msw/CISS.debian.installer
SHA256
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

V8.00.000.2025.06.17
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 51s
Details

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-08-09 00:00:23 +02:00
parent c6a9e31816
commit a5ff4a739a
5 changed files with 95 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files

140
ciss_debian_installer.sh
View File

@@ -115,7 +115,7 @@ for arg in "$@"; do case "${arg,,}" in -c|--contact) . ./meta_loader_cuv.sh; con
for arg in "$@"; do case "${arg,,}" in -h|--help) . ./meta_loader_cuv.sh; usage ; exit 0;; esac; done for arg in "$@"; do case "${arg,,}" in -h|--help) . ./meta_loader_cuv.sh; usage ; exit 0;; esac; done
for arg in "$@"; do case "${arg,,}" in -v|--version) . ./meta_loader_cuv.sh; version; exit 0;; esac; done for arg in "$@"; do case "${arg,,}" in -v|--version) . ./meta_loader_cuv.sh; version; exit 0;; esac; done
### SOURCING MUST SET EARLY VARIABLES. SOURCING COLOR_ECHO() AND GUARD_SOURCING(). ### SOURCING MUST SET EARLY VARIABLES. SOURCING COLOR_ECHO(), GUARD_SOURCING(), AND SOURCE_GUARD().
. ./lib/cdi_0005_guard/0005_guard_sourcing.sh # The function guard_sourcing MUST be present in each file to source. . ./lib/cdi_0005_guard/0005_guard_sourcing.sh # The function guard_sourcing MUST be present in each file to source.
. ./lib/cdi_0005_guard/0006_source_guard.sh # Wrapper for sourcing modules, libraries, variables. . ./lib/cdi_0005_guard/0006_source_guard.sh # Wrapper for sourcing modules, libraries, variables.
source_guard "./var/color.var.sh" source_guard "./var/color.var.sh"
@@ -126,34 +126,34 @@ clear
### ALL CHECKS DONE. READY TO START THE SCRIPT. ### ALL CHECKS DONE. READY TO START THE SCRIPT.
# shellcheck disable=SC2155 # shellcheck disable=SC2155
declare -grx VAR_DIALOG=$(mktemp var_dialog.XXXXXXXX) declare -grx VAR_DIALOG=$(mktemp var_dialog.XXXXXXXX)
color_echo "${GRE}" "CISS.DEBIAN.INSTALLER PREPARATION: ALL CHECKS DONE. READY TO START THE SCRIPT ..." info_echo "ALL CHECKS DONE. READY TO START THE SCRIPT"
declare -grx VAR_SETUP="true" declare -grx VAR_SETUP="true"
### SOURCING FUNCTIONS, LIBRARIES, VARIABLES. ### SOURCING FUNCTIONS, LIBRARIES, VARIABLES.
if [[ "${VAR_SETUP}" == "true" ]]; then if [[ "${VAR_SETUP}" == "true" ]]; then
### SOURCING VARIABLES ### SOURCING VARIABLES
color_echo "${GRE}" "CISS.DEBIAN.INSTALLER PREPARATION: SOURCING VARIABLES ..." info_echo "SOURCING VARIABLES"
. ./meta_loader_var.sh . ./meta_loader_var.sh
### SOURCING FUNCTIONS ### SOURCING FUNCTIONS
color_echo "${GRE}" "CISS.DEBIAN.INSTALLER PREPARATION: SOURCING FUNCTIONS ..." info_echo "SOURCING FUNCTIONS"
. ./meta_loader_func.sh . ./meta_loader_func.sh
### SOURCING LIBRARIES ### SOURCING LIBRARIES
color_echo "${GRE}" "CISS.DEBIAN.INSTALLER PREPARATION: SOURCING LIBRARIES ..." info_echo "SOURCING LIBRARIES"
. ./meta_loader_lib.sh . ./meta_loader_lib.sh
fi fi
### PREPARING DIRECTORIES AND FILES. ### PREPARING DIRECTORIES AND FILES.
color_echo "${GRE}" "CISS.DEBIAN.INSTALLER PREPARATION: PREPARING DIRECTORIES AND FILES ..." info_echo "PREPARING DIRECTORIES AND FILES"
gen_dir_files gen_dir_files
### CHECKING REQUIRED PACKAGES. ### CHECKING REQUIRED PACKAGES.
#color_echo "${GRE}" "CISS.DEBIAN.INSTALLER PREPARATION: CHECKING REQUIRED PACKAGES ..." #info_echo "CHECKING REQUIRED PACKAGES"
#check_pkgs #check_pkgs
color_echo "${GRE}" "CISS.DEBIAN.INSTALLER PREPARATION: CHECKING GIT VARIABLES ..." info_echo "CHECKING GIT VARIABLES"
check_git check_git
### ADVISORY LOCK. ### ADVISORY LOCK.
color_echo "${GRE}" "CISS.DEBIAN.INSTALLER PREPARATION: ADVISORY LOCK ..." info_echo "ADVISORY LOCK"
exec 127>/var/lock/ciss_debian_installer.lock || { exec 127>/var/lock/ciss_debian_installer.lock || {
printf "%b❌ Cannot open lockfile for writing! Bye... %b%b" "${RED}" "${RES}" "${NL}" >&2 printf "%b❌ Cannot open lockfile for writing! Bye... %b%b" "${RED}" "${RES}" "${NL}" >&2
exit "${ERR_FLOCK_PROTECTED}" exit "${ERR_FLOCK_PROTECTED}"
@@ -165,15 +165,15 @@ if ! flock -x -n 127; then
fi fi
### SCAN FOR DEBUG MODE. ### SCAN FOR DEBUG MODE.
color_echo "${GRE}" "CISS.DEBIAN.INSTALLER PREPARATION: SCAN FOR DEBUG MODE ..." info_echo "SCAN FOR DEBUG MODE"
pre_scan_debug "$@" pre_scan_debug "$@"
### CHECK FOR AUTO INSTALL MODE. ### CHECK FOR AUTO INSTALL MODE.
color_echo "${GRE}" "CISS.DEBIAN.INSTALLER PREPARATION: CHECK FOR AUTO INSTALL MODE ..." info_echo "CHECK FOR AUTO INSTALL MODE"
for arg in "$@"; do case "${arg,,}" in -a|--autoinstall) declare -gx VAR_AUTO_INSTALL="true";; esac; done; unset arg for arg in "$@"; do case "${arg,,}" in -a|--autoinstall) declare -gx VAR_AUTO_INSTALL="true";; esac; done; unset arg
### ACTIVATING TRAPS. ### ACTIVATING TRAPS.
color_echo "${GRE}" "CISS.DEBIAN.INSTALLER PREPARATION: ACTIVATING TRAPS ..." info_echo "ACTIVATING TRAPS"
trap 'trap_exit "$?" "${BASH_SOURCE[0]}" "${LINENO}" "${FUNCNAME[0]:-main}" "${BASH_COMMAND}"' EXIT trap 'trap_exit "$?" "${BASH_SOURCE[0]}" "${LINENO}" "${FUNCNAME[0]:-main}" "${BASH_COMMAND}"' EXIT
trap 'trap_err "$?" "${BASH_SOURCE[0]}" "${LINENO}" "${FUNCNAME[0]:-main}" "${BASH_COMMAND}"' ERR trap 'trap_err "$?" "${BASH_SOURCE[0]}" "${LINENO}" "${FUNCNAME[0]:-main}" "${BASH_COMMAND}"' ERR
trap 'trap_int' INT TERM trap 'trap_int' INT TERM
@@ -183,150 +183,150 @@ if ! "${VAR_AUTO_INSTALL}"; then dialog_kernel; fi
if ! "${VAR_AUTO_INSTALL}"; then dialog_notes; fi if ! "${VAR_AUTO_INSTALL}"; then dialog_notes; fi
### Dialog Output for Initialization START. ### Dialog Output for Initialization START.
color_echo "${GRE}" "CISS.DEBIAN.INSTALLER PREPARATION: CHECK DIALOG WRAPPER ..." info_echo "CHECK DIALOG WRAPPER"
if ! "${VAR_AUTO_INSTALL}"; then . ./lib/cdi_0200_dialog/0200_dialog_helper.sh && dialog_box; fi if ! "${VAR_AUTO_INSTALL}"; then dialog_box; fi
### ARGUMENT CHECKS. ### ARGUMENT CHECKS.
echo "MAIN PROGRAM SEQUENCE: 0101_arg_sanitizer.sh ..." info_echo "0101_arg_sanitizer.sh"
arg_check "$@" arg_check "$@"
declare -ar ARY_ARG_SANITIZED=("$@") declare -ar ARY_ARG_SANITIZED=("$@")
declare -grx VAR_ARG_SANITIZED="${ARY_ARG_SANITIZED[*]}" declare -grx VAR_ARG_SANITIZED="${ARY_ARG_SANITIZED[*]}"
### ARGUMENT PARSING. ### ARGUMENT PARSING.
echo "MAIN PROGRAM SEQUENCE: 0102_arg_parser.sh ..." info_echo "0102_arg_parser.sh"
arg_parser "$@" arg_parser "$@"
### PRIORITY UPDATES. ### PRIORITY UPDATES.
echo "MAIN PROGRAM SEQUENCE: 0103_arg_priority_check.sh ..." info_echo "0103_arg_priority_check.sh"
arg_priority_check arg_priority_check
### HASHING PASSWORDS. ### HASHING PASSWORDS.
echo "MAIN PROGRAM SEQUENCE: 0105_arg_nuke_converter.sh ..." info_echo "0105_arg_nuke_converter.sh"
nuke_passphrase nuke_passphrase
### CDI_1200 ### CDI_1200
### CDI_1250 ### CDI_1250
echo "MAIN PROGRAM SEQUENCE: 1250_yaml_parser.sh ..." info_echo "1250_yaml_parser.sh"
yaml_parser yaml_parser
echo "MAIN PROGRAM SEQUENCE: 1251_yaml_reader.sh ..." info_echo "1251_yaml_reader.sh"
yaml_reader yaml_reader
echo "MAIN PROGRAM SEQUENCE: 1252_yaml_validator.sh ..." info_echo "1252_yaml_validator.sh"
yaml_validator yaml_validator
### CDI_3200 ### CDI_3200
echo "MAIN PROGRAM SEQUENCE: 3200_partitioning.sh ..." info_echo "3200_partitioning.sh"
partitioning partitioning
echo "MAIN PROGRAM SEQUENCE: 3210_benchmarking_encryption.sh ..." info_echo "3210_benchmarking_encryption.sh"
benchmarking_encryption benchmarking_encryption
echo "MAIN PROGRAM SEQUENCE: 3220_partition_encryption.sh ..." info_echo "3220_partition_encryption.sh"
partition_encryption partition_encryption
echo "MAIN PROGRAM SEQUENCE: 3240_partition_formatting.sh ..." info_echo "3240_partition_formatting.sh"
partition_formatting partition_formatting
echo "MAIN PROGRAM SEQUENCE: 3280_mount_partition.sh ..." info_echo "3280_mount_partition.sh"
mount_partition mount_partition
echo "MAIN PROGRAM SEQUENCE: 3290_uuid_logger.sh ..." info_echo "3290_uuid_logger.sh"
uuid_logger uuid_logger
### CDI_4000 ### CDI_4000
echo "MAIN PROGRAM SEQUENCE: 4000_debootstrap.sh ..." info_echo "4000_debootstrap.sh"
func_debootstrap func_debootstrap
echo "MAIN PROGRAM SEQUENCE: 4010_prepare_mounts.sh ..." info_echo "4010_prepare_mounts.sh"
prepare_mounts prepare_mounts
echo "MAIN PROGRAM SEQUENCE: 4020_remove_x509.sh ..." info_echo "4020_remove_x509.sh"
remove_x509 remove_x509
echo "MAIN PROGRAM SEQUENCE: 4030_setup_hostname.sh ..." info_echo "4030_setup_hostname.sh"
setup_hostname setup_hostname
echo "MAIN PROGRAM SEQUENCE: 4035_setup_resolv.sh ..." info_echo "4035_setup_resolv.sh"
setup_resolv setup_resolv
echo "MAIN PROGRAM SEQUENCE: 4040_setup_timezone.sh ..." info_echo "4040_setup_timezone.sh"
setup_timezone setup_timezone
echo "MAIN PROGRAM SEQUENCE: 4050_setup_locales.sh ..." info_echo "4050_setup_locales.sh"
setup_locales setup_locales
### CDI_4100 ### CDI_4100
echo "MAIN PROGRAM SEQUENCE: 4100_generate_sources.sh ..." info_echo "4100_generate_sources.sh"
generate_sources generate_sources
echo "MAIN PROGRAM SEQUENCE: 4110_update_sources.sh ..." info_echo "4110_update_sources.sh"
update_sources update_sources
echo "MAIN PROGRAM SEQUENCE: 4120_installation_kernel.sh ..." info_echo "4120_installation_kernel.sh"
installation_kernel installation_kernel
echo "MAIN PROGRAM SEQUENCE: 4121_installation_initramfs.sh ..." info_echo "4121_installation_initramfs.sh"
installation_initramfs installation_initramfs
echo "MAIN PROGRAM SEQUENCE: 4130_installation_toolset.sh ..." info_echo "4130_installation_toolset.sh"
installation_toolset installation_toolset
echo "MAIN PROGRAM SEQUENCE: 4131_installation_systemd.sh ..." info_echo "4131_installation_systemd.sh"
installation_systemd installation_systemd
echo "MAIN PROGRAM SEQUENCE: 4132_installation_machineid.sh ..." info_echo "4132_installation_machineid.sh"
installation_machineid installation_machineid
echo "MAIN PROGRAM SEQUENCE: 4133_installation_masking.sh ..." info_echo "4133_installation_masking.sh"
installation_masking installation_masking
echo "MAIN PROGRAM SEQUENCE: 4140_installation_microcode.sh ..." info_echo "4140_installation_microcode.sh"
installation_microcode installation_microcode
echo "MAIN PROGRAM SEQUENCE: 4150_installation_chrony.sh ..." info_echo "4150_installation_chrony.sh"
installation_chrony installation_chrony
### CDI_4200 ### CDI_4200
echo "MAIN PROGRAM SEQUENCE: 4200_generate_fstab.sh ..." info_echo "4200_generate_fstab.sh"
generate_fstab generate_fstab
echo "MAIN PROGRAM SEQUENCE: 4205_check_fstab.sh ..." info_echo "4205_check_fstab.sh"
check_fstab check_fstab
echo "MAIN PROGRAM SEQUENCE: 4210_generate_crypttab.sh ..." info_echo "4210_generate_crypttab.sh"
generate_crypttab generate_crypttab
echo "MAIN PROGRAM SEQUENCE: 4220_installation_cryptsetup.sh ..." info_echo "4220_installation_cryptsetup.sh"
installation_cryptsetup installation_cryptsetup
echo "MAIN PROGRAM SEQUENCE: 4230_installation_grub.sh ..." info_echo "4230_installation_grub.sh"
installation_grub installation_grub
echo "MAIN PROGRAM SEQUENCE: 4240_update_grub_password.sh ..." info_echo "4240_update_grub_password.sh"
update_grub_password update_grub_password
echo "MAIN PROGRAM SEQUENCE: 4250_update_grub_bootparameter.sh ..." info_echo "4250_update_grub_bootparameter.sh"
update_grub_bootparameter update_grub_bootparameter
### CDI_4300 ### CDI_4300
echo "MAIN PROGRAM SEQUENCE: 4300_installation_network.sh ..." info_echo "4300_installation_network.sh"
installation_network installation_network
echo "MAIN PROGRAM SEQUENCE: 4310_dropbear_build.sh ..." info_echo "4310_dropbear_build.sh"
dropbear_build dropbear_build
echo "MAIN PROGRAM SEQUENCE: 4311_dropbear_initramfs.sh ..." info_echo "4311_dropbear_initramfs.sh"
dropbear_initramfs dropbear_initramfs
echo "MAIN PROGRAM SEQUENCE: 4312_dropbear_setup.sh ..." info_echo "4312_dropbear_setup.sh"
dropbear_setup dropbear_setup
echo "MAIN PROGRAM SEQUENCE: 4320_update_initramfs.sh ..." info_echo "4320_update_initramfs.sh"
update_initramfs update_initramfs
### CDI_4400 ### CDI_4400
echo "MAIN PROGRAM SEQUENCE: 4400_kernel_modules.sh ..." info_echo "4400_kernel_modules.sh"
kernel_modules && kernel_modprobe kernel_modules && kernel_modprobe
echo "MAIN PROGRAM SEQUENCE: 4410_kernel_sysctl.sh ..." info_echo "4410_kernel_sysctl.sh"
kernel_sysctl kernel_sysctl
echo "MAIN PROGRAM SEQUENCE: 4420_installation_ssh.sh ..." info_echo "4420_installation_ssh.sh"
installation_ssh installation_ssh
echo "MAIN PROGRAM SEQUENCE: 4430_installation_skel.sh ..." info_echo "4430_installation_skel.sh"
installation_skel installation_skel
echo "MAIN PROGRAM SEQUENCE: 4440_hardening_files.sh ..." info_echo "4440_hardening_files.sh"
hardening_files hardening_files
echo "MAIN PROGRAM SEQUENCE: 4450_hardening_haveged.sh ..." info_echo "4450_hardening_haveged.sh"
hardening_haveged hardening_haveged
echo "MAIN PROGRAM SEQUENCE: 4460_hardening_memory.sh ..." info_echo "4460_hardening_memory.sh"
hardening_memory hardening_memory
### CDI_4500 ### CDI_4500
echo "MAIN PROGRAM SEQUENCE: 4500_installation_accounts.sh ..." info_echo "4500_installation_accounts.sh"
installation_accounts # TODO: Checks ongoing installation_accounts # TODO: Checks ongoing
### CDI_4600 ### CDI_4600
#echo "MAIN PROGRAM SEQUENCE: 4205_check_fstab.sh ..." #info_echo "4205_check_fstab.sh"
#echo "MAIN PROGRAM SEQUENCE: 4610_finalize_system.sh ..." #info_echo "4610_finalize_system.sh"
#echo "MAIN PROGRAM SEQUENCE: 4670_verify_system.sh ..." #info_echo "4670_verify_system.sh"
#echo "MAIN PROGRAM SEQUENCE: 4680_check_sshd_config_integrity.sh ..." #info_echo "4680_check_sshd_config_integrity.sh"
#echo "MAIN PROGRAM SEQUENCE: 4690_check_grub_cmdline.sh ..." #info_echo "4690_check_grub_cmdline.sh"
### CDI_4700 ### CDI_4700
echo "MAIN PROGRAM SEQUENCE: 4799_exiting_chroot_system.sh ..." info_echo "4799_exiting_chroot_system.sh"
exiting_chroot_system exiting_chroot_system
### CDI_5000 ### CDI_5000

7
func/cdi_4400_hardening/4440_hardening_files.sh
View File

@@ -22,9 +22,10 @@ guard_sourcing
# 0: on success # 0: on success
####################################### #######################################
hardening_files() { hardening_files() {
chmod 0700 /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly chmod 0700 "${TARGET}/etc/cron.d" "${TARGET}/etc/cron.daily" "${TARGET}/etc/cron.hourly" "${TARGET}/etc/cron.monthly" \
chmod 0700 /etc/sudoers.d "${TARGET}/etc/cron.weekly"
chmod 0700 /etc/crontab chmod 0700 "${TARGET}/etc/sudoers.d"
chmod 0700 "${TARGET}/etc/crontab"
guard_dir && return 0 guard_dir && return 0
} }
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

2
func/cdi_4400_hardening/4460_hardening_memory.sh
View File

@@ -50,6 +50,8 @@ hardening_memory() {
[Coredump] [Coredump]
Storage=none Storage=none
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
EOF EOF
chmod 0644 "${TARGET}/etc/systemd/coredump.conf.d/disable.conf" chmod 0644 "${TARGET}/etc/systemd/coredump.conf.d/disable.conf"

8
func/cdi_4600_verification/4610_finalize_system.sh
View File

@@ -13,7 +13,7 @@
guard_sourcing guard_sourcing
####################################### #######################################
# Set locale, locale overrides and configure keyboard layout. # Finalize the system.
# Globals: # Globals:
# TARGET # TARGET
# Arguments: # Arguments:
@@ -21,11 +21,7 @@ guard_sourcing
# Returns: # Returns:
# 0: on success # 0: on success
####################################### #######################################
setup_locales() { finalize_system() {
### Set the X11 keyboard layout (for graphical environments).
do_in_target "${TARGET}" localectl set-x11-keymap "${locale_keyboard_xkb_keymap}"
guard_dir && return 0 guard_dir && return 0
} }
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

17
lib/cdi_0010_basic/0010_color_echo.sh
View File

@@ -28,4 +28,21 @@ color_echo() {
declare msg="${*}" declare msg="${*}"
printf "%b[INFO]%b %s %b" "${c}" "${RES}" "${msg}" "${NL}" | tee -a "${VAR_DIALOG}" printf "%b[INFO]%b %s %b" "${c}" "${RES}" "${msg}" "${NL}" | tee -a "${VAR_DIALOG}"
} }
#######################################
# Print the current module in plain or colorful format.
# Globals:
# GRE
# VAR_AUTO_INSTALL
# Arguments:
# 1: Modulname
#######################################
info_echo() {
declare module="$1"
if ! "${VAR_AUTO_INSTALL}"; then
echo "MAIN PROGRAM SEQUENCE: ${module} ..."
else
color_echo "${GRE}" "MAIN PROGRAM SEQUENCE: ${module} ..."
fi
}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh