Messages

1

General Discussion / Re: Caddy Plugin - DNS providers not listed?

« on: September 22, 2024, 07:50:01 pm »

Just noting here that I did a firmware update recently and that fixed this problem, and I could configure caddy to update my certs again. Bit of a mystery, but oh well.

2

General Discussion / Re: Caddy Plugin - DNS providers not listed?

« on: August 20, 2024, 01:51:18 pm »

Please see my attachment. There are no tabs. Other pages in the caddy plugin, such as Reverse Proxy, have tabs.

I'm using the default theme and there are no hidden HTML nodes, I checked with devtools.

EDIT: Yes, I just updated everything today.

***GOT REQUEST TO INSTALL***
Currently running OPNsense 24.7.1 at Tue Aug 20 23:03:14 NZST 2024
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
Updating mimugmail repository catalogue...
Waiting for another process to update repository mimugmail
All repositories are up to date.
The following 2 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
   caddy-custom: 2.8.4.2.0.4.2.2_2 [OPNsense]
   os-caddy: 1.6.2 [OPNsense]

3

General Discussion / Caddy Plugin - DNS providers not listed?

« on: August 20, 2024, 01:45:37 pm »

Hi all, I recently discovered that there is now an official plugin for Caddy, so I've been migrating my old setup from the migumail one.

However, I can't find any way to set up DNS provider API cert validation. The official docs specify "Services ‣ Caddy Web Server ‣ General Settings ‣ DNS Provider", but I don't have any 'DNS Provider' option under General Settings.

Thankfully Caddy works by picking up my old cert from my previous installation, but this will break in a couple of months. I can't use standard cert validation, as I don't expose caddy on WAN. What's going on?

4

23.7 Legacy Series / [SOLVED] Mitigations for Terrapin ssh attack?

« on: December 22, 2023, 01:02:22 pm »

Hi all,

A few days ago, the terrapin attack on SSH was disclosed. https://terrapin-attack.com

OpenSSH 9.6 includes a new automatic strict KEX mode to mitigate this attack, but both client and server need to support this. As OPNSense ships OpenSSH 9.3, are there any plans for either an OpenSSH update or a targeted patch?

See the PFSense discussion: https://forum.netgate.com/topic/184941/terrapin-ssh-attack/

FreeBSD advisory: https://www.freebsd.org/security/advisories/FreeBSD-SA-23:19.openssh.asc

It seems upstream has already patched.