Recommended SG-4860 firewall has reached end-of-sale

[eloquence]

The officially recommended pfSense 4860 firewall has reached end-of-sale. Netgate recommends SG-3100 and XG-7100 as alternatives.

We should evaluate alternatives and update our recommendation. See #2605 for additional background on alternatives like the SG-3100.

[anxiousnix]

I would move to recommend the SG-3100 firewall from Netgate. At US$349, it's probably the cheapest option we've recommended so far. Additionally, reports of people using it as part of a SecureDrop instance have been positive.

We will need to rework some documentation to support this hardware. We had some documentation that we removed (see #1718) that we can dig up and refurbish into new and improved documentation.

Side note: We should perhaps consider looking at another vendor for firewall appliance solutions, so we have more redundancy. Netgate loves to put new firewalls out all the time it seems.

[b-meson]

I ran through a clean install on the SG-3100 and here are my results:

Basic Server Testing

• [x] I can access both the source and journalist interfaces after a clean install on 0.7.0
• [x] I can SSH into both machines over Tor
• [x] AppArmor is loaded on app and mon
• [x] Both servers are running grsec kernels
• [x] iptables rules loaded
• [x] OSSEC emails begin to flow after install
• [x] OSSEC emails are decrypted to correct key and I am able to decrypt them

Command Line User Generation

• [x] Can successfully add admin user

Application Acceptance Testing

• [x] On submit page, file less than 500 MB submitted successfully
• [x] On submit page, short message submitted successfully

Journalist Interface

Login base cases

• [x] Can log in with 2FA tokens

  Individual source page

• [x] You can submit a reply and a flashed message and new row appears

• [x] Clicking "Delete collection" and the source and docs are deleted

Additionally here is how I physically configured the firewall for my (incoming) PR:

Server	Static IP	Gateway	Port Used
Application Server	10.20.1.2	10.20.1.1	LAN2
Monitor Server	10.20.2.2	10.20.2.1	OPT1
Application Workstation	10.20.1.2	10.20.1.1	LAN1

[b-meson]

There is a WIP on my branch https://github.com/b-meson/securedrop/tree/docs-sg3100

[anxiousnix]

Thanks for the detailed test plan, @b-meson! I look forward to progress in your WIP branch. :)