IPFire is een opensourcefirewall voor i586-, x86_64- en ARM-systemen. Het bevat onder andere een intrusion detection/prevention system, deelt het netwerk op in zones, doet stateful packet inspection en biedt vpn-mogelijkheden. Voor meer informatie verwijzen we naar deze pagina. De ontwikkelaars hebben versie 2.27 Core Update 172 uitgebracht, een stabiele uitgave voor productiesystemen. De bijbehorende aantekeningen zien er als volgt uit:
IPFire 2.27 - Core Update 172 releasedShortly after Christmas, we release IPFire 2.27 - Core Update 172. It comes with cryptography improvements for IPsec and OpenVPN, as well as security improvements under the hood, a plethora of package updates and various bugs fixed across the place.
Future-proofing VPN cryptographyThis Core Update updates the key lengths of host certificates for both IPsec and OpenVPN clients/peers to 4,096 bit RSA, since the previous default of 2,048 bit is no longer recommended for long-term security purposes.
Both IPsec and OpenVPN root CA length has always been 4,096 bit, as has the key pair generated for IPFire's web interface - no action is required on that front. Unfortunately, existing IPsec/OpenVPN client/peer configurations cannot be migrated automatically, and have to be phased-out manually. Thanks to the respective CA certificates not requiring an update, complete disruptions of VPN infrastructure can, however, be avoided.
OpenVPN is automatically reconfigured to use a secure Diffie-Hellman parameter, both of sufficient length of 4,096 bit and standardized (see RFC 7919, section A.3, bug #12632). All OpenVPN clients and peers will automatically benefit from this cryptography improvement; no manual action is required. This also obsoletes the necessity of generating or uploading Diffie-Hellman parameters while configuring OpenVPN, saving a lot of time, as the generation of such parameters could have taken hours on slower hardware.
For early 2023, we anticipate post-quantum cryptography (PQC) to land in IPFire for IPsec, for which there is a strong (and growing) need, thanks to so-called "capture now, decrypt later" attacks endangering the confidentiality of information with long-term secrecy demand, such as biometric and health data.
Miscellaneous
- IPFire's trust store has been updated to incorporate Mozilla's decision to distrust the root certificates of TrustCor Systems S. DE R.L. (further media coverage)1
- Displaying the status and actions of add-ons whose service names differed from their package names is fixed (#12935). The same page has also seen some translation improvements.
- Certificate Revocation Lists (CRLs) of OpenVPN are now properly backed up and reloaded before OpenVPN is (re-)started.
- Adolf Belka submitted a massive patchset for updating Python.
- Roberto Peña updated and improved the Spanish translation of IPFire's web interface.
- Some unnecessary files from
linux-firmwareare no longer shipped and automatically removed from existing installations to keep the system as lean as possible.- Various file permissions have been tightened as a defense in-depth measure.
- The obsolete
gnu-netcatadd-on has been dropped.- Updated packages:
arm-trusted-firmware2.7,bash5.2,bind9.16.35,conntrack-tools1.4.7,curl7.86.0,elinks0.15.1,ethtool6.0,expat2.5.0,iana-etc20221107,intel-microcode20221108,iproute26.0.0,libedit20221030-3.1,libhtp0.5.42,libloc0.9.15,libnetfilter_conntrack1.0.9,libpng, 1.6.39,libtasn14.19.0,libtiff4.4.0,libuv1.44.2,libxcrypt4.4.33,libxml22.10.3,linux-firmware20221109,memtest86+6.00,nano7.0, OpenSSH 9.1p1, OpenSSL 1.1.1s, OpenVPN 2.5.8,poppler22.11.0,python33.10.8,readline8.2,sed4.9,sqlite3400000,strongswan5.9.8,sudo1.9.12p1,suricata6.0.9,sysstat12.7.1,tzdata2022e,u-boot2022.10,unbound1.17.0,usbutils015,vnstat2.10,xz5.2.8,zlib1.2.13- Updated add-ons:
cups-filters1.28.16,ddrescue1.26,dehydrated0.7.1,fetchmail6.4.34,ffmpeg5.1.2,flac1.4.2,fmt9.1.0,git2.38.1,libassuan2.5.5,libvirt8.9.0,mpd0.23.10,nginx1.22.1,pcengines-apu-firmware4.17.0.2,qemu7.1.0,qemu-ga7.1.0,rsync3.2.7,samba4.17.3,sdl2
:fill(white):strip_exif()/i/2004006994.jpeg?f=thumbmedium)
/u/96077/crop5b8d7c89bae9d_cropped.png?f=community){kind=small}
/u/94596/crop643fb12fd4e6d.png?f=community){kind=small}
:strip_icc():strip_exif()/u/140051/BSOD.jpg?f=community){kind=small}
:strip_exif()/u/128173/crop59a1592e54731_cropped.gif?f=community){kind=small}
:strip_exif()/u/19165/9cdefd.gif?f=community){kind=small}