<pre style='margin:0'>
Frank Schima (mf2k) pushed a commit to branch master
in repository macports-ports.
</pre>
<p><a href="https://github.com/macports/macports-ports/commit/2aea590ca3d2be9c69ce4c306cc7102ce139c3ab">https://github.com/macports/macports-ports/commit/2aea590ca3d2be9c69ce4c306cc7102ce139c3ab</a></p>
<pre style="white-space: pre; background: #F8F8F8">The following commit(s) were added to refs/heads/master by this push:
<span style='display:block; white-space:pre;color:#404040;'> new 2aea590 macos-vpn-server: Portfile enhancements
</span>2aea590 is described below
<span style='display:block; white-space:pre;color:#808000;'>commit 2aea590ca3d2be9c69ce4c306cc7102ce139c3ab
</span>Author: Steven Thomas Smith <s.t.smith@ieee.org>
AuthorDate: Mon Nov 11 04:33:42 2019 -0500
<span style='display:block; white-space:pre;color:#404040;'> macos-vpn-server: Portfile enhancements
</span><span style='display:block; white-space:pre;color:#404040;'>
</span><span style='display:block; white-space:pre;color:#404040;'> * Portfile enhancements based on PR https://github.com/macports/macports-ports/pull/4978
</span>---
net/dns-server/Portfile | 18 ++++++-------
net/macos-vpn-server/Portfile | 63 +++++++++++++++++++++----------------------
2 files changed, 39 insertions(+), 42 deletions(-)
<span style='display:block; white-space:pre;color:#808080;'>diff --git a/net/dns-server/Portfile b/net/dns-server/Portfile
</span><span style='display:block; white-space:pre;color:#808080;'>index 3bdf061..f61eb9b 100644
</span><span style='display:block; white-space:pre;background:#e0e0ff;'>--- a/net/dns-server/Portfile
</span><span style='display:block; white-space:pre;background:#e0e0ff;'>+++ b/net/dns-server/Portfile
</span><span style='display:block; white-space:pre;background:#e0e0e0;'>@@ -21,7 +21,7 @@ long_description \
</span> and CNAME (alias) records, MX, SPF, DKIM, and DMARC records for email\
servers, and URI, TXT, and SRV records for Kerberos servers. This\
configuration is based upon macOS Server.app's VPN server prior to\
<span style='display:block; white-space:pre;background:#ffe0e0;'>- its deprecation in Server.app version 5.8. See `man named`.
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ its deprecation in Server.app version 5.7. See `man named`.
</span>
homepage https://www.isc.org/
<span style='display:block; white-space:pre;background:#e0e0e0;'>@@ -179,8 +179,8 @@ settings to provide a basic, working DNS server.
</span> Users must reconfigure the installation for their own network\
specifics by editing the files:
<span style='display:block; white-space:pre;background:#ffe0e0;'>- ${prefix}/etc/named.conf
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- ${prefix}/var/named/db.*
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ ${prefix}/etc/named.conf
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ ${prefix}/var/named/db.*
</span>
Refer to the *.macports template files and `man named` for details.
<span style='display:block; white-space:pre;background:#e0e0e0;'>@@ -190,21 +190,21 @@ Post Installation:
</span> and reverse DNS entries. Example: These two commands should point to\
each other:
<span style='display:block; white-space:pre;background:#ffe0e0;'>- host ${named_host} ${host_lan_ip_address}
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- host ${host_lan_ip_address} ${host_lan_ip_address}
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ host ${named_host} ${host_lan_ip_address}
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ host ${host_lan_ip_address} ${host_lan_ip_address}
</span>
A rndc.key fil is automatically created with the command:
<span style='display:block; white-space:pre;background:#ffe0e0;'>- rndc-confgen -A hmac-sha512 -a -c ${prefix}/var/named/rndc.key -u named
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ rndc-confgen -A hmac-sha512 -a -c ${prefix}/var/named/rndc.key -u named
</span>
2. It is necessary to launch named with:
<span style='display:block; white-space:pre;background:#ffe0e0;'>- sudo port load bind9
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ sudo port load bind9
</span>
3. DNS cache on macOS is flushed with the commands:
<span style='display:block; white-space:pre;background:#ffe0e0;'>- dscacheutil -flushcache ; sudo killall -HUP mDNSResponder ; \\
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- sudo port reload bind9
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ dscacheutil -flushcache ; sudo killall -HUP mDNSResponder ; \\
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ sudo port reload bind9
</span>
4. The DNS server is configured by default to accept requests on port 53\
over the LAN. Make sure that this port is not exposed to the open\
<span style='display:block; white-space:pre;color:#808080;'>diff --git a/net/macos-vpn-server/Portfile b/net/macos-vpn-server/Portfile
</span><span style='display:block; white-space:pre;color:#808080;'>index 5111265..996fbbc 100644
</span><span style='display:block; white-space:pre;background:#e0e0ff;'>--- a/net/macos-vpn-server/Portfile
</span><span style='display:block; white-space:pre;background:#e0e0ff;'>+++ b/net/macos-vpn-server/Portfile
</span><span style='display:block; white-space:pre;background:#e0e0e0;'>@@ -18,10 +18,10 @@ set SystemConfigurationPath /Library/Preferences/SystemConfiguration
</span>
description macOS VPN (L2TP-IPSec-PSK) Server.
long_description ${description} \
<span style='display:block; white-space:pre;background:#ffe0e0;'>- Native macOS VPN Server L2TP-IPSec-PSK configuration using vpnd. This \
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- configuration is based upon macOS Server.app's VPN server prior to its \
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- deprecation in Server.app version 5.8. See `man 5 vpnd` and \
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- ${SystemConfigurationPath}/com.apple.RemoteAccessServers.plist \
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ Native macOS VPN Server L2TP-IPSec-PSK configuration using vpnd. This\
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ configuration is based upon macOS Server.app's VPN server prior to its\
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ deprecation in Server.app version 5.7. See `man 5 vpnd` and\
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ ${SystemConfigurationPath}/com.apple.RemoteAccessServers.plist\
</span> for details.
# uncomment if memorable passwords used
<span style='display:block; white-space:pre;background:#e0e0e0;'>@@ -99,17 +99,16 @@ post-activate {
</span>
ui_msg "Configuring VPN Network with:
<span style='display:block; white-space:pre;background:#ffe0e0;'>- VPNHost ${vpn_vpnhost}
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- OfferedServerAddresses (DNS) ${vpn_offeredserveraddress}
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- OfferedSearchDomains ${vpn_offeredsearchdomain}
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- DestAddressRanges ${vpn_destaddressrange_start} to ${vpn_destaddressrange_end}
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ VPNHost ${vpn_vpnhost}
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ OfferedServerAddresses (DNS) ${vpn_offeredserveraddress}
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ OfferedSearchDomains ${vpn_offeredsearchdomain}
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ DestAddressRanges ${vpn_destaddressrange_start} to ${vpn_destaddressrange_end}
</span>
This configuration can be changed in the file:
<span style='display:block; white-space:pre;background:#ffe0e0;'>- ${SystemConfigurationPath}/com.apple.RemoteAccessServers.plist
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ ${SystemConfigurationPath}/com.apple.RemoteAccessServers.plist
</span>
<span style='display:block; white-space:pre;background:#ffe0e0;'>- See `man 5 vpnd` for details.
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-"
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ See `man 5 vpnd` for details."
</span> }
# Add launchd.plist keys to MacPorts launchdaemon
<span style='display:block; white-space:pre;background:#e0e0e0;'>@@ -123,39 +122,37 @@ post-activate {
</span> ${prefix}/etc/${startupitem.location}/org.macports.${name}/org.macports.${name}.plist
}
<span style='display:block; white-space:pre;background:#ffe0e0;'>-notes "
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-The macOS VPN Server's initial configuration uses installation-time network
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-settings to provide a basic, working VPN server.
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+notes "The macOS VPN Server's initial configuration uses installation-time\
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ network settings to provide a basic, working VPN server.
</span>
<span style='display:block; white-space:pre;background:#ffe0e0;'>-Users must reconfigure the installation for their own network
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-specifics by editing the files:
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ Users must reconfigure the installation for their own network\
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ specifics by editing the files:
</span>
<span style='display:block; white-space:pre;background:#ffe0e0;'>- ${SystemConfigurationPath}/com.apple.RemoteAccessServers.plist
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ ${SystemConfigurationPath}/com.apple.RemoteAccessServers.plist
</span>
See `man 5 vpnd` for details.
<span style='display:block; white-space:pre;background:#ffe0e0;'>-The VPN Pre-Shared Secret is stored in the System Keychain item
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-com.apple.net.racoon, available within Keychain Access.app or
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-/usr/bin/security.
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ The VPN Pre-Shared Secret is stored in the System Keychain item\
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ com.apple.net.racoon, available within Keychain Access.app or\
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ /usr/bin/security.
</span>
<span style='display:block; white-space:pre;background:#ffe0e0;'>-Post Installation:
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ Post Installation:
</span>
<span style='display:block; white-space:pre;background:#ffe0e0;'>- 1. It is necessary to configure local accounts for CHAP authentication
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- by adding ',SMB-NT,CRAM-MD5,RECOVERABLE' to the account's
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ 1. It is necessary to configure local accounts for CHAP authentication\
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ by adding ',SMB-NT,CRAM-MD5,RECOVERABLE' to the account's\
</span> AuthenticationAuthority ShadowHash list of methods.
<span style='display:block; white-space:pre;background:#ffe0e0;'>- dscl . read /Users/username AuthenticationAuthority
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- sudo dscl . change /Users/username AuthenticationAuthority \\
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- \";ShadowHash;HASHLIST:<SALTED-SHA512-PBKDF2,SRP-RFC5054-4096-SHA512-PBKDF2>\" \\
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- \";ShadowHash;HASHLIST:<SALTED-SHA512-PBKDF2,SRP-RFC5054-4096-SHA512-PBKDF2,SMB-NT,CRAM-MD5,RECOVERABLE>\"
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- passwd
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+dscl . read /Users/username AuthenticationAuthority
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+sudo dscl . change /Users/username AuthenticationAuthority \\
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ \";ShadowHash;HASHLIST:<SALTED-SHA512-PBKDF2,SRP-RFC5054-4096-SHA512-PBKDF2>\" \\
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ \";ShadowHash;HASHLIST:<SALTED-SHA512-PBKDF2,SRP-RFC5054-4096-SHA512-PBKDF2,SMB-NT,CRAM-MD5,RECOVERABLE>\"
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+passwd
</span>
<span style='display:block; white-space:pre;background:#ffe0e0;'>- The `passwd` command or re-login may be necessary to populate macOS's
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- user shadow hash database. Note that MS-CHAPv2 is compromised, and the
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ The `passwd` command or re-login may be necessary to populate macOS's\
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ user shadow hash database. Note that MS-CHAPv2 is compromised, and the\
</span> only secure component of this VPN is a strong random PSK.
<span style='display:block; white-space:pre;background:#ffe0e0;'>- 2. The router and firewall must be configured to forward and pass UDP ports
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- 500, 1701, and 4500.
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-"
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ 2. The router and firewall must be configured to forward and pass UDP ports\
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ 500, 1701, and 4500."
</span>
livecheck.type none
</pre><pre style='margin:0'>
</pre>