V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

func/cdi_4100_base/4133_installation_masking.sh

@@ -25,15 +25,16 @@ installation_masking() {
   chroot_script "${TARGET}" "
     systemctl mask ctrl-alt-del.target sleep.target suspend.target hibernate.target hybrid-sleep.target
   "
-
   do_log "info" "file_only" "4133() Masked: [ctrl-alt-del.target sleep.target suspend.target hibernate.target hybrid-sleep.target]"
 
   chroot_script "${TARGET}" "
       systemctl mask plymouth-start.service plymouth-quit.service plymouth-quit-wait.service plymouth-read-write.service
   "
-
   do_log "info" "file_only" "4133() Masked: [plymouth-start.service plymouth-quit.service plymouth-quit-wait.service plymouth-read-write.service]"
 
   guard_dir && return 0
 }
+### Prevents accidental 'unset -f'.
+# shellcheck disable=SC2034
+readonly -f installation_masking
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

func/cdi_4300_network/4310_dropbear_build.sh

@@ -16,16 +16,13 @@ guard_sourcing
 # Build Ultra Hardened dropbear-2025.88 from sources.
 # Globals:
 #   DIR_TMP
-#   PATH
-#   PATH_SEPARATOR
-#   SHELLOPTS
-#   VAR_DEBUG_TRACE
+#   TARGET
 #   VAR_SETUP_PATH
 # Arguments:
 #   None
 # Returns:
 #   0: on success
-#   ERR_PATH_NOT_VALID
+#   ERR_PATH_NOT_VALID: on failure
 #######################################
 dropbear_build() {
   ### Declare Arrays, HashMaps, and Variables.
@@ -76,4 +73,7 @@ dropbear_build() {
 
   guard_dir && return 0
 }
+### Prevents accidental 'unset -f'.
+# shellcheck disable=SC2034
+readonly -f dropbear_build
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

func/cdi_4300_network/4311_dropbear_initramfs.sh

@@ -31,10 +31,15 @@ dropbear_initramfs() {
 
   chroot_script "${TARGET}" '
     export INITRD=No
-    apt-get install -y --no-install-recommends --no-install-suggests dropbear-initramfs 2>&1 | tee -a '"${var_logfile}"'
+    apt-get install -y --no-install-recommends --no-install-suggests dropbear-initramfs dropbear-bin 2>&1 | tee -a '"${var_logfile}"'
     echo ExitCode: $? >> '"${var_logfile}"'
   '
 
+  chroot_script "${TARGET}" '
+    export INITRD=No
+    apt-get purge -y dropbear dropbear-run || true
+    echo ExitCode: $? >> '"${var_logfile}"'
+  '
 
   chroot_script "${TARGET}" '
     export INITRD=No
@@ -42,14 +47,12 @@ dropbear_initramfs() {
     echo ExitCode: $? >> '"${var_logfile}"'
   '
 
-
   chroot_script "${TARGET}" '
     export INITRD=No
     apt-mark hold dropbear dropbear-initramfs 2>&1 | tee -a '"${var_logfile}"'
     echo ExitCode: $? >> '"${var_logfile}"'
   '
 
-
   mv "${TARGET}/usr/sbin/dropbear" "${TARGET}/usr/sbin/dropbear.trixie"
   install -D -m 0755 -o root -g root "${DIR_TMP}/build/dropbear-2025.88/dropbear" "${TARGET}/usr/sbin/"
   do_log "debug" "file_only" "4311() Installation [dropbear] successful."
@@ -73,7 +76,6 @@ Pin-Priority: -1
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
 EOF
 
-
   insert_header   "${TARGET}/etc/apt/preferences.d/99-mask-dropbear-initramfs"
   insert_comments "${TARGET}/etc/apt/preferences.d/99-mask-dropbear-initramfs"
   cat << 'EOF' >> "${TARGET}/etc/apt/preferences.d/99-mask-dropbear-initramfs"
@@ -85,10 +87,12 @@ Pin-Priority: -1
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
 EOF
 
-
   chroot_script "${TARGET}" "systemctl mask dropbear.service dropbear.socket"
   do_log "info" "file_only" "4311() Masked: [dropbear.service dropbear.socket]"
 
   guard_dir && return 0
 }
+### Prevents accidental 'unset -f'.
+# shellcheck disable=SC2034
+readonly -f dropbear_initramfs
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

func/cdi_4300_network/4320_update_initramfs.sh

@@ -46,6 +46,8 @@ update_initramfs() {
     echo ExitCode: \$? >> ${var_logfile}
   "
 
+  chmod 0400 "${TARGET}/boot/grub/grub.cfg"
+
   guard_dir && return 0
 }
 ### Prevents accidental 'unset -f'.

func/cdi_4300_network/4330_installation_ssh.sh

@@ -37,6 +37,20 @@ installation_ssh() {
 
   chroot_exec "${TARGET}" apt-get install -y --no-install-recommends --no-install-suggests ssh
 
+  mkdir -p "${TARGET}/etc/systemd/system/ssh.service.d"
+
+  cat << EOF >| "${TARGET}/etc/systemd/system/ssh.service.d/override.conf"
+[Unit]
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+### If anything named 'dropbear' survived, kill it before binding.
+ExecStartPre=/usr/bin/pkill -x dropbear || :
+Restart=on-failure
+RestartSec=3s
+EOF
+
   install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/banner" "${TARGET}/etc/"
   install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/motd" "${TARGET}/etc/"
   do_log "info" "file_only" "4420() Installed SSH '/etc/banner' and '/etc/motd'."
@@ -156,4 +170,7 @@ EOF
 
   guard_dir && return 0
 }
+### Prevents accidental 'unset -f'.
+# shellcheck disable=SC2034
+readonly -f installation_ssh
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

func/cdi_4400_hardening/4430_hardening_files.sh

@@ -22,17 +22,34 @@ guard_sourcing
 #   0: on success
 #######################################
 hardening_files() {
+  declare     var_bin="" var_binary=""
+
   chmod 0700 "${TARGET}/etc/cron.d" "${TARGET}/etc/cron.daily" "${TARGET}/etc/cron.hourly" "${TARGET}/etc/cron.monthly" \
              "${TARGET}/etc/cron.weekly"
   chmod 0700 "${TARGET}/etc/sudoers.d"
   chmod 0700 "${TARGET}/etc/crontab"
 
+  [[ -f "${TARGET}/etc/cron.deny" ]] && rm "${TARGET}/etc/cron.deny"
+
   rm -f "${TARGET}/etc/issue" "${TARGET}/etc/issue.net"
   install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/issue" "${TARGET}/etc/issue"
   install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/issue.net" "${TARGET}/etc/issue.net"
 
   install -d -m 0700 -o root -g root "${TARGET}/root/.ansible"
 
+  for var_bin in as gcc g++ cc clang; do
+    var_binary=$(readlink -f "${TARGET}/usr/bin/${var_bin}") || {
+      do_log "info" "file_only" "4430() Binary: '${var_bin}' not found, skipping."
+      continue
+    }
+    chmod 0700 "${var_binary}" || {
+      do_log "info" "file_only" "4430() Binary chmod 0700: '${var_bin}' failed, skipping."
+    }
+  done
+
   guard_dir && return 0
 }
+### Prevents accidental 'unset -f'.
+# shellcheck disable=SC2034
+readonly -f hardening_files
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

func/cdi_4600_packages/4620_installation_verification.sh

@@ -46,7 +46,7 @@ install_verification() {
 
 ## Increase the buffers to survive stress events.
 ## Make this bigger for busy systems
--b 8192
+-b 16384
 
 ## This determine how long to wait in burst of events
 --backlog_wait_time 60000