diff --git a/CHANGELOG.md b/CHANGELOG.md index f8c91d77..b997d16b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -16,6 +16,27 @@ Control panel: Setup: * A swap file is now created if system memory is less than 2GB, 5GB of free disk space is available, and if no swap file yet exists. + +v0.17c (April 1, 2016) +---------------------- + +This update addresses some minor security concerns and some installation issues. + +ownCoud: + +* Block web access to the configuration parameters (config.php). There is no immediate impact (see [#776](https://github.com/mail-in-a-box/mailinabox/pull/776)), although advanced users may want to take note. + +Mail: + +* Roundcube html5_notifier plugin updated from version 0.6 to 0.6.2 to fix Roundcube getting stuck for some people. + +Control panel: + +* Prevent click-jacking of the management interface by adding HTTP headers. +* Failed login no longer reveals whether an account exists on the system. + +Setup: + * Setup dialogs did not appear correctly when connecting to SSH using Putty on Windows. * We now install Roundcube from our own mirror because Sourceforge's downloads experience frequent intermittant unavailability. diff --git a/README.md b/README.md index d8329054..a12e48bb 100644 --- a/README.md +++ b/README.md @@ -59,7 +59,7 @@ by me: $ curl -s https://keybase.io/joshdata/key.asc | gpg --import gpg: key C10BDD81: public key "Joshua Tauberer " imported - $ git verify-tag v0.17b + $ git verify-tag v0.17c gpg: Signature made ..... using RSA key ID C10BDD81 gpg: Good signature from "Joshua Tauberer " gpg: WARNING: This key is not certified with a trusted signature! @@ -72,7 +72,7 @@ and on my [personal homepage](https://razor.occams.info/). (Of course, if this r Checkout the tag corresponding to the most recent release: - $ git checkout v0.17b + $ git checkout v0.17c Begin the installation. diff --git a/conf/fail2ban/filter.d/miab-management-daemon.conf b/conf/fail2ban/filter.d/miab-management-daemon.conf index 0541ab6d..0b0489c2 100644 --- a/conf/fail2ban/filter.d/miab-management-daemon.conf +++ b/conf/fail2ban/filter.d/miab-management-daemon.conf @@ -8,5 +8,5 @@ before = common.conf _daemon = mailinabox -failregex = MIAB: Failed login attempt from ip - timestamp .* +failregex = Mail-in-a-Box Management Daemon: Failed login attempt from ip - timestamp .* ignoreregex = diff --git a/conf/fail2ban/jail.d/recidive.conf b/conf/fail2ban/jail.d/recidive.conf index 3546a839..0867e5ca 100644 --- a/conf/fail2ban/jail.d/recidive.conf +++ b/conf/fail2ban/jail.d/recidive.conf @@ -1,4 +1,14 @@ [recidive] enabled = true maxretry = 10 - +action = iptables-allports[name=recidive] +# In the recidive section of jail.conf the action contains: +# +# action = iptables-allports[name=recidive] +# sendmail-whois-lines[name=recidive, logpath=/var/log/fail2ban.log] +# +# The last line on the action will sent an email to the configured address. This mail will +# notify the administrator that someone has been repeatedly triggering one of the other jails. +# By default we don't configure this address and no action is required from the admin anyway. +# So the notification is ommited. This will prevent message appearing in the mail.log that mail +# can't be delivered to fail2ban@$HOSTNAME. diff --git a/conf/fail2ban/jail.local b/conf/fail2ban/jail.local index fcf05396..4150eeeb 100644 --- a/conf/fail2ban/jail.local +++ b/conf/fail2ban/jail.local @@ -5,4 +5,3 @@ # ping services over the public interface so we should whitelist that address of # ours too. The string is substituted during installation. ignoreip = 127.0.0.1/8 PUBLIC_IP - diff --git a/conf/nginx-primaryonly.conf b/conf/nginx-primaryonly.conf index 8fd546af..55c80eba 100644 --- a/conf/nginx-primaryonly.conf +++ b/conf/nginx-primaryonly.conf @@ -18,8 +18,11 @@ rewrite ^(/cloud/core/doc/[^\/]+/)$ $1/index.html; location /cloud/ { alias /usr/local/lib/owncloud/; - location ~ ^/(data|config|\.ht|db_structure\.xml|README) { - deny all; + location ~ ^/cloud/(build|tests|config|lib|3rdparty|templates|data|README)/ { + deny all; + } + location ~ ^/cloud/(?:\.|autotest|occ|issue|indie|db_|console) { + deny all; } } location ~ ^(/cloud)((?:/ocs)?/[^/]+\.php)(/.*)?$ { diff --git a/management/daemon.py b/management/daemon.py index aae7a029..9bc6429b 100755 --- a/management/daemon.py +++ b/management/daemon.py @@ -603,7 +603,7 @@ def log_failed_login(request): # We need to add a timestamp to the log message, otherwise /dev/log will eat the "duplicate" # message. - app.logger.warning( "MIAB: Failed login attempt from ip %s - timestamp %s" % (ip, time.time())) + app.logger.warning( "Mail-in-a-Box Management Daemon: Failed login attempt from ip %s - timestamp %s" % (ip, time.time())) # APP diff --git a/management/templates/custom-dns.html b/management/templates/custom-dns.html index f1244810..bd5643c3 100644 --- a/management/templates/custom-dns.html +++ b/management/templates/custom-dns.html @@ -36,6 +36,7 @@ + diff --git a/setup/bootstrap.sh b/setup/bootstrap.sh index 6ff21c50..3e793576 100644 --- a/setup/bootstrap.sh +++ b/setup/bootstrap.sh @@ -7,7 +7,7 @@ ######################################################### if [ -z "$TAG" ]; then - TAG=v0.17b + TAG=v0.17c fi # Are we running as root?