Тег: ipfire

IPFire 2.29 Core 190

The IPFire project develops a minimal operating system for routers and firewalls. The project's latest release, IPFire 2.29 Core 190, provides a kernel update and begins phasing out support for RSA encryption: "We are starting the path to remove RSA from the IPFire web UI and SSH. On new installations, RSA keys won't be generated any more. On existing installations, this update removes the RSA key from the web UI, but we keep the RSA key for SSH to not break any monitoring tools, etc. We still believe that RSA is strong enough to be used in today's world, but since there is sufficient browser and SSH client support for Elliptic Curve Cryptography which is considered to be much stronger, we want to raise the bar for any potential future attacks on RSA. IPFire is also now using post-quantum cryptography for SSH key exchanges: Streamlined NTRU Prime sntrup761 and X25519 with SHA-512 (sntrup761x25519-sha512) and Module-Lattice-based Key-Encapsulation Mechanism (MK-KEM, mlkem768x25519-sha256) have been enabled."

Софт

IPFire 2.29 Core 187

IPFire is a Linux-based operating system for firewalls. The project focuses on easy set-up and configuration. The project's latest release introduces an extra layer of protection against denial-of-service (DoS) attacks. "Since IPFire is very commonly deployed in data centres where denial-of-service attacks happen on a regular basis, we now have added better protection against those kinds of attacks. Formerly, the system protected itself rather well against (D)DoS attacks, but this was only limited if TCP connections terminated at the firewall itself like for reverse proxies, etc. Now, IPFire can use TCP SYN cookies to protect infrastructure behind it better against SYN flood attacks. This is especially useful in high-bandwidth scenarios and cloud deployments and can be activated with only one checkbox separately for each firewall rule."

Софт

IPFire is a Linux distribution that focuses on easy setup, good handling and high level of security and is mostly used on routers and firewalls. The project's latest release focused on bug fixes and minor upgrades, including fixing IPsec certificate generation in some situations. The release announcement shares the highlights: "An edge case related to bug #13138, which caused IPsec root/host certificate generation to fail on the first attempt only, has been fixed. While editing OpenVPN static IP address pools, spaces are now handled correctly again. udev rules for LVM volumes have been fixed, allowing for configured LVM volumes to start properly on boot again. Remove entries for additional mass storage via the web interface of the ExtraHD add-on have been fixed, partially resolving #12863. Filesystem journal features are now always enabled for cloud images, and as soon as a disk with SMART support is detected. misc-progs, the safety net between IPFire's web interface and the core system, have been improved under the hood to allow for better return code enumeration. Stéphane Pautrel has contributed improvements to the French translation of IPFire's web interface."

Софт

IPFire is a lightweight Linux distribution for use with firewalls and routers. The project has released a new update which introduces publicly supplied IP block lists. "The next Core Update is released: IPFire 2.27 - Core Update 170. It features new IP blocklists for the firewall engine, significant improvements to Pakfire, modernizes the default cryptographic algorithm selection for IPsec connections, as well as a new kernel, and a plethora of bug fixes and security improvements under the hood. IP-Reputation Blocking to keep known threats out: Based on prior development by Tim FitzGeorge, Stefan brought a new feature to the firewall engine, which allows the easy activation of various public IP-based blocklists, just by a single click. All enabled blocklists are updated automatically at an appropriate interval (a technique we already deployed for updating IPS rulesets), and protect against various threats, such as IP addresses or networks having a poor reputation, being involved with cyber crime hosting, or simply not allocated, hence no traffic should be routed to and from them."

Софт

The IPFire team have published a new update to their security and firewall focused distribution. A key update affects the project's intrusion prevention system (IPS): "Stefan contributed a patch series for notably improving the IPS, particularly when it comes to handling of ruleset providers. While many of the changes are done under the hood, the following are visible to the web interface: Monitoring mode can now be enabled for each ruleset provider individually. This makes baselining and testing much less of a hassle, since newly introduced IPS ruleset providers can now first be used for logging only, without risking disruptions or unintended side-effects. Parsing and restructuring changed or updated rulesets has been improved and is now faster by orders of magnitude. The downloader will now automatically check whether a ruleset has been updated on its providers' server by checking the ETag HTTP header. This allows us to drop the update interval selection; every IPS ruleset will now updated automatically on the appropriate interval."

Софт