Package: cmnsense Version: 0.1.0 Architecture: all Maintainer: Szabolcs Gyurko Depends: cmnsense-server (= 0.1.0), cmnsense-cli (= 0.1.0), cmnsense-ui (= 0.1.0), cmnsense-ha (= 0.1.0), cmnsense-frr (= 0.1.0), cmnsense-dhcp (= 0.1.0), cmnsense-dns (= 0.1.0), cmnsense-archive-keyring Recommends: openssh-server Conflicts: cloud-init, netplan.io, netplan-generator, systemd-resolved, ifupdown, ifupdown2, ifupdown-ng, isc-dhcp-client, dhcpcd-base, udhcpc, resolvconf, openresolv, netscript-2.4 Priority: optional Section: net Filename: pool/main/c/cmnsense/cmnsense_0.1.0_all.deb Size: 14408 SHA256: e1700a1b38cb46c834f2a958a77278f72118222090eef79dacb1ba8cbda99436 SHA1: 0e9ee998638acbce7a707db28d7601e3b116eda9 MD5sum: 15f38ae8a8d426979ddb5a8967403817 Description: Debian based firewall distribution (metapackage) Turns a Debian system into a cmnSense firewall appliance: nftables based firewall management with a single IOS-style configuration file, a web interface and a command line interface. . cmnSense takes over all network configuration: installing this package removes or disables the other network managers, imports the current addresses (DHCP-assigned ones as DHCP), routes and name servers into the cmnSense configuration, saves it, and pins interface names to their MAC addresses. Installed-Size: 76 Package: cmnsense-archive-keyring Version: 0.1.0 Architecture: all Maintainer: Szabolcs Gyurko Multi-Arch: foreign Priority: optional Section: misc Filename: pool/main/c/cmnsense-archive-keyring/cmnsense-archive-keyring_0.1.0_all.deb Size: 14164 SHA256: 8818bb83779e563b11582ae251b2433d9e52f835cc6b496c2e096e7fe203b83a SHA1: 7dc496b74fec56ad38a0a283664e88c0363d36d0 MD5sum: 93d17e9d47c5bc848af3cb9672c92a24 Description: OpenPGP key and APT source of the cmnSense repository Installs the key that signs the cmnSense package repository at https://apt.cmnsense.org to /usr/share/keyrings and an APT source that uses only this key for the repository (Signed-By), so the key is not trusted for any other repository. . Primary key fingerprint: 4E9D 50F1 21DE 93A7 F3B4 F2A1 B4D0 7D35 371C 6320 Installed-Size: 96 Package: cmnsense-cli Version: 0.1.0 Architecture: amd64 Maintainer: Szabolcs Gyurko Depends: libc6 (>= 2.36), libnss-systemd, libpam-modules, libpam-runtime, systemd (>= 252) Recommends: cmnsense-server, openssh-server Priority: optional Section: net Filename: pool/main/c/cmnsense-cli/cmnsense-cli_0.1.0_amd64.deb Size: 2090604 SHA256: f3accbcdcd8b46e3eb79af3951087b1ee06ea3a89bd4ae4c361c4757bda84549 SHA1: 1396de69768dd17e2223e97006d756dfab583f35 MD5sum: 717b4c817bdd3f8fa738751205dca41b Description: cmnSense command line interface Interactive, IOS-style command line interface for cmnSense. Talks to the local management API over a unix socket and authenticates the calling user by its peer credentials. . Makes the users of the cmnSense configuration login accounts whose shell is the CLI: systemd userdb records (UIDs 70000-79999, group cmnsense-cli) are generated from the configuration whenever it changes, passwords are checked against the configuration's argon2id secrets through PAM, and SSH keys come from "username NAME ssh-key". Over SSH these accounts get no forwarding, tunnels or agent forwarding. Installed-Size: 7744 Package: cmnsense-dhcp Version: 0.1.0 Architecture: all Maintainer: Szabolcs Gyurko Depends: kea-dhcp4-server (>= 2.6), kea-dhcp6-server (>= 2.6), kea-ctrl-agent (>= 2.6), kea-common (>= 2.6), cmnsense-server (= 0.1.0) Priority: optional Section: net Filename: pool/main/c/cmnsense-dhcp/cmnsense-dhcp_0.1.0_all.deb Size: 14828 SHA256: 1b0356df7822d9b60b6d17cbd90c033deb11b1124d6459183dfb82d04fe732b2 SHA1: 99265ca5fb5325b24d1c88c61c56a1cc34ba2dd2 MD5sum: 65b99e4ac2be448184956a849328f863 Description: cmnSense integration of the Kea DHCP server Lets cmnSense drive ISC Kea: DHCPv4 and DHCPv6 servers per interface are configured in the cmnSense configuration and rendered into /etc/kea/cmnsense, checked by Kea itself before they are applied. On an HA pair the two firewalls run Kea's hot-standby failover over the redundancy link, so leases survive a failover. The Kea control agent listens on localhost only and serves the lease and status views of the web interface and the CLI. Installed-Size: 104 Package: cmnsense-dns Version: 0.1.0 Architecture: all Maintainer: Szabolcs Gyurko Depends: dnsmasq-base (>= 2.86), cmnsense-server (= 0.1.0) Conflicts: dnsmasq Priority: optional Section: net Filename: pool/main/c/cmnsense-dns/cmnsense-dns_0.1.0_all.deb Size: 14864 SHA256: ca5da9f399abfe0bbcc131f2b4ff898314cca45e4af119e40598f3eaed27ee5b SHA1: 9b9c6ecefbeb50d53ae7b853b5b9128bc5f2a44c MD5sum: b16196fc3f99520de5b4d20be2157124 Description: cmnSense DNS resolver (dnsmasq) Runs dnsmasq as a caching DNS forwarder for the networks behind the firewall: per-interface listening, upstream and per-domain forwarders, host overrides, blocked domains, DNSSEC validation and DNS rebinding protection. Host names of DHCP clients are registered automatically. dnsmasq runs unprivileged in a sandboxed unit, cmnsense-dns.service, and serves DNS only (DHCP is served by Kea, see cmnsense-dhcp). Installed-Size: 92 Package: cmnsense-frr Version: 0.1.0 Architecture: all Maintainer: Szabolcs Gyurko Depends: frr (>= 8.4), frr-pythontools, cmnsense-server (= 0.1.0) Priority: optional Section: net Filename: pool/main/c/cmnsense-frr/cmnsense-frr_0.1.0_all.deb Size: 14760 SHA256: 9403e8368cb4ef9f796c6edde2347c18d1ffa6641c2b0020bfbc34821e1ed859 SHA1: 2bd26eea4872d44c78b23d694f78a1dc12feb86a MD5sum: cdc738b70106a2c40bd8af3b9310d97f Description: cmnSense integration of the FRR routing suite Lets cmnSense drive FRR: OSPF, OSPFv3 and BGP are configured in the cmnSense configuration, validated by FRR and rendered into /etc/frr/frr.conf. Ships a fixed daemon list, gives the management server read access to FRR (frrvty) and makes routing HA aware: a VRRP standby keeps its adjacencies but is drained, so a failover only changes metrics. Installed-Size: 84 Package: cmnsense-ha Version: 0.1.0 Architecture: amd64 Maintainer: Szabolcs Gyurko Depends: libc6 (>= 2.36), cmnsense-server (= 0.1.0) Priority: optional Section: net Filename: pool/main/c/cmnsense-ha/cmnsense-ha_0.1.0_amd64.deb Size: 1725996 SHA256: 5842091c31d6667bc1f3ea86b6791b0ccf750d46213b3007b6917267cef4b704 SHA1: 479cbc94274df57dced83712ef30112afef6e4a8 MD5sum: 68f005b191a66e93cb89edfb96ead00e Description: cmnSense high availability (VRRPv3) VRRPv3 daemon for cmnSense firewall pairs: virtual MAC failover addresses, group failover across interfaces and authenticated advertisements. Installed-Size: 9864 Package: cmnsense-server Version: 0.1.0 Architecture: amd64 Maintainer: Szabolcs Gyurko Depends: libc6 (>= 2.36), libssl3t64 (>= 3.0), systemd (>= 252), dbus, polkitd, chrony, libnss-myhostname, iputils-ping, traceroute, lego (>= 4.9) Recommends: nftables Priority: optional Section: net Filename: pool/main/c/cmnsense-server/cmnsense-server_0.1.0_amd64.deb Size: 5026388 SHA256: 6914a653195fafcdcdf517ed622e2329997f6173d4203576296413270e4ce406 SHA1: e3c06eab676fd6a5a46e037d4166ff8bee990207 MD5sum: 55ce6a00f249916de219f7282dcc7988 Description: cmnSense firewall management API server Owns the cmnSense configuration (/etc/cmnsense/cmnsense.conf) and applies it to the running system over netlink. Exposes a local HTTP API on unix sockets for the web interface and the command line interface. Keeps the clock synchronised with chrony, which it also configures to serve time to the networks behind the firewall. Installed-Size: 23116 Package: cmnsense-ui Version: 0.1.0 Architecture: all Maintainer: Szabolcs Gyurko Depends: nginx (>= 1.22), ssl-cert, cmnsense-server Priority: optional Section: net Filename: pool/main/c/cmnsense-ui/cmnsense-ui_0.1.0_all.deb Size: 353728 SHA256: 07642dc45bbfd0ee87e90ad554a7872eeb1ac693da84af9db53d74b643f8d4a9 SHA1: 20b04b9d5fe6df20a885894a8f9d2f3e97ceb1d4 MD5sum: 32239b54ef41fcbe7b89c160b41eae3e Description: cmnSense web interface Statically built web interface for cmnSense, served by nginx over HTTPS and proxied to the local management API. Installed-Size: 1680 Package: cmnsense-vpn Version: 0.1.0 Architecture: all Maintainer: Szabolcs Gyurko Depends: charon-systemd (>= 6.0), libstrongswan-standard-plugins (>= 6.0), cmnsense-server (= 0.1.0) Priority: optional Section: net Filename: pool/main/c/cmnsense-vpn/cmnsense-vpn_0.1.0_all.deb Size: 14552 SHA256: 5e92727c37fbf8f45970286870a6c72984ee727721800f1d3b21544af113eb03 SHA1: 27d97c27cfadcfbe9796d7e2daec807949899872 MD5sum: d8f3e154c77a4f6fde4039be35d92b2a Description: cmnSense VPN (IPsec with strongSwan) Route-based IPsec for cmnSense: IKEv2 (and IKEv1) site-to-site tunnels with pre-shared keys, bound to ipsecN (XFRM) interfaces so that routing, firewall rules and NAT work on them like on any other interface. . cmnsense-server configures strongSwan's charon over its VICI socket and starts it only when IPsec peers are configured, and on a high availability pair only on the active unit. WireGuard is built into cmnsense-server. Installed-Size: 92