V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
2025-08-03 17:10:34 +02:00
parent a022769093
commit 525e7db19f
38 changed files with 288 additions and 182 deletions
--- a/func/cdi_4400_hardening/4420_installation_ssh.sh
+++ b/func/cdi_4400_hardening/4420_installation_ssh.sh
@@ -0,0 +1,112 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
+guard_sourcing
+
+#######################################
+# Setup ssh server.
+# Globals:
+#   BASH_REMATCH
+#   DIR_BAK
+#   DIR_LOG
+#   TARGET
+#   VAR_FINAL_FQDN
+#   VAR_FINAL_IPV4
+#   VAR_FINAL_IPV6
+#   VAR_SETUP_PATH
+#   ssh_port
+#   ssh_root_ca
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#######################################
+installation_ssh() {
+  do_in_target "${TARGET}" apt-get install -y ssh
+
+  #######################################
+  # Variable declaration
+  #######################################
+  declare -a ary_user=()
+  declare -i i
+  declare var_auth="" var_name=""
+
+  install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/etc/banner" "${TARGET}/etc/"
+  install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/etc/motd" "${TARGET}/etc/"
+  do_log "info" "file_only" "Installed SSH banner and motd to '${TARGET}/etc/'."
+
+  ### Only process those for which both *_name and *_authentication_access_ssh are set.
+  for ((i = 0; i <= VAR_USER_MAX; i++)); do
+    var_auth="user_user${i}_authentication_access_ssh"
+    var_name="user_user${i}_name"
+
+    if [[ -v "${var_auth}" && -v "${var_name}" && "${!var_auth}" == "true" ]]; then
+      ary_user+=("${!var_name}")
+    fi
+  done
+
+  rm -rf "${TARGET}"/etc/ssh/ssh_host_*key*
+
+  #shellcheck disable=SC2312
+  do_in_target "${TARGET}" ssh-keygen -o -N "" -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -C "root@${VAR_FINAL_FQDN}-$(date -I)"
+  #shellcheck disable=SC2312
+  do_in_target "${TARGET}" ssh-keygen -o -N "" -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -C "root@${VAR_FINAL_FQDN}-$(date -I)"
+
+  mkdir -p "${DIR_BAK}/etc/ssh"
+  cp "${TARGET}/etc/ssh/sshd_config" "${DIR_BAK}/etc/ssh/sshd_config.bak"
+  chmod 0644 "${DIR_BAK}/etc/ssh/sshd_config.bak"
+  cp "${TARGET}/etc/ssh/ssh_config" "${DIR_BAK}/etc/ssh/ssh_config.bak"
+  chmod 0644 "${DIR_BAK}/etc/ssh/ssh_config.bak"
+
+  rm -f "${TARGET}/etc/ssh/sshd_config"
+
+  install -D -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/etc/ssh/sshd_config" "${TARGET}/etc/ssh/sshd_config"
+  chmod 0600 "${TARGET}/etc/ssh/ssh_config"
+
+  # shellcheck disable=SC2153
+  sed -i -E "s|^\s*ListenAddress\s+.*$|$(printf '%-30s%s' 'ListenAddress' "${VAR_FINAL_IPV4}")|" "${TARGET}/etc/ssh/sshd_config"
+
+  if [[ -n "${VAR_FINAL_IPV6}" ]]; then
+    sed -i -E "s|^\s*ListenAddress\s+::.*$|$(printf '%-30s%s' 'ListenAddress' "${VAR_FINAL_IPV6}")|" "${TARGET}/etc/ssh/sshd_config"
+  else
+    sed -i "/^\s*ListenAddress\s*::/d" "${TARGET}/etc/ssh/sshd_config"
+  fi
+
+  sed -i -E "s|^\s*Port\s+.*$|$(printf '%-30s%s' 'Port' "${ssh_port}")|" "${TARGET}/etc/ssh/sshd_config"
+
+  if (( ${#ary_user[@]} > 0 )); then
+    sed -i -E "s|^\s*AllowUsers\s+.*$|$(printf '%-30s%s' 'AllowUsers' "root ${ary_user[*]}")|" "${TARGET}/etc/ssh/sshd_config"
+  fi
+
+  if [[ -n "${ssh_root_ca}" ]]; then
+    install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}${ssh_root_ca}" "${TARGET}/etc/ssh/"
+     sed -i -E "s|^\s*TrustedUserCAKeys\s+.*$|$(printf '%-30s%s' 'TrustedUserCAKeys' "/etc/ssh/${ssh_root_ca}")|" "${TARGET}/etc/ssh/sshd_config"
+  fi
+
+  do_in_target_script "${TARGET}" "sshd -T >| ${DIR_LOG}/sshd_config.log"
+  do_in_target_script "${TARGET}" "ssh-keygen -r ${VAR_FINAL_FQDN}. >| ${DIR_LOG}/ssh.log"
+
+  ###########################################################################################
+  # The file /etc/profile.d/idle-users.sh is created to set two read-only                   #
+  # environment variables: TMOUT and HISTFILE.                                              #
+  # TMOUT=14400 ensures that users are automatically logged out after 4 hours of inactivity.#
+  # readonly HISTFILE ensures that the command history cannot be changed.                   #
+  # The chmod +x command ensures that the file is executed in every shell session.          #
+  ###########################################################################################
+  echo "readonly TMOUT=14400" >| "${TARGET}/etc/profile.d/idle-users.sh"
+  # TODO: Decide: set HISTFILE=/dev/null or leave unset (readonly var requires value!)
+  #echo "readonly HISTFILE" >> "${TARGET}/etc/profile.d/idle-users.sh"
+  chmod +x "${TARGET}/etc/profile.d/idle-users.sh"
+
+  return 0
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh