Commit message (Collapse) | Author | Age | Files | |
---|---|---|---|---|
* | Improve Debian 11's fail2ban rules. | Guilhem Moulin | 2022-12-18 | 4 |
| | ||||
* | Port baseline to Debian 11 (codename Bullseye). | Guilhem Moulin | 2022-10-13 | 10 |
| | ||||
* | logcheck-database update. | Guilhem Moulin | 2022-10-11 | 3 |
| | ||||
* | logcheck-database update. | Guilhem Moulin | 2021-02-13 | 1 |
| | | | | ansible 2.10.7 uses "ansible-ansible.legacy.stat: Invoked with […]". | |||
* | rkhunter: workaround for mix usrmerge/non-usrmerge environments. | Guilhem Moulin | 2020-11-15 | 1 |
| | | | | See https://bugs.debian.org/932594#15 . | |||
* | logcheck-database update. | Guilhem Moulin | 2020-11-15 | 4 |
| | ||||
* | Bacula: refactor systemd service files. | Guilhem Moulin | 2020-11-03 | 1 |
| | | | | | | Use unit overrides on top of upstream's service files instead of overriding entire service files. In particular, upstream uses flag `-P` so we don't need to use RuntimeDirectory= anymore. | |||
* | IMAP: Update role to Debian Buster. | Guilhem Moulin | 2020-05-19 | 1 |
| | | | | | | | | For `ssl_cipher_list` we pick the suggested value from https://ssl-config.mozilla.org/#server=dovecot&version=2.3.9&config=intermediate&openssl=1.1.1d At the moment it's equivalent (modulo order) to adding ‘EDH+AESGCM+aRSA’ to ‘EECDH+AESGCM:EECDH+CHACHA20!MEDIUM!LOW!EXP!aNULL!eNULL’. | |||
* | stunnel4: Harden and socket-activate. | Guilhem Moulin | 2020-05-18 | 1 |
| | ||||
* | Upgrade baseline to Debian 10. | Guilhem Moulin | 2020-05-16 | 11 |
| | ||||
* | Improve/harden fail2ban configuration. | Guilhem Moulin | 2020-01-25 | 5 |
| | | | | | | | | | * Use nftables sets with a timeout * Start daemon with a hardened unit file and restricted Capability Bounding Set. (This requires to change the log path to /var/log/fail2ban/*.) * Skip database as we don't care about persistence. * Refactor jail.local | |||
* | Convert firewall to nftables. | Guilhem Moulin | 2020-01-23 | 4 |
| | | | | Debian Buster uses the nftables framework by default. | |||
* | MSA: Open 465/TCP for Email Submission over TLS. | Guilhem Moulin | 2019-03-19 | 1 |
| | | | | See RFC 8314 sec. 3.3 "Cleartext Considered Obsolete". | |||
* | firewall: gracefully close invalid connections. | Guilhem Moulin | 2018-12-22 | 1 |
| | | | | | | | This is useful when an ESTABLISHED connection is seen as NEW because the client was offline for some time. For instance, clients now gracefully close existing SSH connections immediately after resuming from a suspend state, rather that waiting for the TCP timeout. | |||
* | Update 'IMAP', 'MSA' and 'LDAP-provider' roles to Debian Stretch. | Guilhem Moulin | 2018-12-09 | 3 |
| | ||||
* | Disable resume device. | Guilhem Moulin | 2018-12-09 | 1 |
| | | | | We don't need suspend-on-disk (hibernation). | |||
* | systemd.service: Tighten hardening options. | Guilhem Moulin | 2018-12-09 | 2 |
| | ||||
* | bacula-*.service: Don't fork in the background. | Guilhem Moulin | 2018-12-09 | 1 |
| | | | | Inspired from /lib/systemd/system/bacula-fd.service. | |||
* | Upgrade 'lists' role to Debian Stretch. | Guilhem Moulin | 2018-12-09 | 1 |
| | ||||
* | systemd: Replace ‘ProtectSystem=full’ with ‘ProtectSystem=strict’. | Guilhem Moulin | 2018-12-09 | 2 |
| | | | | And remove ‘ReadOnlyDirectories=/’ as it's implied by ‘ProtectSystem=strict’. | |||
* | Firewall: REJECT outgoing connections instead of DROPing them. | Guilhem Moulin | 2018-12-09 | 1 |
| | ||||
* | DKIM: also include the "d=" tag in key filenames, not only the "s=" tag. | Guilhem Moulin | 2018-12-05 | 1 |
| | | | | | While the combination of "s=" tag (selector) & "d=" tag signing domain maps to a unique key, the selector alone doesn't necessarily. | |||
* | Postfix: replace cdb & btree tables with lmdb ones. | Guilhem Moulin | 2018-12-03 | 1 |
| | | | | Cf. lmdb_table(5). | |||
* | IPsec: allow ISAKMP over IPv6. | Guilhem Moulin | 2018-12-03 | 1 |
| | ||||
* | Upgrade baseline to Debian Stretch. | Guilhem Moulin | 2018-12-03 | 9 |
| | ||||
* | Skip samhain installation. | Guilhem Moulin | 2018-12-03 | 1 |
| | | | | It's become too verbose (too many false-positive)… | |||
* | Harden anti spam on the MX:es. | Guilhem Moulin | 2018-06-09 | 1 |
| | ||||
* | More logcheck-database tweaks. | Guilhem Moulin | 2018-04-04 | 3 |
| | ||||
* | sympa: wibble | Guilhem Moulin | 2018-04-04 | 1 |
| | ||||
* | Perform recipient address verification on the MSA itself. | Guilhem Moulin | 2018-04-04 | 1 |
| | ||||
* | More logcheck-database tweaks. | Guilhem Moulin | 2017-09-14 | 3 |
| | ||||
* | rkhunter: Disable remote updates to fix CVE-2017-7480. | Guilhem Moulin | 2017-07-29 | 1 |
| | ||||
* | Use MariaDB as default MySQL flavor. | Guilhem Moulin | 2017-07-29 | 1 |
| | ||||
* | More logcheck-database tweaks. | Guilhem Moulin | 2017-06-07 | 1 |
| | ||||
* | postfix-sender-login: wibble | Guilhem Moulin | 2017-06-05 | 1 |
| | ||||
* | dovecot: enable user iteration and add a cronjob for `doveadm purge -A` | Guilhem Moulin | 2017-06-05 | 1 |
| | ||||
* | postfix: don't rate-limit our IPsec subnet. | Guilhem Moulin | 2017-06-02 | 1 |
| | ||||
* | /lib/systemd/system → /etc/systemd/system | Guilhem Moulin | 2017-05-31 | 3 |
| | ||||
* | MSA: reject null sender address. | Guilhem Moulin | 2017-05-14 | 1 |
| | ||||
* | More logcheck-database tweaks. | Guilhem Moulin | 2016-12-08 | 1 |
| | ||||
* | Firewall: allow duplicates rules. | Guilhem Moulin | 2016-09-18 | 1 |
| | ||||
* | More logcheck-database tweaks. | Guilhem Moulin | 2016-08-22 | 2 |
| | ||||
* | Postfix: don't share the master.cf between the instances. | Guilhem Moulin | 2016-07-10 | 1 |
| | ||||
* | More logcheck-database tweaks. | Guilhem Moulin | 2016-07-09 | 2 |
| | ||||
* | IPSec → IPsec | Guilhem Moulin | 2016-06-29 | 1 |
| | ||||
* | More logcheck-database tweaks. | Guilhem Moulin | 2016-06-29 | 3 |
| | ||||
* | update-firewall.sh: COMMIT empty iptables rule files. | Guilhem Moulin | 2016-06-29 | 1 |
| | ||||
* | typo | Guilhem Moulin | 2016-05-24 | 1 |
| | ||||
* | IPSec: replace (self-signed) X.509 certs by their raw pubkey for authentication. | Guilhem Moulin | 2016-05-24 | 1 |
| | | | | There is no need to bother with X.509 cruft here. | |||
* | genkeypair, gendhparam: use -rand /dev/urandom when generating keys or DH ↵ | Guilhem Moulin | 2016-05-22 | 2 |
| | | | | parameters. |