turnkey-fileserver-19.0 (1) turnkey; urgency=low * Fix firewall port conf: appended FTP port (21) was discarded by the port assignment in fileserver.mk; use += so it survives. * Reload smbd instead of the non-existent 'samba' service in the samba-sudoadmin firstboot hook. * smb.conf: drop deprecated 'socket options' and the no-op 'os level'. * Drop WINS support & document network discovery (wsdd + avahi) and how to re-enable WINS if required in the new /etc/samba/README-discovery.txt. * Disable legacy NetBIOS: serve SMB on port 445 only, disable nmbd, and close the NetBIOS firewall ports (139/tcp, 137-138/udp). As noted above discovery is handled by wsdd and avahi. * Stop opening unused MSRPC port 135 (only served by Samba as an AD DC). * Disable the [cdrom] share by default (commented out and documented); it only works on hardware with an optical drive and an fstab entry. * Accessing file shares tested and confirmed from Windows 11 Pro - 25H2 (OS Build 26200.8875). * Upgraded base distribution to Debian 13.x/Trixie. * Replace TurnKey custom Debian-Installer based 'di-live' with new custom TurnKey installer built from scratch; 'tkl-installer'. * Updated release signing keys & apt repo keys - now included as 'turnkey-keys' deb package. * Replace legacy '.list' apt remote config files with Deb822 '.sources' files. * "Proper" IPv6 support. May still have some gaps and still requires cosmetic work but fully functional. * Improved fail2ban config: - Increased default findtime (10 minutes) & bumped maxretry (3) to minimize risk of user accidentally locking themself out. - Removed redundant v18.x custom patches. * Include 'zstd' by default to support smaller initramfs that unpacks faster. * Replace 'ifupdown' with 'ifupdown-ng' (and 'ifupdown-ng-compat'). * Replace 'udhcpc' (IPv4 only) with 'dhcpcd-base' (dual stack ipv4/6). Also include custom TurnKey config (if-pre-up & if-post-down scripts provided by 'tkl-dhcpcd-ifupdown-glue') to ensure DHCP config is in sync with /etc/network/interfaces file. * General code cleanup of TurnKey code; build code, build tools and TurnKey custom tools & libraries. Updates include linting, formating and style updates. Still WIP but solid start. * Configuration console (confconsole): - Bugfixes: - Support for firewall config when setting a static IP. Particularly affected OpenVPN (which ships with firewall enabled by default). Closes #2037. - Fix Let's Encrypt integration failing back-to-back runs. Closes #2121. - Features: - "Proper" support for IPv6: - Make ifutil.py module code "IPv6 aware", including reliable management of /etc/network/interfaces with "inet6" stanza/s. - Show IPv6 info on "usage" page - only shown if IPv6 configured. Special thanks to Marcos: https://github.com/marcos-mendez - https://popsolutions.co/ - Misc clean up and improvements in code and packaging. See Confconsole release notes for full details. * Firstboot Initialization (inithooks): - Bugfixes: - Ensure everyboot scripts only run once per boot. - firstboot.d/15regen-sslcert: - Only services which are already running need to be restarted as restart is only to apply updated certs. - firstboot.d/01ipconfig: - Minor bugfix. - Features/improvements and other changes of significance: - Reimplement an 'inithooks.service' and refactor integration with getty1. - Delay start of inithooks/confconsole at boot time to reduce chance of boot messages overwriting inithooks/confconsole. - Developers - please note that hooks with a prefix less than '30' will still run early, so should _always_ be non-interactive. - TurnKey 'init-fence' (blocks web access at firstboot): - Run by default on all builds pre firstboot initialization (previously only enabled on "headless" builds). - New pre-seed variable 'AUTO_RUN' to skip interactive config (re-implements previous "headless" build functionality). - Replace legacy init.d script with systemd 'turnkey-init-fence.service' (& script which is called by the service). - Add support for 'systemctl reload turnkey-init-fence.service' - which restarts 'simplehttpd.py' (init-fence mini web server) but does not disable the firewall rules. - Support for custom init-fence content. - Update dynamically generated SSH information for IPv6 address display. - Add IPv6 support to mini server. - Ensure inithook 'SEC_UPDATES' pre-seed variable test is case insensitive; eliminates risk of unintended behavior when pre-seeding. - Misc clean up and improvements in code and packaging. See Inithooks release notes for full details. * Web management console (webmin): - Upgraded Webmin to latest upstream. - Refactored TurnKey Webmin packaging process to support easier updates; with the intention of following upstream releases as closely as possible (provided via TurnKey apt repo). - Updated default Webmin config: - Listen on IPv6 by default. - Preconfigured IPv6 firewall matching IPv4 rules (but not enabled - as per historical IPv4 default). - Auto redirect http => https. - Default 30 min user logout (can be overridden via login page "remember me" checkbox or webmin "authentication" config). - Updated logging paths and fixed log file rotation. * Backup (tklbam): - Bugfixes: - Fix broken help pager (not sure how long that has been broken!?). - Fix broken tar command (deprecated functionality removed in Debian Trixie). - Features/improvements: - Migrate core program and direct dependency python2 runtime from cpython2 (EOL) to Pypy (still supported - packaged by TurnKey). - Migrate all other components to python3. Note: remaining python2 TKLBAM code port to python3 is in progress but no ETA yet... - Misc clean up and improvements in code and packaging. See TKLBAM release notes for full details. * Misc code cleanup and improvements. * Modify default Apache mod_ssl conf at build time, rather than overwriting it. Ensures that only explict edits are performed and avoid risk of future Debian updates being overwritten. * Updated SSL/TLS cipher list - "intermediate" level as recommended by Mozilla. Aims to balance security and support for older clients. * Explicitly set elliptic curves offered for ECDH key exchange. * Harderned mod_security defaults: - Block access to all '.' paths by default (e.g. '.env', '.git', etc) to harden security and avoid accidental disclosure of secrets. Note this will break third party Let's Encrypt integrations using HTTP-01 validation - e.g. certbot. TurnKey's integration is unaffected as it uses a custom HTTP server to serve the challenges. - Set additional security headers: X-Content-Type-Options: "nosniff" : - Prevents files from being interpretted as something other than that declared by the content type. Content-Security-Policy "frame-ancestors 'self';" : - Prevents other sites from embedding pages within frames, defends against clickjacking attacks. * Enable HTTP/2 where possible. Note HTTP/2 is not compatable with Apache's mod_php - which is currently the default method that TurnKey LAMP based appliances host PHP applications. TurnKey will migrate to using PHP-FPM in the future. * Redirect HTTP => HTTPS by default. * Note: TLSv1.2 will be disabled by default in a future TurnKey release. -- Jeremy Davis Wed, 12 Aug 2026 09:52:08 +1000 turnkey-fileserver-18.0 (1) turnkey; urgency=low * Add wsdd package for Windows Service for Devices - so Fileserver shows up in Win10/11 Explorer - closes #1598. * Add Avahi Daemon package. Required for Ubuntu & Mac OSX discovery. * Add support for FTPS. [Anand Phulwani ] * Confconsole: bugfix broken DNS-01 Let's Encrypt challenge- closes #1876 & #1895. [Jeremy Davis ] * Ensure hashfile includes URL to public key - closes #1864. * Include webmin-logviewer module by default - closes #1866. * Upgraded base distribution to Debian 12.x/Bookworm. * Configuration console (confconsole): - Support for DNS-01 Let's Encrypt challenges. [ Oleh Dmytrychenko github: @NitrogenUA ] - Support for getting Let's Encrypt cert via IPv6 - closes #1785. - Refactor network interface code to ensure that it works as expected and supports more possible network config (e.g. hotplug interfaces & wifi). - Show error message rather than stacktrace when window resized to incompatable resolution - closes #1609. [ Stefan Davis ] - Bugfix exception when quitting configuration of mail relay. [ Oleh Dmytrychenko github: @NitrogenUA ] - Improve code quality: implement typing, fstrings and make (mostly) PEP8 compliant. [Stefan Davis & Jeremy Davis * Firstboot Initialization (inithooks): - Refactor start up (now hooks into getty process, rather than having it's own service). [ Stefan Davis ] - Refactor firstboot.d/01ipconfig (and 09hostname) to ensure that hostname is included in dhcp info when set via inithooks. - Package turnkey-make-ssl-cert script (from common overlay - now packaged as turnkey-ssl). Refactor relevant scripts to leverage turnkey-ssl. - Refactor run script - use bashisms and general tidying. - Show blacklisted password characters more nicely. - Misc packaging changes/improvements. - Support returning output from MySQL - i.e. support 'SELECT'. (Only applies to apps that include MySQL/MariaDB). * Web management console (webmin): - Upgraded webmin to v2.105. - Replace webmin-shell with webmin-xterm module by default - closes #1904. - Removed stunnel reverse proxy (Webmin hosted directly now). - Ensure that Webmin uses HTTPS with default cert (/etc/ssl/private/cert.pem). - Disabled Webmin Let's Encrypt (for now). * Web shell (shellinabox): - Completely removed in v18.0 (Webmin now has a proper interactive shell). - Note: previous v18.0 releases did not include webmin-xterm pkg - see above webmin note &/or #1904. * Backup (tklbam): - Ported dependencies to Debian Bookworm; otherwise unchanged. * Security hardening & improvements: - Generate and use new TurnKey Bookworm keys. - Automate (and require) default pinning for packages from Debian backports. Also support non-free backports. * IPv6 support: - Adminer (only on LAMP based apps) listen on IPv6. - Nginx/NodeJS (NodeJS based apps only) listen on IPv6. * Misc bugfixes & feature implementations: - Remove rsyslog package (systemd journal now all that's needed). - Include zstd compression support. - Enable new non-free-firmware apt repo by default. - Improve turnkey-artisan so that it works reliably in cron jobs (only Laravel based LAMP apps). * Set mod_evasive log location - makes debugging easier. [ Jeremy Davis ] * Include and enable mod_evasive and mod_security2 by default in Apache. [ Stefan Davis ] -- Jeremy Davis Tue, 04 Jun 2024 06:10:00 +0000 turnkey-fileserver-17.1 (1) turnkey; urgency=low * Updated all Debian packages to latest. [ autopatched by buildtasks ] * Patched bugfix release. Closes #1734. [ autopatched by buildtasks ] -- Jeremy Davis Wed, 14 Sep 2022 07:01:09 +0000 turnkey-fileserver-17.0 (1) turnkey; urgency=low * Add "Logout" button to the WebDAV interface. * Note: Please refer to turnkey-core's 17.0 changelog for changes common to all appliances. Here we only describe changes specific to this appliance. -- Zhenya Hvorostian Thu, 17 Feb 2022 17:52:33 +0300 turnkey-fileserver-16.1 (1) turnkey; urgency=low * Build custom upstream (WebDAV-CGI) libfilesys-smbclient perl module from source - closes #1597. [ Dan Rhode ] * Resolve bug in fileserver firstboot inithook - closes #1596. * Include 'webmin-exports' package (Webmin NFS exports module) - closes #1521. * Note: Please refer to turnkey-core's 16.1 changelog for changes common to all appliances. Here we only describe changes specific to this appliance. -- Jeremy Davis Tue, 13 Apr 2021 08:03:44 +1000 turnkey-fileserver-16.0 (1) turnkey; urgency=low * Update WebDAV CGI from upstream (git master branch). [ Jeremy Davis ] * Explcitly disable TLS<1.2 (i.e. SSLv3, TLSv1, TLSv1.1) for WebDAV CGI. (v15.x TurnKey releases supported TLS 1.2, but could fallback as low as TLSv1). * Update SSL/TLS cyphers to provide "Intermediate" browser/client support (suitable for "General-purpose servers with a variety of clients, recommended for almost all systems"). As provided by Mozilla via https://ssl-config.mozilla.org/. (Only applies to WebDAV CGI). * Note: Please refer to turnkey-core's changelog for changes common to all appliances. Here we only describe changes specific to this appliance. -- Stefan Davis Thu, 16 Jul 2020 20:43:17 +1000 turnkey-fileserver-15.0 (1) turnkey; urgency=low * Update WebDAV CGI from upstream. * Workaround Samba root user password issue within container by creating new inithook (closes #1141). See also #1188. [ Jeremy Davis ] * Note: Please refer to turnkey-core's changelog for changes common to all appliances. Here we only describe changes specific to this appliance. -- Vlad Kuzmenko Tue, 28 Aug 2018 04:36:42 +0200 turnkey-fileserver-14.2 (1) turnkey; urgency=low * WebDAV CGI supersedes SambaDAV (#563). * Recycle bin is enabled by default in all shares (#468). * Logging into the web interface uses the same user database as Samba (#449). * Note: Please refer to turnkey-core's changelog for changes common to all appliances. Here we only describe changes specific to this appliance. -- Anton Pyrogovskyi Sun, 6 Mar 2016 08:59:14 +0100 turnkey-fileserver-14.1 (1) turnkey; urgency=low * Admin Samba account now works reliably with sudoadmin (#523). * Note: Please refer to turnkey-core's changelog for changes common to all appliances. Here we only describe changes specific to this appliance. -- Jeremy Davis Thu, 18 Feb 2016 14:44:25 +1100 turnkey-fileserver-14.0 (1) turnkey; urgency=low * Latest Debian Jessie package version of Samba. * Changed from Pydio (AjaXplorer) to SambaDAV as web front-end. * Now supports NFS, WebDAV access. * Note: Please refer to turnkey-core's changelog for changes common to all appliances. Here we only describe changes specific to this appliance. -- Anton Pyrogovskyi Wed, 29 Jul 2015 23:11:30 +0300 turnkey-fileserver-13.0 (1) turnkey; urgency=low * Latest Debian Wheezy package version of Samba. * Note: Please refer to turnkey-core's changelog for changes common to all appliances. Here we only describe changes specific to this appliance. -- Alon Swartz Thu, 10 Oct 2013 17:53:24 +0300 turnkey-fileserver-12.1 (1) turnkey; urgency=low * AjaXplorer related: - Upgraded to latest version. - Removed smb-root-write-fix patch (included in new version). - Added USER_BASE_DRIVER to plugins multi-auth (required in new version). - Force SSL and set locale to en_US.UTF-8. * Upstream source component versions: ajaxplorer 4.2.3 * Note: Please refer to turnkey-core's changelog for changes common to all appliances. Here we only describe changes specific to this appliance. -- Alon Swartz Sun, 07 Apr 2013 08:00:00 +0200 turnkey-fileserver-12.0 (1) turnkey; urgency=low * Transitioned from eXtplorer to AjaXplorer (web based filemanager) - Pre-configured multi-authentication (Local and Samba). - Pre-configured repositories (storage, user home directory). - Set local admin password on firstboot. * Configured automatic unix/smb user/group synchronization in Webmin. * Major component versions ajaxplorer 4.0.4 (upstream archive) samba 2:3.5.6~dfsg-3squeeze8 lighttpd 1.4.28-2+squeeze1 * Note: Please refer to turnkey-core's changelog for changes common to all appliances. Here we only describe changes specific to this appliance. -- Alon Swartz Wed, 01 Aug 2012 08:00:00 +0200 turnkey-fileserver-11.3 (1) turnkey; urgency=low * Installed security updates. * Enabled etckeeper garbage collection by default. * Upgraded to latest inithooks version (adhoc re-initialization via turnkey-init) -- Alon Swartz Mon, 05 Dec 2011 10:48:44 +0000 turnkey-fileserver-11.2 (1) turnkey; urgency=low * Installed security updates. * Added HubDNS package and firstboot configuration. -- Alon Swartz Fri, 15 Jul 2011 07:47:08 +0000 turnkey-fileserver-11.1 (1) turnkey; urgency=low * Set eXtplorer admin and guest password on firstboot (convenience, security). * Major component versions: samba 2:3.4.7~dfsg-1ubuntu3.2 extplorer 2.0.1 (upstream zipfile) vsftpd 2.2.2-3ubuntu6 lighttpd 1.4.26-1.1ubuntu3 * Note: Please refer to turnkey-core's changelog for changes common to all appliances. Here we only describe changes specific to this appliance. -- Alon Swartz Sun, 19 Dec 2010 15:01:05 +0200 turnkey-fileserver-2009.10 (2) hardy; urgency=low * Installed all security updates (see manifest for package versions). * Install security updates on firstboot (except when running live). * Trick webmin into not checking for upgrades (managed by apt). * Included latest version of inithooks and updated scripts. * Included wget as per common request. -- Alon Swartz Mon, 29 Mar 2010 09:02:11 +0200 turnkey-fileserver-2009.10 (1) hardy; urgency=low * Initial public release of TurnKey File Server. * SSL support out of the box. * File Server configurations: - Preconfigured workgroup: WORKGROUP - Preconfigured netbios name: FILESERVER - Configured samba user accounts to synchronize with UNIX user accounts. - Configured root as administrative Samba user. - Configured shares: - Users home directory. - Public storage. - CD-ROM with automount and umount hooks (/media/cdrom). * eXtplorer configuration: - Provides web interface to file server. - Preconfigured admin and guest users. - Includes vsftpd binded to localhost to provide net2ftp backend: - Provide users access to their home directories. - Workarounds permission issues with eXtplorer. - Includes flip to convert text file endings between UNIX and DOS formats. - Includes popular compression support (zip, rar, bz2). - Enabled multiverse Ubuntu repository so rar/unrar can be updated. * Regenerates all secrets during installation / firstboot (security). * Major component versions: samba 3.0.28a-1ubuntu4.8 extplorer 2.0.1 (upstream zipfile) vsftpd 2.0.6-1ubuntu1.1 lighttpd 1.4.19-0ubuntu3.1 * Note: Please refer to turnkey-core's changelog for changes common to all appliances. Here we only describe changes specific to this appliance. -- Alon Swartz Tue, 29 Sep 2009 15:39:41 +0200