mirror of
https://github.com/freedombox/FreedomBox.git
synced 2026-01-21 07:55:00 +00:00
c5e60632e7
Closes: Debian bug #961733. - The version of Linux kernel supported in FreedomBox is from Debian Bookworm and that is 6.1, released on Sun, 11 Dec 2022[4][5]. - Around 2014, in Linux kernel version 5.4, a way to extract entropy from CPU execution jitter every second was implemented. This is similar to HAVAGE/havaged's approach[1][2]. This ensures that user space applications never hang indefinitely when entropy is not available. - Since 2020, /dev/random only blocks until it is initialized and after that never blocks. It provides cryptographically secure psuedo-random numbers after initialization (which is believed to be as good as blocking pool even for security sensitive applications). This the same behavior as getrandom() call[6]. This means that even on embedded systems, haveged is not necessary once the initialization of the random pool has been completed. - Since Feb/Mar 2022, /dev/urandom no longer provides insecure random numbers[3]. Earlier, if it was used before full initialization, it provided insecure random numbers. Now it blocks the caller until initialization and then provides cryptographically secure pseudo-random numbers. The initialization itself won't take too much time due to the "Jitter Dance" technique of extracting entropy from CPU execution jitter. The only way to request for insecure random number (without even blocking for 1 second) is to use getrandom(GRND_INSECURE) which systemd uses to initialize hash tables. This change was reverted because Jitter Dance did not work on several architectures including arm[3]. Later it was added back as an opportunistic approach, where secure random numbers would be provided by urandom if Jitter Dance worked. - Git repository for haveged mentions that it is less relevant now[7]. It also lists circumstances where haveged might still help (old kernels, user-space RNG, additional source of entry and early boot). Of these, only early boot scenario is of interest for us. - In summary, the understanding of relevance of haveged is as follows: Request Random Number --------------------- Is this during initialization of the random pool? No: - Linux never blocks after initialization. It uses CSPRNG now instead of blocking for entropy. Yes: Is this for secure purposes? No: - It does not block and provides insecure (or secure in most practical cases) numbers with getrandom(GRND_INSECURE), used by systemd hash tables, etc. Yes: Does the architecture provide hardware random numbers? Yes: - Use RDSEED (Intel/AMD) CPU instruction or HWRNG (SOCs) to initialize the random pool. - If on virtual machine, use virtio-rng, ACPI VM ID, etc. to initialize the random pool. No: Is this on architectures with time stamp counter? Yes: - The system will block for 1-2 seconds and provide secure random numbers using "Jitter Dance" (similar to haveged). - ARMv7 (Allwinner A20, etc.) the lowest ARM architecture we support, seems to have time stamp counters but we not sure kernel uses it and implements "Jitter Dance". No: - On urandom, The system will not block and provide insecure random numbers. This is as per the original definition of /dev/urandom. - The system will block until entropy is available through interrupts, etc. - haveged will likely not help here because it also requires time stamp counter provided by CPU. Links: 1) https://lwn.net/Articles/802360/ 2) https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=50ee7529ec45 3) https://www.zx2c4.com/projects/linux-rng-5.17-5.18/ 4) https://lkml.org/lkml/2022/12/11/206 5) https://packages.debian.org/search?searchon=names&keywords=linux-image-6.1.0 6) https://lwn.net/Articles/808575/ 7) https://github.com/jirka-h/haveged Reviewed-by: Joseph Nuthalapati <njoseph@riseup.net>
234 lines
6.2 KiB
Plaintext
234 lines
6.2 KiB
Plaintext
Source: freedombox
|
|
Section: web
|
|
Priority: optional
|
|
Maintainer: FreedomBox packaging team <freedombox-pkg-team@lists.alioth.debian.org>
|
|
Uploaders:
|
|
Tzafrir Cohen <tzafrir@debian.org>,
|
|
Piotr Ożarowski <piotr@debian.org>,
|
|
Petter Reinholdtsen <pere@debian.org>,
|
|
Sunil Mohan Adapa <sunil@medhas.org>,
|
|
Nick Daly <Nick.M.Daly@gmail.com>,
|
|
Federico Ceratto <federico@debian.org>,
|
|
James Valleroy <jvalleroy@mailbox.org>,
|
|
Build-Depends:
|
|
debhelper-compat (= 13),
|
|
dblatex,
|
|
dh-python,
|
|
docbook-xsl,
|
|
e2fsprogs,
|
|
gir1.2-nm-1.0,
|
|
libjs-bootstrap4,
|
|
pybuild-plugin-pyproject,
|
|
python3-all:any,
|
|
python3-apt,
|
|
python3-augeas,
|
|
python3-bootstrapform,
|
|
python3-build,
|
|
python3-cherrypy3,
|
|
python3-configobj,
|
|
python3-dbus,
|
|
python3-django (>= 1.11),
|
|
python3-django-axes (>= 5.0.0),
|
|
python3-django-captcha,
|
|
# Explictly depend on ipware as it is optional dependecy for future versions
|
|
# of django-axes.
|
|
python3-django-ipware (>= 3),
|
|
python3-django-stronghold (>= 0.3.0),
|
|
python3-flake8,
|
|
python3-gi,
|
|
python3-markupsafe,
|
|
python3-mypy,
|
|
python3-openssl,
|
|
python3-pampy,
|
|
python3-paramiko,
|
|
python3-pexpect,
|
|
python3-pip,
|
|
python3-psutil,
|
|
python3-pytest,
|
|
python3-pytest-cov,
|
|
python3-pytest-django,
|
|
python3-pytest-runner,
|
|
python3-requests,
|
|
python3-ruamel.yaml,
|
|
python3-setuptools,
|
|
python3-setuptools-git,
|
|
# python3-tomli is not available in Bullseye
|
|
python3-tomli | python3-coverage (<< 6.0),
|
|
python3-typeshed,
|
|
python3-yaml,
|
|
sshpass,
|
|
xmlto,
|
|
xsltproc
|
|
Standards-Version: 4.6.2
|
|
Homepage: https://salsa.debian.org/freedombox-team/freedombox
|
|
Vcs-Git: https://salsa.debian.org/freedombox-team/freedombox.git
|
|
Vcs-Browser: https://salsa.debian.org/freedombox-team/freedombox
|
|
Rules-Requires-Root: no
|
|
|
|
Package: freedombox
|
|
Breaks:
|
|
freedombox-setup (<< 0.13~),
|
|
plinth (<< 0.46.0~),
|
|
# Ensure fuse gets replaced by fuse3 on upgrades from buster s.t. sshfs can be installed.
|
|
fuse (<< 3),
|
|
# If ufw is installed, remove it. See issue 2247.
|
|
ufw,
|
|
Replaces:
|
|
freedombox-setup (<< 0.13~),
|
|
plinth (<< 0.46.0~),
|
|
Architecture: all
|
|
Provides: plinth
|
|
Depends:
|
|
${python3:Depends},
|
|
${misc:Depends},
|
|
${freedombox:Depends},
|
|
adduser,
|
|
augeas-tools,
|
|
curl,
|
|
debconf,
|
|
dnsutils,
|
|
e2fsprogs,
|
|
fonts-fork-awesome,
|
|
fonts-lato,
|
|
# sgdisk is used in storage app to expand GPT disks
|
|
gdisk,
|
|
gettext,
|
|
gir1.2-glib-2.0,
|
|
gir1.2-nm-1.0,
|
|
javascript-common,
|
|
ldapscripts,
|
|
# For gdbus used to call hooks into service
|
|
libglib2.0-bin,
|
|
libjs-bootstrap4,
|
|
libjs-jquery,
|
|
lsof,
|
|
netcat-openbsd,
|
|
network-manager,
|
|
# Ensure that nscd is installed rather than unscd.
|
|
nscd (>= 2),
|
|
ppp,
|
|
pppoe,
|
|
python3-apt,
|
|
python3-argon2,
|
|
python3-augeas,
|
|
python3-bootstrapform,
|
|
python3-cherrypy3,
|
|
python3-configobj,
|
|
python3-dbus,
|
|
python3-django (>= 1.11),
|
|
python3-django-axes (>= 5.0.0),
|
|
python3-django-captcha,
|
|
# Explictly depend on ipware as it is optional dependecy for future versions
|
|
# of django-axes.
|
|
python3-django-ipware (>= 3),
|
|
python3-django-stronghold,
|
|
python3-gi,
|
|
python3-markupsafe,
|
|
python3-pampy,
|
|
python3-paramiko,
|
|
python3-pexpect,
|
|
python3-psutil,
|
|
python3-requests,
|
|
python3-ruamel.yaml,
|
|
python3-systemd,
|
|
python3-yaml,
|
|
sudo,
|
|
wget,
|
|
# Ensure fuse gets replaced by fuse3 on upgrades from buster s.t. sshfs can be installed.
|
|
fuse3 (>= 3),
|
|
Recommends:
|
|
# Priority: standard
|
|
bzip2,
|
|
# Provides brctl for controlling bridges
|
|
bridge-utils,
|
|
# Read, write to char devices
|
|
devio,
|
|
# Create, repair DOS filesystems
|
|
dosfstools,
|
|
# Priority: standard
|
|
file,
|
|
# Wifi firmware
|
|
firmware-ath9k-htc,
|
|
# FreedomBox documentation
|
|
freedombox-doc-en,
|
|
freedombox-doc-es,
|
|
# Monitor system resources
|
|
htop,
|
|
# Monitor network traffic statistics
|
|
iftop,
|
|
# Basic network utitlity ping
|
|
iputils-ping,
|
|
# Manage wireless devices
|
|
iw,
|
|
# Resolve gateway.localhost
|
|
libnss-gw-name,
|
|
# Resolve .local address using mDNS
|
|
libnss-mdns,
|
|
# Resolve current hostname without /etc/hosts
|
|
libnss-myhostname,
|
|
# Block repeated failed PAM login attempts
|
|
libpam-abl,
|
|
# Priority: standard
|
|
locales,
|
|
# Precompiled data for all locales
|
|
locales-all,
|
|
# Priority: standard
|
|
openssh-client,
|
|
# Priority: standard
|
|
pciutils,
|
|
# Used by unattended-upgrades to check if running on AC power
|
|
powermgmt-base,
|
|
# fuser, pstree and other utilities
|
|
psmisc,
|
|
# Manage /etc/resolv.conf
|
|
resolvconf,
|
|
# Tool to kill WLAN, Bluetooth and moble broadband
|
|
rfkill,
|
|
# Monitor network traffic
|
|
tcpdump,
|
|
# Basic editor, VIM style
|
|
vim-tiny,
|
|
# Priority: standard
|
|
whois,
|
|
# Basic editor, Emacs style
|
|
zile,
|
|
Description: easy to manage, privacy oriented home server
|
|
FreedomBox is designed to be your own inexpensive server at home. It runs free
|
|
software and offers an increasing number of services ranging from a calendar or
|
|
jabber server to a wiki or VPN. A web interface allows you to easily install
|
|
and configure your apps.
|
|
.
|
|
This package provides the FreedomBox Service (Plinth) which installs,
|
|
configures and manages all functions of FreedomBox. The service is managed
|
|
using a web interface available at https://localhost/.
|
|
|
|
Package: freedombox-doc-en
|
|
Architecture: all
|
|
Multi-Arch: foreign
|
|
Section: doc
|
|
Depends: ${misc:Depends}
|
|
Description: easy to manage, privacy oriented home server - user manual (English)
|
|
FreedomBox is designed to be your own inexpensive server at home. It runs free
|
|
software and offers an increasing number of services ranging from a calendar or
|
|
jabber server to a wiki or VPN. A web interface allows you to easily install
|
|
and configure your apps.
|
|
.
|
|
This package contains the English user manual in HTML and PDF formats. It
|
|
describes how to setup and use each application in FreedomBox and FreedomBox
|
|
itself. It is accessible from Help menu in the FreedomBox web interface.
|
|
|
|
Package: freedombox-doc-es
|
|
Architecture: all
|
|
Multi-Arch: foreign
|
|
Section: doc
|
|
Depends: ${misc:Depends}
|
|
Description: easy to manage, privacy oriented home server - user manual (Spanish)
|
|
FreedomBox is designed to be your own inexpensive server at home. It runs free
|
|
software and offers an increasing number of services ranging from a calendar or
|
|
jabber server to a wiki or VPN. A web interface allows you to easily install
|
|
and configure your apps.
|
|
.
|
|
This package contains the Spanish user manual in HTML and PDF formats. It
|
|
describes how to setup and use each application in FreedomBox and FreedomBox
|
|
itself. It is accessible from Help menu in the FreedomBox web interface.
|