NG Firewall 16.3 beta now available for preview

[sky-knight]

This.

It'll be nice to have this granularity. The "nuke em" option, I agree, is overkill when all that's needed is to be able to manually purge entries beyond a certain time.

/usr/share/untangle/bin/reports-clean-tables.py -d "postgresql" 7

You know... because Untangle apparently can't use their own scripts. The above dumps reports down to the last 7 days, change the 7 to fit your needs.

I don't... understand why they went with the scorched Earth approach.

[donhwyo]

The beta security is already out of date. https://lists.debian.org/debian-secu.../msg00090.htmlDebian is pushing the update out to buster now. We will be lucky to see it in the release candidate or the release.

[sky-knight]

The beta security is already out of date. https://lists.debian.org/debian-secu.../msg00090.htmlDebian is pushing the update out to buster now. We will be lucky to see it in the release candidate or the release.

Umm... no?

Untangle doesn't use Bind for DNS, it uses DNSMasq. Bind can't be vulnerable if it's not installed!

[donhwyo]

[root @ homeuntangle] ~ # dpkg -l |grep bind
ii  bind9-host                              1:9.11.5.P4+dfsg-5.1+deb10u3                                   amd64        DNS lookup utility (deprecated)
ii  libbind9-161:amd64                      1:9.11.5.P4+dfsg-5.1+deb10u3                                   amd64        BIND9 Shared Library used by BIND
ii  libwbclient0:amd64                      2:4.9.5+dfsg-5+deb10u1                                         amd64        Samba winbind client library
ii  python-ldb                              2:1.5.1+really1.4.6-3+deb10u1                                  amd64        Python bindings for LDB
ii  python-pycurl                           7.43.0.2-0.1                                                   amd64        Python bindings to libcurl
ii  python-samba                            2:4.9.5+dfsg-5+deb10u1                                         amd64        Python bindings for Samba
ii  python-selenium                         3.14.1+dfsg1-1                                                 all          Python bindings for Selenium
ii  python-talloc:amd64                     2.1.14-2                                                       amd64        hierarchical pool based memory allocator - Python bindings
ii  python-tdb                              1.3.16-2+b1                                                    amd64        Python bindings for TDB
ii  python3-pycurl                          7.43.0.2-0.1                                                   amd64        Python bindings to libcurl (Python 3)
ii  winbind                                 2:4.9.5+dfsg-5+deb10u1                                         amd64        service to resolve user and group information from Windows NT servers

Must have changed for 16.3.

Build: 16.3.0.20210419T114213.6c60930bfe-1buster
Kernel: 4.19.0-11-untangle-amd64

[sky-knight]

And if you run service --status-all you'd notice not a single mention of bind anywhere.

That's an artifact of a default Debian installation, it's not actually running so it cannot be exploited.

Furthermore, if you read your own output you'd notice that is the Bind9 DNS CLIENT, not the Bind9 DNS SERVER. Which is what those vulnerabilities reference.

I repeat, that list of CVs do not apply to Untangle.

[SuperMiguel]

wow still no 2fa for console or letsencrypt support....

[theoak]

I find a lot of the widgets are broken on the dashboard. They just sit there with "Please wait ..."

[donhwyo]

Looks like there is a beta update.

Build: 16.3.0.20210507T132729.edcea096bc-1buster
Kernel: 4.19.0-11-untangle-amd64

[jcoffin]

Looks like there is a beta update.

Build: 16.3.0.20210507T132729.edcea096bc-1buster
Kernel: 4.19.0-11-untangle-amd64

If you forced an upgrade to this, you will need to reinstall when we release rc1 since it will have future issues with upgrades.

[theoak]

There we go, I logged in and the upgrade was already applied. Got my dashboard widgets back.

I had automatic upgrades checked.

I am assuming then I will be okay for RC1?