V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

func/cdi_4200_boot/4230_installation_grub.sh

@@ -212,6 +212,14 @@ EOF
 
   [[ "${var_update_grub_required}" == "true" ]] && do_in_target "${TARGET}" update-grub
 
+  if [[ "${grub_force_efi}" == "true" ]]; then
+
+    mkdir -p "${TARGET}/boot/efi/EFI/BOOT"
+    cp "${TARGET}/boot/efi/EFI/debian/grubx64.efi" "${TARGET}/boot/efi/EFI/BOOT/BOOTX64.EFI"
+    do_log "info" "file_only" "4230() Installed: GRUB on Device: '${grub_bootdev}' [UEFI] on: Default EFI Boot-Path."
+
+  fi
+
   ### Setting the permissions to read and write for root only prevents non-root users from seeing the boot parameters or changing them.
   if [[ -f "${TARGET}/boot/grub/grub.cfg" ]]; then
     chown root:root "${TARGET}/boot/grub/grub.cfg"
@@ -309,14 +317,6 @@ install_grub_uefi() {
   do_log "info" "file_only" "4230() Installed: GRUB on Device: '${grub_bootdev}' [UEFI]."
   var_update_grub_required="true"
 
-  if [[ "${grub_force_efi}" == "true" ]]; then
-
-    mkdir -p "${TARGET}/boot/efi/EFI/BOOT"
-    cp "${TARGET}/boot/efi/EFI/debian/grubx64.efi" "${TARGET}/boot/efi/EFI/BOOT/BOOTX64.EFI"
-    do_log "info" "file_only" "4230() Installed: GRUB on Device: '${grub_bootdev}' [UEFI] on: Default EFI Boot-Path."
-
- fi
-
   return 0
 }
 

func/cdi_4300_network/4310_dropbear_build.sh

@@ -29,9 +29,12 @@ guard_sourcing
 #######################################
 dropbear_build() {
   ### Declare Arrays, HashMaps, and Variables.
-  declare var_dropbear_version="2025.88"
+  declare     var_dropbear_version="2025.88"
-  declare var_tar="${VAR_SETUP_PATH}/upgrades/dropbear/dropbear-${var_dropbear_version}.tar.bz2"
+  declare     var_tar="${VAR_SETUP_PATH}/upgrades/dropbear/dropbear-${var_dropbear_version}.tar.bz2"
-  declare var_build_dir="${DIR_TMP}/build/dropbear-${var_dropbear_version}"
+  declare     var_build_dir="${DIR_TMP}/build/dropbear-${var_dropbear_version}"
+  declare -r  var_logfile="/root/.ciss/cdi/log/4310_dropbear_build.log"
+
+  touch "${TARGET}${var_logfile}" && chmod 0600 "${TARGET}${var_logfile}"
 
   apt-get install -y autoconf automake build-essential libtool libtomcrypt-dev libtommath-dev musl-tools
 
@@ -49,12 +52,13 @@ dropbear_build() {
   #  -Wl,-z,relro,-z,now: Enables full RELRO (symbol resolution at program startup)
 
   [[ "${VAR_DEBUG_TRACE,,}" == "true" ]] && set +x
-  (
+  # shellcheck disable=SC2016,SC2312
+  setsid bash -c '
     ### Sterile environment for the build-process.
     export -n SHELLOPTS
     set +u
     unset PATH_SEPARATOR
-    PATH_SEPARATOR=':'
+    PATH_SEPARATOR=":"
     PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
     CC=musl-gcc \
       CFLAGS="-Os -fPIE -Wno-undef -fstack-protector-strong -D_FORTIFY_SOURCE=2" \
@@ -67,7 +71,7 @@ dropbear_build() {
 
     # shellcheck disable=2312
     make -j"$(nproc)"
-  )
+  ' 2>&1 | tee -a "${TARGET}${var_logfile}"
   [[ "${VAR_DEBUG_TRACE,,}" == "true" ]] && set -x
 
   do_log "info" "file_only" "4310() Ultra Hardened [dropbear-${var_dropbear_version}] build successfully from sources."

func/cdi_4300_network/4311_dropbear_initramfs.sh

@@ -37,7 +37,7 @@ dropbear_initramfs() {
 
   do_in_target_script "${TARGET}" '
     export INITRD=No
-    apt-mark hold -y dropbear dropbear-initramfs 2>&1 | tee -a '"${var_logfile}"'
+    apt-mark hold dropbear dropbear-initramfs 2>&1 | tee -a '"${var_logfile}"'
     echo ExitCode: $? >> '"${var_logfile}"'
   '
 

func/cdi_4300_network/4312_dropbear_setup.sh

@@ -15,26 +15,20 @@ guard_sourcing
 #######################################
 # Set up Dropbear Initramfs Environment.
 # Globals:
-#   HMP_PATH_ENCLABEL
 #   TARGET
-#   VAR_CRYPT_ROOT
 #   VAR_FINAL_FQDN
 #   VAR_FINAL_IPV4
 #   VAR_FINAL_IPV4_GW
 #   VAR_FINAL_IPV4_SUBNET
 #   VAR_FINAL_NIC
-#   VAR_GRUB_CMDLINE_LINUX
 #   VAR_SETUP_PATH
-#   dropbear_dhcp
 #   dropbear_firewall
 #   dropbear_port
+#   network_autoconfig_enable
 #   network_static_ipv4nameserver_0
 #   network_static_ipv4nameserver_1
 #   ssh_allow_ipv4_0
-#   user_root_ssh_pubkeys_0
+#   user_root_sshpubkey
-#   user_root_ssh_pubkeys_1
-#   user_root_ssh_pubkeys_2
-#   user_root_ssh_pubkeys_3
 # Arguments:
 #   None
 # Returns:

func/cdi_4300_network/4320_update_initramfs.sh

@@ -34,7 +34,7 @@ update_initramfs() {
 
 
   do_in_target_script "${TARGET}" "
-    update-initramfs -u -v -k all 2>&1 | tee -a ${var_logfile}
+    update-initramfs -c -v -k all 2>&1 | tee -a ${var_logfile}
     echo ExitCode: \$? >> ${var_logfile}
   "
 

func/cdi_4400_hardening/4400_kernel_modules.sh

@@ -38,7 +38,7 @@ kernel_modules() {
 jitterentropy_rng
 EOF
   chmod 0644 "${TARGET}/usr/lib/modules-load.d/30_security-misc.conf"
-  do_log "info" "file_only" "Installed: '/usr/lib/modules-load.d/30_security-misc.conf'."
+  do_log "info" "file_only" "4400() Installed: '/usr/lib/modules-load.d/30_security-misc.conf'."
   return 0
 }
 
@@ -53,9 +53,9 @@ EOF
 #   0: on success
 #######################################
 setup_modprobe() {
- install -D -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/etc/modprobe.d/0000_ciss_debian_installer.cnf" \
+ install -D -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/modprobe.d/0000_ciss_debian_installer.cnf" \
     "${TARGET}/etc/modprobe.d/0000_ciss_debian_installer.conf"
-  do_log "info" "file_only" "Installed: '/etc/modprobe.d/0000_ciss_debian_installer.conf'."
+  do_log "info" "file_only" "4400() Installed: '/etc/modprobe.d/0000_ciss_debian_installer.conf'."
   return 0
 }
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

func/cdi_4400_hardening/4410_kernel_sysctl.sh

@@ -23,9 +23,9 @@ guard_sourcing
 #   0: on success
 #######################################
 kernel_sysctl() {
-  install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/etc/sysctl.d/99_local.hardened.ini" \
+  install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/sysctl.d/99_local.hardened.ini" \
     "${TARGET}/etc/sysctl.d/99_local.hardened"
-  do_log "info" "file_only" "Installed: '/etc/sysctl.d/99_local.hardened'."
+  do_log "info" "file_only" "4410() Installed: '/etc/sysctl.d/99_local.hardened'."
   return 0
 }
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

func/cdi_4400_hardening/4420_installation_ssh.sh

@@ -31,18 +31,16 @@ guard_sourcing
 #   0: on success
 #######################################
 installation_ssh() {
-  do_in_target "${TARGET}" apt-get install -y ssh
+  ### Declare Arrays, HashMaps, and Variables.
-
-  #######################################
-  # Variable declaration
-  #######################################
   declare -a ary_user=()
-  declare -i i
+  declare -i i=0
-  declare var_auth="" var_name=""
+  declare    var_auth="" var_name=""
 
-  install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/etc/banner" "${TARGET}/etc/"
+  do_in_target "${TARGET}" apt-get install -y --no-install-recommends --no-install-suggests ssh
-  install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/etc/motd" "${TARGET}/etc/"
+
-  do_log "info" "file_only" "Installed SSH banner and motd to '${TARGET}/etc/'."
+  install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/banner" "${TARGET}/etc/"
+  install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/motd" "${TARGET}/etc/"
+  do_log "info" "file_only" "4420() Installed SSH banner and motd to '${TARGET}/etc/'."
 
   ### Only process those for which both *_name and *_authentication_access_ssh are set.
   for ((i = 0; i <= VAR_USER_MAX; i++)); do
@@ -69,7 +67,7 @@ installation_ssh() {
 
   rm -f "${TARGET}/etc/ssh/sshd_config"
 
-  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/etc/ssh/sshd_config" "${TARGET}/etc/ssh/sshd_config"
+  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/ssh/sshd_config" "${TARGET}/etc/ssh/sshd_config"
   chmod 0600 "${TARGET}/etc/ssh/ssh_config"
 
   # shellcheck disable=SC2153
@@ -107,6 +105,8 @@ installation_ssh() {
   #echo "readonly HISTFILE" >> "${TARGET}/etc/profile.d/idle-users.sh"
   chmod +x "${TARGET}/etc/profile.d/idle-users.sh"
 
+  do_log "info" "file_only" "4420() Installed: [ssh] successfully."
+
   return 0
 }
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

func/cdi_4400_hardening/4430_installation_skel.sh

@@ -35,7 +35,7 @@ installation_skel() {
   echo 'set clipboard=unnamed' >| "${TARGET}/etc/skel/.vimrc"
   chmod 0644 "${TARGET}/etc/skel/.vimrc"
 
-  do_log "info" "file_only" "4095() Installed: '/etc/skel'-Files."
+  do_log "info" "file_only" "4430() Installed: [/etc/skel]-Files successfully."
 
   return 0
 }

includes/target/etc/modprobe.d/0000_ciss_debian_installer.cnf

@@ -9,7 +9,7 @@
 # SPDX-PackageName: CISS.debian.installer
 # SPDX-Security-Contact: security@coresecret.eu
 
-### Version Master V8.03.864.2025.07.15
+### Version Master V8.00.000.2025.06.17
 
 # The kernel allows unprivileged users to indirectly cause certain modules to be loaded via module auto-loading. This allows an
 # attacker to auto-load a vulnerable module which is then exploited. One such example is CVE-2017-6074, in which an attacker

lib/cdi_0050_debug/0051_debug_var_dump.sh

@@ -44,6 +44,7 @@ dump_vars_exiting() {
   ### Capture the final snapshot of all variables (excluding '^(BASH|_).*').
   # shellcheck disable=SC2155
   declare var_dump_vars_final=$(mktemp var_dump_vars_final.XXXXXXXX)
+
   set +x
   # shellcheck disable=SC2312
   {
@@ -52,6 +53,7 @@ dump_vars_exiting() {
       declare -p "${var}" 2>/dev/null
     done < <(compgen -v | grep -Ev '^(BASH|_).*')
   } | sort >| "${var_dump_vars_final}"
+  set -x
 
   {
     printf "✅ CISS.debian.installer Config Variable Dump. \n"
@@ -60,15 +62,19 @@ dump_vars_exiting() {
     printf "===== Initial VAR Environment ===== \n"
   } >> "${LOG_VAR}"
 
+  set +x
   comm -23 "${VAR_DUMP_VARS_INITIAL}" "${var_dump_vars_final}" >> "${LOG_VAR}"  || true
+  set -x
 
   {
     printf "\n"
     printf "===== Final VAR Environment ===== \n"
   } >> "${LOG_VAR}"
 
+  set +x
   comm -13 "${VAR_DUMP_VARS_INITIAL}" "${var_dump_vars_final}" >> "${LOG_VAR}" || true
   set -x
+
   rm -f "${VAR_DUMP_VARS_INITIAL}" "${var_dump_vars_final}"
 }
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh