31f09f54a6
* Improved HTTPS cipher handling and added support for chained certificates. * Allow the source password to be undefined. There was a corner case, where a default password would have taken effect. It would require the admin to remove the 'source-password' from the icecast config to take effect. Default configs ship with the password set, so this vulnerability doesn't trigger there. * Prevent error log injection of control characters by substituting non-alphanumeric characters with a '.' (CVE-2011-4612). Injection attempts can be identified via access.log, as that stores URL encoded requests. Investigation if further logging code needs to have sanitized output is ongoing. Tested on amd64. Reads fine aja@ |
||
---|---|---|
.. | ||
DESCR | ||
icecast.rc | ||
MESSAGE | ||
PLIST | ||
README |
$OpenBSD: README,v 1.3 2011/07/08 02:14:58 ajacoutot Exp $ +----------------------------------------------------------------------- | Running ${FULLPKGNAME} on OpenBSD +----------------------------------------------------------------------- Icecast v2 is very versatile and can be used in many different environments. A streaming service provider has different requirements than someone who wants to set up a jukebox at home. To get a better understanding of streaming with Icecast, http://liveice.sourceforge.net/understanding.html may be of use. This is a small step-by-step guide to get Icecast v2 running in a basic setup, using its chrooting feature, dropping privileges to an unprivileged account. 1. Complete the chroot environment with additional system files. While this is optional, it allows YP directory listings (DNS lookups are required for those) to work and the log files to contain correct timestamps. # cp -p /etc/{hosts,localtime,resolv.conf} /var/icecast/etc 2. Adjust /var/icecast/icecast.xml. Consult the documentation and comments about the various options. * CHANGE THE DEFAULT PASSWORDS FOR SOURCE CLIENTS, RELAYS AND THE ADMIN INTERFACE. Mode 600 is highly recommended, for icecast.xml contains plain-text passwords. 3. Start Icecast and monitor the logs in /var/icecast/log and resolve any errors. # icecast -c /var/icecast/icecast.xml Add the command line parameter `-b' to daemonize. 4. Test your server. Use a source client to create a stream and listen to it with your favourite player that supports streaming. Also test Icecast's web interface. Be aware that Icecast sends everything located in <webroot> to those who request it like a regular (basic) web server. You can restrict this behaviour to serve only .xsl files by setting <fileserve> to 0 in your icecast.xml; however, you should definitely take a closer look at what you actually want to show the world here. There is no reason for paranoia, it's all safe, but you should spend some time thinking about it. Note that disabling <fileserve> will also prevent CSS stylesheets and images from being sent, making the web interface less pleasant to look at. 5. Make Icecast start at boot. Add 'icecast' to pkg_scripts in /etc/rc.conf.local. Eg: pkg_scripts="icecast" Random hints: * Remember to give your mount point a proper name -- MP3 streams should use no extension, Ogg Vorbis streams should use .ogg, so that dumb or broken players can send the stream to the appropriate decoder. * The default "bind to any address" only opens an IPv6 socket. Specify a specific address or use 0.0.0.0 to accept any IPv4 address.