V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

func/cdi_4300_network/4330_installation_ssh.sh

@@ -63,7 +63,7 @@ Wants=ifup@${VAR_FINAL_NIC}.service
 ExecStartPre=/bin/sh -c '\
   for i in $(seq 1 60); do \
     ip -6 addr show dev ${VAR_FINAL_NIC} tentative | grep -q "inet6" && { sleep 0.5; continue; }; \
-    ip -6 addr show dev ${VAR_FINAL_NIC} scope global | grep -q "${VAR_FINAL_IPV6}/" && exit 0; \
+    ip -6 addr show dev ${VAR_FINAL_NIC} scope global | grep -Fq " ${VAR_FINAL_IPV6}/" && exit 0; \
     sleep 0.5; \
   done; \
   echo "IPv6 address ${VAR_FINAL_IPV6} on ${VAR_FINAL_NIC} not ready"; exit 1'

func/cdi_4500_user/4500_accounts_preparation.sh

@@ -37,19 +37,20 @@ accounts_preparation() {
 
   install -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/skel/.bashrc" "${TARGET}/etc/skel/.bashrc"
   install -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/skel/.zshrc" "${TARGET}/etc/skel/.zshrc"
-  install -m 0700 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/skel/.ciss/check_chrony.sh" "${TARGET}/etc/skel/.ciss/"
   install -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/skel/.ciss/theme_eza_ciss.yml" "${TARGET}/etc/skel/.ciss/"
-  install -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/target/root/.ciss/alias" "${TARGET}/etc/skel/.ciss/alias"
+  install -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/skel/.ciss/alias" "${TARGET}/etc/skel/.ciss/"
-  install -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/target/root/.ciss/clean_logout.sh" "${TARGET}/etc/skel/.ciss/clean_logout.sh"
+  install -m 0700 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/skel/.ciss/check_chrony.sh" "${TARGET}/etc/skel/.ciss/"
-  install -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/target/root/.ciss/f2bchk.sh" "${TARGET}/etc/skel/.ciss/f2bchk.sh"
+  install -m 0700 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/skel/.ciss/clean_logout.sh" "${TARGET}/etc/skel/.ciss/"
-  install -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/target/root/.ciss/scan_libwrap" "${TARGET}/etc/skel/.ciss/scan_libwrap"
+  install -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/skel/.ciss/f2bchk" "${TARGET}/etc/skel/.ciss/"
-  install -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/target/root/.ciss/shortcuts" "${TARGET}/etc/skel/.ciss/shortcuts"
+  install -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/skel/.ciss/scan_libwrap" "${TARGET}/etc/skel/.ciss/"
+  install -m 0600 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/skel/.ciss/shortcuts" "${TARGET}/etc/skel/.ciss/"
 
   insert_comments "${TARGET}/etc/skel/.bashrc"
   insert_comments "${TARGET}/etc/skel/.zshrc"
   insert_comments "${TARGET}/etc/skel/.ciss/alias"
+  insert_comments "${TARGET}/etc/skel/.ciss/check_chrony.sh"
   insert_comments "${TARGET}/etc/skel/.ciss/clean_logout.sh"
-  insert_comments "${TARGET}/etc/skel/.ciss/f2bchk.sh"
+  insert_comments "${TARGET}/etc/skel/.ciss/f2bchk"
   insert_comments "${TARGET}/etc/skel/.ciss/scan_libwrap"
   insert_comments "${TARGET}/etc/skel/.ciss/shortcuts"
 

includes/target/etc/skel/.ciss/alias

@@ -0,0 +1,274 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
+########################################################################################### Alpha
+alias genkeyfile='haveged -n 1048576 >| /tmp/secure_keyfile_$(date +%s)'
+
+########################################################################################### Bash
+alias clear="printf '\033c'"
+alias c='clear'
+alias q='exit'
+
+########################################################################################### Chrony
+alias cytr='echo "tracking -a -v" | chronyc'
+alias cysd='echo "selectdata -a -v" | chronyc'
+alias cyss='echo "sourcestats -a -v" | chronyc'
+
+########################################################################################### fail2ban & ufw
+alias f2ball='fail2ban-client status'
+alias f2bubn='fail2ban-client unban --all'
+alias f2bufw='fail2ban-client status ufw'
+alias usn='ufw status numbered'
+alias usv='ufw status verbose'
+
+########################################################################################### ls
+alias ls='eza --group-directories-first --icons=always --oneline --long --all --group --header --blocksize --inode --flags --binary --octal-permissions --total-size --sort extension'
+alias lsf='eza --group-directories-first --icons=always --oneline --long --all --absolute --group --header --blocksize --inode --flags --binary --octal-permissions --total-size --sort extension'
+alias lss='eza --group-directories-first --icons=always --oneline --long --all --absolute --group --header --blocksize --inode --flags --binary --octal-permissions --total-size --sort extension --extended'
+alias la='ls'
+alias ll=ls
+alias l=ls
+
+########################################################################################### Package Management
+alias aptac='apt autoclean'
+alias aptap='apt autopurge'
+alias aptar='apt autoremove'
+alias aptcheck='apt-get check'
+alias aptcp='apt-cache policy'
+alias aptdep='apt-cache depends'
+alias aptdl='apt-get install --download-only'
+alias aptfug='apt full-upgrade'
+alias aptupd='apt update'
+alias aptupg='apt upgrade'
+alias apti='apt install'
+alias aptp='apt purge'
+alias aptpp='dpkg --purge'
+alias aptr='apt remove'
+alias aptse='apt search'
+alias aptsh='apt show'
+alias aptimage='apt-cache search linux-image | grep linux-image | grep amd64 | grep -v "dbg" | grep -v "meta-package" | grep -v "cloud" | grep -v "PREEMPT"'
+
+########################################################################################### Readability
+alias df='df -h'
+alias free='free -m'
+alias mkdir='mkdir -pv'
+
+########################################################################################### Service restart
+alias rsban='systemctl restart fail2ban'
+alias rsweb='systemctl restart nginx php8.4-fpm redis'
+
+########################################################################################### System maintaining
+alias boot='reboot -h now'
+alias cscan='clamscan -r --bell -i'
+alias chkhvg='haveged -n 0 | dieharder -g 200 -a'
+alias dev='lsblk -o NAME,MAJ:MIN,FSTYPE,FSVER,SIZE,UUID,MOUNTPOINT,PATH'
+alias i='echo "$(whoami) @ $(uname -a)"'
+alias ipunused='iptables -L -v -n'
+alias jboot='journalctl --boot=0'
+alias lsadt='lynis audit system --auditor Centurion_Intelligence_Consulting_Agency'
+alias lsadtdoc='lynis audit system --auditor Centurion_Intelligence_Consulting_Agency > /root/lynis-$(date +%F_%H-%M-%S).txt 2>&1'
+alias n='nano'
+alias nstat='netstat -tlpnvWa'
+alias s='sudo -i'
+alias sas='systemd-analyze security'
+alias shut='shutdown -h now'
+alias ssa='systemctl status'
+alias ssf='systemctl status --failed'
+alias sysdr='systemctl daemon-reload'
+alias syses='systemctl edit'
+alias sysrl='systemctl reload'
+alias sysrs='systemctl restart'
+alias syssp='systemctl stop'
+alias sysst='systemctl start'
+alias v='nvim'
+alias whatdelete='lsof | grep deleted'
+alias whatimage='dpkg --list | grep linux-image'
+alias whatpurge='dpkg --get-selections | grep deinstall'
+# shellcheck disable=SC2142
+alias xpurge="dpkg -l | awk '/^rc/ {print \$2}' | xargs -r dpkg --purge"
+
+########################################################################################### Functions
+
+#######################################
+# Generates Secure (/dev/random) Passwords
+# Arguments:
+#    Length of Password, e.g., 32, and --base64 in case of encoding in BASE64.
+#######################################
+# shellcheck disable=SC2317
+genpasswd() {
+  declare -i length=32
+  declare -i usebase64=0
+
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --base64)
+        usebase64=1
+        ;;
+      '' | *[!0-9]*) ;;
+      *)
+         length="$1"
+        ;;
+    esac
+    shift
+  done
+
+  declare passwd
+  # shellcheck disable=SC2312
+  passwd=$(tr -dc 'A-Za-z0-9_' < /dev/random | head -c "${length}")
+
+  if [[ ${usebase64} -eq 1 ]]; then
+    echo -n "${passwd}" | base64
+  else
+    echo "${passwd}"
+  fi
+}
+
+#######################################
+# Generates Secure (/dev/random) Passwords.
+# Arguments:
+#   none
+#######################################
+# shellcheck disable=SC2317
+genpasswdhash() {
+  declare salt
+  # shellcheck disable=SC2312
+  salt=$(tr -dc 'A-Za-z0-9' < /dev/random | head -c 16)
+  mkpasswd --method=sha-512 --salt="${salt}" --rounds=8388608
+}
+
+#######################################
+# Outputs a 16-character random printable string
+# Arguments:
+#   None
+#######################################
+genstring() {
+  # shellcheck disable=SC2312
+  (haveged -n 1000 -f - 2>/dev/null | tr -cd '[:graph:]' | fold -w 16 && echo ) | head
+}
+
+#######################################
+# Wrapper for secure curl
+# Globals:
+#   CRED
+#   CRES
+#   NL
+# Arguments:
+#   1: URL from which to download a specific file
+#   2: /path/to/file to be saved to
+# Returns:
+#   0: Download successful
+#   1: Usage error
+#   2: Download failure
+#######################################
+scurl() {
+  if [[ $# -ne 2 ]]; then
+    printf "%s❌ Error: Usage: scurl <URL> <path/to/file>. %s%s" "${CRED}" "${CRES}" "${NL}" >&2
+    return 1
+  fi
+  declare url="$1"
+  declare output_path="$2"
+  if ! curl --doh-url "https://dns01.eddns.eu/dns-query" \
+            --doh-cert-status \
+            --tlsv1.3 \
+            -sSf \
+            -o "${output_path}" \
+            "${url}"
+  then
+    printf "%s❌ Error: Download failed for URL: '%s'. %s%s" "${CRED}" "${url}" "${CRES}" "${NL}" >&2
+    return 2
+  fi
+  return 0
+}
+
+#######################################
+# Wrapper for secure wget
+# Globals:
+#   CRED
+#   CRES
+#   NL
+# Arguments:
+#   1: URL from which to download a specific file
+#   2: /path/to/file to be saved to
+# Returns:
+#   0: Download successful
+#   1: Usage error
+#   2: Download failure
+#######################################
+swget() {
+  if [[ $# -ne 2 ]]; then
+    printf "%s❌ Error: Usage: swget <URL> <path/to/file>. %s%s" "${CRED}" "${CRES}" "${NL}" >&2
+    return 1
+  fi
+  declare url="$1"
+  declare output_path="$2"
+  mkdir -p "$(dirname "${output_path}")"
+  if ! wget --show-progress \
+            --no-clobber \
+            --https-only \
+            --secure-protocol=TLSv1_3 \
+            -qO "${output_path}" \
+            "${url}"
+  then
+    printf "%s❌ Error: Download failed for URL: '%s'. %s%s" "${CRED}" "${url}" "${CRES}" "${NL}" >&2
+    return 2
+  fi
+  return 0
+}
+
+#######################################
+# Wrapper for loading CISS.2025 hardened Kernel Parameters.
+# Arguments:
+#   None
+#######################################
+sysp() {
+  sysctl -p /etc/sysctl.d/99_local.hardened
+  # sleep 1
+  # shellcheck disable=SC2312
+  sysctl -a | grep -E 'kernel|vm|net' >| /var/log/sysctl_check"$(date +"%Y-%m-%d_%H:%M:%S")".log
+}
+
+#######################################
+# Wrapper for tree
+# Arguments:
+#   1: Depth of Directory Listing
+#######################################
+trel() {
+  declare depth=${1:-3}
+  tree -C -h --dirsfirst -L "${depth}"
+}
+
+#######################################
+# Wrapper for package and path to bin.
+# Arguments:
+#   1: Program
+#######################################
+whichpackage() {
+  if ! command -v "$1" >/dev/null 2>&1; then
+    printf '%s❌ Error: Program '%s' not found. %s%s' "${CRED}" "$1" "${CRES}" "${NL}" >&2
+    exit 1
+  fi
+  # shellcheck disable=SC2230,SC2312
+  dpkg -S "$(which "$1")"
+}
+
+#######################################
+# Wrapper for Diskspace used in Path.
+# Arguments:
+#   1: Path (defaults /var)
+#   2: Depth (defaults 1)
+#   3: Number of Entries (defaults 16)
+#######################################
+whichused() {
+  # shellcheck disable=SC2312
+  du -h --max-depth="${2:-1}" "${1:-/var}" | sort -hr | head -n "${3:-16}"
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

includes/target/etc/skel/.ciss/clean_logout.sh

@@ -0,0 +1,42 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
+clear
+
+cat << 'EOF'
+#######################################################################
+                 #                                              #
+                 ##                                             ##
+ ###### ######## ###  ## ######## ###  ## #######  ### #######  ###  ##
+###              #### ##    ###   ###  ##       ## ###       ## #### ##
+###      ####### #######    ###   ###  ##  ######  ###  ##   ## #######
+###      ###     ### ###    ###   ###  ##  ##  ##  ###  ##   ## ### ###
+ ######  ####### ###  ##    ###    #####   ##   ## ###   #####  ###  ##
+                       #                                              #
+#######################################################################
+EOF
+
+echo ""
+echo -e "\e[97m      (c) Marc S. Weidner, 2018 - 2025 \e[0m"
+echo -e "\e[97m      (p) Centurion Press, 2018 - 2025 \e[0m"
+echo -e "\e[97m          Centurion Intelligence Consulting Agency (tm) \e[0m"
+echo -e "\e[97m          https://coresecret.eu/ \e[0m"
+echo -e "\e[95m          Please consider making a donation: \e[0m"
+echo -e "\e[95m          https://coresecret.eu/spenden/ \e[0m"
+echo ""
+echo -e "\e[92m          All done" "\e[95m'${USER}'" "\e[92m! \e[0m"
+echo -e "\e[92m          Close shell with 'ENTER' to exit" "\e[95m'${HOST}'" "\e[92m! \e[0m"
+# shellcheck disable=SC2162
+read
+
+[[ -x /usr/bin/clear_console ]] && /usr/bin/clear_console -q
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

includes/target/etc/skel/.ciss/f2bchk

@@ -0,0 +1,97 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
+#######################################
+# Wrapper for fail2ban filter checks against logs.
+# Usage: f2bchk --mode=ignored || --mode=matched  || --mode=missed \
+#               --filter=/etc/fail2ban/filter.d/ufw.aggressive.conf \
+#               --log=/var/log/ufw.log \
+#               --output=/tmp/f2bchk.log
+# Globals:
+#   CGRE
+#   CRED
+#   CRES
+#   NL
+# Arguments:
+#   None
+# Returns:
+#   0: on success
+#   1: In case of any errors
+#######################################
+f2bchk(){
+  ### Declare default values (readonly)
+  declare -r DEFAULT_MODE="matched"
+  declare -r DEFAULT_FILTER="/etc/fail2ban/filter.d/ufw.aggressive.conf"
+  declare -r DEFAULT_LOG="/var/log/ufw.log"
+
+  declare mode="${DEFAULT_MODE}"
+  declare filter="${DEFAULT_FILTER}"
+  declare log="${DEFAULT_LOG}"
+  declare output=""
+  declare arg=""
+
+  for arg in "$@"; do
+    case "${arg}" in
+      --mode=*)   mode="${arg#--mode=}";;
+      --filter=*) filter="${arg#--filter=}";;
+      --log=*)    log="${arg#--log=}";;
+      --output=*) output="${arg#--output=}";;
+      *)
+        printf "%b[ERROR]%b Unknown argument: '%s' %b" "${CRED}" "${CRES}" "${arg}" "${CRED}"
+        return 1
+        ;;
+    esac
+  done
+
+  declare flag suffix
+  case "${mode}" in
+    ignored) flag="--print-all-ignored"; suffix="all.ignored";;
+    matched) flag="--print-all-matched"; suffix="all.matched";;
+    missed)  flag="--print-all-missed";  suffix="all.missed";;
+    *)
+      printf "%b[ERROR]%b Invalid mode: '%s' %b" "${CRED}" "${CRES}" "${mode}" "${NL}"
+      return 1
+      ;;
+  esac
+
+  if [[ -z "${output}" ]]; then
+    declare filter_name="${filter##*/}"
+    filter_name="${filter_name%.conf}"
+    output="/tmp/${filter_name}.${suffix}.log"
+  fi
+
+  if [[ ! -r "${log}" ]]; then
+    printf "%b[ERROR]%b Log file '%s' not found or not readable. %b" "${CRED}" "${CRES}" "${log}" "${NL}"
+    return 1
+  fi
+
+  if [[ ! -r "${filter}" ]]; then
+    printf "%b[ERROR]%b Filter file '%s' not found or not readable. %b" "${CRED}" "${CRES}" "${filter}" "${NL}"
+    return 1
+  fi
+
+  printf "%b[INFO]%b Running: fail2ban-regex '%s %s %s' %b" "${CGRE}" "${CRES}" "${log}" "${filter}" "${flag}" "${NL}"
+
+  if fail2ban-regex "${log}" "${filter}" "${flag}" >| "${output}"; then
+
+    printf "%b[SUCCESS]%b Saved log to: '%s' %b" "${CGRE}" "${CRES}" "${output}" "${NL}"
+    printf "You can view it with: cat %s%b" "${output}" "${NL}"
+  else
+
+    printf "%b[ERROR]%b fail2ban-regex execution failed. %b" "${CRED}" "${CRES}" "${NL}"
+    return 1
+
+  fi
+
+  exit 0
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

includes/target/etc/skel/.ciss/scan_libwrap

@@ -0,0 +1,49 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
+#######################################
+# Scanner for 'libwrap' usage.
+# Globals:
+#   CGRE
+#   CRES
+#   NL
+# Arguments:
+#   None
+#######################################
+scanlw() {
+  printf "%b🔍 Scanning all running processes for 'libwrap' usage ... %b%b" "${CGRE}" "${CRES}" "${NL}"
+  printf "\n"
+
+  ### Collect binaries from all running PIDs.
+  declare pid exe_path comm user
+
+  for pid in $(ps -e -o pid=); do
+    exe_path=$(readlink -f "/proc/${pid}/exe" 2>/dev/null)
+
+    ### Skip if not a regular executable.
+    [[ -x "${exe_path}" ]] || continue
+
+    ### Check if the binary is linked with libwrap.
+    # shellcheck disable=SC2312
+    if ldd "${exe_path}" 2>/dev/null | grep -q "libwrap"; then
+      comm=$(ps -p "${pid}" -o comm=)
+      user=$(ps -p "${pid}" -o user=)
+      printf "%b✅ PID: %s (%s) [User: %s] is linked with 'libwrap.so'. %b%b" "${CGRE}" "${pid}" "${comm}" "${user}" "${CRES}" "${NL}"
+    fi
+  done
+
+  printf "\n"
+  printf "%b✅ Scan complete. %b%b" "${CGRE}" "${CRES}" "${NL}"
+
+  exit 0
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

includes/target/etc/skel/.ciss/shortcuts

@@ -0,0 +1,119 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.installer
+# SPDX-Security-Contact: security@coresecret.eu
+
+declare -ag shortcuts=(
+  "aptac: apt autoclean"
+  "aptap: apt autopurge"
+  "aptar: apt autoremove"
+  "aptcheck: apt-get check"
+  "aptcp: apt-cache policy"
+  "aptdep: apt-cache depends"
+  "aptdl: apti --download-only"
+  "aptfug: apt full-upgrade"
+  "apti: apt install"
+  "aptimage: get Kernel Img"
+  "aptp: apt purge"
+  "aptpp: dpkg --purge"
+  "aptr: apt remove"
+  "aptse: apt search"
+  "aptsh: apt show"
+  "aptupd: apt update"
+  "aptupg: apt upgrade"
+  "boot: reboot -h now"
+  "c: clear"
+  "clear: printf \033c"
+  "cscan: clamscan -r --bell -i"
+  "chkhvg: hvg -n 0 | dieharder -g 200 -a"
+  "cysd: chrony selectdata"
+  "cyss: chrony sourcestats"
+  "cytr: chrony tracking"
+  "dev: lsblk -o ..."
+  "df: df -h"
+  "f2ball: f2b status all"
+  "f2bubn: f2b unban --all"
+  "f2bufw: f2b status ufw"
+  "free: free -m"
+  "genkeyfile: 1MiBi"
+  "genpasswd: PWD"
+  "genpasswdhash: PWD Hash"
+  "genstring: Random String"
+  "i: who you are"
+  "ipunused: iptables -L -v -n"
+  "jboot: journalctl --boot=0"
+  "l: ls"
+  "la: ls"
+  "ll: ls"
+  "ls: eza"
+  "lsadt: lynis audit system"
+  "lsadtdoc: lynis audit system"
+  "lsf: eza --absolute"
+  "lss: eza --extended"
+  "mkdir: mkdir -pv"
+  "n: nano"
+  "nstat: netstat -tlpnvWa"
+  "q: exit"
+  "rsban: restart fail2ban"
+  "rsweb: restart nginx php8.4-fpm redis"
+  "s: sudo -i"
+  "sas: systemd-analyze security"
+  "scanlw: scan libwrap"
+  "scurl: TLS1.3 curl"
+  "shut: shutdown -h now"
+  "ssa: systemctl status"
+  "ssf: systemctl status --failed"
+  "swget: TLS1.3 wget"
+  "sysdr: systemctl daemon-reload"
+  "syses: systemctl edit"
+  "sysp: load 99_local.hardened"
+  "sysrl: systemctl reload"
+  "sysrs: systemctl restart'"
+  "syssp: systemctl stop"
+  "sysst: systemctl start"
+  "trel: tree"
+  "usn: ufw status numbered"
+  "usv: ufw status verbose"
+  "v: nvim"
+  "whatdelete: lsof | grep deleted"
+  "whatimage: dpkg --list | grep linux"
+  "whatpurge: dpkg --get-selections"
+  "whichpackage <PROGRAM>"
+  "whichused <PATH> <DEPTH> <ENTRIES>"
+)
+
+#######################################
+# Show available Aliases
+# Globals:
+#   CMAG
+#   CRES
+#   shortcuts
+# Arguments:
+#  None
+#######################################
+celp() {
+  declare -a arr=( "${shortcuts[@]}" )
+  declare -i cols=3 col_width=42 i=0
+  declare    entry=""
+
+  for entry in "${arr[@]}"; do
+    ### Print entry left-aligned in fixed width, colored.
+    printf "${CMAG}%-${col_width}s${CRES}" "${entry}"
+    ((i++))
+    if ((i % cols == 0)); then
+      printf "\n"
+    fi
+  done
+  # If last line not full, add a newline
+  if ((i % cols != 0)); then
+    printf "\n"
+  fi
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh