V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

.preseed/preseed.yaml

@@ -803,13 +803,13 @@ software:
 # USA         : time-a-g.nist.gov time-c-b.nist.gov utcnist3.colorado.edu
 ntp:
   server:
-    - "ntp.ripe.net"
+    #- "ntp.ripe.net"
     - "ptbtime3.ptb.de"
     - "ptbtime2.ptb.de"
     - "ptbtime1.ptb.de"
-    - "ntp13.metas.ch"
-    - "time-c-b.nist.gov"
-    - "sth1.ntp.se"
+    #- "ntp13.metas.ch"
+    #- "time-c-b.nist.gov"
+    #- "sth1.ntp.se"
     - "ntp0.fau.de"
   timezone: "Europe/Lisbon"    # Any valid setting for $TZ; see the contents of '/usr/share/zoneinfo' for valid values.
   utc: true                    # Controls whether the hardware clock is set to UTC.

func/cdi_4300_network/4300_installation_network.sh

@@ -97,7 +97,7 @@ EOF
 
     cat << EOF >>   "${TARGET}/etc/network/interfaces"
 # The primary network interface: IPv4 via DHCP
-allow-hotplug ${VAR_FINAL_NIC}
+auto ${VAR_FINAL_NIC}
 iface ${VAR_FINAL_NIC} inet dhcp
 
 EOF
@@ -107,7 +107,7 @@ EOF
 
     cat << EOF >>   "${TARGET}/etc/network/interfaces"
 # The primary network interface: IPv4 via DHCP
-allow-hotplug ${VAR_FINAL_NIC}
+auto ${VAR_FINAL_NIC}
 iface ${VAR_FINAL_NIC} inet dhcp
 
 EOF
@@ -119,7 +119,7 @@ EOF
 
     cat << EOF >>   "${TARGET}/etc/network/interfaces"
 # The primary network interface: IPv4 via static IP
-allow-hotplug ${VAR_FINAL_NIC}
+auto ${VAR_FINAL_NIC}
 iface ${VAR_FINAL_NIC} inet static
   address ${VAR_FINAL_IPV4}
   netmask ${VAR_FINAL_IPV4_SUBNET}
@@ -168,6 +168,9 @@ EOF
   insert_header   "${TARGET}/etc/dhcpcd.conf"
   insert_comments "${TARGET}/etc/dhcpcd.conf"
   cat << 'EOF' >> "${TARGET}/etc/dhcpcd.conf"
+### Global IPv6 Options
+noipv6rs
+
 ### No Global APIPA-Fallback.
 noipv4ll
 

func/cdi_4300_network/4330_installation_ssh.sh

@@ -39,15 +39,22 @@ installation_ssh() {
   chroot_exec "${TARGET}" apt-get install -y --no-install-recommends --no-install-suggests ssh
 
   mkdir -p "${TARGET}/etc/systemd/system/ssh.service.d"
+
+  # shellcheck disable=SC2312
   cat << EOF >> "${TARGET}/etc/systemd/system/ssh.service.d/override.conf"
 [Unit]
-Wants=ifup@${VAR_FINAL_NIC}.service network-online.target
-After=ifup@{VAR_FINAL_NIC}.service network-online.target
+Wants=network-online.target
+After=network-online.target
 
 [Service]
+# Wait until v4 *and* v6 global addresses exist on ens3
+ExecStartPre=/bin/sh -c 'for i in $(seq 1 60); do \
+  ip -4 addr show dev ens3 scope global | grep -q "inet " && \
+  ip -6 addr show dev ens3 scope global | grep -q "inet6 " && exit 0; \
+  sleep 1; \
+done; exit 1'
 Restart=on-failure
 RestartSec=3s
-
 EOF
 
   install -D -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/banner" "${TARGET}/etc/"

func/cdi_4400_hardening/4470_hardening_ufw.sh

@@ -26,6 +26,7 @@ guard_sourcing
 hardening_ufw() {
   ### Declare Arrays, HashMaps, and Variables.
   declare -r  var_logfile="/root/.ciss/cdi/log/4470_hardening_ufw.log"
+  declare -r  var_rules="${TARGET}/etc/ufw/before6.rules"
 
   chroot_logger "${TARGET}${var_logfile}"
 
@@ -76,6 +77,20 @@ hardening_ufw() {
   sed -i "/# ok icmp code for FORWARD/i \-A ufw-before-output -p icmp --icmp-type parameter-problem -j ACCEPT" "${TARGET}/etc/ufw/before.rules"
   sed -i "/# ok icmp code for FORWARD/i \-A ufw-before-output -p icmp --icmp-type echo-request -j ACCEPT" "${TARGET}/etc/ufw/before.rules"
 
+
+  ### Remove previous custom blocks (idempotent).
+  sed -i "/^# BEGIN custom MLD rules/,/^# END custom MLD rules/d" "${var_rules}"
+  sed -i "/^# BEGIN custom MLD OUTPUT rules/,/^# END custom MLD OUTPUT rules/d" "${var_rules}"
+
+  ### Inbound MLD (INPUT chain) – insert before the existing echo-request rule.
+  ### Allows MLDv1 (130/131/132) and MLDv2 (143) to link-local multicast (ff02::/16)
+  sed -i "/-A ufw6-before-input .*--icmpv6-type echo-request -j ACCEPT/i # BEGIN custom MLD rules\n-A ufw6-before-input -i ${VAR_FINAL_NIC} -p icmpv6 --icmpv6-type 130 -d ff02::/16 -j ACCEPT\n-A ufw6-before-input -i ${VAR_FINAL_NIC} -p icmpv6 --icmpv6-type 131 -d ff02::/16 -j ACCEPT\n-A ufw6-before-input -i ${VAR_FINAL_NIC} -p icmpv6 --icmpv6-type 132 -d ff02::/16 -j ACCEPT\n-A ufw6-before-input -i ${VAR_FINAL_NIC} -p icmpv6 --icmpv6-type 143 -d ff02::/16 -j ACCEPT\n# END custom MLD rules" "${var_rules}"
+
+  ### Outbound MLD (OUTPUT chain) – insert before echo-request.
+  ### Useful if local daemons join multicast groups, and you want clean logs.
+  sed -i "/-A ufw6-before-output .*--icmpv6-type echo-request -j ACCEPT/i # BEGIN custom MLD OUTPUT rules\n-A ufw6-before-output -o ${VAR_FINAL_NIC} -p icmpv6 --icmpv6-type 131 -d ff02::/16 -j ACCEPT\n-A ufw6-before-output -o ${VAR_FINAL_NIC} -p icmpv6 --icmpv6-type 143 -d ff02::/16 -j ACCEPT\n# END custom MLD OUTPUT rules" "${var_rules}"
+
+
   chroot_script "${TARGET}" "echo 'y' | ufw enable 2>&1"
 
   chroot_script "${TARGET}" "ufw status verbose >> ${var_logfile}"

includes/target/etc/skel/.zshrc

@@ -121,6 +121,7 @@ source ${ZSH}/oh-my-zsh.sh
 ### Added by CISS.debian.installer ###
 trap ' "${SHELL}" "${HOME}/.ciss/clean_logout.sh" ' EXIT
 . "${HOME}/.ciss/alias"
+. "${HOME}/.ciss/check_chrony.sh"
 . "${HOME}/.ciss/shortcuts"
 . "${HOME}/.ciss/scan_libwrap"
 . /usr/share/doc/fzf/examples/key-bindings.zsh