* Sat Jan 18 2025 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-23.sme

- handle all ssl ciphers and protocol in one place esmith::ssl [SME: 12827]
  this will allow to sync all service default protocol and ciphers
  in one place.

.gitignore

@@ -2,3 +2,5 @@
 *.log
 *spec-20*
 *.tar.xz
+*.bak
+*gz

README.md

@@ -6,7 +6,14 @@ SMEServer Koozali developed git repo for smeserver-base smeserver
 <br />https://wiki.koozali.org/
 
 ## Bugzilla
-Show list of outstanding bugs: [here](https://bugs.koozali.org/buglist.cgi?component=smeserver-base&product=SME%20Server%2010.X&query_format=advanced&limit=0&bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&bug_status=CONFIRMED)\
+Show list of outstanding bugs:
+[All](https://bugs.koozali.org/buglist.cgi?action=wrap&bug_status=UNCONFIRMED&bug_status=CONFIRMED&bug_status=NEEDINFO&bug_status=IN_PROGRESS&bug_status=RESOLVED&bug_status=VERIFIED&cf_package=smeserver-base&classification=SME+Server&list_id=105756&order=changeddate+DESC%2Ccomponent%2Cpriority%2Cbug_severity&query_format=advanced)  
+[Confirmed](https://bugs.koozali.org/buglist.cgi?action=wrap&bug_status=CONFIRMED&cf_package=smeserver-base&classification=SME+Server&order=changeddate+DESC%2Ccomponent%2Cpriority%2Cbug_severity&query_format=advanced)  
+[Unconfirmed](https://bugs.koozali.org/buglist.cgi?action=wrap&bug_status=UNCONFIRMED&cf_package=smeserver-base&classification=SME+Server&order=changeddate+DESC%2Ccomponent%2Cpriority%2Cbug_severity&query_format=advanced)  
+[Need info](https://bugs.koozali.org/buglist.cgi?action=wrap&bug_status=NEEDINFO&cf_package=smeserver-base&classification=SME+Server&order=changeddate+DESC%2Ccomponent%2Cpriority%2Cbug_severity&query_format=advanced)  
+[In progress](https://bugs.koozali.org/buglist.cgi?action=wrap&bug_status=IN_PROGRESS&cf_package=smeserver-base&classification=SME+Server&order=changeddate+DESC%2Ccomponent%2Cpriority%2Cbug_severity&query_format=advanced)  
+[Resolved](https://bugs.koozali.org/buglist.cgi?action=wrap&bug_status=RESOLVED&cf_package=smeserver-base&classification=SME+Server&order=changeddate+DESC%2Ccomponent%2Cpriority%2Cbug_severity&query_format=advanced)  
+[Verified](https://bugs.koozali.org/buglist.cgi?action=wrap&bug_status=VERIFIED&cf_package=smeserver-base&classification=SME+Server&order=changeddate+DESC%2Ccomponent%2Cpriority%2Cbug_severity&query_format=advanced)
 And a list of outstanding Legacy bugs: (e-smith-base) [here](https://bugs.koozali.org/buglist.cgi?component=e-smith-base&product=SME%20Server%2010.X&query_format=advanced&limit=0&bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&bug_status=CONFIRMED)
 
 ## Description

additional/CVS/Entries

@@ -1 +0,0 @@
-D

additional/CVS/Repository

@@ -1 +0,0 @@
-rpms/e-smith-base/sme10/e-smith-base-5.8.0

additional/CVS/Root

@@ -1 +0,0 @@
-:ext:jpp@shell.koozali.org:/cvs/smeserver

additional/createlinks.orig

@@ -1,672 +0,0 @@
-#!/usr/bin/perl -w
-
-use esmith::Build::CreateLinks  qw(:all);
-
-templates2events("/etc/sysconfig/i18n", qw(post-install post-upgrade e-smith-base-update));
-
-templates2events("/etc/selinux/config", qw(post-install post-upgrade e-smith-base-update));
-
-# give the correct configuration file of dhcpd.conf 
-templates2events("/etc/dhcp/dhcpd.conf", qw(bootstrap-console-save e-smith-base-update));
-
-# ppp-conf-users
-
-foreach (qw(pap-secrets chap-secrets))
-{
-    templates2events("/etc/ppp/$_", qw(
-	    bootstrap-console-save
-	    console-save
-	    remoteaccess-update
-	    e-smith-base-update));
-}
-
-foreach (qw(
-	/var/service/wan/pppoe.pppd.conf
-	/var/service/wan/run.pppoe.conf
-	/etc/ppp/ip-down.local
-	/etc/ppp/ip-up.local
-    ))
-{
-    templates2events("$_", qw(
-	console-save
-	bootstrap-console-save
-	e-smith-base-update
-	));
-}
-
-safe_symlink("daemontools", "root/etc/rc.d/init.d/wan");
-service_link_enhanced("wan", "S37", "7");
-service_link_enhanced("wan", "K90", "6");
-service_link_enhanced("wan", "K90", "0");
-service_link_enhanced("wan", "K90", "1");
-
-# conf-dialup
-foreach (qw(
-    /etc/sysconfig/network-scripts/ifcfg-ppp0
-    /etc/sysconfig/network-scripts/chat-ppp0
-    /etc/ppp/ip-up.local
-    /etc/ppp/ip-down.local
-    /etc/diald.conf
-    /etc/diald.filter
-    /etc/diald/link
-    /var/service/ippp/config
-    /etc/ppp/ioptions
-    ))
-{
-    templates2events($_, qw(console-save bootstrap-console-save e-smith-base-update));
-}
-
-# conf-networking
-
-foreach (qw(
-    /etc/sysconfig/network-scripts/ifcfg-bond0
-    /etc/modprobe.d/bonding.conf
-    /etc/sysconfig/network
-    /etc/nsswitch.conf
-    /etc/HOSTNAME
-    /etc/hosts
-    /etc/resolv.conf
-    /etc/sysctl.conf
-    /var/service/wan/dhclient.config
-    ))
-{
-    templates2events($_, qw(console-save bootstrap-console-save e-smith-base-update));
-}
-event_link("update-ifcfg", "console-save", "05");
-event_link("update-ifcfg", "bootstrap-console-save", "05");
-
-# conf-other
-
-templates2events("/etc/crontab",  qw(
-	console-save
-	bootstrap-console-save
-	post-install
-	post-upgrade
-	email-update
-	logrotate
-	e-smith-base-update
-	));
-templates2events("/etc/mime.types",  qw(
-	console-save
-	bootstrap-console-save
-	post-install
-	post-upgrade
-	email-update
-	logrotate
-	e-smith-base-update
-	));
-templates2events("/etc/sysconfig/rsyslog",  qw(
-	console-save
-	bootstrap-console-save
-	post-install
-	post-upgrade
-	email-update
-	logrotate
-	e-smith-base-update
-	));
-templates2events("/etc/rsyslog.conf",  qw(
-	console-save
-	bootstrap-console-save
-	post-install
-	post-upgrade
-	email-update
-	logrotate
-	e-smith-base-update
-	));
-templates2events("/etc/updatedb.conf", qw(
-	bootstrap-console-save
-	e-smith-base-update
-));
-templates2events("/etc/openssl.conf",  qw(
-        console-save
-        bootstrap-console-save
-        post-install
-        post-upgrade
-	domain-create
-	domain-delete
-	network-create
-	network-delete
-        ip-change
-	e-smith-base-update
-        ));
-
-# conf-routes
-event_link("update-ifcfg", "network-create", "05");
-event_link("update-ifcfg", "network-delete", "05");
-
-# conf-security
-
-templates2events("/etc/securetty", qw(
-	console-save
-	bootstrap-console-save
-	ibay-create
-	ibay-delete
-	ibay-modify
-	ibay-modify-servers
-	network-create
-	network-delete
-	ip-change
-	email-update
-	remoteaccess-update
-	e-smith-base-update
-	));
-templates2events("/etc/services", qw(
-	console-save
-	bootstrap-console-save
-	ibay-create
-	ibay-delete
-	ibay-modify
-	ibay-modify-servers
-	network-create
-	network-delete
-	ip-change
-	email-update
-	remoteaccess-update
-	e-smith-base-update
-	));
-templates2events("/etc/shells", qw(
-	console-save
-	bootstrap-console-save
-	ibay-create
-	ibay-delete
-	ibay-modify
-	ibay-modify-servers
-	network-create
-	network-delete
-	ip-change
-	email-update
-	remoteaccess-update
-	e-smith-base-update
-	));
-templates2events("/etc/hosts.deny", qw(
-	console-save
-	bootstrap-console-save
-	ibay-create
-	ibay-delete
-	ibay-modify
-	ibay-modify-servers
-	network-create
-	network-delete
-	ip-change
-	email-update
-	remoteaccess-update
-	e-smith-base-update
-	));
-templates2events("/etc/hosts.allow", qw(
-	console-save
-	bootstrap-console-save
-	ibay-create
-	ibay-delete
-	ibay-modify
-	ibay-modify-servers
-	network-create
-	network-delete
-	ip-change
-	email-update
-	remoteaccess-update
-	e-smith-base-update
-	));
-foreach my $file (qw(
-        /etc/pam.d/login
-	/etc/pam.d/system-auth
-	/etc/pam.d/passwd
-	/etc/pam.d/pwauth
-	/etc/pam_ldap.conf
-	/etc/pam_ldap.secret
-	/etc/security/pam_abl.conf
-    ))
-{
-    templates2events($file, qw(console-save bootstrap-console-save e-smith-base-update));
-}
-
-foreach (qw(
-       /etc/cpu.conf
-       /etc/cpu-system.conf
-    ))
-{
-    templates2events("$_", qw(
-	post-upgrade
-	console-save
-	bootstrap-console-save
-	ldap-update
-	e-smith-base-update
-	));
-}
-
-# conf-userlists
-
-foreach (qw(users.allow accounts.allow accounts.deny))
-{
-    templates2events("/etc/e-smith/pam/$_", qw(
-	bootstrap-console-save
-	ibay-create
-	ibay-delete
-	user-create
-	user-delete
-	password-modify
-	e-smith-base-update
-	));
-}
-
-# fstab-conf
-
-templates2events("/etc/fstab", qw(post-install post-upgrade e-smith-base-update));
-
-# init-conf
-
-templates2events("/etc/inittab", qw(
-	console-save
-	bootstrap-console-save
-	post-install
-	post-upgrade
-	remoteaccess-update
-	e-smith-base-update
-	));
-
-# lynx-conf
-
-templates2events("/etc/lynx.cfg", qw(console-save bootstrap-console-save e-smith-base-update));
-templates2events("/etc/elinks.conf", qw(bootstrap-console-save e-smith-base-update));
-
-#
-# Set up generic logfile timestamp renaming/symlinking
-
-foreach (qw(
-    /var/log/messages
-    /var/log/boot.log
-    /var/log/secure
-    /var/log/cron
-    /var/log/spooler
-    /var/log/maillog
-    ))
-{
-    safe_touch "root/etc/e-smith/events/logrotate/logfiles2timestamp/$_";
-    safe_touch "root/etc/e-smith/events/post-install/logfiles2timestamp/$_";
-    safe_touch "root/etc/e-smith/events/post-upgrade/logfiles2timestamp/$_";
-    safe_touch "root/etc/e-smith/events/e-smith-base-update/logfiles2timestamp/$_";
-}
-
-#--------------------------------------------------
-# functions for manager panel
-#--------------------------------------------------
-my $panel = "manager";
-
-panel_link("groups", $panel);
-panel_link("localnetworks", $panel);
-panel_link("online-manual", $panel);
-panel_link("reboot", $panel);
-panel_link("remoteaccess", $panel);
-panel_link("review", $panel);
-panel_link("useraccounts", $panel);
-
-#--------------------------------------------------
-# actions for e-smith-base-update event
-#--------------------------------------------------
-my $event = "e-smith-base-update";
-
-
-templates2events("/etc/smartd.conf", $event);
-templates2events("/home/e-smith/ssl.pem/pem", $event);
-event_link("fix-startup", $event, "05");
-event_link("rotate_timestamped_logfiles", $event, "05");
-event_link("init-accounts", $event, "05");
-event_link("set-hostname", $event, "10");
-event_link("rmmod-bonding", $event, "10");
-event_link("conf-startup", $event, "10");
-event_link("user-lock-passwd", $event, "15");
-event_link("group-modify-unix", $event, "15");
-event_link("update-passwd", $event, "20");
-event_link("count-active-user-accounts", $event, "25");
-event_link("conf-modules", $event, "30");
-event_link("create-mnt-floppy", $event, "50");
-event_link("conf-routes", $event, "89");
-event_link("reset-unsavedflag", $event, "95")
-
-safe_symlink("restart", "root/etc/e-smith/events/$event/services2adjust/wan");
-safe_symlink("restart", "root/etc/e-smith/events/$event/services2adjust/dhcpd");
-safe_symlink("restart", "root/etc/e-smith/events/$event/services2adjust/rsyslog");
-safe_symlink("restart", "root/etc/e-smith/events/$event/services2adjust/crond");
-
-#--------------------------------------------------
-# actions for console-save event
-#--------------------------------------------------
-my $event = "console-save";
-
-
-templates2events("/etc/smartd.conf", $event);
-templates2events("/home/e-smith/ssl.pem/pem", $event);
-event_link("set-hostname", $event, "10");
-event_link("conf-modules", $event, "30");
-event_link("conf-startup", $event, "60");
-event_link("reset-unsavedflag", $event, "95");
-
-safe_symlink("restart", "root/etc/e-smith/events/$event/services2adjust/wan");
-safe_symlink("restart", "root/etc/e-smith/events/$event/services2adjust/dhcpd");
-
-#--------------------------------------------------
-# actions for bootstrap-console-save event
-#--------------------------------------------------
-$event = "bootstrap-console-save";
-
-
-templates2events("/etc/smartd.conf", $event);
-templates2events("/home/e-smith/ssl.pem/pem", $event);
-event_link("rmmod-bonding", $event, "10");
-event_link("set-hostname", $event, "10");
-event_link("conf-modules", $event, "30");
-event_link("conf-startup", $event, "60");
-event_link("conf-routes", $event, "89");
-event_link("reset-unsavedflag", $event, "95");
-
-#--------------------------------------------------
-# actions for bootstrap-ldap-save
-#--------------------------------------------------
-$event = "bootstrap-ldap-save";
-
-templates2events("/etc/nsswitch.conf", $event);
-templates2events("/etc/pam.d/system-auth", $event);
-event_link("user-lock-passwd", $event, "15");
-event_link("user-modify-unix", $event, "15");
-
-#--------------------------------------------------
-# actions for group-create event
-#--------------------------------------------------
-
-$event = "group-create";
-
-event_link("group-create-unix", $event, "04");
-
-#--------------------------------------------------
-# actions for group-delete event
-#--------------------------------------------------
-
-$event = "group-delete";
-
-event_link("group-delete-unix", $event, "15");
-
-#--------------------------------------------------
-# actions for group-modify event
-#--------------------------------------------------
-
-$event = "group-modify";
-
-event_link("group-modify-unix", $event, "15");
-
-#--------------------------------------------------
-# actions for halt event
-#--------------------------------------------------
-
-$event = "halt";
-
-event_link("halt", $event, "70");
-
-#--------------------------------------------------
-# actions for ip-change event
-#--------------------------------------------------
-
-$event = "ip-change";
-
-event_link("set-external-ip", $event, "03");
-event_link("update-dns", $event, "85");
-
-#--------------------------------------------------
-# actions for network-create event
-#--------------------------------------------------
-
-$event = "network-create";
-
-event_link("conf-routes", $event, "89");
-
-#--------------------------------------------------
-# actions for network-delete event
-#--------------------------------------------------
-
-$event = "network-delete";
-
-event_link("conf-routes", $event, "89");
-
-#--------------------------------------------------
-# actions for post-install event
-#--------------------------------------------------
-
-$event = "post-install";
-
-event_link("fix-startup", $event, "05");
-event_link("rotate_timestamped_logfiles", $event, "05");
-event_link("init-accounts", $event, "05");
-event_link("init-passwords", $event, "10");
-event_link("conf-startup", $event, "10");
-event_link("conf-modules", $event, "30");
-event_link("create-mnt-floppy", $event, "50");
-
-#--------------------------------------------------
-# actions for post-upgrade event
-#--------------------------------------------------
-
-$event = "post-upgrade";
-
-event_link("fix-startup", $event, "05");
-event_link("rotate_timestamped_logfiles", $event, "05");
-event_link("init-accounts", $event, "05");
-event_link("conf-startup", $event, "10");
-event_link("user-lock-passwd", $event, "15");
-event_link("group-modify-unix", $event, "15");
-event_link("update-passwd", $event, "20");
-event_link("count-active-user-accounts", $event, "25");
-event_link("conf-modules", $event, "30");
-event_link("create-mnt-floppy", $event, "50");
-event_link("copy-anaconda-logs", $event, "90");
-
-#--------------------------------------------------
-# actions for reboot event
-#--------------------------------------------------
-
-$event = "reboot";
-
-safe_symlink("stop", "root/etc/e-smith/events/$event/services2adjust/wan");
-event_link("reboot", $event, "99");
-
-#--------------------------------------------------
-# actions for remoteaccess-update event
-#--------------------------------------------------
-
-$event = "remoteaccess-update";
-
-safe_symlink("restart", "root/etc/e-smith/events/$event/services2adjust/dhcpd");
-
-#--------------------------------------------------
-# actions for user-create event
-#--------------------------------------------------
-
-$event = "user-create";
-
-event_link("user-create-unix", $event, "04");
-event_link("count-active-user-accounts", $event, "25");
-event_link("user-group-modify", $event, "85");
-
-#--------------------------------------------------
-# actions for user-delete event
-#--------------------------------------------------
-
-$event = "user-delete";
-
-event_link("user-delete-groups-and-pseudonyms", $event, "02");
-event_link("user-delete-unix", $event, "15");
-event_link("initialize-default-databases", $event, "23");
-event_link("count-active-user-accounts", $event, "25");
-
-#--------------------------------------------------
-# actions for user-modify event
-#--------------------------------------------------
-
-$event = "user-modify";
-
-event_link("user-modify-unix", $event, "15");
-event_link("user-group-modify", $event, "85");
-
-$event = "user-modify-admin";
-
-event_link("user-modify-unix", $event, "15");
-
-#--------------------------------------------------
-# actions for user-lock event
-#--------------------------------------------------
-
-$event = "user-lock";
-
-event_link("user-lock-passwd", $event, "15");
-event_link("count-active-user-accounts", $event, "25");
-
-#--------------------------------------------------
-# actions for password-modify event
-#--------------------------------------------------
-
-$event = "password-modify";
-
-event_link("count-active-user-accounts", $event, "25");
-
-#--------------------------------------------------
-# actions for timeserver-update event
-#--------------------------------------------------
-
-$event = "timeserver-update";
-
-safe_symlink("restart", "root/etc/e-smith/events/$event/services2adjust/crond");
-
-#--------------------------------------------------
-# actions for ip-up event
-#--------------------------------------------------
-
-$event = "ip-up";
-
-event_link("set-gateway-ip", $event, "55");
-
-#--------------------------------------------------
-# actions for ip-down event
-#--------------------------------------------------
-
-$event = "ip-down";
-
-event_link("isdn-down-notify", $event, "50");
-
-#--------------------------------------------------
-# actions for logrotate event
-#--------------------------------------------------
-
-$event = "logrotate";
-
-event_link("rotate_timestamped_logfiles", $event, "05");
-event_link("purge-old-logs", $event, "75");
-
-safe_symlink("restart", "root/etc/e-smith/events/$event/services2adjust/rsyslog");
-
-#--------------------------------------------------
-# actions for local event
-#--------------------------------------------------
-
-$event = "local";
-
-#--------------------------------------------------
-# actions for ldap-update event
-#--------------------------------------------------
-
-$event = "ldap-update";
-
-templates2events("/home/e-smith/ssl.pem/pem", $event);
-
-#--------------------------------------------------
-# actions for ldap-update event
-#--------------------------------------------------
-
-$event = "ssl-update";
-
-templates2events("/home/e-smith/ssl.pem/pem", $event);
-
-
-#--------------------------------------------------
-# actions for email-update event:
-# email parameters have been changed in the e-smith
-# manager; update system security, rewrite email config
-# files, configure other system files (crontab is the
-# important one), and restart server
-#--------------------------------------------------
-$event = "email-update";
-
-
-my %service2order =
-(
-    # Start rsyslog up before network!
-    raidmonitor => "15",
-    network  	=> "37",
-    dhcpd    	=> "65",
-    'local'    	=> "99",
-);
-
-foreach my $service (keys %service2order)
-{
-    service_link_enhanced($service, $service2order{$service}, 7);
-}
-
-%service2order =
-(
-    dhcpd       => "K35",
-);
-
-foreach my $service (keys %service2order)
-{
-    service_link_enhanced($service, $service2order{$service}, 0);
-    service_link_enhanced($service, $service2order{$service}, 6);
-    service_link_enhanced($service, $service2order{$service}, 1);
-}
-
-# Set up links to daemontools.
-safe_symlink("daemontools", "root/etc/rc.d/init.d/raidmonitor");
-
-safe_symlink("run.dhclient", "root/var/service/wan/run.DHCPHostname");
-safe_symlink("run.dhclient", "root/var/service/wan/run.DHCPEthernetAddress");
-
-# Local event
-safe_symlink("../daemontools", "root/etc/rc.d/init.d/supervise/local");
-safe_symlink("/var/service/local" , 'root/service/local');
-safe_touch("root/var/service/local/down");
-
-# no template headers for /etc/pam_ldap.secret
-safe_touch("root/etc/e-smith/templates/etc/pam_ldap.secret/template-begin");
-
-
-system('mkdir -p root/usr/lib/systemd/system/multi-user.target.wants/');
-	unlink "root/usr/lib/systemd/system/multi-user.target.wants/bootstrap-console.service";
-symlink("/usr/lib/systemd/system/bootstrap-console.service",
-		"root/usr/lib/systemd/system/multi-user.target.wants/bootstrap-console.service")
-	or die "Can't symlink to root/usr/lib/systemd/system/multi-user.target.wants/bootstrap-console.service: $!";
-
-# languages links
-foreach (qw(fr-be fr-lu fr-mc fr-ch))
-{
-	safe_symlink("fr", "root/etc/e-smith/locale/$_");
-}
-foreach (qw(en-bz en-ca en-ie en-in en-jm en-my en-ph en-sg en-tt en-za en-zw))
-{
-        safe_symlink("en-us", "root/etc/e-smith/locale/$_");
-}
-foreach (qw(es-ar es-bo es-cl es-co es-cr es-do es-ec es-es es-gt es-hn es-mx es-ni es-pa es-pe es-pr es-py es-sv es-us es-uy es-ve))
-{
-        safe_symlink("es", "root/etc/e-smith/locale/$_");
-}
-foreach (qw(de-at de-ch de-de de-li de-lu))
-{
-        safe_symlink("de", "root/etc/e-smith/locale/$_");
-}
-foreach (qw(it-ch it-it))
-{
-	safe_symlink("it", "root/etc/e-smith/locale/$_");
-}
-foreach (qw(ro-ro ro-md))
-{
-        safe_symlink("ro", "root/etc/e-smith/locale/$_");
-}
-foreach (qw(sv-fi sv-se))
-{
-	safe_symlink("sv", "root/etc/e-smith/locale/$_");
-}
-safe_symlink("zh-tw", "root/etc/e-smith/locale/zh-hk");

contriborbase

@@ -1 +0,0 @@
-sme10

createlinks

@@ -309,6 +309,7 @@ templates2events("/usr/lib/systemd/system/dhcpd.service.d/50koozali.conf", $even
 event_link("systemd-journald", $event, "02");
 event_link("fix-startup", $event, "05");
 event_link("init-accounts", $event, "05");
+event_link("mail-spool-fix", $event, "05");
 event_link("logrotate-migrate", $event, "06");
 event_link("rotate_logfiles", $event, "07");
 event_link("set-hostname", $event, "10");
@@ -325,6 +326,7 @@ event_link("conf-routes", $event, "89");
 event_link("systemd-default", $event, "88");
 event_link("systemd-isolate", $event, "89");
 event_link("systemd-reload", $event, "89");
+event_link("fix-noise-el8", $event, "89");
 event_link("raidmonitor-check", $event, "92");
 
 safe_symlink("restart", "root/etc/e-smith/events/$event/services2adjust/network");
@@ -457,6 +459,7 @@ event_link("conf-modules", $event, "30");
 event_link("create-mnt-floppy", $event, "50");
 event_link("systemd-default", $event, "88");
 event_link("systemd-reload", $event, "89");
+event_link("fix-noise-el8", $event, "89");
 
 #--------------------------------------------------
 # actions for post-upgrade event
@@ -469,6 +472,7 @@ templates2events("/usr/lib/systemd/system/dhcpd.service.d/50koozali.conf", $even
 event_link("systemd-journald", $event, "02");
 event_link("fix-startup", $event, "05");
 event_link("init-accounts", $event, "05");
+event_link("mail-spool-fix", $event, "05");
 event_link("logrotate-migrate", $event, "06");
 event_link("rotate_logfiles", $event, "07");
 event_link("conf-startup", $event, "10");
@@ -512,6 +516,7 @@ $event = "user-create";
 event_link("user-create-unix", $event, "04");
 event_link("count-active-user-accounts", $event, "25");
 event_link("user-group-modify", $event, "85");
+event_link("mail-spool-fix", $event, "89");
 
 #--------------------------------------------------
 # actions for user-delete event
@@ -523,6 +528,7 @@ event_link("user-delete-groups-and-pseudonyms", $event, "02");
 event_link("user-delete-unix", $event, "15");
 event_link("initialize-default-databases", $event, "23");
 event_link("count-active-user-accounts", $event, "25");
+event_link("mail-spool-fix", $event, "89");
 
 #--------------------------------------------------
 # actions for user-modify event
@@ -624,6 +630,7 @@ templates2events("/home/e-smith/ssl.pem/pem", $event);
 $event = "email-update";
 event_link("systemd-default", $event, "88");
 event_link("systemd-reload", $event, "89");
+event_link("mail-spool-fix", $event, "89");
 
 #--------------------------------------------------
 # actions for webapps-update event

root/etc/dnf/plugins/post-transaction-actions.d/smeserver.action

@@ -0,0 +1,2 @@
+# cockpit noise [SME: 12575]
+cockpit-ws:any:ln -sfn /dev/null /etc/motd.d/cockpit 

root/etc/e-smith/db/accounts/defaults/Primary/SSLRequireSSL

@@ -0,0 +1 @@
+enabled

root/etc/e-smith/db/accounts/defaults/primary/type

@@ -1 +0,0 @@
-system

root/etc/e-smith/db/accounts/migrate/10primary

@@ -0,0 +1,10 @@
+{
+    # Delete any pre-existing primary=system record (all lower case)
+    my $p = $DB->get('primary');
+    return unless defined $p;
+
+    my $type = $p->prop('type');
+    return unless defined $type;
+
+    $p->delete if $type eq 'system';
+}

root/etc/e-smith/events/actions/fix-noise-el8

@@ -0,0 +1,4 @@
+#!/bin/bash
+# remove cockpit alert forever [SME: 12575]
+ln -sfn /dev/null /etc/motd.d/cockpit 
+

root/etc/e-smith/events/actions/group-create-unix

@@ -137,7 +137,9 @@ foreach my $member (@groupMembers)
     # new group to the list. Finally sort, join and run the usermod
     # function to update the group list for this member.
 
-    my $cmd = "/usr/bin/id -G -n '$member'";
+    #my $cmd = "/usr/bin/id -G -n '$member'";
+    # this will not fail in case of apache aliase before www in passwd
+    my $cmd = "/usr/bin/groups '$member' 2>/dev/null | cut -d' ' -f3- ";
     my $groups = `$cmd 2>/dev/null`; 
     if ($? != 0)
     {

root/etc/e-smith/events/actions/group-delete-unix

@@ -59,4 +59,7 @@ $result && ( $x = $ldapauth ne 'enabled' ? $x : 255, warn "Failed to delete dumm
 $result = $ldap->ldapdelgroup($groupName);
 $result && ( $x = $ldapauth ne 'enabled' ? $x : 255, warn "Failed to delete (ldap) group $groupName.\n" );
 
+# delete mail spool file
+unless ($x == 255) { if ( -e "/var/spool/mail/$groupName" ) {unlink("/var/spool/mail/$groupName") or ( $x = 255, warn "Failed to delete /var/spool/mail/$groupName.\n" );} }
+
 exit ($x);

root/etc/e-smith/events/actions/group-modify-unix

@@ -54,6 +54,11 @@ else
     @groups = $a->groups;
 }
 
+# fix www missing in shared
+my ( $name,   $passwd,   $gid,       $members  ) = getgrnam('shared');
+my @mb= split(/ /, $members);
+system("usermod -a -G shared www") unless ( grep(/^www$/, @mb) ) ;
+
 foreach my $group (@groups)
 {
     my $groupName = $group->key;
@@ -125,18 +130,23 @@ foreach my $group (@groups)
 	# We need to add or remove this member from the group
 	# Get the supplementary group list for the member we are adding or
 	# deleting.
-	my $cmd = "/usr/bin/id -G -n '$member'";
+	#my $cmd = "/usr/bin/id -G -n '$member'";
+	# this will not fail in case of apache before www in passwd
+	my $cmd = "/usr/bin/groups '$member' 2>/dev/null | cut -d' ' -f3- "; 
 	my $groups = `$cmd 2>/dev/null`; 
 	if ($? != 0)
 	{
 	    die "Failed to get supplementary group list for $member.\n";
 	}
+	$groups =~ s/^.*:\s+//;
 	chomp ($groups);
 
 	my @groupList = split (/\s+/, $groups);
 	@groupList = grep (!/^$member$/, @groupList);
 	# Apache is an alias for www
 	@groupList = map { $_ =~ s/^apache$/www/g; $_ } @groupList;
+	# www needs to be in shared
+	push(@groupList,'shared') if ( ($member eq 'www') and (! grep{$_ eq 'shared'} @groupList));
 
 	if ($oldMembers{$member})
 	{

root/etc/e-smith/events/actions/mail-spool-fix

@@ -0,0 +1,47 @@
+#! /bin/bash
+
+#----------------------------------------------------------------------
+# copyright (C) 2023 Koozali SME Server
+#               
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#               
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#               
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307  USA
+# 
+#----------------------------------------------------------------------
+
+# fix ownership of spool folder content
+pushd /var/spool/mail/ >/dev/null
+for file in *; do
+  if [ ! -f "$file" ]; then
+    continue
+  fi
+  if ( ! `id -u $file 2>/dev/null 1>&2`) ; then
+    echo "$file user does not exist deleting mail spool file" 
+    rm -f /var/spool/mail/$file
+    continue
+  fi
+  userf=$(stat -c %U /var/spool/mail/$file 2>/dev/null)
+  if [[ "$userf" != "$file" ]]; then
+    uidf=$(stat -c %u /var/spool/mail/$file 2>/dev/null)
+    uiduser=$(id -u $file 2>/dev/null )
+    # extra step needed if username has an alias eg www=apache
+    if [[ "$uidf" != "$uiduser" ]]; then
+    echo "fixing ownership of $file spool mail"
+    # extra security we want to clean it from sensitive information
+    echo ""> /var/spool/mail/$file
+    chown $file /var/spool/mail/$file
+    fi
+  fi
+done
+popd >/dev/null
+

root/etc/e-smith/events/actions/set-gateway-ip

@@ -34,7 +34,7 @@
 # remote_ip = $6
 # ipparam = $7
 
-if [ "$7" = "diald" ]
+if [ "$7" = "diald" ] || [ "$7" = "wan" ]
 then
     exec /sbin/e-smith/config set GatewayIP "$6"
 fi

root/etc/e-smith/events/actions/systemd-default

@@ -54,7 +54,9 @@ if (!symlink($old_qfn, $new_qfn)) {
 
 # we let the dedicated systemd command tryin to do what we will do later in this script
 # as up to systemd 236 it is bugged see:
-#  https://github.com/systemd/systemd/pull/7158 and https://github.com/systemd/systemd/pull/7289
+#  https://github.com/systemd/systemd/pull/7158 : systemctl: respect [Install] section in drop-ins: should be fixed in SME 12 (239)
+#  https://github.com/systemd/systemd/issues/9477 : aliases; open
+#  https://github.com/systemd/systemd/pull/9901 allow instantiated units to be enabled via presets v240
 system("/usr/bin/systemctl  preset-all");
 # in case preset-all messed up  with our default target
 system("/usr/bin/systemctl  set-default sme-server.target");
@@ -101,11 +103,12 @@ foreach my $filen (reverse sort keys %files) {
 	    my $service=$2;
 	    my $stats=$1;
 #	    print $_ ."\n"; 
-	    #ignore service that does not exists !
+	    # ignore service that does not exists !
+	    # here we are searching for service@instance.service type
 	    my $multiple = $service;
 	    ($multiple = $service ) =~ s/([a-zA-Z0-9\-_.]+@)(.*)/$1.service/ if ( $service =~ /@/ );
-	    #print "$stats $service $multiple\n";
-	    next unless ( -e "/usr/lib/systemd/system/$service" or -e "/etc/lib/systemd/system/$service" or -e "/usr/lib/systemd/system/$multiple");
+	    #print "$stats $service $multiple\n" if $service ne $multiple;
+	    next unless ( -e "/usr/lib/systemd/system/$service" or -e "/etc/systemd/system/$service" or -e "/usr/lib/systemd/system/$multiple");
 	    # eliminate duplicates, this way we keep only the last entry of the lowest file as we do it in reverse order of file,
 	    # but from top to bottom of file.
 	    $services{$service}=$stats;
@@ -117,7 +120,7 @@ foreach my $filen (reverse sort keys %files) {
 		#print "want $service \n";
             }
             else {
-                my $wanted = `grep -P '^WantedBy=.*sme-server.target' /usr/lib/systemd/system/$service*  /etc/systemd/system/$service* -rsh` ;
+                my $wanted = `grep -P '^WantedBy=.*sme-server.target' /usr/lib/systemd/system/$service*  /etc/systemd/system/$service* /usr/lib/systemd/system/$multiple* /etc/systemd/system/$multiple* -rsh` ;
                 chomp $wanted;
 		$wantedBy{$service}=1 unless ( $wanted eq "");
 		#print "want $service \n" unless ( $wanted eq "") ;

root/etc/e-smith/events/actions/update-ifcfg

@@ -18,6 +18,15 @@ if (($c->get('EthernetDriver1')->value || 'unknown') eq 'dummy'){
 if (($c->get('InternalInterface')->prop('NICBonding') || 'disabled') eq 'enabled'){
   push @adapters, "bond\tbond\t10:00:01:02:03:04\tBonding virtual Interface\tbond0";
 }
+# if external VLAN is configured
+if (($c->get('ExternalInterface')->prop('VLAN') || 'disabled') ne 'disabled'){
+  my $name= ($c->get('ExternalInterface')->prop('Name') eq "ppp0") ? $c->get('pppoe')->prop('PhysicalInterface')  : $c->get('ExternalInterface')->prop('Name') ;
+  my $vlan=$c->get('ExternalInterface')->prop('VLAN');
+  $name=~ s/\.$vlan$//;
+  my ($newl) = grep ( /$name$/ , @adapters);
+  push @adapters, "$newl.$vlan";
+}
+#TODO if external virtual lan is configured
 
 # Expand templates for every adapters found
 foreach my $adapter (@adapters){

root/etc/e-smith/events/actions/user-lock-passwd

@@ -32,6 +32,7 @@ my $a = esmith::AccountsDB->open or die "Could not open accounts db";
 my $conf = esmith::ConfigDB->open or die "Could not open configuration db";
 
 my $ldapauth = $conf->get('ldap')->prop('Authentication') || 'disabled';
+my $result;
 my $x = 0; # exit value
 
 # prepare LDAP bind

root/etc/e-smith/templates/etc/pam.d/system-auth/40password

@@ -2,7 +2,7 @@ password    sufficient    pam_unix.so nullok md5 shadow
 {
     my $status = $ldap{Authentication} || 'disabled';
     return unless $status eq 'enabled';
-    $OUT .= "password    sufficient    pam_ldap.so use_authtok";
+    $OUT .= "password    sufficient    pam_ldap.so";
 }
 password    required      pam_deny.so
 

root/etc/e-smith/templates/etc/rc.d/init.d/masq/29PPPOEclampMSS

@@ -0,0 +1,3 @@
+# PPPOE needs this if using kernel space with rp-pppoe.se plugin
+/sbin/iptables -t mangle -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
+

root/etc/e-smith/templates/etc/sysconfig/network-scripts/chat-ppp0/20LINUX_PLUGIN

@@ -0,0 +1 @@
+LINUX_PLUGIN=/usr/lib64/pppd/2.4.5/rp-pppoe.so

root/etc/e-smith/templates/etc/sysconfig/network-scripts/ifcfg-ethX/01setupvlan

@@ -0,0 +1,10 @@
+{
+    $is_vlan = "no";
+    if ( ( exists $ExternalInterface{VLAN} && $ExternalInterface{VLAN} =~ /^\d+$/ ) && ($is_external || ( $ExternalInterface{Configuration} eq "pppoe") && $pppoe{PhysicalInterface}  eq $THIS_DEVICE ) )
+    {
+	$ifup_this_device = "yes";
+        $is_vlan = "yes";
+    }
+
+    "";
+}

root/etc/e-smith/templates/etc/sysconfig/network-scripts/ifcfg-ethX/75vlan

@@ -0,0 +1,4 @@
+{
+  return unless ($is_vlan eq  "yes");
+  $OUT = "VLAN=yes\n";
+}

root/etc/e-smith/templates/etc/systemd/system-preset/49-koozali.preset/20services

@@ -11,7 +11,7 @@ foreach my $service ($c->get_all_by_prop(type => 'service')){
   my $multiple = $servicename;
   ($multiple = $servicename ) =~ s/([a-zA-Z0-9\-_.]+@)(.*)/$1.service/ if ( $servicename =~ /@/ );
 
-  $OUT .= "# Systemd service file  does not exist :	" unless -e "/usr/lib/systemd/system/$servicename" || -e "/etc/lib/systemd/system/$servicename" ||  -e "/usr/lib/systemd/system/$multiple";
+  $OUT .= "# Systemd service file  does not exist :	" unless -e "/usr/lib/systemd/system/$servicename" || -e "/etc/systemd/system/$servicename" ||  -e "/usr/lib/systemd/system/$multiple";
   $OUT .= "$status $servicename\n";
   $OUT .= "$status $multiple\n" unless $multiple eq $servicename ;
   

root/etc/e-smith/templates/var/service/wan/pppoe.pppd.conf/plugin

@@ -0,0 +1 @@
+plugin /usr/lib64/pppd/2.4.5/rp-pppoe.so

root/etc/e-smith/templates/var/service/wan/run.pppoe.conf/device_more

@@ -0,0 +1,2 @@
+# add pppoe module
+/sbin/modprobe pppoe

root/etc/modules-load.d/vlan.conf

@@ -0,0 +1 @@
+8021q

root/etc/tmpfiles.d/portreserve.conf

@@ -0,0 +1 @@
+d /run/portreserve 0755 root root 10d

root/usr/share/perl5/vendor_perl/esmith/console/configure.pm

@@ -559,9 +559,37 @@ ETHERNET_EXTERNAL:
         goto ETHERNET_EXTERNAL;
     }
 
+    goto ETHERNET_EXTERNAL_VLAN;# was SERVER_GATEWAY_DEDICATED;
+}
+#------------------------------------------------------------
+ETHERNET_EXTERNAL_VLAN:
+#------------------------------------------------------------
+{
+    ($rc, $choice) = $console->input_page
+        (
+         title  => gettext("Select External Interface VLAN"),
+         text   =>
+         gettext("Your ISP might have provided you a VLAN to use, if not leave empty."),
+         value   => $db->get_prop('ExternalInterface', 'VLAN') || ""
+        );
+
+    goto ETHERNET_EXTERNAL unless ($rc == 0);
+    # sanitize if a previous VLAN is present
+    my $extIF = $db->get_prop('ExternalInterface', 'Name');
+    $extIF =~  s/\.\d+$//;
+    if ( $choice =~ /^\d+$/ ) 
+    {
+       $db->set_prop('ExternalInterface', 'VLAN', $choice );
+       $db->set_prop('ExternalInterface', 'Name',  $extIF . ".$choice") unless $db->get_prop('ExternalInterface', 'Name') =~ /\.$choice$/; 
+    }
+    else 
+    {
+       $db->delete_prop('ExternalInterface', 'VLAN');
+       $db->set_prop('ExternalInterface', 'Name',$extIF);
+    }
+    
     goto SERVER_GATEWAY_DEDICATED;
 }
-
 #------------------------------------------------------------
 SERVER_GATEWAY_DEDICATED:
 #------------------------------------------------------------

root/usr/share/perl5/vendor_perl/esmith/ssl.pm

@@ -6,18 +6,26 @@ use esmith::ConfigDB;
 
 
 our @ISA = qw(Exporter);
-our @EXPORT = qw( key_exists_good_size cert_exists_good_size cert_is_cert key_is_key related_key_cert);
+our @EXPORT = qw( key_exists_good_size cert_exists_good_size cert_is_cert key_is_key related_key_cert SSLproto SSLprotoApache SSLprotoComa SSLprotoHyphen SSLprotoMin SSLprotoLDAP SSLprotoQpsmtpd $smeCiphers $smeSSLprotocol %existingSSLprotos);
 
 my $configdb = esmith::ConfigDB->open_ro or die "Could not open accounts db";
 our $SystemName = $configdb->get('SystemName')->value;
 our $DomainName = $configdb->get('DomainName')->value;
 our $FQDN = "$SystemName.$DomainName";
 
-# test key size
-# test key exists
+#default cipher list 
+our $smeCiphers = "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-RSA-AES256-SHA384:ECDH-ECDSA-AES256-SHA384:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:!ADH:!SSLv2:!ADH:!aNULL:!MD5:!RC4";
+#default protocol list 
+# 2024 phase out : TLS 1.1 and 1.0 ; insuficient: SSL 3.0, 2.0 and 1.0
+our $smeSSLprotocol = "TLSv1.2 TLSv1.3";
+
+# SSLv2 and SSLv3 are not available in el8 openssl-1.1.1, while -ssl3 still in man page
+# it will throw  Option unknown option -ssl3
+our %existingSSLprotos=%{ {'SSLv3'=>1, 'TLSv1'=>1, 'TLSv1.1'=>1, 'TLSv1.2'=>1, 'TLSv1.3'=>1}};
+
 =head1 NAME
 
-esmith::php - A few tools to help with php-fpm installed versions
+esmith::ssl - A few tools to help with ssl handling
 
 =head1 SYNOPSIS
 
@@ -42,6 +50,7 @@ returns 0 if key is missing or wrong size
 returns 1 if key exists and key size is correct
 
 =cut
+
 sub key_exists_good_size {
     my $configdb = esmith::ConfigDB->open_ro or die "Could not open accounts db";
     my %modSSL = $configdb->as_hash('modSSL');
@@ -74,8 +83,8 @@ sub key_exists_good_size {
 # check cert size Public-Key
 # openssl rsa -noout -modulus -in domain.key | openssl md5
 # openssl x509 -noout -modulus -in domain.crt | openssl md5
-
 =cut
+
 sub cert_exists_good_size {
     my $configdb = esmith::ConfigDB->open_ro or die "Could not open accounts db";
     my %modSSL = $configdb->as_hash('modSSL');
@@ -99,6 +108,10 @@ sub cert_exists_good_size {
     return 0;
 }
 
+=head2 cert_is_cert
+check if file is really a certificate
+=cut
+
 sub cert_is_cert {
     my $crt = shift || "/home/e-smith/ssl.crt/$FQDN.crt";
     if ( -f $crt ) 
@@ -115,6 +128,10 @@ sub cert_is_cert {
     return 0;
 }
 
+=head2 key_is_key
+check if file is really a key
+=cut
+
 sub key_is_key {
     my $key = shift || "/home/e-smith/ssl.key/$FQDN.key";
     if ( -f $key )
@@ -144,7 +161,8 @@ sub related_key_cert {
     }
     return 0;
 }
-##TODO migrate those actions from 
+
+##TODO write sub and migrate those actions from template fragments
 # check cert is related to key
 # => /etc/e-smith/templates/home/e-smith/ssl.crt 
 # check cert domain and alt
@@ -152,3 +170,126 @@ sub related_key_cert {
 # check is valid / expiry date
 # => /etc/e-smith/templates/home/e-smith/ssl.crt 
 ###################################
+
+=head2 SSLprotoApache
+output a list of allowed protocols with apache format
+e.g. -all +TLSv1.2 +TLSv1.3
+=cut
+
+sub SSLprotoApache{
+ my $protocols = " -all +".join(" +",split(" ",$smeSSLprotocol)) ." ";
+ my $configdb = esmith::ConfigDB->open_ro or die "Could not open accounts db";
+ my $httpd = $configdb->get('httpd-e-smith');
+ # SSLv2 and SSLv3 are not available in el8 openssl-1.1.1, while -ssl3 still referenced
+ # it will throw  Option unknown option -ssl3
+ #$protocols .= " +SSLv3" if ($httpd->{'SSLv3'} || 'disabled') eq 'enabled';
+ #  TODO: a loop using existingSSLprotos
+ $protocols .= " +TLSv1" if ($httpd->{'TLSv1'} || 'disabled') eq 'enabled';
+ $protocols .= " +TLSv1.1" if ($httpd->{'TLSv1.1'} || 'disabled') eq 'enabled';
+ # look closely this is to remove what has been added on first line,
+ # hence the minus sign and reverse logic.
+ $protocols .= " -TLSv1.2" unless ($httpd->{'TLSv1.2'} || 'enabled') eq 'enabled';
+ $protocols .= " -TLSv1.3" unless ($httpd->{'TLSv1.3'} || 'enabled') eq 'enabled';
+ return $protocols;
+}
+
+=head2 SSLprotoQpsmtpd
+output an expected IO::Socket::SSL string to enable 
+only the wanted TLS versions
+SSLv23:!SSLv2:!SSLv3:!TLSv1:!TLSv1_1
+=cut
+
+sub SSLprotoQpsmtpd{
+ my $service= shift || 'qpsmtpd';
+ my $configdb = esmith::ConfigDB->open_ro or die "Could not open accounts db";
+ my %qpsmtpd = %{$configdb->get($service)};
+ # SSLv2 and SSLv3 are not available in el8 openssl-1.1.1, while -ssl3 still referenced
+ # it will throw  Option unknown option -ssl3
+ my $protocols = "SSLv23:!SSLv2:!SSLv3";
+ # TODO: a loop using existingSSLprotos and SSLprotoHyphen()
+ $protocols .= ':!TLSv1' unless ($qpsmtpd{'TLSv1'} || 'disabled') eq 'enabled';
+ $protocols .= ':!TLSv1_1' unless ($qpsmtpd{'TLSv1.1'} || 'disabled') eq 'enabled';
+ $protocols .= ':!TLSv1_2' unless ($qpsmtpd{'TLSv1.2'} || 'enabled') eq 'enabled';
+ $protocols .= ':!TLSv1_3' unless ($qpsmtpd{'TLSv1.3'} || 'enabled') eq 'enabled';
+ return $protocols;
+}
+
+=head2 SSLproto
+default display of list of protocol. This is how it will be displayed in 
+httpd.conf and proftpd.conf
+e.g. TLSv1.2 TLSv1.3
+=cut
+
+sub SSLproto{
+return $smeSSLprotocol;
+}
+
+=head2 SSLprotoComa
+way to display protocols in Mariadb as a string list separated by coma
+e.g. TLSv1.2,TLSv1.3
+=cut
+
+sub SSLprotoComa{
+my $string = shift || $smeSSLprotocol;
+$string =~ s/[ :]/,/g;
+return $string;
+}
+
+=head2 SSLprotoHyphen
+convert TLSv1.2 to TLSv1_2
+This is the format required by perl IO::Socket::SSL; and as the result by 
+qpsmtpd, uqpsmtpd, sqpsmtpd SME Server services
+=cut
+
+sub SSLprotoHyphen {
+my $string = shift || $smeSSLprotocol;
+$string =~ s/[ ,]/:/g;
+$string =~ s/\./_/g;
+return $string;
+}
+
+=head2 SSLprotoMin
+display only the lower protocol, as expected for dovecot
+ssl_min_protocol = TLSv1.2
+# limit : will not handle all or sslv23 as input
+=cut
+
+sub SSLprotoMin{
+  my @SSLarray =  split(" ",shift || $smeSSLprotocol);
+  my %hash ;
+  foreach my $value (@SSLarray) {
+    my $toto = $value =~ s/(.*)(\d{1})+$/$2/r;
+    # hack for TLS > SSL
+    $toto = ($value =~ /^TLS/) ? "2$toto" : "1$toto";
+    $hash{$toto}=$value ;
+  }
+  my @keys_sorted_by_value = sort { $a <=> $b } keys %hash;
+  my $lowest_value = $keys_sorted_by_value[0] ;
+  return $hash{$lowest_value};
+}
+
+=head2 SSLprotoLDAP
+convert min protocol suported to LDAP format
+TLSProtocolMin          3.3
+To require TLS 1.x or higher, set this option to 3.(x+1), e.g., TLSProtocolMin 3.2          would require TLS 1.1.
+from $smeSSLprotocol = "TLSv1.2 TLSv1.3";
+=cut
+
+sub SSLprotoLDAP{
+  # convert to array 
+  my @SSLarray =  split(" ",shift || $smeSSLprotocol);
+  return "3.0" if  (grep /^SSLv3$/, @SSLarray);
+  # TLSv1
+  return "3.1" if (grep /^TLSv1$/ , @SSLarray);
+  # keep only digit after .
+  @SSLarray = grep{ $_ =~ s/(.*)(\d{1})+$/$2/ } @SSLarray;
+  # order
+  @SSLarray = sort @SSLarray;
+  # get lower
+  my $num = $SSLarray[0];
+  # sum 3.1 + 0.$x
+  $num = "0.".$num;
+  # return
+  $num = $num +3.1;
+  return $num;
+}

root/var/service/wan/run.pppoe

@@ -29,4 +29,4 @@ exec \
     /usr/local/bin/softlimit -m $PPPD_MLIMIT \
     /usr/bin/setsid \
     /usr/sbin/pppd ${extaddr:+$extaddr:} \
-    file pppoe.pppd.conf
+    file pppoe.pppd.conf ${interface}

smeserver-base.spec

@@ -4,7 +4,7 @@ Summary: smeserver server and gateway - base module
 %define name smeserver-base
 Name: %{name}
 %define version 11.0.0
-%define release 11
+%define release 23
 Version: %{version}
 Release: %{release}%{?dist}
 License: GPL
@@ -184,6 +184,49 @@ fi
 
 
 %changelog
+* Sat Jan 18 2025 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-23.sme
+- handle all ssl ciphers and protocol in one place esmith::ssl [SME: 12827]
+  this will allow to sync all service default protocol and ciphers
+  in one place.
+
+* Fri Jan 03 2025 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-21.sme
+- improve support of  systemd service with instance service@instance.service [SME: 12859]
+
+* Thu Jan 02 2025 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-20.sme
+- Primary default to SSL required and redirect [SME: 12858]
+- cleanup remove primary=system [SME: 8268]
+
+* Tue Dec 31 2024 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-19.sme
+- fix www removed from shared on group creation [SME: 12848]
+
+* Mon Dec 23 2024 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-18.sme
+- add vlan support on External Interface [SME: 12677]
+- fix typo [SME: 12763] 
+
+* Mon Dec 23 2024 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-16.sme
+-  add kernel module support for rp-pppoe plugin [SME: 12678]
+   will allow faster fiber connexion when using multiple queue interface (RSS)
+   set-gateway-ip will propagate both wan and diald ip
+   run.pppoe call an interface
+
+* Sat Dec 21 2024 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-15.sme
+- fix use of passwd command when ldap auth enabled [SME: 6453]
+- delete spool file only if exists to avoid error [SME: 12763]
+
+* Mon Sep 23 2024 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-14.sme
+- fix result variable not initialized [SME: 12663]
+
+* Sun Sep 22 2024 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-13.sme
+- fix mail spool perms [SME: 12654]
+- fix motd noise related to cockpit [SME: 12575]
+- fix /run vs /var/run temps dir noise [SME: 12639]
+
+* Wed Aug 14 2024 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-12.sme
+- fix 3 regressions from SME10 [SME: 12654]
+  fix www missing from shared and few groups [SME: 12146]
+  fix group deletion leaves mail spool file [SME: 12431]
+  fix path to /etc/systemd for seeking service files [SME: 12421]
+
 * Tue Aug 13 2024 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-11.sme
 - fix new systemd.log does not fill after log rotate [SME: 12688]