V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

func/cdi_4700_verification/4680_check_sshd_config_integrity.sh

@@ -0,0 +1,74 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+# SPDX-Comment: SSH-Hardening Integrity Check (Centurion SSH Audit Support)
+
+set -Ceuo pipefail
+IFS=$'\n\t'
+
+declare -r REF_CONFIG="/path/to/includes/etc/ssh/sshd_config"
+declare -r LIVE_CONFIG="/etc/ssh/sshd_config"
+declare -r REF_SSHD_T="/path/to/includes/etc/ssh/sshd_config.sshdT"
+
+hash_file() {
+  sha256sum "$1" | awk '{print $1}'
+}
+
+bold()  { tput bold; echo "$1"; tput sgr0; }
+red()   { tput setaf 1; echo "$1"; tput sgr0; }
+green() { tput setaf 2; echo "$1"; tput sgr0; }
+
+echo
+bold "Checking SSH Configuration Integrity..."
+
+if [[ ! -f "${REF_CONFIG}" ]]; then
+  red "ERROR: Reference config '${REF_CONFIG}' not found."
+  exit 1
+fi
+
+if [[ ! -f "${LIVE_CONFIG}" ]]; then
+  red "ERROR: Live config '${LIVE_CONFIG}' not found."
+  exit 1
+fi
+
+declare -r HASH_REF=$(hash_file "${REF_CONFIG}")
+declare -r HASH_LIVE=$(hash_file "${LIVE_CONFIG}")
+
+if [[ "${HASH_REF}" == "${HASH_LIVE}" ]]; then
+  green "✓ sshd_config matches reference (SHA256: ${HASH_LIVE})"
+else
+  red "✗ sshd_config has been modified!"
+  diff -u "${REF_CONFIG}" "${LIVE_CONFIG}" || true
+fi
+
+# Vergleich der sshd -T Ausgabe
+echo
+bold "🔍 Verifying sshd -T output..."
+
+if [[ ! -f "${REF_SSHD_T}" ]]; then
+  red "ERROR: Reference sshd -T output not found: '${REF_SSHD_T}'"
+  exit 1
+fi
+
+TMP_SSHD_T=$(mktemp)
+sshd -T > "${TMP_SSHD_T}"
+
+if diff -q "${TMP_SSHD_T}" "${REF_SSHD_T}" >/dev/null; then
+  green "✓ sshd -T output matches expected configuration."
+else
+  red "✗ sshd -T output has changed:"
+  diff -u "${REF_SSHD_T}" "${TMP_SSHD_T}" || true
+fi
+
+rm -f "${TMP_SSHD_T}"
+echo
+bold "✔ SSH config integrity check completed."
+guard_dir && return 0