Release Huginn 0.23.1: security fixes, web trap identities · ancientswede/Huginn

This release contains security fixes. Please update.

Security and reliability

A specially crafted command line sent to the honeypot could freeze Huginn for minutes. It needed no login and no page view. Fixed.
Web requests containing / were counted as logins and ended up on the password lists and exports. Fixed for new data, and older lines are recognised.
A failed update of the New page left permanent holes. It now resumes from a saved position.
Backup and restore-db could collide, and an interrupted restore could lose recent data. Restore now takes the database for itself and folds in the write-ahead log first. It also refuses a database that is not Huginn's.
One huge captured file could stop all file analysis.
A reverse DNS name containing a word like research could keep an attacker off the blocklist. A name now has to be a known scanner domain that resolves back to the address.
The ipset and MikroTik feeds now clear IPv6 when the list becomes empty. Use v6=0 on a firewall without IPv6.
The database file is no longer readable by other users on the machine.

The web trap on ports 80 and 443 can pretend to be 19 NAS and router brands and changes by itself every few weeks (hp-identity, ROTATE_DAYS). Personas shows hits per day for each device.
A visual pass: clearer attacker pages, shorter lists on phones, commands before hashes in Campaigns and New, a warm colour for rare finds, a terminal-style Replay with a timeline, bars on Personas.
Time wasted has a receipt, and the raven in the header reacts once to a new find.
Releases include a Debian package and Docker files that work without cloning the repository.

git pull && ./update-huginn.sh      # on the Huginn machine
git pull && ./update-honeypot.sh    # on the honeypot

Scanners that were excluded because of their reverse DNS are looked up again after the update, so some may be on the blocklist for a short while.