IPFire Core Update 72 released 28AUG13

An update for IPFire has been released, the following changes have been made

obtained from http://www.ipfire.org/news/ipfire-2-13-core-update-72-released

Today, IPFire 2.13 Core Update 72 and the crowd-funded Tor add-on have been released.
The Core Update comes with a lot of feature enhancements for IPsec, smaller fixes for OpenVPN and fixed two denial-of-service attacks in the Squid web proxy.

strongswan 5.1.0

strongswan, the software package that is responsible for IPsec VPN connections, has been updated to version 5.1.0. This is a major version, which fixes various kinds of bugs and also fixes a denial-of-service bug, which is of very little priority for IPFire users (CVE-2013-5013).

Elliptic Curve Cryptography

It is now possible to use Elliptic Curve Cryptography (ECC) groups in the Internet Key Exchange (IKE) protocols in addition to the previously defined Diffie-Hellman groups. Advantages of using these include better efficiency because the underlying integer arithmetic is much faster than the binary field arithmetic MODP uses. Also ECC requires much smaller keys in order to achieve the same level of security than the Diffie-Hellman algorithm does. Therefore less entropy is consumed.

Smaller default keys

As it has often been pointed out, it is a problem to gather enough entropy on some computers. This makes it hard to do a proper key exchange, because you need to generate keys for that which are of a certain length of random data. The default settings for the key length have been very high since IPFire 2.13 and are now lowered, because of the reasons above. Instead of 8192 bits, the highest selected MODP group uses 4096 bits long keys.
More technical reasons are to be found in the comments of #10396.

squid Web Proxy server

The squid web proxy server has got two denial-of-service issues that are fixed in this Core Update. It was able to crash the cache manager when authenticating and it was possible to crash the entire proxy server with requests with over-long domain names (more information about this).

OpenVPN fixes

The OpenVPN GUI does now more precise validation of the subnet that is used as a transfer network for OpenVPN N2N connections. Incorrect data let the openvpnctrl binary crash when a new connection was started and no firewall rules were added.
It is now permitted to leave the “remote” field empty on a N2N server site, which makes creating connections with clients from dynamic IP addresses easier.
OpenVPN client connections with more than one space character in their names work again.

Misc Changes

• snort has been enabled to decode packets from non-Ethernet devices again.
• Dynamic DNS supports all-inkl.com now.
• This update comes with all the requirements you need for Tor.

---

Tor – Protecting Online Anonymity

The Tor add-on is finally released together with Core Update 72, which you need to install first if you want to use Tor. Please make sure to reboot your IPFire system after the Tor add-on has been installed.
Documentation about this add-on can be found on our wiki: Tor documentation
We would like to thank all the people who contributed to this wish on the IPFire wishlist. If you want to, there are other things you can support, so those get implemented soon, too!

---

Please note a deprecation warning for Xen 3.x users!

Turn off fan on Avaya ERS 3510GT-PWR+ (fanless mode)

Now you may be reading this article because you are the "poor" soul who has an Avaya ERS3510GT-PWR+ switch humming away in close proximity to you in your normally silent workspace, or you may be the support guy/gal who has just received the call from said "poor" soul who is complaining about this noisy switch.................

You may have also searching the internet for "turn off fan Avaya ERS 3510GT-PWR+" and come back with almost nothing but the following statement from the support documentation

The ERS 3510GT-PWR+ can operate in one of two different power “modes”. Low Power

Budget mode provides a maximum PoE budget of up to 60W across 8 ports (fanless mode),

while High Power Budget mode provides a maximum of 170 Watts of power across 8 ports

(fan mode). This provides average concurrent power of 7.5W per port in Lower Power Budget

mode or 21.25W per port in High Power Budget mode.

So how do you turn the annoying little fan off?

Its easy (once you know how) with the following two CLI commands.

3510GT-PWR+#conf t
3510GT-PWR+(config)#poe power-mode low-power-budget

Alternately you can perform the change using EDM/COM via the left menu by first click on "Power Management", then PoE, and finally selecting "Power Mode" from the top tab.

Success!

The annoying little fan turns off instantly and you are left with a silent device so you can get back to your thoughts.


BUT WAIT!!!!








I now require more PoE power to run my new IP cameras and wireless access points.  Thats ok, you can either use EDM/COM as shown above and click on highPowerBudget or you can use the following CLI command

3510GT-PWR+(config)#poe power-mode high-power-budget

Finally........Success!







Please leave a comment if you have any questions or if you have found this guide to be useful.  I will attempt to get back to you in a timely manner.

IPFire Core Update 71 released 06AUG13

An update for IPFire has been released, the following changes have been made

obtained from http://www.ipfire.org/news/ipfire-2-13-core-update-71-released

This is the official release announcement for IPFire 2.13 – Core Update 71. This update comes with some new features and minor bug fixes.

Wireless Client on RED

It is now possible to assign a wireless adapter as the RED interface. A GUI has been written where you can configure wireless access points, to which the IPFire system will connect when in reach.
You will be able to configure backup access points, to which IPFire will switch when the first one is down or out of reach. You can prioritize them, so that you can connect to the best one when ever that is possible. All common encryption technologies are supported.
This was funded on the IPFire wishlist a while ago, but was delayed because of lack of testers.

DNS forwarding GUI

A new GUI has been written on which you are able to define different name servers than the public name servers for your DNS zones. So, you can use your internal name server for internal name resolution instead of the public one on the Internet.

Performance improvement of squidclamav

Scanning all the HTTP traffic that is going through the proxy is very costly and makes browsing slow. In this update, we put the squidclamav process “in front of the proxy”. It now trusts the cache and won’t scan data that’s coming from the cache again which results in a huge performance increase. You now don’t even reckon that your traffic is scanned for viruses.

snort 2.9.5

The Intrusion Detection System (IDS) snort has been updated to version 2.9.5. Updating the official ruleset from sourcefire is now possible, again.
The VRT community rules package which was not available for a long time has been re-added to the list of rule sources again.

Smaller changes

• The USB modeswitch database has been updated. This software will configure UMTS/LTE/3G USB adapters that they can be used as modems. Now, more of this hardware is supported.
• Allow squid, the Web proxy service, to open more files and connections at once (more open file descriptors). This will result in a higher performance and better stability under high loads.
• The whois tool for whois lookups has been replaced by GNU jwhois. It is much more flexible and does not have an outdated database like the old one.
• squidclamav freezing when accessing sites that are also available over IPv6 has been fixed.
• MTU negotiation on PPPoE: The default MTU for DSL lines has been 1492 which is not working on all DSL lines. If not configured correctly, your DSL connection won’t be able to transport big packets. We now allow to leave that field empty so IPFire will try to negotiate an appropriate MTU on itself.

Add-ons

• VDR 2.0 has been pushed to the stable tree.

Tor from the IPFire wishlist

Thanks to all the people who donated for integrating Tor into IPFire. You can still support this wish or support the advanced firewall GUI.
The Tor add-on is already well advanced, because we worked day and night on it for a couple of days. We are confident that we will be able to ship it with Core Update 72. For that, we will need testers, so please stay tuned for that.