msw/CISS.debian.installer
SHA256
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

V8.00.000.2025.06.17
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m30s
Details

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-10-19 13:02:33 +01:00
parent 12653e9607
commit a918981bb1
2 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
.preseed/preseed.yaml
View File

@@ -856,7 +856,7 @@ user:
password: true # Allow password login. SSH password login is always disabled.
2fa:
ssh: false # Require 2FA for SSH access.
tty: false # Require 2FA for TTY (local console) login.
tty: true # Require 2FA for TTY (local console) login.
privileges:
description: "Root user with full system access and administrative privileges."
restricted: false # If true, the user is limited in scope (e.g., no login, no file access, --no-create-home)
@@ -885,8 +885,8 @@ user:
tty: true # Allow TTY (local console) login.
password: true # Allow password login. SSH password login is always disabled.
2fa:
ssh: false # Require 2FA for SSH access.
tty: false # Require 2FA for TTY (local console) login.
ssh: true # Require 2FA for SSH access.
tty: true # Require 2FA for TTY (local console) login.
privileges:
description: "Primary admin user with full sudo access and interactive login."
sudo: true # Whether the user can escalate to root using sudo.

5
func/cdi_4500_user/4510_accounts_hardening.sh
View File

@@ -45,8 +45,9 @@ accounts_hardening() {
### Preparing 2fa hardening.
install -d -m 0755 -o root -g root "${var_target}/etc/ciss"
touch "${var_target}/etc/ciss/2fa.users"
chmod 0600 "${var_target}/etc/ciss/2fa.users"
insert_header "${var_target}/etc/ciss/2fa.users"
insert_comments "${var_target}/etc/ciss/2fa.users"
chmod 0600 "${var_target}/etc/ciss/2fa.users"
### Keep 'tty1' active, disable the rest.
# shellcheck disable=SC2016