{"push_id":648765030,"size":4,"distinct_size":3,"ref":"refs/heads/next","head":"86ef9b4498f64916cb6c0b0cd13808b8351b2530","before":"8330a741485d6807a1bf31e386a1a0c8b85609f0","commits":[{"sha":"d3f570cee307fa32c04381057f4cdf149922c61c","author":{"email":"7ffe1ba40f2584b96991dec44ac44fe7e8d6bc68@quarksecurity.com","name":"Patrick McClory"},"message":"allow variants to specify which packages get built\n\nfor speeding up build times.  i.e. only the vpn needs strongswan","distinct":false,"url":"https://api.github.com/repos/quark-pat/CLIP/commits/d3f570cee307fa32c04381057f4cdf149922c61c"},{"sha":"0f79d9e729602502dfc2852607bdbd361a58b29f","author":{"email":"7ffe1ba40f2584b96991dec44ac44fe7e8d6bc68@quarksecurity.com","name":"Patrick McClory"},"message":"VPN user automation\n\n-Add a second user \"vpn\" that a user can login as to setup a connection\n-Present a *very* simple interface as the login shell - all it does is\n accept \"1\" or \"2\" for IKEv1 or IKEv2 respectively.  and call a setuid\n root program\n-The setuid program again validates the input, and runs a script to\n do the actual work.  No user input is passed to this script\n-The login shell, setuid program and scripts all run as,\n vpnadm_u:vpnadm_r:vpnadm_t.\n-all passwords are generated at runtime, made up of a sequence of\n random english words of a minimum length (based off of\n https://xkcd.com/936/)\n-necessary policy updates\n-move configure_strongswan init script into new configure-strongswan\n package\n-rename client -> sftp\n-map the sftp login to vpnadm_u (to avoid UBAC constraint violation)\n-always include vpn and sftp users in AWS builds, optionally include\n toor\n\nTODO: allow a user to specify a what IP address and/or subnet they want\nto use, so that it doesn't conflict with their current network config.","distinct":true,"url":"https://api.github.com/repos/quark-pat/CLIP/commits/0f79d9e729602502dfc2852607bdbd361a58b29f"},{"sha":"01e44cda69feebd430e1e5544c1d9ee2ebaa75bc","author":{"email":"7ffe1ba40f2584b96991dec44ac44fe7e8d6bc68@quarksecurity.com","name":"Patrick McClory"},"message":"only generate a random list of words once\n\ndoing the whole sort and grep of the dictionary is expensive time wise\nand we really only need it to happen once","distinct":true,"url":"https://api.github.com/repos/quark-pat/CLIP/commits/01e44cda69feebd430e1e5544c1d9ee2ebaa75bc"},{"sha":"86ef9b4498f64916cb6c0b0cd13808b8351b2530","author":{"email":"7ffe1ba40f2584b96991dec44ac44fe7e8d6bc68@quarksecurity.com","name":"Patrick McClory"},"message":"allow ipsec_t to run iptables when running as vpnadm_u:vpnadm_r:ipsec_t","distinct":true,"url":"https://api.github.com/repos/quark-pat/CLIP/commits/86ef9b4498f64916cb6c0b0cd13808b8351b2530"}]}