From 56d252c63409c4637354b8511149d8455a41f000 Mon Sep 17 00:00:00 2001 From: "(system)" <(system)@gondor2.dss.mywire.org> Date: Fri, 14 Mar 2025 00:40:23 +1030 Subject: [PATCH] /usr/local/opnsense/mvc/script/run_migrations.php made changes @ 2025-03-14T00:40:21.365000 ((system)) --- config.xml | 338 +++++++++++++++++++++++++++++------------------------ 1 file changed, 186 insertions(+), 152 deletions(-) diff --git a/config.xml b/config.xml index 6ae3aa4..12331f4 100644 --- a/config.xml +++ b/config.xml @@ -1,215 +1,215 @@ opnsense - - - Increase UFS read-ahead speeds to match the state of hard drives and NCQ. + + vfs.read_max - default + + Increase UFS read-ahead speeds to match the state of hard drives and NCQ. - - Set the ephemeral port range to be lower. + net.inet.ip.portrange.first - default + + Set the ephemeral port range to be lower. - - Drop packets to closed TCP ports without returning a RST + net.inet.tcp.blackhole - default + + Drop packets to closed TCP ports without returning a RST - - Do not send ICMP port unreachable messages for closed UDP ports + net.inet.udp.blackhole - default + + Do not send ICMP port unreachable messages for closed UDP ports - - Randomize the ID field in IP packets + net.inet.ip.random_id - default + + Randomize the ID field in IP packets - - - Source routing is another way for an attacker to try to reach non-routable addresses behind your box. - It can also be used to probe for information about your internal networks. These functions come enabled - as part of the standard FreeBSD core system. - + net.inet.ip.sourceroute - default - - + Source routing is another way for an attacker to try to reach non-routable addresses behind your box. It can also be used to probe for information about your internal networks. These functions come enabled as part of the standard FreeBSD core system. - net.inet.ip.accept_sourceroute - default - + + net.inet.ip.accept_sourceroute + + + Source routing is another way for an attacker to try to reach non-routable addresses behind your box. + It can also be used to probe for information about your internal networks. These functions come enabled + as part of the standard FreeBSD core system. + + + + net.inet.icmp.log_redirect + This option turns off the logging of redirect packets because there is no limit and this could fill up your logs consuming your whole hard drive. - net.inet.icmp.log_redirect - default - - Drop SYN-FIN packets (breaks RFC1379, but nobody uses it anyway) + net.inet.tcp.drop_synfin - default + + Drop SYN-FIN packets (breaks RFC1379, but nobody uses it anyway) - - Enable sending IPv6 redirects + net.inet6.ip6.redirect - default + + Enable sending IPv6 redirects - - Enable privacy settings for IPv6 (RFC 4941) + net.inet6.ip6.use_tempaddr - default + + Enable privacy settings for IPv6 (RFC 4941) - - Prefer privacy addresses and use them over the normal addresses + net.inet6.ip6.prefer_tempaddr - default + + Prefer privacy addresses and use them over the normal addresses - - Generate SYN cookies for outbound SYN-ACK packets + net.inet.tcp.syncookies - default + + Generate SYN cookies for outbound SYN-ACK packets - - Maximum incoming/outgoing TCP datagram size (receive) + net.inet.tcp.recvspace - default + + Maximum incoming/outgoing TCP datagram size (receive) - - Maximum incoming/outgoing TCP datagram size (send) + net.inet.tcp.sendspace - default + + Maximum incoming/outgoing TCP datagram size (send) - - Do not delay ACK to try and piggyback it onto a data packet + net.inet.tcp.delayed_ack - default + + Do not delay ACK to try and piggyback it onto a data packet - - Maximum outgoing UDP datagram size + net.inet.udp.maxdgram - default + + Maximum outgoing UDP datagram size - - Handling of non-IP packets which are not passed to pfil (see if_bridge(4)) + net.link.bridge.pfil_onlyip - default + + Handling of non-IP packets which are not passed to pfil (see if_bridge(4)) - - Set to 1 to additionally filter on the physical interface for locally destined packets + net.link.bridge.pfil_local_phys - default + + Set to 1 to additionally filter on the physical interface for locally destined packets - - Set to 0 to disable filtering on the incoming and outgoing member interfaces. + net.link.bridge.pfil_member - default + + Set to 0 to disable filtering on the incoming and outgoing member interfaces. - - Set to 1 to enable filtering on the bridge interface + net.link.bridge.pfil_bridge - default + + Set to 1 to enable filtering on the bridge interface - - Allow unprivileged access to tap(4) device nodes + net.link.tap.user_open - default + + Allow unprivileged access to tap(4) device nodes - - Randomize PID's (see src/sys/kern/kern_fork.c: sysctl_kern_randompid()) + kern.randompid - default + + Randomize PID's (see src/sys/kern/kern_fork.c: sysctl_kern_randompid()) - - Maximum size of the IP input queue + net.inet.ip.intr_queue_maxlen - default + + Maximum size of the IP input queue - - Disable CTRL+ALT+Delete reboot from keyboard. + hw.syscons.kbd_reboot - default + + Disable CTRL+ALT+Delete reboot from keyboard. - - Hint at default settings for serial console in case the autodetect is not working + hw.uart.console - default + + Hint at default settings for serial console in case the autodetect is not working - - Enable TCP extended debugging + net.inet.tcp.log_debug - default + + Enable TCP extended debugging - - Set ICMP Limits + net.inet.icmp.icmplim - default + + Set ICMP Limits - - TCP Offload Engine + net.inet.tcp.tso - default + + TCP Offload Engine - - UDP Checksums + net.inet.udp.checksum - default + + UDP Checksums - - Maximum socket buffer size + kern.ipc.maxsockbuf - default + + Maximum socket buffer size - - Page Table Isolation (Meltdown mitigation, requires reboot.) + vm.pmap.pti - default + + Page Table Isolation (Meltdown mitigation, requires reboot.) - - Disable Indirect Branch Restricted Speculation (Spectre V2 mitigation) + hw.ibrs_disable - default + + Disable Indirect Branch Restricted Speculation (Spectre V2 mitigation) - - Hide processes running as other groups + security.bsd.see_other_gids - default + + Hide processes running as other groups - - Hide processes running as other users + security.bsd.see_other_uids - default + + Hide processes running as other users - + + net.inet.ip.redirect + 0 Enable/disable sending of ICMP redirects in response to IP packets for which a better, and for the sender directly reachable, route and next hop is known. - net.inet.ip.redirect - 0 - + + net.inet.icmp.drop_redirect + 1 Redirect attacks are the purposeful mass-issuing of ICMP type 5 packets. In a normal network, redirects to the end stations should not be required. This option enables the NIC to drop all inbound ICMP redirect packets without returning a response. - net.inet.icmp.drop_redirect - 1 - - Maximum outgoing UDP datagram size + net.local.dgram.maxdgram - default + + Maximum outgoing UDP datagram size - + dev.netmap.buf_num 1000000 Automatically added by Zenarmor: Netmap Generic/Native Driver @@ -220,35 +220,51 @@ gondor2 dss.mywire.org 1 - - admins - System Administrators - system + 1999 - 0 - 2000 - page-all - - - root - System Administrator + admins system - admins - $2y$10$V5R3OFK0X8dz/shqsIj3AuuhVvT/TR8gA6u9s.j0gknxplOMg4tyC + System Administrators + page-all + 0,2000 + + 0 - - - $2y$11$77rIEmn8xjecWoKfve.cZ.Fb5PIDN6PR8mM4MdlHubJiuBMiWacqW - user - dion - Dion + root + 0 + system - - LYA2AG53OBHL35L6NMGE4KEM4ZPHYAWI - dionscarman@gmail.com + + + $2y$10$V5R3OFK0X8dz/shqsIj3AuuhVvT/TR8gA6u9s.j0gknxplOMg4tyC + + + + + + + System Administrator + + + 2000 - 65b4a1c0bffcf + dion + 0 + user + + + LYA2AG53OBHL35L6NMGE4KEM4ZPHYAWI + + $2y$11$77rIEmn8xjecWoKfve.cZ.Fb5PIDN6PR8mM4MdlHubJiuBMiWacqW + + + dionscarman@gmail.com + + + + Dion + 2001 2000 @@ -4647,8 +4663,8 @@ e+7APPmE4+Hdfyhcws1MAAAAG3Jvb3RAZ29uZG9yMi5kc3MubXl3aXJlLm9yZwEC (system) - /usr/local/opnsense/scripts/firmware/register.php made changes - + /usr/local/opnsense/mvc/script/run_migrations.php made changes + @@ -5243,7 +5259,7 @@ e+7APPmE4+Hdfyhcws1MAAAAG3Jvb3RAZ29uZG9yMi5kc3MubXl3aXJlLm9yZwEC - + 1 53 @@ -6373,7 +6389,7 @@ e+7APPmE4+Hdfyhcws1MAAAAG3Jvb3RAZ29uZG9yMi5kc3MubXl3aXJlLm9yZwEC - + 0 @@ -6754,9 +6770,7 @@ e+7APPmE4+Hdfyhcws1MAAAAG3Jvb3RAZ29uZG9yMi5kc3MubXl3aXJlLm9yZwEC - - - + @@ -6770,15 +6784,35 @@ e+7APPmE4+Hdfyhcws1MAAAAG3Jvb3RAZ29uZG9yMi5kc3MubXl3aXJlLm9yZwEC - + 0 0 1400 + 0 + + + + + + + + + + + + + + + + + + +