V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

func/cdi_4300_network/4310_dropbear_build.sh

@@ -16,16 +16,13 @@ guard_sourcing
 # Build Ultra Hardened dropbear-2025.88 from sources.
 # Globals:
 #   DIR_TMP
-#   PATH
-#   PATH_SEPARATOR
-#   SHELLOPTS
-#   VAR_DEBUG_TRACE
+#   TARGET
 #   VAR_SETUP_PATH
 # Arguments:
 #   None
 # Returns:
 #   0: on success
-#   ERR_PATH_NOT_VALID
+#   ERR_PATH_NOT_VALID: on failure
 #######################################
 dropbear_build() {
   ### Declare Arrays, HashMaps, and Variables.
@@ -76,4 +73,7 @@ dropbear_build() {
 
   guard_dir && return 0
 }
+### Prevents accidental 'unset -f'.
+# shellcheck disable=SC2034
+readonly -f dropbear_build
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

func/cdi_4300_network/4311_dropbear_initramfs.sh

@@ -31,10 +31,15 @@ dropbear_initramfs() {
 
   chroot_script "${TARGET}" '
     export INITRD=No
-    apt-get install -y --no-install-recommends --no-install-suggests dropbear-initramfs 2>&1 | tee -a '"${var_logfile}"'
+    apt-get install -y --no-install-recommends --no-install-suggests dropbear-initramfs dropbear-bin 2>&1 | tee -a '"${var_logfile}"'
     echo ExitCode: $? >> '"${var_logfile}"'
   '
 
+  chroot_script "${TARGET}" '
+    export INITRD=No
+    apt-get purge -y dropbear dropbear-run || true
+    echo ExitCode: $? >> '"${var_logfile}"'
+  '
 
   chroot_script "${TARGET}" '
     export INITRD=No
@@ -42,14 +47,12 @@ dropbear_initramfs() {
     echo ExitCode: $? >> '"${var_logfile}"'
   '
 
-
   chroot_script "${TARGET}" '
     export INITRD=No
     apt-mark hold dropbear dropbear-initramfs 2>&1 | tee -a '"${var_logfile}"'
     echo ExitCode: $? >> '"${var_logfile}"'
   '
 
-
   mv "${TARGET}/usr/sbin/dropbear" "${TARGET}/usr/sbin/dropbear.trixie"
   install -D -m 0755 -o root -g root "${DIR_TMP}/build/dropbear-2025.88/dropbear" "${TARGET}/usr/sbin/"
   do_log "debug" "file_only" "4311() Installation [dropbear] successful."
@@ -73,7 +76,6 @@ Pin-Priority: -1
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
 EOF
 
-
   insert_header   "${TARGET}/etc/apt/preferences.d/99-mask-dropbear-initramfs"
   insert_comments "${TARGET}/etc/apt/preferences.d/99-mask-dropbear-initramfs"
   cat << 'EOF' >> "${TARGET}/etc/apt/preferences.d/99-mask-dropbear-initramfs"
@@ -85,10 +87,12 @@ Pin-Priority: -1
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
 EOF
 
-
   chroot_script "${TARGET}" "systemctl mask dropbear.service dropbear.socket"
   do_log "info" "file_only" "4311() Masked: [dropbear.service dropbear.socket]"
 
   guard_dir && return 0
 }
+### Prevents accidental 'unset -f'.
+# shellcheck disable=SC2034
+readonly -f dropbear_initramfs
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

func/cdi_4300_network/4320_update_initramfs.sh

@@ -46,6 +46,8 @@ update_initramfs() {
     echo ExitCode: \$? >> ${var_logfile}
   "
 
+  chmod 0400 "${TARGET}/boot/grub/grub.cfg"
+
   guard_dir && return 0
 }
 ### Prevents accidental 'unset -f'.

func/cdi_4300_network/4330_installation_ssh.sh

@@ -37,6 +37,20 @@ installation_ssh() {
 
   chroot_exec "${TARGET}" apt-get install -y --no-install-recommends --no-install-suggests ssh
 
+  mkdir -p "${TARGET}/etc/systemd/system/ssh.service.d"
+
+  cat << EOF >| "${TARGET}/etc/systemd/system/ssh.service.d/override.conf"
+[Unit]
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+### If anything named 'dropbear' survived, kill it before binding.
+ExecStartPre=/usr/bin/pkill -x dropbear || :
+Restart=on-failure
+RestartSec=3s
+EOF
+
   install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/banner" "${TARGET}/etc/"
   install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/motd" "${TARGET}/etc/"
   do_log "info" "file_only" "4420() Installed SSH '/etc/banner' and '/etc/motd'."
@@ -156,4 +170,7 @@ EOF
 
   guard_dir && return 0
 }
+### Prevents accidental 'unset -f'.
+# shellcheck disable=SC2034
+readonly -f installation_ssh
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh