msw/CISS.debian.installer
SHA256
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

V8.00.000.2025.06.17
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m39s
Details

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-08-26 21:55:09 +02:00
parent 5ce320fb37
commit 6c2a2bfd8b
3 changed files with 24 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
func/cdi_4300_network/4312_dropbear_setup.sh
View File

@@ -99,6 +99,7 @@ dropbear_setup() {
### Install the script to be called inside the initramfs environment for preparing dropbear execution.
chroot_exec "${TARGET}" mv /usr/share/initramfs-tools/scripts/init-premount/dropbear /usr/share/initramfs-tools/scripts/init-premount/dropbear.trixie
chmod 0644 "${TARGET}/usr/share/initramfs-tools/scripts/init-premount/dropbear.trixie"
install -D -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/target/usr/share/initramfs-tools/scripts/init-premount/dropbear" \
"${TARGET}/usr/share/initramfs-tools/scripts/init-premount/"
@@ -140,23 +141,9 @@ EOF
write_dropbear_conf() {
[[ -z "${dropbear_port:-}" ]] && dropbear_port="2222"
cat << EOF >| "${TARGET}/etc/dropbear/initramfs/dropbear.conf"
# SPDX-Version: 3.0
# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
# Static file system information: /etc/dropbear/dropbear.conf
# Generated by CISS.debian.installer ${VAR_VERSION}
# Architecture: ${VAR_ARCHITECTURE}
# Distribution: ${VAR_CODENAME}
insert_header "${TARGET}/etc/dropbear/initramfs/dropbear.conf"
insert_comment "${TARGET}/etc/dropbear/initramfs/dropbear.conf"
cat << EOF >> "${TARGET}/etc/dropbear/initramfs/dropbear.conf"
# Configuration options for the dropbear-initramfs boot scripts.
# Variable assignment follow shell semantics and escaping/quoting rules.
# You must run update-initramfs(8) to effect changes to this file (like

5
func/cdi_4400_hardening/4440_hardening_files.sh
View File

@@ -26,6 +26,11 @@ hardening_files() {
"${TARGET}/etc/cron.weekly"
chmod 0700 "${TARGET}/etc/sudoers.d"
chmod 0700 "${TARGET}/etc/crontab"
rm -f "${TARGET}/etc/issue" "${TARGET}/etc/issue.net"
install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/issue" "${TARGET}/etc/issue"
install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/issue.net" "${TARGET}/etc/issue.net"
guard_dir && return 0
}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

30
includes/target/etc/initramfs-tools/hooks/custom-initramfs.sh
View File

@@ -23,7 +23,7 @@ esac
# shellcheck disable=2292
if [ ! -e /etc/initramfs-tools/files/unlock_wrapper.sh ]; then
echo -e "\e[91mMissing unlock_wrapper.sh in: [/etc/initramfs-tools/files/] \e[0m"
printf "\e[91mMissing unlock_wrapper.sh in: [/etc/initramfs-tools/files/] \n\e[0m"
exit 1
fi
@@ -36,38 +36,38 @@ mkdir -p "${DESTDIR}/etc/initramfs-tools/scripts/init-premount"
### Include Bash
copy_exec /usr/bin/bash /usr/bin
echo -e "\e[92mSuccessfully executed: [copy_exec /usr/bin/bash /usr/bin] \e[0m"
printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/bash /usr/bin] \n\e[0m"
### Include Busybox
copy_exec /usr/bin/busybox /usr/bin
copy_exec /usr/bin/busybox /bin
echo -e "\e[92mSuccessfully executed: [copy_exec /usr/bin/busybox /usr/bin] \e[0m"
printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/busybox /usr/bin] \n\e[0m"
### Include lsblk (block device info tool)
copy_exec /usr/bin/lsblk /usr/bin
echo -e "\e[92mSuccessfully executed: [copy_exec /usr/bin/lsblk /usr/bin] \e[0m"
printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/lsblk /usr/bin] \n\e[0m"
### Include mkpasswd
copy_exec /usr/bin/mkpasswd /usr/bin
echo -e "\e[92mSuccessfully executed: [copy_exec /usr/bin/mkpasswd /usr/bin] \e[0m"
printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/mkpasswd /usr/bin] \n\e[0m"
### Include udevadm (udev management tool)
copy_exec /usr/bin/udevadm /usr/bin
echo -e "\e[92mSuccessfully executed: [copy_exec /usr/bin/udevadm /usr/bin] \e[0m"
printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/udevadm /usr/bin] \n\e[0m"
### Include sha512sum e.g.
copy_exec /usr/bin/sha512sum /usr/bin
echo -e "\e[92mSuccessfully executed: [copy_exec /usr/bin/sha512sum /usr/bin] \e[0m"
printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/sha512sum /usr/bin] \n\e[0m"
copy_exec /usr/bin/sha384sum /usr/bin
echo -e "\e[92mSuccessfully executed: [copy_exec /usr/bin/sha384sum /usr/bin] \e[0m"
printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/sha384sum /usr/bin] \n\e[0m"
### Include GPG
copy_exec /usr/bin/gpg /usr/bin
echo -e "\e[92mSuccessfully executed: [copy_exec /usr/bin/gpgv /usr/bin] \e[0m"
printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/gpgv /usr/bin] \n\e[0m"
### Include Whois
copy_exec /usr/bin/whois /usr/bin
echo -e "\e[92mSuccessfully executed: [copy_exec /usr/bin/whois /usr/bin] \e[0m"
printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/whois /usr/bin] \n\e[0m"
### Link busybox applets for compatibility
for dir in bin usr/bin; do
@@ -77,15 +77,15 @@ done
### Install Dropbear firewall configuration
install -m 0444 /etc/initramfs-tools/files/dropbear_fw.conf "${DESTDIR}/etc/initramfs-tools/conf.d/dropbear_fw.conf"
echo -e "\e[92mSuccessfully executed: [install -m 0444 /etc/initramfs-tools/files/dropbear_fw.conf ${DESTDIR}/etc/initramfs-tools/conf.d/dropbear_fw.conf] \e[0m"
printf "\e[92mSuccessfully executed: [install -m 0444 /etc/initramfs-tools/files/dropbear_fw.conf %s/etc/initramfs-tools/conf.d/dropbear_fw.conf] \n\e[0m" "${DESTDIR}"
### Install Dropbear configuration
install -m 0444 /etc/dropbear/initramfs/dropbear.conf "${DESTDIR}/etc/dropbear/dropbear.conf"
echo -e "\e[92mSuccessfully executed: [install -m 0444 /etc/dropbear/initramfs/dropbear.conf ${DESTDIR}/etc/dropbear/dropbear.conf] \e[0m"
printf "\e[92mSuccessfully executed: [install -m 0444 /etc/dropbear/initramfs/dropbear.conf %s/etc/dropbear/dropbear.conf] \n\e[0m" "${DESTDIR}"
### Install Dropbear Cryptroot Unlock Wrapper
install -m 0555 /etc/initramfs-tools/files/unlock_wrapper.sh "${DESTDIR}/usr/local/bin/unlock_wrapper.sh"
echo -e "\e[92mSuccessfully executed: [install -m 0555 /etc/initramfs-tools/files/unlock_wrapper.sh ${DESTDIR}/usr/local/bin/unlock_wrapper.sh] \e[0m"
printf "\e[92mSuccessfully executed: [install -m 0555 /etc/initramfs-tools/files/unlock_wrapper.sh %s/usr/local/bin/unlock_wrapper.sh] \n\e[0m" "${DESTDIR}"
# TODO: Update preseed.yaml for pgp signing key AND / OR implementation of presigned unlock_wrapper.sh
#install -m 0444 /etc/initramfs-tools/files/unlock_wrapper.sh.sha384 "${DESTDIR}/usr/local/bin/unlock_wrapper.sh.sha384"
#install -m 0444 /etc/initramfs-tools/files/unlock_wrapper.sh.sha512 "${DESTDIR}/usr/local/bin/unlock_wrapper.sh.sha512"
@@ -97,8 +97,8 @@ echo -e "\e[92mSuccessfully executed: [install -m 0555 /etc/initramfs-tools/file
### Install Dropbear Banner
install -m 0444 /etc/dropbear/initramfs/banner "${DESTDIR}/etc/dropbear/banner"
echo -e "\e[92mSuccessfully executed: [install -m 0444 /etc/dropbear/initramfs/banner ${DESTDIR}/etc/dropbear/banner] \e[0m"
printf "\e[92mSuccessfully executed: [install -m 0444 /etc/dropbear/initramfs/banner %s/etc/dropbear/banner] \n\e[0m" "${DESTDIR}"
echo -e "\e[92mSuccessfully executed: [/etc/initramfs-tools/hooks/custom-initramfs.sh] \e[0m"
printf "\e[92mSuccessfully executed: [/etc/initramfs-tools/hooks/custom-initramfs.sh] \n\e[0m"
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh