msw/CISS.debian.installer
SHA256
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

V8.00.000.2025.06.17
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 50s
Details

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-08-08 21:38:05 +02:00
parent f9ba15e1da
commit a9fab33829
19 changed files with 169 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
func/cdi_4400_hardening/4440_hardening_files.sh
View File

@@ -12,7 +12,7 @@
guard_sourcing
###########################################################################################
#######################################
# Hardening files and directories.
# Globals:
# None
@@ -20,8 +20,11 @@ guard_sourcing
# None
# Returns:
# 0: on success
###########################################################################################
#######################################
hardening_files() {
chmod 0700 /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly
chmod 0700 /etc/sudoers.d
chmod 0700 /etc/crontab
guard_dir && return 0
}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

37
func/cdi_4400_hardening/4450_hardening_haveged.sh
View File

@@ -12,16 +12,47 @@
guard_sourcing
###########################################################################################
#######################################
# Hardening haveged.
# Globals:
# None
# TARGET
# VAR_ARCHITECTURE
# VAR_CODENAME
# VAR_VERSION
# Arguments:
# None
# Returns:
# 0: on success
###########################################################################################
#######################################
hardening_haveged() {
cat << EOF >| "${TARGET}/etc/default/haveged"
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
# Static file system information: /etc/default/haveged
# Generated by CISS.debian.installer ${VAR_VERSION}
# Architecture: ${VAR_ARCHITECTURE}
# Distribution: ${VAR_CODENAME}
# Configuration file for haveged
# Minimal, sane defaults for server/headless systems.
# -w <bits> : target entropy level in bits; 1024 ensures fast pool fill on boot
# -v 1 : low verbosity (startup/shutdown only)
# Options to pass to haveged:
DAEMON_ARGS="-w 2048 -v 1"
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
EOF
guard_dir && return 0
}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

76
func/cdi_4400_hardening/4460_hardening_memory.sh Normal file
View File

@@ -0,0 +1,76 @@
#!/bin/bash
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
guard_sourcing
#######################################
# Hardening memory dump.
# Globals:
# TARGET
# Arguments:
# None
# Returns:
# 0: on success
#######################################
hardening_memory() {
mkdir -p "${TARGET}/etc/systemd/coredump.conf.d"
cat << EOF >| "${TARGET}/etc/systemd/coredump.conf.d/disable.conf"
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
# Static file system information: /etc/systemd/coredump.conf.d/disable.conf
# Generated by CISS.debian.installer ${VAR_VERSION}
# Architecture: ${VAR_ARCHITECTURE}
# Distribution: ${VAR_CODENAME}
[Coredump]
Storage=none
EOF
chmod 0644 "${TARGET}/etc/systemd/coredump.conf.d/disable.conf"
cat << EOF >| "${TARGET}/etc/security/limits.d/90-ciss-core.conf"
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
# Static file system information: /etc/security/limits.d/90-ciss-core.conf
# Generated by CISS.debian.installer ${VAR_VERSION}
# Architecture: ${VAR_ARCHITECTURE}
# Distribution: ${VAR_CODENAME}
# Format: <domain> <type> <item> <value>
* soft core 0
* hard core 0
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
EOF
chmod 0644 "${TARGET}/etc/security/limits.d/90-ciss-core.conf"
guard_dir && return 0
}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh