V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
2025-10-14 18:20:29 +01:00
parent 087b104924
commit 4e6f4b7447
8 changed files with 130 additions and 79 deletions
--- a/func/cdi_4300_network/4300_installation_network.sh
+++ b/func/cdi_4300_network/4300_installation_network.sh
@@ -148,6 +148,8 @@ EOF
 iface ${VAR_FINAL_NIC} inet6 static
  address ${VAR_FINAL_IPV6_CIDR}
  gateway ${VAR_FINAL_IPV6_GW}
+  ### Optional harden, no RA on static v6
+  pre-up sysctl -w net.ipv6.conf.ens3.accept_ra=0

 EOF
    do_log "info" "file_only" "4300() IPv6 on the primary NIC: '${VAR_FINAL_NIC}' configured statically."
@@ -168,9 +170,6 @@ EOF
  insert_header   "${TARGET}/etc/dhcpcd.conf"
  insert_comments "${TARGET}/etc/dhcpcd.conf"
  cat << 'EOF' >> "${TARGET}/etc/dhcpcd.conf"
-### Global IPv6 Options
-noipv6rs
-
 ### No Global APIPA-Fallback.
 noipv4ll

@@ -219,6 +218,11 @@ EOF

  fi

+  if [[ "${VAR_LINK_IPV6}" == "true" && -n "${network_static_ipv6address}" ]]; then
+    echo "  noipv6rs" >> "${TARGET}/etc/dhcpcd.conf"
+  fi
+
+
  ### Footer (always).
  echo '' >> "${TARGET}/etc/dhcpcd.conf"
  echo '# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf' >> "${TARGET}/etc/dhcpcd.conf"
--- a/func/cdi_4300_network/4311_dropbear_initramfs.sh
+++ b/func/cdi_4300_network/4311_dropbear_initramfs.sh
@@ -26,46 +26,79 @@ dropbear_initramfs() {
  ### Declare Arrays, HashMaps, and Variables.
  declare     var_file=""
  declare -r  var_logfile="/root/.ciss/cdi/log/4311_dropbear_initramfs.log"
+  declare     var_target="${TARGET}"

-  chroot_logger "${TARGET}${var_logfile}"
+  ### Check for TARGET / RECOVERY.
+  [[ "${VAR_RUN_RECOVERY}" == "true" ]] && var_target="${RECOVERY}"

-  chroot_script "${TARGET}" "
+  chroot_logger "${var_target}${var_logfile}"
+
+  chroot_script "${var_target}" "
    export INITRD=No
    apt-get install -y --no-install-recommends --no-install-suggests dropbear-initramfs dropbear-bin 2>&1 | tee -a ${var_logfile}
  "

-  chroot_script "${TARGET}" "
+  chroot_script "${var_target}" "
    export INITRD=No
    apt-get purge -y dropbear dropbear-run || true
  "

-  chroot_script "${TARGET}" "
+  chroot_script "${var_target}" "
    export INITRD=No
    apt-get install -y --no-install-recommends --no-install-suggests gpgv 2>&1 | tee -a ${var_logfile}
  "

-  chroot_script "${TARGET}" "
+  chroot_script "${var_target}" "
    export INITRD=No
    apt-mark hold dropbear dropbear-initramfs 2>&1 | tee -a ${var_logfile}
  "

-  mv "${TARGET}/usr/sbin/dropbear" "${TARGET}/usr/sbin/dropbear.trixie"
-  install -D -m 0755 -o root -g root "${DIR_TMP}/build/dropbear-2025.88/dropbear" "${TARGET}/usr/sbin/"
+  mv "${var_target}/usr/sbin/dropbear" "${var_target}/usr/sbin/dropbear.trixie"
+  install -D -m 0755 -o root -g root "${DIR_TMP}/build/dropbear-2025.88/dropbear" "${var_target}/usr/sbin/"
  do_log "debug" "file_only" "4311() Installation [dropbear] successful."


  for var_file in dbclient dropbearconvert dropbearkey; do

-    mv "${TARGET}/usr/bin/${var_file}" "${TARGET}/usr/bin/${var_file}.trixie"
-    install -D -m 0755 -o root -g root "${DIR_TMP}/build/dropbear-2025.88/${var_file}" "${TARGET}/usr/bin/"
+    mv "${var_target}/usr/bin/${var_file}" "${var_target}/usr/bin/${var_file}.trixie"
+    install -D -m 0755 -o root -g root "${DIR_TMP}/build/dropbear-2025.88/${var_file}" "${var_target}/usr/bin/"
    do_log "debug" "file_only" "4311() Installation [${var_file}] successful."

  done

+  mkdir -p "${var_target}/etc/initramfs-tools/scripts/init-bottom"

-  insert_header   "${TARGET}/etc/apt/preferences.d/99-mask-dropbear"
-  insert_comments "${TARGET}/etc/apt/preferences.d/99-mask-dropbear"
-  cat << 'EOF' >> "${TARGET}/etc/apt/preferences.d/99-mask-dropbear"
+  cat << 'EOF' >| "${var_target}/etc/initramfs-tools/scripts/init-bottom/zzzz-dropbear-kill"
+#!/bin/sh
+
+PREREQ=""
+prereqs() { echo "${PREREQ}"; }
+# shellcheck disable=SC2249
+case "${1}" in
+  prereqs) prereqs; exit 0 ;;
+esac
+
+### Stop dropbear shipped in the initramfs after root pivot.
+[ -x /bin/pidof ] || exit 0
+
+P=$(/bin/pidof dropbear 2>/dev/null) || true
+
+[ -n "${P}" ] || exit 0
+
+/bin/kill -TERM "${P}" 2>/dev/null || true
+/bin/sleep 1
+
+/bin/kill -KILL "${P}" 2>/dev/null || true
+exit 0
+
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
+EOF
+
+  chmod 0755 "${var_target}/etc/initramfs-tools/scripts/init-bottom/zzzz-dropbear-kill"
+
+  insert_header   "${var_target}/etc/apt/preferences.d/99-mask-dropbear"
+  insert_comments "${var_target}/etc/apt/preferences.d/99-mask-dropbear"
+  cat << 'EOF' >> "${var_target}/etc/apt/preferences.d/99-mask-dropbear"
 # Never install the dropbear daemon package at all.
 Package: dropbear
 Pin: release *
@@ -74,9 +107,9 @@ Pin-Priority: -1
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
 EOF

-  insert_header   "${TARGET}/etc/apt/preferences.d/99-mask-dropbear-initramfs"
-  insert_comments "${TARGET}/etc/apt/preferences.d/99-mask-dropbear-initramfs"
-  cat << 'EOF' >> "${TARGET}/etc/apt/preferences.d/99-mask-dropbear-initramfs"
+  insert_header   "${var_target}/etc/apt/preferences.d/99-mask-dropbear-initramfs"
+  insert_comments "${var_target}/etc/apt/preferences.d/99-mask-dropbear-initramfs"
+  cat << 'EOF' >> "${var_target}/etc/apt/preferences.d/99-mask-dropbear-initramfs"
 # Keep the currently installed initramfs integration; never upgrade it.
 Package: dropbear-initramfs
 Pin: release *
@@ -85,7 +118,7 @@ Pin-Priority: -1
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
 EOF

-  chroot_script "${TARGET}" "systemctl mask dropbear.service dropbear.socket"
+  chroot_script "${var_target}" "systemctl mask dropbear.service dropbear.socket"
  do_log "info" "file_only" "4311() Masked: [dropbear.service dropbear.socket]"

  guard_dir && return 0
--- a/func/cdi_4300_network/4330_installation_ssh.sh
+++ b/func/cdi_4300_network/4330_installation_ssh.sh
@@ -15,16 +15,20 @@ guard_sourcing
 #######################################
 # Setup ssh server.
 # Globals:
+#   RECOVERY
 #   TARGET
 #   VAR_DROPBEAR
 #   VAR_FINAL_FQDN
 #   VAR_FINAL_IPV4
 #   VAR_FINAL_IPV6
 #   VAR_FINAL_NIC
+#   VAR_LINK_IPV6
+#   VAR_RUN_RECOVERY
 #   VAR_SETUP_PATH
 #   VAR_SSH_CA
 #   VAR_SSH_PORT
 #   VAR_USER_MAX
+#   network_static_ipv6address
 # Arguments:
 #   None
 # Returns:
@@ -35,30 +39,41 @@ installation_ssh() {
  declare -a ary_user=()
  declare -i i=0
  declare    var_auth="" var_name="" var_ca="" var_pub=""
+  declare    var_target="${TARGET}"

-  chroot_exec "${TARGET}" apt-get install -y --no-install-recommends --no-install-suggests ssh
+  ### Check for TARGET / RECOVERY.
+  [[ "${VAR_RUN_RECOVERY}" == "true" ]] && var_target="${RECOVERY}"

-  mkdir -p "${TARGET}/etc/systemd/system/ssh.service.d"
+  chroot_exec "${var_target}" apt-get install -y --no-install-recommends --no-install-suggests ssh

-  # shellcheck disable=SC2312
-  cat << EOF >> "${TARGET}/etc/systemd/system/ssh.service.d/override.conf"
+  mkdir -p "${var_target}/etc/systemd/system/ssh.service.d"
+
+  if [[ "${VAR_LINK_IPV6}" == "true" && -n "${network_static_ipv6address}" ]]; then
+
+    # shellcheck disable=SC2312
+    cat << EOF >| "${var_target}/etc/systemd/system/ssh.service.d/override.conf"
 [Unit]
-Wants=network-online.target
-After=network-online.target
+After=ifup@${VAR_FINAL_NIC}.service network.target
+Wants=ifup@${VAR_FINAL_NIC}.service

 [Service]
-# Wait until v4 *and* v6 global addresses exist on ens3
-ExecStartPre=/bin/sh -c 'for i in $(seq 1 60); do \
-  ip -4 addr show dev ens3 scope global | grep -q "inet " && \
-  ip -6 addr show dev ens3 scope global | grep -q "inet6 " && exit 0; \
-  sleep 1; \
-done; exit 1'
+### Block until the exact v6 address is present and not tentative
+ExecStartPre=/bin/sh -c '\
+  var_ip="${VAR_FINAL_IPV6}"; \
+  for i in $(seq 1 60); do \
+    ip -6 addr show dev ens3 tentative | grep -q "inet6" && { sleep 0.5; continue; }; \
+    ip -6 addr show dev ens3 scope global | grep -q "\${var_ip}/" && exit 0; \
+    sleep 0.5; \
+  done; \
+  echo "IPv6 address ${var_ip} not ready"; exit 1'
+TimeoutStartSec=32s
 Restart=on-failure
-RestartSec=3s
+RestartSec=2s
 EOF
+  fi

-  install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/banner" "${TARGET}/etc/"
-  install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/motd" "${TARGET}/etc/"
+  install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/banner" "${var_target}/etc/"
+  install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/motd" "${var_target}/etc/"
  do_log "info" "file_only" "4420() Installed SSH '/etc/banner' and '/etc/motd'."

  ### Only process those for which both *_name and *_authentication_access_ssh are set.
@@ -71,85 +86,85 @@ EOF
    fi
  done

-  rm -rf "${TARGET}"/etc/ssh/ssh_host_*key*
+  rm -rf "${var_target}"/etc/ssh/ssh_host_*key*

-  if [[ -f "${TARGET}/etc/dropbear/initramfs/dropbear_ed25519_host_key" ]]; then
+  if [[ -f "${var_target}/etc/dropbear/initramfs/dropbear_ed25519_host_key" ]]; then

-    chroot_script "${TARGET}" "
+    chroot_script "${var_target}" "
      dropbearconvert dropbear openssh /etc/dropbear/initramfs/dropbear_ed25519_host_key /etc/ssh/ssh_host_ed25519_key"

-    chroot_script "${TARGET}" "
+    chroot_script "${var_target}" "
      dropbearconvert dropbear openssh /etc/dropbear/initramfs/dropbear_rsa_host_key /etc/ssh/ssh_host_rsa_key"

-    chroot_script "${TARGET}" "
+    chroot_script "${var_target}" "
      dropbearkey -y -f /etc/dropbear/initramfs/dropbear_ed25519_host_key /etc/ssh/ssh_host_ed25519_key.pub"

-    chroot_script "${TARGET}" "
+    chroot_script "${var_target}" "
      dropbearkey -y -f /etc/dropbear/initramfs/dropbear_rsa_host_key /etc/ssh/ssh_host_rsa_key.pub"

  else

    # shellcheck disable=SC2312
-    chroot_exec "${TARGET}" ssh-keygen -o -N "" -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -C "root@${VAR_FINAL_FQDN}-$(date -I)"
+    chroot_exec "${var_target}" ssh-keygen -o -N "" -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -C "root@${VAR_FINAL_FQDN}-$(date -I)"
    # shellcheck disable=SC2312
-    chroot_exec "${TARGET}" ssh-keygen -o -N "" -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -C "root@${VAR_FINAL_FQDN}-$(date -I)"
+    chroot_exec "${var_target}" ssh-keygen -o -N "" -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -C "root@${VAR_FINAL_FQDN}-$(date -I)"

  fi

-  mkdir -p "${TARGET}/root/.ciss/cdi/backup/etc/ssh"
-  cp "${TARGET}/etc/ssh/sshd_config" "${TARGET}/root/.ciss/cdi/backup/etc/ssh/sshd_config.bak"
-  cp "${TARGET}/etc/ssh/ssh_config" "${TARGET}/root/.ciss/cdi/backup/etc/ssh/ssh_config.bak"
-  rm -f "${TARGET}/etc/ssh/sshd_config"
+  mkdir -p "${var_target}/root/.ciss/cdi/backup/etc/ssh"
+  cp "${var_target}/etc/ssh/sshd_config" "${var_target}/root/.ciss/cdi/backup/etc/ssh/sshd_config.bak"
+  cp "${var_target}/etc/ssh/ssh_config" "${var_target}/root/.ciss/cdi/backup/etc/ssh/ssh_config.bak"
+  rm -f "${var_target}/etc/ssh/sshd_config"

-  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/ssh/sshd_config" "${TARGET}/etc/ssh/sshd_config"
-  chmod 0600 "${TARGET}/etc/ssh/ssh_config"
+  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/ssh/sshd_config" "${var_target}/etc/ssh/sshd_config"
+  chmod 0600 "${var_target}/etc/ssh/ssh_config"

-  insert_comments "${TARGET}/etc/ssh/sshd_config"
+  insert_comments "${var_target}/etc/ssh/sshd_config"

  # shellcheck disable=SC2153
-  sed -i -E "s|^[[:space:]]*ListenAddressIPV4[[:space:]]+.*$|$(printf '%-29s%s' 'ListenAddress' "${VAR_FINAL_IPV4}")|" "${TARGET}/etc/ssh/sshd_config"
+  sed -i -E "s|^[[:space:]]*ListenAddressIPV4[[:space:]]+.*$|$(printf '%-29s%s' 'ListenAddress' "${VAR_FINAL_IPV4}")|" "${var_target}/etc/ssh/sshd_config"

  if [[ -n "${VAR_FINAL_IPV6}" ]]; then
-    sed -i -E "s|^[[:space:]]*ListenAddressIPV6[[:space:]]+.*$|$(printf '%-29s%s' 'ListenAddress' "${VAR_FINAL_IPV6}")|" "${TARGET}/etc/ssh/sshd_config"
+    sed -i -E "s|^[[:space:]]*ListenAddressIPV6[[:space:]]+.*$|$(printf '%-29s%s' 'ListenAddress' "${VAR_FINAL_IPV6}")|" "${var_target}/etc/ssh/sshd_config"
  else
-    sed -i "/^[[:space:]]*ListenAddressIPV6[[:space:]]*/d" "${TARGET}/etc/ssh/sshd_config"
+    sed -i "/^[[:space:]]*ListenAddressIPV6[[:space:]]*/d" "${var_target}/etc/ssh/sshd_config"
  fi

-  sed -i -E "s|^[[:space:]]*Port[[:space:]]+.*$|$(printf '%-29s%s' 'Port' "${VAR_SSH_PORT}")|" "${TARGET}/etc/ssh/sshd_config"
+  sed -i -E "s|^[[:space:]]*Port[[:space:]]+.*$|$(printf '%-29s%s' 'Port' "${VAR_SSH_PORT}")|" "${var_target}/etc/ssh/sshd_config"

  if (( ${#ary_user[@]} > 0 )); then
-    sed -i -E "s|^\s*AllowUsers\s+.*$|$(printf '%-29s%s' 'AllowUsers' "root ${ary_user[*]}")|" "${TARGET}/etc/ssh/sshd_config"
+    sed -i -E "s|^\s*AllowUsers\s+.*$|$(printf '%-29s%s' 'AllowUsers' "root ${ary_user[*]}")|" "${var_target}/etc/ssh/sshd_config"
  fi

  if [[ -n "${VAR_SSH_CA}" ]]; then
    var_ca="${VAR_SSH_CA##*/}"
-    install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}${VAR_SSH_CA}" "${TARGET}/etc/ssh/"
-    sed -i -E "s|^\s*TrustedUserCAKeys\s+.*$|$(printf '%-29s%s' 'TrustedUserCAKeys' "/etc/ssh/${var_ca}")|" "${TARGET}/etc/ssh/sshd_config"
+    install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}${VAR_SSH_CA}" "${var_target}/etc/ssh/"
+    sed -i -E "s|^\s*TrustedUserCAKeys\s+.*$|$(printf '%-29s%s' 'TrustedUserCAKeys' "/etc/ssh/${var_ca}")|" "${var_target}/etc/ssh/sshd_config"
  fi

  ### Preparing the test environment in chroot.
-  chroot_exec "${TARGET}" install -d -o root -g root -m 0755 /run/sshd
+  chroot_exec "${var_target}" install -d -o root -g root -m 0755 /run/sshd

  ### Syntax test (hard).
-  if ! chroot_script "${TARGET}" "sshd -t -f /etc/ssh/sshd_config"; then
+  if ! chroot_script "${var_target}" "sshd -t -f /etc/ssh/sshd_config"; then
    do_log "emergency" "file_only" "4420() [sshd -t -f /etc/ssh/sshd_config] failed."
    return "${ERR_CONF_VALIDATION}"
  fi

  ### Effective configuration (soft, purely informative).
-  if ! chroot_script "${TARGET}" "sshd -T -f /etc/ssh/sshd_config >| /root/.ciss/cdi/log/sshd_config.log"; then
+  if ! chroot_script "${var_target}" "sshd -T -f /etc/ssh/sshd_config >| /root/.ciss/cdi/log/sshd_config.log"; then
    do_log "warn" "file_only" "4420() [sshd -T -f /etc/ssh/sshd_config] failed. Likely env. Continuing."
  fi

-  chroot_script "${TARGET}" "ssh-keygen -r ${VAR_FINAL_FQDN}. >| /root/.ciss/cdi/log/SSHFP.log"
+  chroot_script "${var_target}" "ssh-keygen -r ${VAR_FINAL_FQDN}. >| /root/.ciss/cdi/log/SSHFP.log"

  if [[ "${VAR_DROPBEAR}" == "true" ]]; then

-    printf "### Dropbear SSHFP RR: \n" >> "${TARGET}/root/.ciss/cdi/log/SSHFP.log"
+    printf "### Dropbear SSHFP RR: \n" >> "${var_target}/root/.ciss/cdi/log/SSHFP.log"

-    for var_pub in "${TARGET}"/etc/dropbear/initramfs/dropbear*.pub; do
+    for var_pub in "${var_target}"/etc/dropbear/initramfs/dropbear*.pub; do

-      chroot_script "${TARGET}" "ssh-keygen -E sha256 -r ${VAR_FINAL_FQDN}. -f ${var_pub#/target} >> /root/.ciss/cdi/log/SSHFP.log"
+      chroot_script "${var_target}" "ssh-keygen -E sha256 -r ${VAR_FINAL_FQDN}. -f ${var_pub#/target} >> /root/.ciss/cdi/log/SSHFP.log"

    done

@@ -160,9 +175,9 @@ EOF
  # environment variables: TMOUT                                                            #
  # TMOUT=14400 ensures that users are automatically logged out after 4 hours of inactivity.#
  ###########################################################################################
-  insert_header   "${TARGET}/etc/profile.d/idle-users.sh"
-  insert_comments "${TARGET}/etc/profile.d/idle-users.sh"
-  cat << EOF >>   "${TARGET}/etc/profile.d/idle-users.sh"
+  insert_header   "${var_target}/etc/profile.d/idle-users.sh"
+  insert_comments "${var_target}/etc/profile.d/idle-users.sh"
+  cat << EOF >>   "${var_target}/etc/profile.d/idle-users.sh"
 case $- in
  *i*)
    TMOUT=14400