V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

func/cdi_4300_network/4312_dropbear_setup.sh

@@ -99,6 +99,7 @@ dropbear_setup() {
 
   ### Install the script to be called inside the initramfs environment for preparing dropbear execution.
   chroot_exec "${TARGET}" mv /usr/share/initramfs-tools/scripts/init-premount/dropbear /usr/share/initramfs-tools/scripts/init-premount/dropbear.trixie
+  chmod 0644 "${TARGET}/usr/share/initramfs-tools/scripts/init-premount/dropbear.trixie"
   install -D -m 0755 -o root -g root "${VAR_SETUP_PATH}/includes/target/usr/share/initramfs-tools/scripts/init-premount/dropbear" \
     "${TARGET}/usr/share/initramfs-tools/scripts/init-premount/"
 
@@ -140,23 +141,9 @@ EOF
 write_dropbear_conf() {
   [[ -z "${dropbear_port:-}" ]] && dropbear_port="2222"
 
-  cat << EOF >| "${TARGET}/etc/dropbear/initramfs/dropbear.conf"
+  insert_header "${TARGET}/etc/dropbear/initramfs/dropbear.conf"
-# SPDX-Version: 3.0
+  insert_comment "${TARGET}/etc/dropbear/initramfs/dropbear.conf"
-# SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
+  cat << EOF >> "${TARGET}/etc/dropbear/initramfs/dropbear.conf"
-# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
-# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
-# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
-# SPDX-FileType: SOURCE
-# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
-# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
-# SPDX-PackageName: CISS.debian.installer
-# SPDX-Security-Contact: security@coresecret.eu
-
-# Static file system information: /etc/dropbear/dropbear.conf
-# Generated by CISS.debian.installer ${VAR_VERSION}
-# Architecture: ${VAR_ARCHITECTURE}
-# Distribution: ${VAR_CODENAME}
-
 # Configuration options for the dropbear-initramfs boot scripts.
 # Variable assignment follow shell semantics and escaping/quoting rules.
 # You must run update-initramfs(8) to effect changes to this file (like

func/cdi_4400_hardening/4440_hardening_files.sh

@@ -26,6 +26,11 @@ hardening_files() {
              "${TARGET}/etc/cron.weekly"
   chmod 0700 "${TARGET}/etc/sudoers.d"
   chmod 0700 "${TARGET}/etc/crontab"
+
+  rm -f "${TARGET}/etc/issue" "${TARGET}/etc/issue.net"
+  install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/issue" "${TARGET}/etc/issue"
+  install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/issue.net" "${TARGET}/etc/issue.net"
+
   guard_dir && return 0
 }
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

includes/target/etc/initramfs-tools/hooks/custom-initramfs.sh

@@ -23,7 +23,7 @@ esac
 
 # shellcheck disable=2292
 if [ ! -e /etc/initramfs-tools/files/unlock_wrapper.sh ]; then
-  echo -e "\e[91mMissing unlock_wrapper.sh in: [/etc/initramfs-tools/files/] \e[0m"
+  printf "\e[91mMissing unlock_wrapper.sh in: [/etc/initramfs-tools/files/] \n\e[0m"
   exit 1
 fi
 
@@ -36,38 +36,38 @@ mkdir -p "${DESTDIR}/etc/initramfs-tools/scripts/init-premount"
 
 ### Include Bash
 copy_exec /usr/bin/bash /usr/bin
-echo -e "\e[92mSuccessfully executed: [copy_exec /usr/bin/bash /usr/bin] \e[0m"
+printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/bash /usr/bin] \n\e[0m"
 
 ### Include Busybox
 copy_exec /usr/bin/busybox /usr/bin
 copy_exec /usr/bin/busybox /bin
-echo -e "\e[92mSuccessfully executed: [copy_exec /usr/bin/busybox /usr/bin] \e[0m"
+printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/busybox /usr/bin] \n\e[0m"
 
 ### Include lsblk (block device info tool)
 copy_exec /usr/bin/lsblk /usr/bin
-echo -e "\e[92mSuccessfully executed: [copy_exec /usr/bin/lsblk /usr/bin] \e[0m"
+printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/lsblk /usr/bin] \n\e[0m"
 
 ### Include mkpasswd
 copy_exec /usr/bin/mkpasswd /usr/bin
-echo -e "\e[92mSuccessfully executed: [copy_exec /usr/bin/mkpasswd /usr/bin] \e[0m"
+printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/mkpasswd /usr/bin] \n\e[0m"
 
 ### Include udevadm (udev management tool)
 copy_exec /usr/bin/udevadm /usr/bin
-echo -e "\e[92mSuccessfully executed: [copy_exec /usr/bin/udevadm /usr/bin] \e[0m"
+printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/udevadm /usr/bin] \n\e[0m"
 
 ### Include sha512sum e.g.
 copy_exec /usr/bin/sha512sum /usr/bin
-echo -e "\e[92mSuccessfully executed: [copy_exec /usr/bin/sha512sum /usr/bin] \e[0m"
+printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/sha512sum /usr/bin] \n\e[0m"
 copy_exec /usr/bin/sha384sum /usr/bin
-echo -e "\e[92mSuccessfully executed: [copy_exec /usr/bin/sha384sum /usr/bin] \e[0m"
+printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/sha384sum /usr/bin] \n\e[0m"
 
 ### Include GPG
 copy_exec /usr/bin/gpg /usr/bin
-echo -e "\e[92mSuccessfully executed: [copy_exec /usr/bin/gpgv /usr/bin] \e[0m"
+printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/gpgv /usr/bin] \n\e[0m"
 
 ### Include Whois
 copy_exec /usr/bin/whois /usr/bin
-echo -e "\e[92mSuccessfully executed: [copy_exec /usr/bin/whois /usr/bin] \e[0m"
+printf "\e[92mSuccessfully executed: [copy_exec /usr/bin/whois /usr/bin] \n\e[0m"
 
 ### Link busybox applets for compatibility
 for dir in bin usr/bin; do
@@ -77,15 +77,15 @@ done
 
 ### Install Dropbear firewall configuration
 install -m 0444 /etc/initramfs-tools/files/dropbear_fw.conf "${DESTDIR}/etc/initramfs-tools/conf.d/dropbear_fw.conf"
-echo -e "\e[92mSuccessfully executed: [install -m 0444 /etc/initramfs-tools/files/dropbear_fw.conf ${DESTDIR}/etc/initramfs-tools/conf.d/dropbear_fw.conf] \e[0m"
+printf "\e[92mSuccessfully executed: [install -m 0444 /etc/initramfs-tools/files/dropbear_fw.conf %s/etc/initramfs-tools/conf.d/dropbear_fw.conf] \n\e[0m" "${DESTDIR}"
 
 ### Install Dropbear configuration
 install -m 0444 /etc/dropbear/initramfs/dropbear.conf "${DESTDIR}/etc/dropbear/dropbear.conf"
-echo -e "\e[92mSuccessfully executed: [install -m 0444 /etc/dropbear/initramfs/dropbear.conf ${DESTDIR}/etc/dropbear/dropbear.conf] \e[0m"
+printf "\e[92mSuccessfully executed: [install -m 0444 /etc/dropbear/initramfs/dropbear.conf %s/etc/dropbear/dropbear.conf] \n\e[0m" "${DESTDIR}"
 
 ### Install Dropbear Cryptroot Unlock Wrapper
 install -m 0555 /etc/initramfs-tools/files/unlock_wrapper.sh "${DESTDIR}/usr/local/bin/unlock_wrapper.sh"
-echo -e "\e[92mSuccessfully executed: [install -m 0555 /etc/initramfs-tools/files/unlock_wrapper.sh ${DESTDIR}/usr/local/bin/unlock_wrapper.sh] \e[0m"
+printf "\e[92mSuccessfully executed: [install -m 0555 /etc/initramfs-tools/files/unlock_wrapper.sh %s/usr/local/bin/unlock_wrapper.sh] \n\e[0m" "${DESTDIR}"
 # TODO: Update preseed.yaml for pgp signing key AND / OR implementation of presigned unlock_wrapper.sh
 #install -m 0444 /etc/initramfs-tools/files/unlock_wrapper.sh.sha384 "${DESTDIR}/usr/local/bin/unlock_wrapper.sh.sha384"
 #install -m 0444 /etc/initramfs-tools/files/unlock_wrapper.sh.sha512 "${DESTDIR}/usr/local/bin/unlock_wrapper.sh.sha512"
@@ -97,8 +97,8 @@ echo -e "\e[92mSuccessfully executed: [install -m 0555 /etc/initramfs-tools/file
 
 ### Install Dropbear Banner
 install -m 0444 /etc/dropbear/initramfs/banner "${DESTDIR}/etc/dropbear/banner"
-echo -e "\e[92mSuccessfully executed: [install -m 0444 /etc/dropbear/initramfs/banner ${DESTDIR}/etc/dropbear/banner] \e[0m"
+printf "\e[92mSuccessfully executed: [install -m 0444 /etc/dropbear/initramfs/banner %s/etc/dropbear/banner] \n\e[0m" "${DESTDIR}"
 
-echo -e "\e[92mSuccessfully executed: [/etc/initramfs-tools/hooks/custom-initramfs.sh] \e[0m"
+printf "\e[92mSuccessfully executed: [/etc/initramfs-tools/hooks/custom-initramfs.sh] \n\e[0m"
 
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh