V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

func/cdi_4100_base/4130_installation_toolset.sh

@@ -62,6 +62,7 @@ installation_toolset() {
     [pwgen]="pwgen"
     [rsyslogd]="rsyslog"
     [sudo]="sudo"
+    [pam_systemd]="libpam-systemd"
     [tree]="tree"
     [unzip]="unzip"
     [lsusb]="usbutils"

func/cdi_4400_hardening/4420_hardening_fail2ban.sh

@@ -62,14 +62,13 @@ EOF
     ### fail2ban ufw aggressive mode, one attempt for jumphost configuration.
     cat << EOF >> "${var_target}/etc/fail2ban/jail.d/ciss-default.conf"
 [DEFAULT]
-usedns                = yes
+dbpurgeage            = 384d
-#                       127.0.0.1/8 – IPv4 loopback range (local host)
+#                       127.0.0.1/8 - IPv4 loopback range (local host)
-#                       ::1/128     – IPv6 loopback
+#                       ::1/128     - IPv6 loopback
-#                       fe80::/10   – IPv6 link-local (on-link only; NDP/RA/DAD)
+#                       fe80::/10   - IPv6 link-local (on-link only; NDP/RA/DAD)
-#                       fc00::/7    – IPv6 ULA (private LAN addresses)
+#                       ff00::/8    - IPv6 multicast (not an unicast host)
-#                       ff00::/8    – IPv6 multicast (not an unicast host)
+#                       ::/128      - IPv6 unspecified (all zeros; never a real peer)
-#                       ::/128      – IPv6 unspecified (all zeros; never a real peer)
+ignoreip              = 127.0.0.1/8 ::1/128 fe80::/10 ff00::/8 ::/128
-ignoreip              = 127.0.0.1/8 ::1/128 fe80::/10 fc00::/7 ff00::/8 ::/128
 # ${VAR_FINAL_FQDN}
   ${VAR_FINAL_IPV4}
 EOF
@@ -94,53 +93,74 @@ EOF
     fi
 
     cat << EOF >> "${var_target}/etc/fail2ban/jail.d/ciss-default.conf"
-maxretry              = 3
+usedns                = yes
-findtime              = 1d
-bantime               = 1h
-bantime.increment     = true
-bantime.factor        = 1
-bantime.maxtime       = 16d
-bantime.overalljails  = true
-bantime.rndtime       = 877s
-
 
 [recidive]
 enabled               = true
-filter                = recidive
+banaction             = ufw[blocktype=deny]
-logpath               = /var/log/fail2ban/fail2ban.log*
-banaction             = iptables-allports
-maxretry              = 3
-findtime              = 16d
 bantime               = 8d
 bantime.increment     = true
 bantime.factor        = 1
-bantime.maxtime       = 96d
+bantime.maxtime       = 128d
-bantime.multipliers   = 1, 2, 4, 8
+bantime.multipliers   = 1 2 4 8 16
 bantime.overalljails  = true
 bantime.rndtime       = 877s
-
+filter                = recidive
+findtime              = 16d
+logpath               = /var/log/fail2ban/fail2ban.log*
+maxretry              = 3
 
 [sshd]
 enabled               = true
 backend               = systemd
+bantime               = 1h
+bantime.increment     = true
+bantime.factor        = 1
+bantime.maxtime       = 16d
+bantime.multipliers   = 1 2 4 8 16 32 64 128 256 384
+bantime.overalljails  = true
+bantime.rndtime       = 877s
 filter                = sshd
-mode                  = normal
+findtime              = 16m
+mode                  = aggressive
 port                  = ${VAR_SSH_PORT}
 protocol              = tcp
-logpath               = /var/log/auth.log
 maxretry              = 4
 
-
 #
-# ufw aggressive approach:
+# CISS aggressive approach:
 # Any valid client communicating with our server should be going directly to the service ports opened in ufw (ssh, 80, ...).
 # Any client touching other ports is treated as malicious and therefore should be blocked access to ALL ports after 1 attempt.
+# There is no necessity to ping our servers excessively. Any client pinging us more than 1 times will be blocked.
 #
 
+[icmp]
+enabled               = true
+banaction             = ufw[blocktype=deny]
+bantime               = 1h
+bantime.increment     = true
+bantime.factor        = 1
+bantime.maxtime       = 16d
+bantime.multipliers   = 1 2 4 8 16 32 64 128 256 384
+bantime.overalljails  = true
+bantime.rndtime       = 877s
+filter                = ciss.icmp
+findtime              = 16m
+logpath               = /var/log/ufw.log
+maxretry              = 1
+
 [ufw]
 enabled               = true
+banaction             = ufw[blocktype=deny]
+bantime               = 1h
+bantime.increment     = true
+bantime.factor        = 1
+bantime.maxtime       = 16d
+bantime.multipliers   = 1 2 4 8 16 32 64 128 256 384
+bantime.overalljails  = true
+bantime.rndtime       = 877s
 filter                = ciss.ufw
-action                = iptables-allports
+findtime              = 16m
 logpath               = /var/log/ufw.log
 maxretry              = 1
 
@@ -152,14 +172,13 @@ EOF
     ### fail2ban ufw aggressive mode, 32 attempts for NO jumphost configuration.
     cat << EOF >> "${var_target}/etc/fail2ban/jail.d/ciss-default.conf"
 [DEFAULT]
-usedns                = yes
+dbpurgeage            = 384d
-#                       127.0.0.1/8 – IPv4 loopback range (local host)
+#                       127.0.0.1/8 - IPv4 loopback range (local host)
-#                       ::1/128     – IPv6 loopback
+#                       ::1/128     - IPv6 loopback
-#                       fe80::/10   – IPv6 link-local (on-link only; NDP/RA/DAD)
+#                       fe80::/10   - IPv6 link-local (on-link only; NDP/RA/DAD)
-#                       fc00::/7    – IPv6 ULA (private LAN addresses)
+#                       ff00::/8    - IPv6 multicast (not an unicast host)
-#                       ff00::/8    – IPv6 multicast (not an unicast host)
+#                       ::/128      - IPv6 unspecified (all zeros; never a real peer)
-#                       ::/128      – IPv6 unspecified (all zeros; never a real peer)
+ignoreip              = 127.0.0.1/8 ::1/128 fe80::/10 ff00::/8 ::/128
-ignoreip              = 127.0.0.1/8 ::1/128 fe80::/10 fc00::/7 ff00::/8 ::/128
 # ${VAR_FINAL_FQDN}
   ${VAR_FINAL_IPV4}
 EOF
@@ -172,55 +191,76 @@ EOF
     fi
 
     cat << EOF >> "${var_target}/etc/fail2ban/jail.d/ciss-default.conf"
-maxretry              = 3
+usedns                = yes
-findtime              = 1d
-bantime               = 1h
-bantime.increment     = true
-bantime.factor        = 1
-bantime.maxtime       = 16d
-bantime.overalljails  = true
-bantime.rndtime       = 877s
-
 
 [recidive]
 enabled               = true
-filter                = recidive
+banaction             = ufw[blocktype=deny]
-logpath               = /var/log/fail2ban/fail2ban.log*
-banaction             = iptables-allports
-maxretry              = 3
-findtime              = 16d
 bantime               = 8d
 bantime.increment     = true
 bantime.factor        = 1
-bantime.maxtime       = 96d
+bantime.maxtime       = 128d
-bantime.multipliers   = 1, 2, 4, 8
+bantime.multipliers   = 1 2 4 8 16
 bantime.overalljails  = true
 bantime.rndtime       = 877s
-
+filter                = recidive
+findtime              = 16d
+logpath               = /var/log/fail2ban/fail2ban.log*
+maxretry              = 3
 
 [sshd]
 enabled               = true
 backend               = systemd
+bantime               = 1h
+bantime.increment     = true
+bantime.factor        = 1
+bantime.maxtime       = 16d
+bantime.multipliers   = 1 2 4 8 16 32 64 128 256 384
+bantime.overalljails  = true
+bantime.rndtime       = 877s
 filter                = sshd
-mode                  = normal
+findtime              = 16m
+mode                  = aggressive
 port                  = ${VAR_SSH_PORT}
 protocol              = tcp
-logpath               = /var/log/auth.log
 maxretry              = 4
 
-
 #
-# ufw aggressive approach:
+# CISS aggressive approach:
 # Any valid client communicating with our server should be going directly to the service ports opened in ufw (ssh, 80, ...).
-# Any client touching other ports is treated as malicious and therefore should be blocked access to ALL ports after 8 attempts.
+# Any client touching other ports is treated as malicious and therefore should be blocked access to ALL ports after 3 attempts.
+# There is no necessity to ping our servers excessively. Any client pinging us more than 3 times will be blocked.
 #
 
+[icmp]
+enabled               = true
+banaction             = ufw[blocktype=deny]
+bantime               = 1h
+bantime.increment     = true
+bantime.factor        = 1
+bantime.maxtime       = 16d
+bantime.multipliers   = 1 2 4 8 16 32 64 128 256 384
+bantime.overalljails  = true
+bantime.rndtime       = 877s
+filter                = ciss.icmp
+findtime              = 16m
+logpath               = /var/log/ufw.log
+maxretry              = 3
+
 [ufw]
 enabled               = true
+banaction             = ufw[blocktype=deny]
+bantime               = 1h
+bantime.increment     = true
+bantime.factor        = 1
+bantime.maxtime       = 16d
+bantime.multipliers   = 1 2 4 8 16 32 64 128 256 384
+bantime.overalljails  = true
+bantime.rndtime       = 877s
 filter                = ciss.ufw
-action                = iptables-allports
+findtime              = 16m
 logpath               = /var/log/ufw.log
-maxretry              = 4
+maxretry              = 3
 
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
 EOF
@@ -234,13 +274,24 @@ EOF
 
   fi
 
+  insert_header   "${var_target}/etc/fail2ban/filter.d/ciss.icmp.conf"
+  insert_comments "${var_target}/etc/fail2ban/filter.d/ciss.icmp.conf"
+  cat << EOF >>   "${var_target}/etc/fail2ban/filter.d/ciss.icmp.conf"
+[Definition]
+# Generic ICMP/ICMPv6 blocks
+failregex             = ^.*UFW (?:BLOCK|REJECT).*?\bSRC=<HOST>\b.*?\bPROTO=ICMP\b.*$
+                        ^.*UFW (?:BLOCK|REJECT).*?\bSRC=<HOST>\b.*?\bPROTO=ICMPv6\b.*$
+
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
+EOF
+
   insert_header   "${var_target}/etc/fail2ban/filter.d/ciss.ufw.conf"
   insert_comments "${var_target}/etc/fail2ban/filter.d/ciss.ufw.conf"
   cat << EOF >>   "${var_target}/etc/fail2ban/filter.d/ciss.ufw.conf"
-
 [Definition]
-failregex = \[UFW BLOCK\].+SRC=<HOST> DST
+# Match UFW BLOCK/REJECT with a source IP and *any* port field (SPT or DPT), protocol may be missing.
-ignoreregex =
+failregex             = ^.*UFW (?:BLOCK|REJECT).*?\bSRC=<HOST>\b.*?(?:\bDPT=\d+\b|\bSPT=\d+\b).*$
+ignoreregex           =
 
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
 EOF
@@ -273,11 +324,11 @@ EOF
 
   cat << 'EOF' >> "${var_target}/etc/fail2ban/fail2ban.local"
 [Definition]
-logtarget = /var/log/fail2ban/fail2ban.log
+logtarget             = /var/log/fail2ban/fail2ban.log
 
 [Database]
 # Keep entries for at least 384 days to cover recidive findtime.
-dbpurgeage = 384d
+dbpurgeage            = 384d
 
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
 EOF
@@ -287,19 +338,23 @@ EOF
   cp "${var_target}/etc/logrotate.d/fail2ban" "${var_target}/root/.ciss/cdi/backup/etc/logrotate.d/fail2ban.bak"
   cat << EOF >| "${var_target}/etc/logrotate.d/fail2ban"
 /var/log/fail2ban/fail2ban.log {
-
     daily
     rotate 384
-    compress
+    maxage 384
-    # Do not rotate if empty
     notifempty
-
+    dateext
+    dateyesterday
+    compress
+    compresscmd /usr/bin/zstd
+    compressext .zst
+    compressoptions -20
+    uncompresscmd /usr/bin/unzstd
     delaycompress
+    shred
     missingok
     postrotate
         fail2ban-client flushlogs 1>/dev/null
     endscript
-
     # If fail2ban runs as non-root it still needs to have write access
     # to logfiles.
     # create 640 fail2ban adm

func/cdi_4400_hardening/4445_hardening_logrotate.sh

@@ -36,27 +36,49 @@ hardening_logrotate() {
   cat << EOF >>   "${var_target}/etc/logrotate.conf"
 # See "man logrotate" for details. Global options do not affect preceding include directives.
 
-# rotate log files daily
+# Rotate log files daily
 daily
 
-# keep 384 daily worth of backlogs
+# Keep 384 daily worth of backlogs.
 rotate 384
 
-# hard cap: delete rotated logs older than 384 days
+# Hard cap: delete rotated logs older than 384 days.
 maxage 384
 
-# create new (empty) log files after rotating old ones
+# Do not rotate the log if it is empty (this overrides the ifempty option).
+notifempty
+
+# Create new (empty) log files after rotating old ones.
 create
 
-# use date as a suffix of the rotated file
+# Use date as a suffix of the rotated file.
 dateext
 
-# gzip older rotations
+# Use yesterday's instead of today's date to create the dateext extension, so that the rotated log file has a date in its name
+# that is the same as the timestamps within it.
+dateyesterday
+
+# Enable compression
 compress
 
-# keep the most recent rotation uncompressed for one cycle
+# Use zstd instead of gzip.
+compresscmd /usr/bin/zstd
+
+# File extension for compressed logs.
+compressext .zst
+
+# Set zstd level 3 (default).
+compressoptions -20
+
+# How to decompress for 'logrotate -d' or similar.
+uncompresscmd /usr/bin/unzstd
+
+# Keep the most recent rotation uncompressed for one cycle.
 delaycompress
 
+# Delete log files using shred -u instead of unlink().
+shred
+
 # packages drop log rotation information into this directory
 include /etc/logrotate.d
 

func/cdi_4500_user/4520_accounts_setup.sh

@@ -976,7 +976,6 @@ auth	   required   pam_permit.so
 
 # And here are more per-package modules (the "Additional" block):
 
-# End of pam-auth-update config.
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
 EOF
   do_log "info" "file_only" "4520() Written: [/etc/pam.d/common-auth]."
@@ -987,6 +986,63 @@ EOF
 # shellcheck disable=SC2034
 readonly -f write_pam_common_auth
 
+#######################################
+# Writes CISS Header for '/etc/pam.d/common-session'.
+# Globals:
+#   None
+# Arguments:
+#   1: TARGET
+# Returns:
+#   0: on success
+#######################################
+write_pam_common_session() {
+  ### Declare Arrays, HashMaps, and Variables.
+  declare -r  var_target="$1"
+
+  mv "${var_target}/etc/pam.d/common-session" "${var_target}/root/.ciss/cdi/backup/etc/pam.d/common-session"
+
+  insert_header   "${var_target}/etc/pam.d/common-session"
+  insert_comments "${var_target}/etc/pam.d/common-session"
+  cat << EOF >>   "${var_target}/etc/pam.d/common-session"
+#
+# /etc/pam.d/common-session - session-related modules common to all services
+#
+
+# This file is included from other service-specific PAM config files, and should contain a list of modules that define tasks to
+# be performed at the start and end of interactive sessions.
+
+# As of pam 1.0.1-6, this file is managed by pam-auth-update by default. To take advantage of this, it is recommended that you
+# configure any local modules either before or after the default block, and use pam-auth-update to manage selection of other
+# modules. See pam-auth-update(8) for details.
+
+# Here are the per-package modules (the "Primary" block).
+session	            [default=1] pam_permit.so
+
+# Reset the umask for new sessions.
+session  optional   pam_umask.so
+
+# Here is the fallback if no module succeeds.
+session	 requisite  pam_deny.so
+
+# Prime the stack with a positive return value if there is not one already; this avoids us returning an error just because
+# nothing sets a success code since the modules above will each just jump around.
+session	 required   pam_permit.so
+
+# And here are more per-package modules (the "Additional" block).
+session	 required   pam_unix.so
+
+session  optional   pam_systemd.so
+
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
+EOF
+  do_log "info" "file_only" "4520() Written: [/etc/pam.d/common-session]."
+
+  return 0
+}
+### Prevents accidental 'unset -f'.
+# shellcheck disable=SC2034
+readonly -f write_pam_common_session
+
 #######################################
 # Writes CISS Header for '/etc/pam.d/login'.
 # Globals:

includes/target/etc/skel/.zshenv

@@ -13,15 +13,10 @@
 : "${XDG_CACHE_HOME:=${HOME}/.cache}"
 : "${XDG_DATA_HOME:=${HOME}/.local/share}"
 : "${XDG_STATE_HOME:=${HOME}/.local/state}"
-if [ -z "${XDG_RUNTIME_DIR:-}" ]; then
-  if [ -d "/run/user/$(id -u)" ]; then
-    XDG_RUNTIME_DIR="/run/user/$(id -u)"
-  else
-    XDG_RUNTIME_DIR="/tmp/xdg-runtime-$(id -u)"
-  fi
-fi
 
-export XDG_CONFIG_HOME XDG_CACHE_HOME XDG_DATA_HOME XDG_STATE_HOME XDG_RUNTIME_DIR
+# Do NOT set XDG_RUNTIME_DIR here.
+
+export XDG_CONFIG_HOME XDG_CACHE_HOME XDG_DATA_HOME XDG_STATE_HOME
 
 ### Zsh history -> XDG_STATE_HOME (best-effort; zsh might not read /etc/profile)
 if [ "${ENABLE_XDG_ZSH_HISTORY:-1}" = "1" ] && [ -n "${ZSH_VERSION:-}" ]; then

includes/target/root/.zshenv

@@ -13,15 +13,9 @@
 : "${XDG_CACHE_HOME:=${HOME}/.cache}"
 : "${XDG_DATA_HOME:=${HOME}/.local/share}"
 : "${XDG_STATE_HOME:=${HOME}/.local/state}"
-if [ -z "${XDG_RUNTIME_DIR:-}" ]; then
+# Do NOT set XDG_RUNTIME_DIR here.
-  if [ -d "/run/user/$(id -u)" ]; then
-    XDG_RUNTIME_DIR="/run/user/$(id -u)"
-  else
-    XDG_RUNTIME_DIR="/tmp/xdg-runtime-$(id -u)"
-  fi
-fi
 
-export XDG_CONFIG_HOME XDG_CACHE_HOME XDG_DATA_HOME XDG_STATE_HOME XDG_RUNTIME_DIR
+export XDG_CONFIG_HOME XDG_CACHE_HOME XDG_DATA_HOME XDG_STATE_HOME
 
 ### Zsh history -> XDG_STATE_HOME (best-effort; zsh might not read /etc/profile)
 if [ "${ENABLE_XDG_ZSH_HISTORY:-1}" = "1" ] && [ -n "${ZSH_VERSION:-}" ]; then