msw/CISS.debian.installer
SHA256
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

V9.14.002.2026.06.08

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2026-06-08 15:21:48 +01:00
parent 830aa1afa7
commit 925cdae81c
38 changed files with 114 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/ISSUE_TEMPLATE/ISSUE_TEMPLATE.yaml
+1 -1
View File
@@ -25,7 +25,7 @@ body:
attributes: attributes:
label: "Version" label: "Version"
description: "Which version are you running? Use `./setup.sh -v`." description: "Which version are you running? Use `./setup.sh -v`."
placeholder: "e.g., Master V9.14.000.2026.06.07" placeholder: "e.g., Master V9.14.002.2026.06.08"
validations: validations:
required: true required: true
.gitea/trigger/t_generate_dns.yaml
+1 -1
View File
@@ -11,5 +11,5 @@
build: build:
counter: 1023 counter: 1023
version: V9.14.000.2026.06.07 version: V9.14.002.2026.06.08
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml
.gitea/workflows/linter_char_scripts.yaml
+1 -1
View File
@@ -9,7 +9,7 @@
# SPDX-PackageName: CISS.debian.installer # SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
### Version Master V9.14.000.2026.06.07 ### Version Master V9.14.002.2026.06.08
# Gitea Workflow: Shell-Script Linting # Gitea Workflow: Shell-Script Linting
# #
.gitea/workflows/render-dnssec-status.yaml
+1 -1
View File
@@ -9,7 +9,7 @@
# SPDX-PackageName: CISS.debian.installer # SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
### Version Master V9.14.000.2026.06.07 ### Version Master V9.14.002.2026.06.08
name: 🛡️ Retrieve DNSSEC status of coresecret.dev. name: 🛡️ Retrieve DNSSEC status of coresecret.dev.
.gitea/workflows/render-dot-to-png.yaml
+1 -1
View File
@@ -9,7 +9,7 @@
# SPDX-PackageName: CISS.debian.installer # SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
### Version Master V9.14.000.2026.06.07 ### Version Master V9.14.002.2026.06.08
name: 🔁 Render Graphviz Diagrams. name: 🔁 Render Graphviz Diagrams.
.preseed/SECRETS.yaml
+2 -2
View File
@@ -11,7 +11,7 @@
# #
# #
# This file contains all required Secrets, Tokens and Public and Private Keys for the CISS.debian.installer # This file contains all required Secrets, Tokens and Public and Private Keys for the CISS.debian.installer
# Master V9.14.000.2026.06.07 # Master V9.14.002.2026.06.08
# YAML specification: 1.2 # YAML specification: 1.2
# #
secrets: secrets:
@@ -19,7 +19,7 @@ secrets:
created_at: "2025-10-23" created_at: "2025-10-23"
created_for: "host_domain_tld" created_for: "host_domain_tld"
name: "CISS.debian.installer" name: "CISS.debian.installer"
version: "V9.14.000.2026.06.07" version: "V9.14.002.2026.06.08"
x_files: "false" x_files: "false"
################################################################################################################################ ################################################################################################################################
# Grub bootloader passphrase # Grub bootloader passphrase
.preseed/preseed.yaml
+4 -4
View File
@@ -11,7 +11,7 @@
%YAML 1.2 %YAML 1.2
--- ---
# This file contains configurations for the CISS.debian.installer # This file contains configurations for the CISS.debian.installer
# Master V9.14.000.2026.06.07 # Master V9.14.002.2026.06.08
# YAML specification: 1.2 # YAML specification: 1.2
# #
preseed: preseed:
@@ -19,7 +19,7 @@ preseed:
created_at: "2025-10-23" created_at: "2025-10-23"
created_for: "host_domain_tld" created_for: "host_domain_tld"
name: "CISS.debian.installer" name: "CISS.debian.installer"
version: "V9.14.000.2026.06.07" version: "V9.14.002.2026.06.08"
# #
################################################################################################################################ ################################################################################################################################
# APT settings # APT settings
@@ -28,7 +28,7 @@ apt:
contrib: true # Optionally, install contrib software. contrib: true # Optionally, install contrib software.
deb_sources: true # Optionally includes deb-src entries for source repositories. deb_sources: true # Optionally includes deb-src entries for source repositories.
default_list: false # By default, source repositories are listed in '/etc/apt/sources.list'. default_list: false # By default, source repositories are listed in '/etc/apt/sources.list'.
default_deb822: true # Since Trixie, source repositories are listed in '/etc/apt/sources.list.d/' in deb.822 format. default_deb822: true # Since Trixie, source repositories have been listed in '/etc/apt/sources.list.d/' in deb.822 format.
full_upgrade: true # Whether to upgrade packages after debootstrap. full_upgrade: true # Whether to upgrade packages after debootstrap.
install_recommends: true # Configure APT to not install recommended packages by default. install_recommends: true # Configure APT to not install recommended packages by default.
non_free: true # Optionally, install non-free software. non_free: true # Optionally, install non-free software.
@@ -262,7 +262,7 @@ grub_parameter:
############################################################################################################################## ##############################################################################################################################
# All Kernel Messages with a loglevel smaller than the console loglevel will be printed to the console. It can also be # All Kernel Messages with a loglevel smaller than the console loglevel will be printed to the console. It can also be
# changed with 'klogd' or other programs. The log levels are defined as follows: # changed with 'klogd' or other programs. The log levels are defined as follows:
# 0 (KERN_EMERG) system is unusable # 0 (KERN_EMERG) the system is unusable
# 1 (KERN_ALERT) action must be taken immediately # 1 (KERN_ALERT) action must be taken immediately
# 2 (KERN_CRIT) critical conditions # 2 (KERN_CRIT) critical conditions
# 3 (KERN_ERR) error conditions # 3 (KERN_ERR) error conditions
.version.properties
+1 -1
View File
@@ -15,5 +15,5 @@ properties_SPDX-License-Identifier="EUPL-1.2 OR LicenseRef-CCLA-1.0"
properties_SPDX-LicenseComment="This file is part of the CISS.debian.installer.secure framework." properties_SPDX-LicenseComment="This file is part of the CISS.debian.installer.secure framework."
properties_SPDX-PackageName="CISS.debian.installer" properties_SPDX-PackageName="CISS.debian.installer"
properties_SPDX-Security-Contact="security@coresecret.eu" properties_SPDX-Security-Contact="security@coresecret.eu"
properties_version="V9.14.000.2026.06.07" properties_version="V9.14.002.2026.06.08"
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
CISS.debian.installer.spdx
+1 -1
View File
@@ -6,7 +6,7 @@ Creator: Person: Marc S. Weidner (Centurion Intelligence Consulting Agency)
Created: 2025-06-17T12:00:00Z Created: 2025-06-17T12:00:00Z
Package: CISS.debian.installer Package: CISS.debian.installer
PackageName: CISS.debian.installer PackageName: CISS.debian.installer
PackageVersion: Master V9.14.000.2026.06.07 PackageVersion: Master V9.14.002.2026.06.08
PackageSupplier: Organization: Centurion Intelligence Consulting Agency PackageSupplier: Organization: Centurion Intelligence Consulting Agency
PackageDownloadLocation: https://git.coresecret.dev/msw/CISS.debian.installer PackageDownloadLocation: https://git.coresecret.dev/msw/CISS.debian.installer
PackageHomePage: https://git.coresecret.dev/msw/CISS.debian.installer PackageHomePage: https://git.coresecret.dev/msw/CISS.debian.installer
README.md
+2 -2
View File
@@ -2,7 +2,7 @@
gitea: none gitea: none
include_toc: true include_toc: true
--- ---
[![Static Badge](https://badges.coresecret.dev/badge/Release-V9.14.000.2026.06.07-white?style=plastic&logo=linux&logoColor=white&logoSize=auto&label=Release&color=%23FCC624)](https://git.coresecret.dev/msw/CISS.debian.installer) [![Static Badge](https://badges.coresecret.dev/badge/Release-V9.14.002.2026.06.08-white?style=plastic&logo=linux&logoColor=white&logoSize=auto&label=Release&color=%23FCC624)](https://git.coresecret.dev/msw/CISS.debian.installer)
&nbsp; &nbsp;
[![Static Badge](https://badges.coresecret.dev/badge/Licence-EUPL1.2-white?style=plastic&logo=europeanunion&logoColor=white&logoSize=auto&label=Licence&color=%23003399)](https://eupl.eu/1.2/en/) &nbsp; [![Static Badge](https://badges.coresecret.dev/badge/Licence-EUPL1.2-white?style=plastic&logo=europeanunion&logoColor=white&logoSize=auto&label=Licence&color=%23003399)](https://eupl.eu/1.2/en/) &nbsp;
[![Static Badge](https://badges.coresecret.dev/badge/opensourceinitiative-Compliant-white?style=plastic&logo=opensourceinitiative&logoColor=white&logoSize=auto&label=OSI&color=%233DA639)](https://opensource.org/license/eupl-1-2) &nbsp; [![Static Badge](https://badges.coresecret.dev/badge/opensourceinitiative-Compliant-white?style=plastic&logo=opensourceinitiative&logoColor=white&logoSize=auto&label=OSI&color=%233DA639)](https://opensource.org/license/eupl-1-2) &nbsp;
@@ -27,7 +27,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*The CISS Debian Installer provides a fully automated and hardened installation process.*<br> *The CISS Debian Installer provides a fully automated and hardened installation process.*<br>
**Master Version**: 9.00<br> **Master Version**: 9.00<br>
**Build**: V9.14.000.2026.06.07<br> **Build**: V9.14.002.2026.06.08<br>
This is a digitally signed, self-verifying shell script for installing a hardened Debian Bookworm server environment, based on This is a digitally signed, self-verifying shell script for installing a hardened Debian Bookworm server environment, based on
the latest server and service hardening best practices. Compared to the original Debian installer, this installer offers much the latest server and service hardening best practices. Compared to the original Debian installer, this installer offers much
docs/AUDIT_DNSSEC.md
+1 -1
View File
@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*The CISS Debian Installer provides a fully automated and hardened installation process.*<br> *The CISS Debian Installer provides a fully automated and hardened installation process.*<br>
**Master Version**: 9.00<br> **Master Version**: 9.00<br>
**Build**: V9.14.000.2026.06.07<br> **Build**: V9.14.002.2026.06.08<br>
# 2. DNSSEC Status # 2. DNSSEC Status
docs/AUDIT_TLS.md
+1 -1
View File
@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*The CISS Debian Installer provides a fully automated and hardened installation process.*<br> *The CISS Debian Installer provides a fully automated and hardened installation process.*<br>
**Master Version**: 9.00<br> **Master Version**: 9.00<br>
**Build**: V9.14.000.2026.06.07<br> **Build**: V9.14.002.2026.06.08<br>
# 2. TLS Audit: # 2. TLS Audit:
docs/CHANGELOG.md
+2 -2
View File
@@ -8,11 +8,11 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*The CISS Debian Installer provides a fully automated and hardened installation process.*<br> *The CISS Debian Installer provides a fully automated and hardened installation process.*<br>
**Master Version**: 9.00<br> **Master Version**: 9.00<br>
**Build**: V9.14.000.2026.06.07<br> **Build**: V9.14.002.2026.06.08<br>
# 2. Changelog # 2. Changelog
## V9.14.000.2026.06.07 ## V9.14.002.2026.06.08
* Initial Release * Initial Release
docs/CNET.md
+1 -1
View File
@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*The CISS Debian Installer provides a fully automated and hardened installation process.*<br> *The CISS Debian Installer provides a fully automated and hardened installation process.*<br>
**Master Version**: 9.00<br> **Master Version**: 9.00<br>
**Build**: V9.14.000.2026.06.07<br> **Build**: V9.14.002.2026.06.08<br>
# 2. Centurion Net - Developer Branch Overview # 2. Centurion Net - Developer Branch Overview
docs/CODING_CONVENTION.md
+1 -1
View File
@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*The CISS Debian Installer provides a fully automated and hardened installation process.*<br> *The CISS Debian Installer provides a fully automated and hardened installation process.*<br>
**Master Version**: 9.00<br> **Master Version**: 9.00<br>
**Build**: V9.14.000.2026.06.07<br> **Build**: V9.14.002.2026.06.08<br>
# 2. Purpose # 2. Purpose
docs/CONTRIBUTING.md
+1 -1
View File
@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*The CISS Debian Installer provides a fully automated and hardened installation process.*<br> *The CISS Debian Installer provides a fully automated and hardened installation process.*<br>
**Master Version**: 9.00<br> **Master Version**: 9.00<br>
**Build**: V9.14.000.2026.06.07<br> **Build**: V9.14.002.2026.06.08<br>
# 2. Contributing / participating # 2. Contributing / participating
docs/CREDITS.md
+1 -1
View File
@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*The CISS Debian Installer provides a fully automated and hardened installation process.*<br> *The CISS Debian Installer provides a fully automated and hardened installation process.*<br>
**Master Version**: 9.00<br> **Master Version**: 9.00<br>
**Build**: V9.14.000.2026.06.07<br> **Build**: V9.14.002.2026.06.08<br>
# 2. Credits # 2. Credits
docs/DOCUMENTATION.md
+9 -4
View File
@@ -8,15 +8,15 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*The CISS Debian Installer provides a fully automated and hardened installation process.*<br> *The CISS Debian Installer provides a fully automated and hardened installation process.*<br>
**Master Version**: 9.00<br> **Master Version**: 9.00<br>
**Build**: V9.14.000.2026.06.07<br> **Build**: V9.14.002.2026.06.08<br>
# 2. Usage # 2. Usage
````text ````text
CISS.debian.installer CISS.debian.installer
Master V9.14.000.2026.06.07 Master V9.14.002.2026.06.08
(c) Marc S. Weidner, 2018 - 2025 (c) Marc S. Weidner, 2018 - 2026
(p) Centurion Press, 2024 - 2025 (p) Centurion Press, 2024 - 2026
https://coresecret.eu/ https://coresecret.eu/
@@ -34,6 +34,11 @@ A powerful Debian installer for setting up a hardened Debian environment.
Enables debug logging for the main program routine. Detailed logging Enables debug logging for the main program routine. Detailed logging
information are written to "/tmp/ciss_live_builder_516151.log" information are written to "/tmp/ciss_live_builder_516151.log"
--dropbear-version <YYYY>.<NUMBER>
Sets the Dropbear source version used for the hardened Dropbear build.
Also accepts "--dropbear-version=<YYYY>.<NUMBER>".
Defaults to "2026.91".
--renice-priority <PRIORITY> --renice-priority <PRIORITY>
Reset the nice priority value of the script and all its children Reset the nice priority value of the script and all its children
to the desired PRIORITY. MUST be an integer (between "-19" and 19). to the desired PRIORITY. MUST be an integer (between "-19" and 19).
docs/MANPAGES.md
+1 -1
View File
@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*The CISS Debian Installer provides a fully automated and hardened installation process.*<br> *The CISS Debian Installer provides a fully automated and hardened installation process.*<br>
**Master Version**: 9.00<br> **Master Version**: 9.00<br>
**Build**: V9.14.000.2026.06.07<br> **Build**: V9.14.002.2026.06.08<br>
# 2. ToC # 2. ToC
docs/REFERENCES.md
+1 -1
View File
@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*The CISS Debian Installer provides a fully automated and hardened installation process.*<br> *The CISS Debian Installer provides a fully automated and hardened installation process.*<br>
**Master Version**: 9.00<br> **Master Version**: 9.00<br>
**Build**: V9.14.000.2026.06.07<br> **Build**: V9.14.002.2026.06.08<br>
# 2. Resources # 2. Resources
docs/man/BOOTPARAMS.md
+1 -1
View File
@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*The CISS Debian Installer provides a fully automated and hardened installation process.*<br> *The CISS Debian Installer provides a fully automated and hardened installation process.*<br>
**Master Version**: 9.00<br> **Master Version**: 9.00<br>
**Build**: V9.14.000.2026.06.07<br> **Build**: V9.14.002.2026.06.08<br>
# 2. Hardened Kernel Boot Parameters # 2. Hardened Kernel Boot Parameters
docs/man/DEBUG_HANDLING.md
+1 -1
View File
@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*The CISS Debian Installer provides a fully automated and hardened installation process.*<br> *The CISS Debian Installer provides a fully automated and hardened installation process.*<br>
**Master Version**: 9.00<br> **Master Version**: 9.00<br>
**Build**: V9.14.000.2026.06.07<br> **Build**: V9.14.002.2026.06.08<br>
# 2. Debugging and Tracing Infrastructure # 2. Debugging and Tracing Infrastructure
docs/man/ERROR_HANDLING.md
+1 -1
View File
@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*The CISS Debian Installer provides a fully automated and hardened installation process.*<br> *The CISS Debian Installer provides a fully automated and hardened installation process.*<br>
**Master Version**: 9.00<br> **Master Version**: 9.00<br>
**Build**: V9.14.000.2026.06.07<br> **Build**: V9.14.002.2026.06.08<br>
# 2. Global Environment and Error Handling in CISS.debian.installer # 2. Global Environment and Error Handling in CISS.debian.installer
docs/man/LINTER_CHAR.md
+1 -1
View File
@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*The CISS Debian Installer provides a fully automated and hardened installation process.*<br> *The CISS Debian Installer provides a fully automated and hardened installation process.*<br>
**Master Version**: 9.00<br> **Master Version**: 9.00<br>
**Build**: V9.14.000.2026.06.07<br> **Build**: V9.14.002.2026.06.08<br>
# 2. Git Workflow Linter — Character Set Policy Enforcement # 2. Git Workflow Linter — Character Set Policy Enforcement
docs/man/TRAP_MECHANISM.md
+1 -1
View File
@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*The CISS Debian Installer provides a fully automated and hardened installation process.*<br> *The CISS Debian Installer provides a fully automated and hardened installation process.*<br>
**Master Version**: 9.00<br> **Master Version**: 9.00<br>
**Build**: V9.14.000.2026.06.07<br> **Build**: V9.14.002.2026.06.08<br>
# 2. Interplay Between Global Hardening Settings and TRAP Mechanisms # 2. Interplay Between Global Hardening Settings and TRAP Mechanisms
func/cdi_1000_helper/README/README_1080.md
+1 -1
View File
@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*The CISS Debian Installer provides a fully automated and hardened installation process.*<br> *The CISS Debian Installer provides a fully automated and hardened installation process.*<br>
**Master Version**: 9.00<br> **Master Version**: 9.00<br>
**Build**: V9.14.000.2026.06.07<br> **Build**: V9.14.002.2026.06.08<br>
# 2. [1080_helper_chroot.sh](../1080_helper_chroot.sh) # 2. [1080_helper_chroot.sh](../1080_helper_chroot.sh)
**Scope:** This note explains *what to use when* among **Scope:** This note explains *what to use when* among
func/cdi_4000_debootstrap/README/README_4000.md
+1 -1
View File
@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*The CISS Debian Installer provides a fully automated and hardened installation process.*<br> *The CISS Debian Installer provides a fully automated and hardened installation process.*<br>
**Master Version**: 9.00<br> **Master Version**: 9.00<br>
**Build**: V9.14.000.2026.06.07<br> **Build**: V9.14.002.2026.06.08<br>
# 2. [4000_debootstrap.sh](../4000_debootstrap.sh) # 2. [4000_debootstrap.sh](../4000_debootstrap.sh)
This module provisions a minimal Debian userspace into the installers target root (`$TARGET`) using `debootstrap`. This module provisions a minimal Debian userspace into the installers target root (`$TARGET`) using `debootstrap`.
func/cdi_4300_network/4310_dropbear_build.sh
+7 -5
View File
@@ -15,7 +15,10 @@ guard_sourcing || return "${ERR_GUARD_SOURCE}"
####################################### #######################################
# Build Ultra Hardened dropbear from sources. # Build Ultra Hardened dropbear from sources.
# Globals: # Globals:
# PATH
# TARGET # TARGET
# VAR_DROPBEAR_BUILD_ROOT
# VAR_DROPBEAR_VERSION
# VAR_SETUP_PATH # VAR_SETUP_PATH
# Arguments: # Arguments:
# None # None
@@ -27,10 +30,9 @@ guard_sourcing || return "${ERR_GUARD_SOURCE}"
####################################### #######################################
dropbear_build() { dropbear_build() {
### Declare Arrays, HashMaps, and Variables. ### Declare Arrays, HashMaps, and Variables.
declare var_dropbear_version="2026.91" declare -r var_tar="${VAR_SETUP_PATH}/upgrades/dropbear/dropbear-${VAR_DROPBEAR_VERSION}.tar.bz2"
declare var_tar="${VAR_SETUP_PATH}/upgrades/dropbear/dropbear-${var_dropbear_version}.tar.bz2" declare -r var_build_root="${VAR_DROPBEAR_BUILD_ROOT}"
declare var_build_root="/opt/.ciss/build" declare -r var_build_dir="${var_build_root}/dropbear-${VAR_DROPBEAR_VERSION}"
declare var_build_dir="${var_build_root}/dropbear-${var_dropbear_version}"
declare -r var_logfile="/root/.ciss/cdi/log/4310_dropbear_build.log" declare -r var_logfile="/root/.ciss/cdi/log/4310_dropbear_build.log"
declare -r var_build_log="${TARGET}${var_logfile}" declare -r var_build_log="${TARGET}${var_logfile}"
declare -r var_build_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" declare -r var_build_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
@@ -49,7 +51,7 @@ dropbear_build() {
fi fi
case "${var_build_dir}" in case "${var_build_dir}" in
/opt/.ciss/build/dropbear-*) ;; "${VAR_DROPBEAR_BUILD_ROOT}"/dropbear-*) ;;
*) *)
do_log "error" "file_only" "4310() Refusing to clean unexpected Dropbear build directory: '${var_build_dir}'." do_log "error" "file_only" "4310() Refusing to clean unexpected Dropbear build directory: '${var_build_dir}'."
return "${ERR_PATH_NOT_VALID}" return "${ERR_PATH_NOT_VALID}"
func/cdi_4300_network/4311_dropbear_initramfs.sh
+20 -3
View File
@@ -15,9 +15,10 @@ guard_sourcing || return "${ERR_GUARD_SOURCE}"
####################################### #######################################
# Install the 'dropbear-initramfs' and replace the binaries with those from the previous Ultra Hardened build. # Install the 'dropbear-initramfs' and replace the binaries with those from the previous Ultra Hardened build.
# Globals: # Globals:
# DIR_TMP
# RECOVERY # RECOVERY
# TARGET # TARGET
# VAR_DROPBEAR_BUILD_ROOT
# VAR_DROPBEAR_VERSION
# VAR_RUN_RECOVERY # VAR_RUN_RECOVERY
# Arguments: # Arguments:
# None # None
@@ -27,6 +28,7 @@ guard_sourcing || return "${ERR_GUARD_SOURCE}"
dropbear_initramfs() { dropbear_initramfs() {
### Declare Arrays, HashMaps, and Variables. ### Declare Arrays, HashMaps, and Variables.
declare var_file="" declare var_file=""
declare -r var_build_dir="${VAR_DROPBEAR_BUILD_ROOT}/dropbear-${VAR_DROPBEAR_VERSION}"
declare -r var_logfile="/root/.ciss/cdi/log/4311_dropbear_initramfs.log" declare -r var_logfile="/root/.ciss/cdi/log/4311_dropbear_initramfs.log"
declare var_target="${TARGET}" declare var_target="${TARGET}"
@@ -35,6 +37,21 @@ dropbear_initramfs() {
chroot_logger "${var_target}${var_logfile}" chroot_logger "${var_target}${var_logfile}"
case "${var_build_dir}" in
"${VAR_DROPBEAR_BUILD_ROOT}"/dropbear-*) ;;
*)
do_log "error" "file_only" "4311() Refusing unexpected Dropbear build directory: '${var_build_dir}'."
return "${ERR_PATH_NOT_VALID}"
;;
esac
for var_file in dropbear dbclient dropbearconvert dropbearkey; do
if [[ ! -x "${var_build_dir}/${var_file}" ]]; then
do_log "error" "file_only" "4311() Dropbear build artifact missing or not executable: '${var_build_dir}/${var_file}'."
return "${ERR_PATH_NOT_VALID}"
fi
done
chroot_script "${var_target}" " chroot_script "${var_target}" "
export INITRD=No export INITRD=No
[[ -r /root/ciss_xdg_tmp.sh ]] && . /root/ciss_xdg_tmp.sh [[ -r /root/ciss_xdg_tmp.sh ]] && . /root/ciss_xdg_tmp.sh
@@ -60,14 +77,14 @@ dropbear_initramfs() {
" "
mv "${var_target}/usr/sbin/dropbear" "${var_target}/usr/sbin/dropbear.trixie" mv "${var_target}/usr/sbin/dropbear" "${var_target}/usr/sbin/dropbear.trixie"
install -D -m 0755 -o root -g root "${DIR_TMP}/build/dropbear-2025.88/dropbear" "${var_target}/usr/sbin/" install -D -m 0755 -o root -g root "${var_build_dir}/dropbear" "${var_target}/usr/sbin/"
do_log "debug" "file_only" "4311() Installation [dropbear] successful." do_log "debug" "file_only" "4311() Installation [dropbear] successful."
for var_file in dbclient dropbearconvert dropbearkey; do for var_file in dbclient dropbearconvert dropbearkey; do
mv "${var_target}/usr/bin/${var_file}" "${var_target}/usr/bin/${var_file}.trixie" mv "${var_target}/usr/bin/${var_file}" "${var_target}/usr/bin/${var_file}.trixie"
install -D -m 0755 -o root -g root "${DIR_TMP}/build/dropbear-2025.88/${var_file}" "${var_target}/usr/bin/" install -D -m 0755 -o root -g root "${var_build_dir}/${var_file}" "${var_target}/usr/bin/"
do_log "debug" "file_only" "4311() Installation [${var_file}] successful." do_log "debug" "file_only" "4311() Installation [${var_file}] successful."
done done
lib/cdi_0000_preliminary/0002_usage.sh
+10 -4
View File
@@ -37,9 +37,9 @@ usage() {
declare var_cols=$(tput cols 2> /dev/null || echo 80) declare var_cols=$(tput cols 2> /dev/null || echo 80)
# shellcheck disable=SC2155 # shellcheck disable=SC2155
declare var_header=$(center "V9.14.000.2026.06.07 CISS.debian.installer" "${var_cols}") declare var_header=$(center "V9.14.002.2026.06.08 CISS.debian.installer" "${var_cols}")
# shellcheck disable=SC2155 # shellcheck disable=SC2155
declare var_footer=$(center "V9.14.000.2026.06.07 CISS.debian.installer" "${var_cols}") declare var_footer=$(center "V9.14.002.2026.06.08 CISS.debian.installer" "${var_cols}")
{ {
echo -e "\e[97m${var_header} \e[0m" echo -e "\e[97m${var_header} \e[0m"
@@ -48,8 +48,8 @@ usage() {
echo -e "\e[92m${VAR_VERSION} \e[0m" echo -e "\e[92m${VAR_VERSION} \e[0m"
echo -e "\e[92mA powerful Debian installer for setting up a hardened Debian environment. \e[0m" echo -e "\e[92mA powerful Debian installer for setting up a hardened Debian environment. \e[0m"
echo echo
echo -e "\e[97m(c) Marc S. Weidner, 2018 - 2025 \e[0m" echo -e "\e[97m(c) Marc S. Weidner, 2018 - 2026 \e[0m"
echo -e "\e[97m(p) Centurion Press, 2024 - 2025 \e[0m" echo -e "\e[97m(p) Centurion Press, 2024 - 2026 \e[0m"
echo echo
echo -e "\e[91mUse only in trusted, non-production environments unless code audited! \e[0m" echo -e "\e[91mUse only in trusted, non-production environments unless code audited! \e[0m"
echo echo
@@ -75,6 +75,12 @@ usage() {
echo " - /tmp/.ciss/log/ciss_debian_installer_$$_trace.log" echo " - /tmp/.ciss/log/ciss_debian_installer_$$_trace.log"
echo " - /tmp/.ciss/log/ciss_debian_installer_$$_var.log" echo " - /tmp/.ciss/log/ciss_debian_installer_$$_var.log"
echo echo
echo -e "\e[97m --dropbear-version <YYYY>.<NUMBER> \e[0m"
echo " Set the Dropbear source version used for the hardened Dropbear build."
echo " Also accepts '--dropbear-version=<YYYY>.<NUMBER>'."
echo " Example: --dropbear-version 2026.91"
echo " Defaults to '${VAR_DROPBEAR_VERSION:-2026.91}'."
echo
echo -e "\e[97m --log, -l <LEVEL> \e[0m" echo -e "\e[97m --log, -l <LEVEL> \e[0m"
echo " This changes the default log level from 'info' to one of the following values:" echo " This changes the default log level from 'info' to one of the following values:"
echo " debug" echo " debug"
lib/cdi_0000_preliminary/README.md
+1 -1
View File
@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*The CISS Debian Installer provides a fully automated and hardened installation process.*<br> *The CISS Debian Installer provides a fully automated and hardened installation process.*<br>
**Master Version**: 9.00<br> **Master Version**: 9.00<br>
**Build**: V9.14.000.2026.06.07<br> **Build**: V9.14.002.2026.06.08<br>
# 2. Preliminary Components – `cdi_0000_preliminary` # 2. Preliminary Components – `cdi_0000_preliminary`
lib/cdi_0005_guard/README.md
+1 -1
View File
@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*The CISS Debian Installer provides a fully automated and hardened installation process.*<br> *The CISS Debian Installer provides a fully automated and hardened installation process.*<br>
**Master Version**: 9.00<br> **Master Version**: 9.00<br>
**Build**: V9.14.000.2026.06.07<br> **Build**: V9.14.002.2026.06.08<br>
# 2. Guarding and Safe Execution – `cdi_0005_guard` # 2. Guarding and Safe Execution – `cdi_0005_guard`
lib/cdi_0100_arg/0100_arg_mismatch.sh
+6 -2
View File
@@ -23,17 +23,21 @@ guard_sourcing || return "${ERR_GUARD_SOURCE}"
# VAR_IN_DIALOG_WR # VAR_IN_DIALOG_WR
# Arguments: # Arguments:
# 1: Message to be printed. # 1: Message to be printed.
# 2: Optional exit code.
####################################### #######################################
arg_mismatch() { arg_mismatch() {
declare -i err_code="${2:-${ERR_ARG_MISMATCH}}"
### Call cleaner if and only if not in auto-install mode. ### Call cleaner if and only if not in auto-install mode.
if [[ "${VAR_AUTO_INSTALL}" == "false" ]]; then if [[ "${VAR_AUTO_INSTALL}" == "false" ]]; then
### Dynamically select the cleaner based on the dialog wrapper type. ### Dynamically select the cleaner based on the dialog wrapper type.
# shellcheck disable=SC2249
case "${VAR_IN_DIALOG_WR}" in case "${VAR_IN_DIALOG_WR}" in
box|gauge) "dialog_${VAR_IN_DIALOG_WR}_cleaner" ;; box|gauge) "dialog_${VAR_IN_DIALOG_WR}_cleaner" ;;
esac esac
fi fi
printf "%b❌ Error: '%s'. %b%b" "${RED}" "${1}" "${RES}" "${NL}" >&2 printf "%b❌ Error: '%s'. %b%b" "${RED}" "${1}" "${RES}" "${NL}" >&2
read -pr $'\e[92m✅ Press \'ENTER\' to exit the script ... \e[0m' read -rp $'\e[92m✅ Press \'ENTER\' to exit the script ... \e[0m'
exit "${ERR_ARG_MISMATCH}" exit "${err_code}"
} }
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
lib/cdi_0100_arg/0102_arg_parser.sh
+19
View File
@@ -17,6 +17,7 @@ guard_sourcing || return "${ERR_GUARD_SOURCE}"
# Globals: # Globals:
# VAR_DEFAULT_LOG_LEVEL # VAR_DEFAULT_LOG_LEVEL
# VAR_AUTO_INSTALL # VAR_AUTO_INSTALL
# VAR_DROPBEAR_VERSION
# VAR_IN_DIALOG_WR # VAR_IN_DIALOG_WR
# VAR_PRIORITY # VAR_PRIORITY
# VAR_REIONICE_CLASS # VAR_REIONICE_CLASS
@@ -51,6 +52,24 @@ arg_parser() {
shift 1 shift 1
;; ;;
--dropbear-version)
if [[ -n "${2-}" && "${2}" =~ ^[0-9]{4}\.[0-9]+$ ]]; then
declare -gx VAR_DROPBEAR_VERSION="${2}"
shift 2
else
arg_mismatch "--dropbear-version MUST match <YYYY>.<NUMBER>." "${ERR_DROPBEAR_V}"
fi
;;
--dropbear-version=*)
if [[ "${argument#*=}" =~ ^[0-9]{4}\.[0-9]+$ ]]; then
declare -gx VAR_DROPBEAR_VERSION="${argument#*=}"
shift 1
else
arg_mismatch "--dropbear-version MUST match <YYYY>.<NUMBER>." "${ERR_DROPBEAR_V}"
fi
;;
-l | --log) -l | --log)
case "${2,,}" in case "${2,,}" in
debug|info|notice|warn|error|critical|fatal|emergency) declare -gx VAR_DEFAULT_LOG_LEVEL="$2"; shift 2 ;; debug|info|notice|warn|error|critical|fatal|emergency) declare -gx VAR_DEFAULT_LOG_LEVEL="$2"; shift 2 ;;
var/README/README_BASH_VAR.md
+1 -1
View File
@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*The CISS Debian Installer provides a fully automated and hardened installation process.*<br> *The CISS Debian Installer provides a fully automated and hardened installation process.*<br>
**Master Version**: 9.00<br> **Master Version**: 9.00<br>
**Build**: V9.14.000.2026.06.07<br> **Build**: V9.14.002.2026.06.08<br>
# 2. [bash.var.sh](../bash.var.sh) # 2. [bash.var.sh](../bash.var.sh)
This module establishes the global execution profile for all modules of the `CISS.debian.installer`. It is sourced at the very This module establishes the global execution profile for all modules of the `CISS.debian.installer`. It is sourced at the very
var/early.var.sh
+1 -1
View File
@@ -24,7 +24,7 @@ declare -grx VAR_BASH_VER="$(bash --version | head -n1 | awk '{
declare -grx VAR_CONTACT="security@coresecret.eu" declare -grx VAR_CONTACT="security@coresecret.eu"
# shellcheck disable=SC2155 # shellcheck disable=SC2155
declare -grx VAR_DS_VER="$(debootstrap --version)" declare -grx VAR_DS_VER="$(debootstrap --version)"
declare -grx VAR_VERSION="Master V9.14.000.2026.06.07" declare -grx VAR_VERSION="Master V9.14.002.2026.06.08"
# shellcheck disable=SC2155 # shellcheck disable=SC2155
declare -grx VAR_SYSTEM="$(uname -mnosv)" declare -grx VAR_SYSTEM="$(uname -mnosv)"
declare -gx VAR_ARG_SANITIZED="" declare -gx VAR_ARG_SANITIZED=""
var/errors.var.sh
+3 -2
View File
@@ -42,10 +42,10 @@ declare -girx ERR_MOUNTING_LUKS=231 # The LUKS Volume could not be mounted.
declare -girx ERR_UNKNOWN_DEV=230 # Unknown Device Path. declare -girx ERR_UNKNOWN_DEV=230 # Unknown Device Path.
declare -girx ERR_DEBOOTSTRAP=229 # Failure occurred on the debootstrap. declare -girx ERR_DEBOOTSTRAP=229 # Failure occurred on the debootstrap.
declare -girx ERR_CHRT_MOUNTS=228 # Failure occurred while mounting system devices. declare -girx ERR_CHRT_MOUNTS=228 # Failure occurred while mounting system devices.
declare -girx ERR_CHRT_COMMAND=227 # Failure occurred while executing chroot environment command. declare -girx ERR_CHRT_COMMAND=227 # Failure occurred while executing the chroot environment command.
declare -girx ERR_GRUB_INSTALL=226 # Error while installing Grub on the specified device. declare -girx ERR_GRUB_INSTALL=226 # Error while installing Grub on the specified device.
declare -girx ERR_GRUB_BACKGROUND=225 # Failure occurred on setting up the GRUB-background. declare -girx ERR_GRUB_BACKGROUND=225 # Failure occurred on setting up the GRUB-background.
declare -girx ERR_GRUB_ARCHITECTURE=224 # Architecture is not supported by Grub. declare -girx ERR_GRUB_ARCHITECTURE=224 # Grub does not support architecture.
declare -girx ERR_PATH_NOT_VALID=223 # A specific path is not existing. declare -girx ERR_PATH_NOT_VALID=223 # A specific path is not existing.
declare -girx ERR_READ_NUKE_FILE=222 # Error reading the Luks Nuke password file. declare -girx ERR_READ_NUKE_FILE=222 # Error reading the Luks Nuke password file.
declare -girx ERR_READ_GRUB_FILE=221 # Error reading the Grub password file. declare -girx ERR_READ_GRUB_FILE=221 # Error reading the Grub password file.
@@ -60,6 +60,7 @@ declare -girx ERR_VERIFY_LOGROTATE=213 # Error verification by 'logrotate'.
declare -girx ERR_READ_AUTH_FILE=212 # Error reading the Luks Backup auth token file. declare -girx ERR_READ_AUTH_FILE=212 # Error reading the Luks Backup auth token file.
declare -girx ERR_ACCOUNT_CREATE=211 # Error creating user accounts. declare -girx ERR_ACCOUNT_CREATE=211 # Error creating user accounts.
declare -girx ERR_LUKS_HEADER_ENC=210 # Error encrypting LUKS Header backup. declare -girx ERR_LUKS_HEADER_ENC=210 # Error encrypting LUKS Header backup.
declare -girx ERR_DROPBEAR_V=209 # Invalid Dropbear version argument.
declare -girx ERR_DECRYPTION_SOPS=132 # An error occurred while decrypting SECRETS.yaml. declare -girx ERR_DECRYPTION_SOPS=132 # An error occurred while decrypting SECRETS.yaml.
declare -girx ERR_MISSING_AGE_BIN=130 # SOPS binary for decryption SECRETS.yaml missing. declare -girx ERR_MISSING_AGE_BIN=130 # SOPS binary for decryption SECRETS.yaml missing.
declare -girx ERR_MISSING_AGE_KEY=129 # AGE key for decryption SECRETS.yaml values missing. declare -girx ERR_MISSING_AGE_KEY=129 # AGE key for decryption SECRETS.yaml values missing.
var/global.var.sh
+2
View File
@@ -87,6 +87,8 @@ declare -gx VAR_GRUB_PASSWORD="false"
### 4310_dropbear_build.sh ### 4310_dropbear_build.sh
declare -gx VAR_DROPBEAR="" declare -gx VAR_DROPBEAR=""
declare -gx VAR_DROPBEAR_VERSION="2026.91"
declare -gx VAR_DROPBEAR_BUILD_ROOT="/opt/.ciss/build"
### 4330_installation_ssh.sh ### 4330_installation_ssh.sh
declare -gx VAR_SSH_PORT="" declare -gx VAR_SSH_PORT=""