Messages

Best to ask the maintainer: https://github.com/opnsense/plugins/blob/master/security/maltrail/Makefile

But A user can use both VPN and SSH: the VPN gives secure network access, while SSH provides a remote shell for diagnostics, logs, configuration changes and recovery. The VPN alone lets them reach the WebGUI, but SSH is what gives them terminal access.

I didn't say otherwise xD

SSH needs to be reachable only through a secure management path, for example WireGuard, Tailscale, or another VPN. Then create a local tunnel

If a VPN is configured, an SSH tunnel is not needed. Just access the GUI directly over the VPN.

OPNsense has yet to ship the patched FreeBSD caroot, or the patched ca_root_nss from ports (or a patched py313-certifi for that matter, though that doesn't affect Squid, and ports doesn't even have it yet).

You can manually remove the certs / mark them untrusted, and rebuild the trust store, in the meantime.

All of that said, there is no doubt a lesson in repeated CVEs happening due to similar reasons (input sanitization). I assume the tests have been hardened on that front.

As a matter of interest, does the development team use AI for vulnerability spotting?

forgetting to push any CE code commits for 6 months?

But, but...: https://forum.netgate.com/topic/201215/releasing-more-often-doesn-t-mean-more-secure

Why do they still have a chip on their shoulder? The obsession is unhealthy.

That first change should now read "is disabled" rather than "is enabled". :)

No, that commit relates to this: https://github.com/opnsense/core/pull/10909

but a breaking change

The main breaking change is the change of the default config location from /usr/local/etc/ to /usr/local/etc/ddclient/.

The real issue is how the ddclient version that OPNsense bundles parses and filters per-provider options. That has been fixed in ddclient 4.0. Stripping the commas and backslashes "works" because ddclient then interprets the options as global and doesn't filter them, but if you had multiple providers configured this would potentially interfere with others.

The real solution is for 4.0 to be shipped with OPNsense (it is already in ports), with some changes in the plugin to accommodate it.

Among other enhancements, the Notify plugin now has a regular summary reporting function. A channel can be set up to generate a daily, weekly or monthly summary of the firewall's status, its events, firewall blocks, traffic and system health (as selected by the user): by email as a formatted report with graphs, elsewhere as a short text linking to the full report on the firewall, which also keeps an archive of them.

This reporting functionality has now been added to my Notify plugin.

I am looking at adding a summary reporter to my notify plugin, as it sits well alongside the existing functionality.

I cant update to the latest release.

Have you resolved this now?

If not:

Code Select Expand

pkg clean -ay && pkg update -f

I've created a plugin that adds S3-compatible object storage (AWS S3, Backblaze B2, Cloudflare R2, Wasabi, MinIO and others) as a backup destination option to System > Configuration > Backups.

See my website.