V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

.preseed/preseed.yaml

@@ -372,16 +372,21 @@ ntp:
 # Dropbear settings
 ################################################################################################################################
 dropbear:
-  boot: true
+  boot: true                   # Dropbear initramfs integration.
-  dhcp: true
+  dhcp: true                   # Whether the '/etc/initramfs-tools/conf.d/ip' file should be configured statically or via DHCP.
-  firewall: false
+  firewall: false              # Yet not implemented. MUST be "false".
-  port: 42137
+                               # Additional ultra hardening of the dropbear initramfs environment via firewall.
+                               # The "bastion_ipv4" MUST be provided.
+  port: 42137                  # SSH Port dropbear initramfs should listen.
 
 ################################################################################################################################
 # SSH settings
 ################################################################################################################################
 ssh:
-  allow_hardening: true
+  allow_hardening: true        # For additional hardening of SSH connections via TCP wrapper: '/etc/hosts.allow'.
+                               # If "allow_policies" = "true", at least one 'bastion_ipv4' MUST be provided.
+                               # One or multiple Domains could be provided as well via 'allow_domain'.
+
   allow_domain:
     - vpn00.x448.eu
   allow_ipv4:
@@ -413,10 +418,9 @@ user:
     - 2a03:4000:53:f:abcd:9494:0:2
   allow_domain:                # Provide Bastion / Jump-Server / static VPN-Exit-Nodes Domains.
     - vpn00.x448.eu
-  dropbear_boot: true          # Dropbear initramfs integration.
+
-  dropbear_dhcp: true          # Whether the '/etc/initramfs-tools/conf.d/ip' file should be configured statically or via DHCP.
+
-  dropbear_fw: true            # Additional ultra hardening of the dropbear initramfs environment via firewall.
+
-                               # The "bastion_ipv4" MUST be provided.
   ssh_port: 42137              # SSH Port. In case "dropbear_boot" = "true" the same SSH Port will be used.
   ssh_rootca: "/.preseed/ssh_root_ca.pub"
 

func/4060_generate_crypttab.sh

@@ -39,7 +39,7 @@ write_crypttab() {
 #   HMP_PATH_ENCLABEL
 #   HMP_PATH_LUKSUUID
 #   TARGET
-#   user_dropbear_boot
+#   dropbear_boot
 # Arguments:
 #   None
 # Returns:
@@ -77,7 +77,7 @@ EOF
     var_encryption_label="${HMP_PATH_ENCLABEL["${var_key}"]}"
     var_luks_uuid="${HMP_PATH_LUKSUUID["${var_key}"]}"
 
-    if [[ "${user_dropbear_boot,,}" == "true" ]]; then
+    if [[ "${dropbear_boot,,}" == "true" ]]; then
 
       write_crypttab "${var_encryption_label}" "UUID=${var_luks_uuid}" "none" "luks,discard,initramfs"
 

func/4195_setup_dropbear.sh

@@ -29,8 +29,8 @@ guard_sourcing
 #   network_static_ipv4nameserver_1
 #   user_bastion_enable
 #   user_bastion_ipv4_0
-#   user_dropbear_dhcp
+#   dropbear_dhcp
-#   user_dropbear_fw
+#   dropbear_firewall
 #   user_root_ssh_pubkeys_0
 #   user_root_ssh_pubkeys_1
 #   user_root_ssh_pubkeys_2
@@ -63,7 +63,7 @@ setup_dropbear() {
   install -D -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/etc/banner" "${TARGET}/etc/dropbear/initramfs/"
 
   ### Check for initramfs "IP"-variable: static or dynamic configuration vai dhcp.
-  if [[ "${user_dropbear_dhcp,,}" != "true" ]]; then
+  if [[ "${dropbear_dhcp,,}" != "true" ]]; then
     declare network_static_ipv4ntpserver_0="192.53.103.108"
     ### "IP=<HOST IP>::<GATEWAY IP>:<SUBNET MASK>:<FQDN>:<NIC>:none:<DNS 0 IP>:<DNS 1 IP>:<NTP IP>"
     printf "IP=%s::%s:%s:%s:%s:none:%s:%s:%s\n" \
@@ -138,13 +138,13 @@ EOF
   install -D -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/initramfs-tools/files/dropbear_fw.sh" \
     "${TARGET}/includes/initramfs-tools/files/"
 
-  if [[ "${user_dropbear_fw,,}" == "true" && -n "${user_bastion_ipv4_0}" ]]; then
+  if [[ "${dropbear_firewall,,}" == "true" && -n "${user_bastion_ipv4_0}" ]]; then
 
     sed -i 's/^DROPBEAR_FIREWALL_ENABLED=0$/DROPBEAR_FIREWALL_ENABLED=1/' "${TARGET}/includes/initramfs-tools/files/dropbear_fw.cnf"
     sed -i '/^# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh$/d' "${TARGET}/includes/initramfs-tools/files/dropbear_fw.cnf"
 
     cat << EOF >> "${TARGET}/includes/initramfs-tools/files/dropbear_fw.cnf"
-DROPBEAR_PORT=${user_ssh_port}
+DROPBEAR_PORT=${dropbear_port}
 DROPBEAR_JUMP_SERVER_IP=${user_bastion_ipv4_0}
 DROPBEAR_BASTION_ENABLE=${user_bastion_enable}