V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
2025-08-03 17:10:34 +02:00
parent a022769093
commit 525e7db19f
38 changed files with 288 additions and 182 deletions
--- a/func/cdi_4400_hardening/4400_kernel_modules.sh
+++ b/func/cdi_4400_hardening/4400_kernel_modules.sh
@@ -0,0 +1,61 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
+guard_sourcing
+
+#######################################
+# Entropy collection improvements '/usr/lib/modules-load.d/30_security-misc.conf'.
+# Globals:
+#   TARGET
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#######################################
+kernel_modules() {
+  ### Entropy collection improvements
+  mkdir -p "${TARGET}/usr/lib/modules-load.d"
+  cat << EOF >| "${TARGET}/usr/lib/modules-load.d/30_security-misc.conf"
+## The jitterentropy_rng kernel module provides a reliable and hardware-independent source of cryptographic entropy by measuring
+## minute variations in CPU execution timing (jitter). These microsecond-level differences are unpredictable and rooted in
+## physical randomness, making them suitable for high-quality entropy generation. Unlike other RNG methods that rely on hardware
+## features like TPMs or Intel's RDRAND, which may not be available or trusted, jitterentropy_rng works across all platforms,
+## including virtual machines and air-gapped systems. It is compliant with NIST SP 800-90B and BSI TR-02102-4, ensuring secure
+## entropy even during early boot stages, such as in initramfs or before full userland is available. It is the most secure,
+## standards-compliant, and universally applicable entropy source for hardened Linux environments.
+## https://www.whonix.org/wiki/Dev/Entropy
+## https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=927972
+## https://forums.whonix.org/t/jitterentropy-rngd/7204
+jitterentropy_rng
+EOF
+  chmod 0644 "${TARGET}/usr/lib/modules-load.d/30_security-misc.conf"
+  do_log "info" "file_only" "Installed: '/usr/lib/modules-load.d/30_security-misc.conf'."
+  return 0
+}
+
+#######################################
+# Blacklist some kind of potential hazardous modules via '/etc/modprobe.d/0000_ciss_debian_installer.conf'.
+# Globals:
+#   TARGET
+#   VAR_SETUP_PATH
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#######################################
+setup_modprobe() {
+ install -D -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/etc/modprobe.d/0000_ciss_debian_installer.cnf" \
+    "${TARGET}/etc/modprobe.d/0000_ciss_debian_installer.conf"
+  do_log "info" "file_only" "Installed: '/etc/modprobe.d/0000_ciss_debian_installer.conf'."
+  return 0
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
--- a/func/cdi_4400_hardening/4410_kernel_sysctl.sh
+++ b/func/cdi_4400_hardening/4410_kernel_sysctl.sh
@@ -0,0 +1,31 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
+guard_sourcing
+
+#######################################
+# Install Kernel Hardening-Presets '/etc/sysctl.d/99_local.hardened'.
+# Globals:
+#   TARGET
+#   VAR_SETUP_PATH
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#######################################
+kernel_sysctl() {
+  install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/etc/sysctl.d/99_local.hardened.ini" \
+    "${TARGET}/etc/sysctl.d/99_local.hardened"
+  do_log "info" "file_only" "Installed: '/etc/sysctl.d/99_local.hardened'."
+  return 0
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
--- a/func/cdi_4400_hardening/4420_installation_ssh.sh
+++ b/func/cdi_4400_hardening/4420_installation_ssh.sh
@@ -0,0 +1,112 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
+guard_sourcing
+
+#######################################
+# Setup ssh server.
+# Globals:
+#   BASH_REMATCH
+#   DIR_BAK
+#   DIR_LOG
+#   TARGET
+#   VAR_FINAL_FQDN
+#   VAR_FINAL_IPV4
+#   VAR_FINAL_IPV6
+#   VAR_SETUP_PATH
+#   ssh_port
+#   ssh_root_ca
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#######################################
+installation_ssh() {
+  do_in_target "${TARGET}" apt-get install -y ssh
+
+  #######################################
+  # Variable declaration
+  #######################################
+  declare -a ary_user=()
+  declare -i i
+  declare var_auth="" var_name=""
+
+  install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/etc/banner" "${TARGET}/etc/"
+  install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/etc/motd" "${TARGET}/etc/"
+  do_log "info" "file_only" "Installed SSH banner and motd to '${TARGET}/etc/'."
+
+  ### Only process those for which both *_name and *_authentication_access_ssh are set.
+  for ((i = 0; i <= VAR_USER_MAX; i++)); do
+    var_auth="user_user${i}_authentication_access_ssh"
+    var_name="user_user${i}_name"
+
+    if [[ -v "${var_auth}" && -v "${var_name}" && "${!var_auth}" == "true" ]]; then
+      ary_user+=("${!var_name}")
+    fi
+  done
+
+  rm -rf "${TARGET}"/etc/ssh/ssh_host_*key*
+
+  #shellcheck disable=SC2312
+  do_in_target "${TARGET}" ssh-keygen -o -N "" -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -C "root@${VAR_FINAL_FQDN}-$(date -I)"
+  #shellcheck disable=SC2312
+  do_in_target "${TARGET}" ssh-keygen -o -N "" -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -C "root@${VAR_FINAL_FQDN}-$(date -I)"
+
+  mkdir -p "${DIR_BAK}/etc/ssh"
+  cp "${TARGET}/etc/ssh/sshd_config" "${DIR_BAK}/etc/ssh/sshd_config.bak"
+  chmod 0644 "${DIR_BAK}/etc/ssh/sshd_config.bak"
+  cp "${TARGET}/etc/ssh/ssh_config" "${DIR_BAK}/etc/ssh/ssh_config.bak"
+  chmod 0644 "${DIR_BAK}/etc/ssh/ssh_config.bak"
+
+  rm -f "${TARGET}/etc/ssh/sshd_config"
+
+  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/etc/ssh/sshd_config" "${TARGET}/etc/ssh/sshd_config"
+  chmod 0600 "${TARGET}/etc/ssh/ssh_config"
+
+  # shellcheck disable=SC2153
+  sed -i -E "s|^\s*ListenAddress\s+.*$|$(printf '%-30s%s' 'ListenAddress' "${VAR_FINAL_IPV4}")|" "${TARGET}/etc/ssh/sshd_config"
+
+  if [[ -n "${VAR_FINAL_IPV6}" ]]; then
+    sed -i -E "s|^\s*ListenAddress\s+::.*$|$(printf '%-30s%s' 'ListenAddress' "${VAR_FINAL_IPV6}")|" "${TARGET}/etc/ssh/sshd_config"
+  else
+    sed -i "/^\s*ListenAddress\s*::/d" "${TARGET}/etc/ssh/sshd_config"
+  fi
+
+  sed -i -E "s|^\s*Port\s+.*$|$(printf '%-30s%s' 'Port' "${ssh_port}")|" "${TARGET}/etc/ssh/sshd_config"
+
+  if (( ${#ary_user[@]} > 0 )); then
+    sed -i -E "s|^\s*AllowUsers\s+.*$|$(printf '%-30s%s' 'AllowUsers' "root ${ary_user[*]}")|" "${TARGET}/etc/ssh/sshd_config"
+  fi
+
+  if [[ -n "${ssh_root_ca}" ]]; then
+    install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}${ssh_root_ca}" "${TARGET}/etc/ssh/"
+     sed -i -E "s|^\s*TrustedUserCAKeys\s+.*$|$(printf '%-30s%s' 'TrustedUserCAKeys' "/etc/ssh/${ssh_root_ca}")|" "${TARGET}/etc/ssh/sshd_config"
+  fi
+
+  do_in_target_script "${TARGET}" "sshd -T >| ${DIR_LOG}/sshd_config.log"
+  do_in_target_script "${TARGET}" "ssh-keygen -r ${VAR_FINAL_FQDN}. >| ${DIR_LOG}/ssh.log"
+
+  ###########################################################################################
+  # The file /etc/profile.d/idle-users.sh is created to set two read-only                   #
+  # environment variables: TMOUT and HISTFILE.                                              #
+  # TMOUT=14400 ensures that users are automatically logged out after 4 hours of inactivity.#
+  # readonly HISTFILE ensures that the command history cannot be changed.                   #
+  # The chmod +x command ensures that the file is executed in every shell session.          #
+  ###########################################################################################
+  echo "readonly TMOUT=14400" >| "${TARGET}/etc/profile.d/idle-users.sh"
+  # TODO: Decide: set HISTFILE=/dev/null or leave unset (readonly var requires value!)
+  #echo "readonly HISTFILE" >> "${TARGET}/etc/profile.d/idle-users.sh"
+  chmod +x "${TARGET}/etc/profile.d/idle-users.sh"
+
+  return 0
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
--- a/func/cdi_4400_hardening/4430_installation_skel.sh
+++ b/func/cdi_4400_hardening/4430_installation_skel.sh
@@ -0,0 +1,42 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
+guard_sourcing
+
+#######################################
+# Prepare '/etc/skel'-Directory.
+# Globals:
+#   TARGET
+#   VAR_SETUP_PATH
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#######################################
+installation_skel() {
+  mkdir -p "${TARGET}/etc/skel/.ciss"
+
+  install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/skel/.bashrc" "${TARGET}/etc/skel/.bashrc"
+  install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/skel/.zshrc" "${TARGET}/etc/skel/.zshrc"
+  install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/root/.ciss/alias" "${TARGET}/etc/skel/.ciss/alias"
+  install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/root/.ciss/clean_logout.sh" "${TARGET}/etc/skel/.ciss/clean_logout.sh"
+  install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/root/.ciss/shortcuts" "${TARGET}/etc/skel/.ciss/shortcuts"
+
+  ### In order to be able to copy/paste from vim, one needs to create a '.vimrc' in every home directory with the following content:
+  echo 'set clipboard=unnamed' >| "${TARGET}/etc/skel/.vimrc"
+  chmod 0644 "${TARGET}/etc/skel/.vimrc"
+
+  do_log "info" "file_only" "4095() Installed: '/etc/skel'-Files."
+
+  return 0
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
--- a/func/cdi_4400_hardening/4440_hardening_files.sh
+++ b/func/cdi_4400_hardening/4440_hardening_files.sh
@@ -0,0 +1,27 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
+guard_sourcing
+
+###########################################################################################
+# Hardening files and directories.
+# Globals:
+#   None
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+###########################################################################################
+hardening_files() {
+  return 0
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh