn/ca/dh1024.pem|/etc/ssl/ffdhe4096.pem|' /var/ipfire/ovpn/n2nconf/*/*.conf >> + fi > > The second command will never be executed because "/var/ipfire/ovpn/n2nconf/*/*.conf” will never exist. > > Because the string is quoted, the shell won’t conduct any path expansion. Indeed, and even with the string not quoted, it won't work either, at least according to https://www.shellcheck.net/wiki/SC2144. Glad you caught that, this error made it into the update.sh script of Core Update 172 as well. :-/ > What could work is running the sed command on all files simultaneously and if there is nothing to change, it won’t do anything. Passing server.conf and n2nconfig/*/*.conf will never fail if there is no N2N configuration. server.conf should always exist. Thanks. I can confirm that sed -i 's|/var/ipfire/ovpn/ca/dh1024.pem|/etc/ssl/ffdhe4096.pem|' /var/ipfire/ovpn/server.conf /var/ipfire/ovpn/n2nconf/*/*.conf conducts this task properly. I will update the update.sh script and take the liberty to amend this change to backup.pl straight away. I'll get back to you bilaterally for the rest of C172. Thanks, and best regards, Peter Müller > > Best, > -Michael > >> + >> return 0 >> } >> >> -- >> 2.35.3 >
diff --git a/config/backup/backup.pl b/config/backup/backup.pl index 6fd9e45bb..520d9315d 100644 --- a/config/backup/backup.pl +++ b/config/backup/backup.pl @@ -187,6 +187,15 @@ restore_backup() { # Update OpenVPN CRL /etc/fcron.daily/openvpn-crl-updater + # Replace previously used OpenVPN Diffie-Hellman parameter by ffdhe4096 + if [ -f /var/ipfire/ovpn/server.conf ]; then + sed -i 's|/var/ipfire/ovpn/ca/dh1024.pem|/etc/ssl/ffdhe4096.pem|' /var/ipfire/ovpn/server.conf + fi + + if [ -f "/var/ipfire/ovpn/n2nconf/*/*.conf" ]; then + sed -i 's|/var/ipfire/ovpn/ca/dh1024.pem|/etc/ssl/ffdhe4096.pem|' /var/ipfire/ovpn/n2nconf/*/*.conf + fi + return 0 }