1824 Commits

Author SHA1 Message Date
James Valleroy
abdcbd3f65
security: Drop PrivateUsers=yes from all service files
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
2020-02-09 18:48:22 -08:00
James Valleroy
e5c80e8af3
matrixsynapse: Enable systemd sandboxing
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
2020-02-09 18:48:07 -08:00
James Valleroy
4fc3d14ac3
bind: Add CapabilityBoundingSet and ReadWritePaths to service file
Change ProtectSystem to strict.

Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
2020-02-09 18:47:38 -08:00
James Valleroy
20a1c70fc2
security: Add Sandbox Coverage to report page
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
[sunil: Change label from 'Not Running' to 'Not running' for consistency]
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
2020-02-09 15:03:22 -08:00
James Valleroy
8cec7893e7
users: Make help text translatable
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
2020-02-09 11:18:12 -05:00
Veiko Aasa
274e8a74fd
users: Add unit tests for views
Signed-off-by: Veiko Aasa <veiko17@disroot.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2020-02-09 11:17:50 -05:00
Veiko Aasa
72f653f5e8
sso, users: Turn off autocapitalization on the username field
Set autocapitalization='none' and autocomplete='username' on the username field.
Latest Django version uses those attributes by default on the username field.

Closes #1207

Signed-off-by: Veiko Aasa <veiko17@disroot.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2020-02-09 11:17:47 -05:00
Veiko Aasa
bcadf26ffc
users: More precise username validation
- Username should match [a-zA-Z0-9_.@-], can't start with '-'
- Use Python pwd module to retrieve all users instead of getent command.
- Checking, that a username already exists or is reservered, is case insensitive

Created usernames are now compatible with openldap and nslcd. Didn't change
urlpatterns in case of an invalid username is already created by the admin.

Closes #1773

Signed-off-by: Veiko Aasa <veiko17@disroot.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2020-02-09 11:17:44 -05:00
Joseph Nuthalapati
494fcd155b
l10n: Add missing trimmed to blocktrans blocks
Signed-off-by: Joseph Nuthalapati <njoseph@riseup.net>
2020-02-09 10:54:44 +05:30
Joseph Nuthalapati
447e5c3e38
l10n: Add blocktrans trimmed tag on a block
Signed-off-by: Joseph Nuthalapati <njoseph@riseup.net>
2020-02-09 10:31:47 +05:30
Veiko Aasa
0f16a0fbee
storage: Show disks if FreedomBox is running in an unprivileged container
- Get disks info from df command and add info from udisks, if available.
  Before, it was other way round.
- Add a functional test that asserts root disk is available
- Remove unused key file_system_type from disks info

Closes #1765

Signed-off-by: Veiko Aasa <veiko17@disroot.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2020-02-02 09:40:12 -05:00
Sunil Mohan Adapa
dfd4d40ed1
firewall: Show Run Diagnostics button in app
- Use AppView for firewall view so that diagnostics button shows up
  automatically. Consistency with the rest of the apps. Allow new features to
  AppView become useful.

- A status section is automatically added but can be removed when all the other
  apps loose their status section.

- Does not change anything else.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
2020-01-31 12:33:55 +02:00
Veiko Aasa
8ef2c77891
diagnostics: Show firewall service status
Signed-off-by: Veiko Aasa <veiko17@disroot.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
2020-01-30 14:10:31 -08:00
Veiko Aasa
932d2e17f9
networks: Support virtual Ethernet (veth) devices
Closes #1767

Signed-off-by: Veiko Aasa <veiko17@disroot.org>
[sunil: Add comment and a cosmetic change]
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
2020-01-28 13:13:54 -08:00
James Valleroy
a9ab05bde3
bind: Enable systemd sandbox options for bind9 service
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
2020-01-27 14:56:51 -08:00
Veiko Aasa
3f5035c6d5
gitweb: Add link to the manual page
Signed-off-by: Veiko Aasa <veiko17@disroot.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
2020-01-27 14:14:08 -08:00
James Valleroy
9c33567a54
networks: Update text for router setup
- Move router setup below connections
- Use default style for Update button
- Use box_name in templates
- Add 2nd example of router IP
- Minor updates to text

Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
2020-01-26 17:10:20 -05:00
Nektarios Katakis
ed6cd38c22
networks: save router config to kvstore
Closes: #1695

Signed-off-by: Nektarios Katakis <iam@nektarioskatakis.xyz>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2020-01-26 16:02:55 -05:00
Nektarios Katakis
33f5114241
networks: modify as first boot wizard step
Signed-off-by: Nektarios Katakis <iam@nektarioskatakis.xyz>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2020-01-26 16:02:52 -05:00
Nektarios Katakis
e771ca3b8e
networks: add first boot step for router config helper
Signed-off-by: Nektarios Katakis <iam@nektarioskatakis.xyz>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2020-01-26 16:02:50 -05:00
Nektarios Katakis
09545155a0
networks: add link to main page for router config form
Signed-off-by: Nektarios Katakis <iam@nektarioskatakis.xyz>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2020-01-26 16:02:47 -05:00
Nektarios Katakis
cabfcbc6ef
networks: create view & url for new form
Signed-off-by: Nektarios Katakis <iam@nektarioskatakis.xyz>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2020-01-26 16:02:45 -05:00
Nektarios Katakis
f3d2654a13
networks: form for configuring router
Signed-off-by: Nektarios Katakis <iam@nektarioskatakis.xyz>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2020-01-26 16:02:41 -05:00
Veiko Aasa
9d653d87ec
storage: Make external disk mounts accessible by other users
- samba app doesn't need anymore to change mount permissions

Fixes #1692 (in a different way)

Signed-off-by: Veiko Aasa <veiko17@disroot.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2020-01-26 07:32:04 -05:00
Veiko Aasa
8e698987de
deluge: Allow to set a download directory
- add directory selection form to the app configuration page
- add debian-deluged user to the freedombox-share group
- storage: new validator parameter check-creatable
  (because deluged is able to create subdirectories)

Signed-off-by: Veiko Aasa <veiko17@disroot.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2020-01-25 18:27:11 -05:00
James Valleroy
21ba450484
repro: Remove app
The repro app has been disabled for a long time. Its package has been
removed from Debian, and there is no sign of it returning soon.

Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
2020-01-18 20:00:43 -05:00
James Valleroy
c8a5f3727f
restore: Remove app
The restore app has always been disabled, because node-restore package
is not available in Debian (RFP #804507). There hasn't been progress
towards packaging it since 2016.

Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
2020-01-18 19:59:02 -05:00
Sunil Mohan Adapa
419559a86f
wireguard: Show public key even when connection is not active
When wireguard interface is not active 'wg show' does not provide any
information. In such case, get the public key by computing it from private key
by calling 'wg pubkey'.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2020-01-18 13:53:55 -05:00
Sunil Mohan Adapa
f43d9a5469
wireguard: When a connection is edited, reactivate to apply changes
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2020-01-18 13:53:53 -05:00
Sunil Mohan Adapa
318df8723a
wireguard: Enable/disable connections along with the app
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2020-01-18 13:53:51 -05:00
Sunil Mohan Adapa
0bc097f37d
wireguard: Implement enabling/disabling app using a stored flag
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2020-01-18 13:53:49 -05:00
Sunil Mohan Adapa
642d44aced
wireguard: Ensure tests work without latest network manager
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2020-01-18 13:53:46 -05:00
Sunil Mohan Adapa
43ad12c563
wireguard: Add validations in forms
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2020-01-18 13:53:44 -05:00
Sunil Mohan Adapa
69e418ada3
wireguard: Generate private key if needed when editing server
- Refactor code that edits the connection to server.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2020-01-18 13:53:41 -05:00
Sunil Mohan Adapa
2b9d278a95
wireguard: Update descriptions for client vs. server clarity
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2020-01-18 13:53:38 -05:00
Sunil Mohan Adapa
6e1b0a3642
wireguard: Handle client connections through network manager
- Any changes done directly using 'wg' command need to be redone after a reboot
  and disable/enable sequence. Let that duty be handled by network manager.

- Handle (none) values for keys and 0 values for latest handshake from 'wg'
  dump command output.

- Don't store public/private keys for wireguard in /var/lib. Let Network Manager
  deal with the storage of secrets.

- Create client connections in the 'external' zone.

- Show allowed IPs for each client in the main page.

- Show server connection public key only for clients. We use different key pairs
  when connecting to each of the servers.

- Separate out configuration information and status information in the show
  page.

- Allocate IP addresses to each of the clients.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2020-01-18 13:53:35 -05:00
Sunil Mohan Adapa
71c7ab4a9d
wireguard: Only use network manager for connections to servers
- Don't create network link. This don't persist across reboots and it is the job
  of Network Manager.

- Move NM settings code to regular plinth process instead of superuser.
  Permission for managing NM connections from the service daemon is granted by
  PolKit.

- Use interface name to identify the connection as it seems to be simply to do
  so than the public key. Public key is not easy to retrieve from NM connection.

- Merge code for adding and editing the connection to avoid repetition.

- Add icon to the edit button.

- Throw 404 error when incorrect client is specified.

- Fix issue with storing preshared key.

- Show formatting date in case of last connected time.

- Show formatted sizes for data transmitted.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2020-01-18 13:53:31 -05:00
Sunil Mohan Adapa
b96c5e5433
wireguard: Update descriptions in form labels
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2020-01-18 13:53:29 -05:00
Sunil Mohan Adapa
9242a9404f
wireguard: Add ability to set private key in client addition
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2020-01-18 13:53:24 -05:00
Sunil Mohan Adapa
ad53848983
wireguard: Don't error out when wg0 server is not setup
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2020-01-18 13:53:21 -05:00
Sunil Mohan Adapa
fe182a0faa
wireguard: Cosmetic fixes by yapf and isort
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2020-01-18 13:53:19 -05:00
Sunil Mohan Adapa
6a2942a9c4
wireguard: Show large buttons in show client/server pages
- To be consistent with other such pages.

- Larger buttons are more accessible, since they are the only operations on the
  page.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2020-01-18 13:53:17 -05:00
James Valleroy
28bc880dc5
wireguard: Write pre-shared key to tempfile
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
2020-01-18 13:53:07 -05:00
James Valleroy
aa66a9135c
wireguard: Add views for editing and deleting clients and servers
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
2020-01-18 13:53:03 -05:00
James Valleroy
6b39aa8075
wireguard: Encode public keys for use in URLs
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
2020-01-18 13:52:58 -05:00
James Valleroy
aed82eca1b
wireguard: Show this box's public key
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
2020-01-18 13:52:54 -05:00
James Valleroy
966b179756
wireguard: Add server information view
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
2020-01-18 13:52:50 -05:00
James Valleroy
36fdedb9a7
wireguard: List peers in client section
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
2020-01-18 13:52:48 -05:00
James Valleroy
901f89f393
wireguard: Form to add server
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
2020-01-18 13:52:46 -05:00
James Valleroy
5d287ce579
wireguard: Add client info view
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
2020-01-18 13:52:44 -05:00