msw/CISS.debian.installer
SHA256
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

V8.00.000.2025.06.17

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-08-08 17:54:25 +02:00
parent 166186a8f0
commit 06c093e0a1
26 changed files with 156 additions and 2050 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
func/cdi_1000_helper/1081_helper_grub.sh
View File

@@ -146,6 +146,7 @@ EOF
umask 0022
{
printf "GRUB_CMDLINE_LINUX='%s'\n" "${var_linux}"
printf "\n"
printf "GRUB_CMDLINE_LINUX_DEFAULT='%s'\n" "${var_linux_default}"
printf "\n"
printf "# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh\n"

13
func/cdi_1000_helper/1082_helper_modules.sh
View File

@@ -82,14 +82,21 @@ grep_nic_driver_modules() {
# 0: on success
#######################################
insert_comments() {
declare file="${1}"
declare of_file="${1}" var_name=""
case "${of_file}" in
/target/*) var_name="${of_file#/target}" ;;
/recovery/*) var_name="${of_file#/recovery}" ;;
*) var_name="${of_file}" ;;
esac
sed -i '/^# SPDX-Security-Contact: security@coresecret\.eu$/a\
\
# Static file system information: '"${file}"'\
# Static file system information: '"${var_name}"'\
# Generated by CISS.debian.installer '"${VAR_VERSION}"'\
# Architecture: '"${VAR_ARCHITECTURE}"'\
# Distribution: '"${VAR_CODENAME}"'
' "${file}"
' "${of_file}"
return 0
}

2
func/cdi_4300_network/4310_dropbear_build.sh
View File

@@ -71,7 +71,7 @@ dropbear_build() {
# shellcheck disable=2312
make -j"$(nproc)"
' 2>&1 | tee -a "${TARGET}${var_logfile}"
' >> "${TARGET}${var_logfile}" 2>&1
[[ "${VAR_DEBUG_TRACE,,}" == "true" ]] && set -x
guard_dir && return 0

4
func/cdi_4300_network/4312_dropbear_setup.sh
View File

@@ -22,9 +22,9 @@ guard_sourcing
# VAR_FINAL_IPV4_SUBNET
# VAR_FINAL_NIC
# VAR_SETUP_PATH
# dropbear_dhcp
# dropbear_firewall
# dropbear_port
# network_autoconfig_enable
# network_static_ipv4nameserver_0
# network_static_ipv4nameserver_1
# ssh_allow_ipv4_0
@@ -36,7 +36,7 @@ guard_sourcing
#######################################
dropbear_setup() {
### Declare Arrays, HashMaps, and Variables.
declare network_static_ipv4ntpserver_0="192.53.103.108" var_modules=""
declare network_static_ipv4ntpserver_0="192.53.103.108"
### Prepare strong dropbear host keys
rm -f "${TARGET}"/etc/dropbear/initramfs/dropbear*key

51
func/cdi_4400_hardening/4420_installation_ssh.sh
View File

@@ -70,18 +70,14 @@ installation_ssh() {
insert_comments "${TARGET}/etc/ssh/sshd_config"
# shellcheck disable=SC2153
#sed -i -E "s|^\s*ListenAddress\s+.*$|$(printf '%-29s%s' 'ListenAddress' "${VAR_FINAL_IPV4}")|" "${TARGET}/etc/ssh/sshd_config"
sed -i -E "s|^[[:space:]]*ListenAddress[[:space:]]+.*$|$(printf '%-29s%s' 'ListenAddress' "${VAR_FINAL_IPV4}")|" "${TARGET}/etc/ssh/sshd_config"
sed -i -E "s|^[[:space:]]*ListenAddressIPV4[[:space:]]+.*$|$(printf '%-29s%s' 'ListenAddress' "${VAR_FINAL_IPV4}")|" "${TARGET}/etc/ssh/sshd_config"
if [[ -n "${VAR_FINAL_IPV6}" ]]; then
#sed -i -E "s|^\s*ListenAddress\s+::.*$|$(printf '%-29s%s' 'ListenAddress' "${VAR_FINAL_IPV6}")|" "${TARGET}/etc/ssh/sshd_config"
sed -i -E "s|^[[:space:]]*ListenAddress[[:space:]]+::.*$|$(printf '%-29s%s' 'ListenAddress' "${VAR_FINAL_IPV6}")|" "${TARGET}/etc/ssh/sshd_config"
sed -i -E "s|^[[:space:]]*ListenAddressIPV6[[:space:]]+.*$|$(printf '%-29s%s' 'ListenAddress' "${VAR_FINAL_IPV6}")|" "${TARGET}/etc/ssh/sshd_config"
else
#sed -i "/^\s*ListenAddress\s*::/d" "${TARGET}/etc/ssh/sshd_config"
sed -i "/^[[:space:]]*ListenAddress[[:space:]]*::/d" "${TARGET}/etc/ssh/sshd_config"
sed -i "/^[[:space:]]*ListenAddressIPV6[[:space:]]*/d" "${TARGET}/etc/ssh/sshd_config"
fi
#sed -i -E "s|^\s*Port\s+.*$|$(printf '%-29s%s' 'Port' "${ssh_port}")|" "${TARGET}/etc/ssh/sshd_config"
sed -i -E "s|^[[:space:]]*Port[[:space:]]+.*$|$(printf '%-29s%s' 'Port' "${ssh_port}")|" "${TARGET}/etc/ssh/sshd_config"
if (( ${#ary_user[@]} > 0 )); then
@@ -111,16 +107,41 @@ installation_ssh() {
do_in_target_script "${TARGET}" "ssh-keygen -r ${VAR_FINAL_FQDN}. >| /root/.ciss/cdi/log/SSHFP.log"
###########################################################################################
# The file /etc/profile.d/idle-users.sh is created to set two read-only #
# environment variables: TMOUT and HISTFILE. #
# The file /etc/profile.d/idle-users.sh is created to set the read-only #
# environment variables: TMOUT #
# TMOUT=14400 ensures that users are automatically logged out after 4 hours of inactivity.#
# readonly HISTFILE ensures that the command history cannot be changed. #
# The chmod +x command ensures that the file is executed in every shell session. #
###########################################################################################
echo "readonly TMOUT=14400" >| "${TARGET}/etc/profile.d/idle-users.sh"
# TODO: Decide: set HISTFILE=/dev/null or leave unset (readonly var requires value!)
#echo "readonly HISTFILE" >> "${TARGET}/etc/profile.d/idle-users.sh"
chmod +x "${TARGET}/etc/profile.d/idle-users.sh"
cat << EOF >| "${TARGET}/etc/profile.d/idle-users.sh"
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
# Static file system information: /etc/profile.d/idle-users.sh
# Generated by CISS.debian.installer ${VAR_VERSION}
# Architecture: ${VAR_ARCHITECTURE}
# Distribution: ${VAR_CODENAME}
EOF
cat << 'EOF' >> "${TARGET}/etc/profile.d/idle-users.sh"
case $- in
*i*)
TMOUT=14400
export TMOUT
readonly TMOUT
;;
esac
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
EOF
chmod 0644 "${TARGET}/etc/profile.d/idle-users.sh"
insert_comments "${TARGET}/etc/profile.d/idle-users.sh"
guard_dir && return 0
}

10
func/cdi_4400_hardening/4430_installation_skel.sh
View File

@@ -29,8 +29,18 @@ installation_skel() {
install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/skel/.zshrc" "${TARGET}/etc/skel/.zshrc"
install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/root/.ciss/alias" "${TARGET}/etc/skel/.ciss/alias"
install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/root/.ciss/clean_logout.sh" "${TARGET}/etc/skel/.ciss/clean_logout.sh"
install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/root/.ciss/f2bchk.sh" "${TARGET}/etc/skel/.ciss/f2bchk.sh"
install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/root/.ciss/scan_libwrap" "${TARGET}/etc/skel/.ciss/scan_libwrap"
install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/root/.ciss/shortcuts" "${TARGET}/etc/skel/.ciss/shortcuts"
insert_comments "${TARGET}/etc/skel/.bashrc"
insert_comments "${TARGET}/etc/skel/.zshrc"
insert_comments "${TARGET}/etc/skel/.ciss/alias"
insert_comments "${TARGET}/etc/skel/.ciss/clean_logout.sh"
insert_comments "${TARGET}/etc/skel/.ciss/f2bchk.sh"
insert_comments "${TARGET}/etc/skel/.ciss/scan_libwrap"
insert_comments "${TARGET}/etc/skel/.ciss/shortcuts"
### In order to be able to copy/paste from vim, one needs to create a '.vimrc' in every home directory with the following content:
echo 'set clipboard=unnamed' >| "${TARGET}/etc/skel/.vimrc"
chmod 0644 "${TARGET}/etc/skel/.vimrc"