secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-28 21:17:36 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

feat(netplan): standardize SecuBox LAN to 192.168.10.0/24; bump 1.10.0 (ref #760)

Browse Source 
Default br-lan 192.168.1.1/24 collided with common ISP-router LANs
(Freebox/Livebox 192.168.1.0/24) when the appliance sits behind one:
WAN(DHCP)+LAN land on the same subnet -> duplicate route, ARP ambiguity,
unreachable mgmt IP. Observed live on c3box behind a Freebox.

- All board netplans (mochabin, espressobin-v7/ultra, x64-vm, x64-live)
  + VM LANs (vm-x64, vm-arm64) -> br-lan/LAN 192.168.10.1/24
- Generators: secubox-netmodes (inline + router.yaml.j2 template),
  secubox-hub preview, secubox-net-detect
- dnsmasq (espressobin-v7.conf): dhcp-range + option:router + dns-server
- live-usb build scripts + self-signed cert SANs -> IP:192.168.10.1
- Out of scope (untouched): 192.168.255.1 mgmt/trusted-proxy whitelist,
  WAN-probe GATEWAYS lists, remote-ui/round + tests
- Minor "medium" bump 1.9.0 -> 1.10.0 (core build scripts; mochabin-live
  stays on its 2.0.0 track)

Live: c3box br-lan already 192.168.10.1/24 + netmodes template aligned;
gk2 WAN moved to eth2 DHCP @ .200 (Freebox reservation on eth2 MAC).
This commit is contained in:
CyberMind-FR 2026-06-27 17:11:23 +02:00
parent 47076b24d3
commit a52af3b50a
19 changed files with 62 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
.claude/HISTORY.md
View File

@ -3,6 +3,39 @@
---
## 2026-06-27 — LAN standardisé 192.168.10.0/24 + c3box/gk2 live Freebox + bump 1.10.0 (#760)
Session terrain "c3box derrière Freebox" : la LAN SecuBox par défaut (`br-lan 192.168.1.1/24`)
entrait en collision avec la LAN d'un routeur opérateur courant (Freebox/Livebox en
`192.168.1.0/24`). En aval d'une Freebox, le WAN DHCP et la LAN se retrouvaient sur le **même
sous-réseau** → route dupliquée, ARP ambigu, IP de management injoignable.
### A. Constat live + remédiation immédiate
- **c3box** (second MOCHAbin) derrière Freebox : WAN `eth2=192.168.1.94` (bail Freebox) +
`br-lan=192.168.1.1/24` → `.94` injoignable depuis le LAN. Corrigé live : `br-lan → 192.168.10.1/24`.
SSH root activé, webadmin `https://192.168.1.94/` OK, `/dev/sda1` (931 G) monté sur `/data`
(style gk2 : UUID + nofail), partition eMMC retirée (`emmc-data`).
- **gk2** (live PoC) : uplink déplacé de `lan0` (DSA) vers le port cuivre WAN `eth2` ; netplan
réparé via **série** (gk2 hors-réseau le temps du switch) → `eth2 dhcp4: true`, `lan0` dépouillé.
Bail Freebox réservé sur le MAC eth2 `f0:ad:4e:27:88:9b` → gk2 reprend `192.168.1.200`. Persisté.
### B. Standardisation source (LAN = 192.168.10.0/24, gw .10.1) — 17 fichiers
- Netplans board : mochabin, espressobin-v7, espressobin-ultra, x64-vm, x64-live (`br-lan`),
+ unification VM vm-x64/vm-arm64 (`192.168.100.1 → 192.168.10.1`).
- Générateurs de netplan : `secubox-netmodes`, `secubox-hub` (preview), `secubox-net-detect`.
- dnsmasq (`espressobin-v7.conf`) : `dhcp-range` + `option:router` + `option:dns-server`.
- Scripts live-usb (mochabin/ebin) + SAN des certs auto-signés (`firstboot`, `build-image`,
`build-rpi-usb`, `build-live-usb`) → `IP:192.168.10.1`.
- **Hors scope (intacts)** : `192.168.255.1` (whitelist mgmt/trusted-proxy WAF/mail/wg/mitm),
listes `GATEWAYS` de sonde WAN, exemples remote-ui/round + tests.
### C. Release
- Bump mineur (« medium ») **1.9.0 → 1.10.0** : `build-image.sh`, `build-live-usb.sh`,
`build-ebin-live-usb.sh`, `build-rpi-usb.sh` (mochabin-live reste sur sa piste 2.0.0).
- Artefacts amd64 (x64) reconstruits depuis cette base.
---
## 2026-06-27 — Netboot live PROUVÉ + première install SecuBox Debian sur c3box (second MOCHAbin) (#748 #737)
Grande session hardware : netboot gk2→c3box validé de bout en bout, premier SecuBox Debian installé

2
board/espressobin-ultra/netplan/00-secubox.yaml
View File

@ -19,7 +19,7 @@ network:
bridges:
br-lan:
interfaces: [lan0, lan1, lan2, lan3]
addresses: [192.168.1.1/24]
addresses: [192.168.10.1/24]
dhcp4: false
parameters:
stp: false

2
board/espressobin-v7/netplan/00-secubox.yaml
View File

@ -44,7 +44,7 @@ network:
bridges:
br-lan:
interfaces: [lan0, lan1]
addresses: [192.168.1.1/24]
addresses: [192.168.10.1/24]
dhcp4: false
parameters:
stp: false

2
board/mochabin/netplan/00-secubox.yaml
View File

@ -37,7 +37,7 @@ network:
# Bridge LAN
br-lan:
interfaces: [eth1, eth3, eth4]
addresses: [192.168.1.1/24]
addresses: [192.168.10.1/24]
dhcp4: false
parameters:
stp: false

2
board/vm-arm64/netplan/00-secubox.yaml
View File

@ -13,7 +13,7 @@ network:
# LAN — Interface 2 QEMU (si configurée)
enp0s2:
addresses: [192.168.100.1/24]
addresses: [192.168.10.1/24]
dhcp4: false
optional: true

2
board/vm-x64/netplan/00-secubox.yaml
View File

@ -14,7 +14,7 @@ network:
# LAN — Interface 2 VirtualBox (Internal Network ou Host-Only)
enp0s8:
addresses: [192.168.100.1/24]
addresses: [192.168.10.1/24]
dhcp4: false
optional: true

2
board/x64-live/netplan/00-secubox.yaml
View File

@ -64,7 +64,7 @@ network:
br-lan:
interfaces: []
addresses:
- 192.168.1.1/24
- 192.168.10.1/24
dhcp4: false
optional: true
parameters:

2
board/x64-vm/netplan/00-secubox.yaml
View File

@ -63,7 +63,7 @@ network:
bridges:
br-lan:
interfaces: [enp0s8]
addresses: [192.168.1.1/24]
addresses: [192.168.10.1/24]
dhcp4: false
parameters:
stp: false

4
image/build-ebin-live-usb.sh
View File

@ -10,7 +10,7 @@ SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
REPO_DIR="$(dirname "$SCRIPT_DIR")"
# ── Version & Build Info ──────────────────────────────────────────
SECUBOX_VERSION="1.9.0"
SECUBOX_VERSION="1.10.0"
BUILD_DATE=$(date '+%Y-%m-%d')
BUILD_TIMESTAMP=$(date '+%Y-%m-%d %H:%M')
@ -310,7 +310,7 @@ network:
bridges:
br-lan:
interfaces: [lan0, lan1]
addresses: [192.168.1.1/24]
addresses: [192.168.10.1/24]
dhcp4: false
parameters:
stp: false

4
image/build-image.sh
View File

@ -26,7 +26,7 @@ LOCAL_REPO_PORT="8080"
SLIPSTREAM_DEBS=1 # Intégrer les .deb locaux dans l'image (default: ON)
# SecuBox versioning
SECUBOX_VERSION="1.9.0"
SECUBOX_VERSION="1.10.0"
BUILD_TIMESTAMP=$(date '+%Y-%m-%d %H:%M')
RED='\033[0;31m'; CYAN='\033[0;36m'; GOLD='\033[0;33m'
@ -989,7 +989,7 @@ openssl req -x509 -newkey rsa:2048 -days 365 \
-keyout "${ROOTFS}/etc/secubox/tls/key.pem" \
-out "${ROOTFS}/etc/secubox/tls/cert.pem" \
-nodes -subj "/CN=secubox/O=CyberMind SecuBox/C=FR" \
-addext "subjectAltName=DNS:localhost,DNS:secubox.local,IP:127.0.0.1,IP:192.168.1.1" \
-addext "subjectAltName=DNS:localhost,DNS:secubox.local,IP:127.0.0.1,IP:192.168.10.1" \
2>/dev/null
if [[ -f "${ROOTFS}/etc/secubox/tls/cert.pem" ]]; then

6
image/build-live-usb.sh
View File

@ -14,7 +14,7 @@ SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
REPO_DIR="$(dirname "$SCRIPT_DIR")"
# ── Version & Build Info ──────────────────────────────────────────
SECUBOX_VERSION="1.9.0"
SECUBOX_VERSION="1.10.0"
BUILD_TIMESTAMP=$(date '+%Y-%m-%d %H:%M')
BUILD_DATE=$(date '+%Y%m%d')
@ -786,7 +786,7 @@ cat > "${ROOTFS}/etc/netplan/00-secubox.yaml" <<'NETPLAN'
# and router-mode br-lan later via secubox-net-* tools.
#
# Earlier versions baked an empty `br-lan` bridge with a static
# 192.168.1.1/24 address into the bootstrap. On bare-metal real
# 192.168.10.1/24 address into the bootstrap. On bare-metal real
# hardware the physical NIC went silent and only the phantom br-lan
# showed an IP — networkd was honouring the static bridge but
# something (predictable rename? secubox-net-detect leftover?)
@ -1226,7 +1226,7 @@ openssl req -x509 -newkey rsa:2048 -days 365 \
-keyout "${ROOTFS}/etc/secubox/tls/key.pem" \
-out "${ROOTFS}/etc/secubox/tls/cert.pem" \
-nodes -subj "/CN=secubox-live/O=CyberMind SecuBox/C=FR" \
-addext "subjectAltName=DNS:localhost,DNS:secubox.local,IP:127.0.0.1,IP:192.168.1.1" \
-addext "subjectAltName=DNS:localhost,DNS:secubox.local,IP:127.0.0.1,IP:192.168.10.1" \
2>/dev/null
if [[ -f "${ROOTFS}/etc/secubox/tls/cert.pem" ]]; then

2
image/build-mochabin-live-usb.sh
View File

@ -331,7 +331,7 @@ network:
bridges:
br-lan:
interfaces: [eth1, eth2, eth3, eth4]
addresses: [192.168.1.1/24]
addresses: [192.168.10.1/24]
dhcp4: false
parameters:
stp: false

4
image/build-rpi-usb.sh
View File

@ -13,7 +13,7 @@ SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
REPO_DIR="$(dirname "$SCRIPT_DIR")"
# ── Version ───────────────────────────────────────────────────────
SECUBOX_VERSION="1.9.0"
SECUBOX_VERSION="1.10.0"
# ── Defaults ──────────────────────────────────────────────────────
SUITE="bookworm"
@ -702,7 +702,7 @@ openssl req -x509 -newkey rsa:2048 -days 365 \
-keyout "${ROOTFS}/etc/secubox/tls/key.pem" \
-out "${ROOTFS}/etc/secubox/tls/cert.pem" \
-nodes -subj "/CN=secubox-rpi/O=CyberMind SecuBox/C=FR" \
-addext "subjectAltName=DNS:localhost,DNS:secubox.local,IP:127.0.0.1,IP:192.168.1.1" \
-addext "subjectAltName=DNS:localhost,DNS:secubox.local,IP:127.0.0.1,IP:192.168.10.1" \
2>/dev/null
if [[ -f "${ROOTFS}/etc/secubox/tls/cert.pem" ]]; then

4
image/firstboot.sh
View File

@ -359,7 +359,7 @@ if [[ ! -f "${TLS_DIR}/cert.pem" ]]; then
-keyout "${TLS_DIR}/key.pem" \
-out "${TLS_DIR}/cert.pem" \
-nodes -subj "/CN=${HOSTNAME}/O=CyberMind SecuBox/C=FR" \
-addext "subjectAltName=DNS:${HOSTNAME},DNS:secubox.local,IP:192.168.1.1" \
-addext "subjectAltName=DNS:${HOSTNAME},DNS:secubox.local,IP:192.168.10.1" \
2>/dev/null
chown -R secubox:secubox "${TLS_DIR}"
chmod 640 "${TLS_DIR}/key.pem"
@ -378,7 +378,7 @@ log "=== Network Detection ==="
# Short-circuit when the image was built with --static-ip: build-live-usb.sh
# wrote a fixed netplan AND pre-touched /var/lib/secubox/.net-configured.
# Running net-detect here would clobber the static config with router-mode
# defaults (WAN + br-lan 192.168.1.1/24), the exact regression in #128.
# defaults (WAN + br-lan 192.168.10.1/24), the exact regression in #128.
if [[ -f /var/lib/secubox/.net-configured ]]; then
log "Static netplan in effect (.net-configured present) — skipping net-detect"
elif [[ -x /usr/sbin/secubox-net-detect ]]; then

8
image/profiles/espressobin-v7.conf
View File

@ -127,7 +127,7 @@ network:
bridges:
br-lan:
interfaces: [lan0, lan1]
addresses: [192.168.1.1/24]
addresses: [192.168.10.1/24]
dhcp4: false
EOF
@ -135,8 +135,8 @@ EOF
cat > "$root/etc/dnsmasq.d/secubox.conf" << 'EOF'
interface=br-lan
bind-interfaces
dhcp-range=192.168.1.100,192.168.1.250,24h
dhcp-option=option:router,192.168.1.1
dhcp-option=option:dns-server,192.168.1.1
dhcp-range=192.168.10.100,192.168.10.250,24h
dhcp-option=option:router,192.168.10.1
dhcp-option=option:dns-server,192.168.10.1
EOF
}

4
image/sbin/secubox-net-detect
View File

@ -337,7 +337,7 @@ generate_netplan() {
bridges=" bridges:
br-lan:
interfaces: [${lan_array}]
addresses: [192.168.1.1/24]
addresses: [192.168.10.1/24]
dhcp4: false
optional: true
parameters:
@ -346,7 +346,7 @@ generate_netplan() {
"
else
# No LAN interfaces — DON'T create an empty br-lan with
# 192.168.1.1/24. A member-less bridge with a static IP
# 192.168.10.1/24. A member-less bridge with a static IP
# squats the .1 address without routing anything, makes
# systemd-networkd think the interface is "configured",
# and frequently breaks DHCP on the real WAN NIC (the

2
packages/secubox-hub/api/main.py
View File

@ -1754,7 +1754,7 @@ async def preview_network_mode(mode: str, user=Depends(require_jwt)):
bridges:
br-lan:
interfaces: [{lan_str}]
addresses: [192.168.1.1/24]
addresses: [192.168.10.1/24]
dhcp4: false
"""
elif mode in ("sniffer-inline", "sniffer-passive"):

2
packages/secubox-netmodes/api/main.py
View File

@ -526,7 +526,7 @@ network:
bridges:
br-lan:
interfaces: [{lan_list}]
addresses: [192.168.1.1/24]
addresses: [192.168.10.1/24]
dhcp4: false
parameters:
stp: false

4
packages/secubox-netmodes/templates/router.yaml.j2
View File

@ -9,13 +9,13 @@ network:
dhcp6: false
{{ lan | default('eth1') }}:
addresses:
- 192.168.100.1/24
- 192.168.10.1/24
bridges:
br0:
interfaces:
- {{ lan | default('eth1') }}
addresses:
- 192.168.100.1/24
- 192.168.10.1/24
dhcp4: false
parameters:
stp: false