Marc S. Weidner
74f18a2dd5
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m57s
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
931 lines
59 KiB
YAML
931 lines
59 KiB
YAML
# SPDX-Version: 3.0
|
||
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
|
||
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
||
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||
# SPDX-FileType: SOURCE
|
||
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
||
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
||
# SPDX-PackageName: CISS.debian.installer
|
||
# SPDX-Security-Contact: security@coresecret.eu
|
||
%YAML 1.2
|
||
---
|
||
### This file contains configurations for the CISS.debian.installer
|
||
### Master V8.00.000.2025.06.17
|
||
### YAML specification: 1.2
|
||
|
||
installer:
|
||
name: "CISS.debian.installer"
|
||
version: "V8.00.000.2025.06.17"
|
||
|
||
################################################################################################################################
|
||
# APT settings
|
||
################################################################################################################################
|
||
apt:
|
||
contrib: true # Optionally, install contrib software.
|
||
deb_sources: true # Optionally includes deb-src entries for source repositories.
|
||
default_list: false # By default, source repositories are listed in '/etc/apt/sources.list'.
|
||
default_deb822: true # Since Trixie, source repositories are listed in '/etc/apt/sources.list.d/' in deb.822 format.
|
||
full_upgrade: true # Whether to upgrade packages after debootstrap.
|
||
install_recommends: true # Configure APT to not install recommended packages by default.
|
||
non_free: true # Optionally, install non-free software.
|
||
non_free_firmware: true # Optionally, install non-free firmware. MUST be "true" for microcode updates.
|
||
sec: "security.debian.org" # Debian Security Updates Archive.
|
||
|
||
##############################################################################################################################
|
||
# A network mirror MUST be used to supplement the software not included on the installation media. This may also make newer
|
||
# versions of software available.
|
||
##############################################################################################################################
|
||
mirror:
|
||
activate: true # MUST be "true".
|
||
country: "US" # Country code of mirror destination.
|
||
directory: "/debian/" # Debian archive mirror directory in which the mirror of the Debian archive is located.
|
||
hostname: "deb.debian.org" # Debian archive mirror hostname.
|
||
https-country: "US" # Debian archive mirror country.
|
||
protocol: "https" # Protocol to be used for downloading files, where "https" is RECOMMENDED.
|
||
proxy: "" # HTTP proxy information (blank for none) or "http://[[user][:pass]@]host[:port]/"
|
||
|
||
##############################################################################################################################
|
||
# Debian has the following services that provide updates.
|
||
#
|
||
# Backported software is adapted from the development version to work with this release. Although this software has not gone
|
||
# through such complete testings as that contained in the release, it includes newer versions of some applications that may
|
||
# provide useful features. Enabling backports here does not cause any of them to be installed by default; it only allows you
|
||
# to manually select backports to use.
|
||
#
|
||
# Release updates provide more current versions for software that changes relatively frequently and where not having the
|
||
# latest version could reduce the usability of the software. It also provides regression fixes. This service is only
|
||
# available for stable and oldstable releases.
|
||
#
|
||
# Security updates help to keep your system secured against attacks. Enabling this service is strongly recommended.
|
||
#
|
||
# Applying updates on a frequent basis is an important part of keeping the system secure. By default, security updates are not
|
||
# automatically installed, as security advisories should be reviewed before manual installation of the updates using standard
|
||
# package management tools.
|
||
#
|
||
# Alternatively, the unattended-upgrades package can be installed, which will install security updates automatically. Note,
|
||
# however, that automatic installation of updates may occasionally cause unexpected downtime of services provided by this
|
||
# machine in the rare cases where the update is not fully backward-compatible, or where the security advisory requires the
|
||
# administrator to perform some other manual operation. Possible choices: "none", "security", "unattended" (RECOMMENDED)
|
||
##############################################################################################################################
|
||
updates:
|
||
backports: true
|
||
release: true
|
||
security: true
|
||
policy: "unattended"
|
||
|
||
################################################################################################################################
|
||
# Basic settings
|
||
################################################################################################################################
|
||
architecture: "amd64" # MUST be one of "amd64" or "arm64".
|
||
chroot_debug: "false" # Enable debug mode in the chroot environment in case of errors.
|
||
debootstrap: # Provide a mirror for downloading the Debian packages for debootstrap.
|
||
# Specify the packages to be included in the debootstrapping process. Include a comma-separated
|
||
# list of official Debian packages.
|
||
mirror: "https://deb.debian.org/debian"
|
||
# The following packages MUST be included in the debootstrap.
|
||
includes: "busybox,ca-certificates,git,locales,openssl,python3,python3-apt,systemd-cryptsetup,zstd"
|
||
distribution: "trixie" # MUST be "trixie".
|
||
debian_suite: "stable" # MUST be "stable". Not supported yet: "testing", "experimental".
|
||
exit:
|
||
halt: false # This is how to make the installer shutdown when finished, but not reboot.
|
||
poweroff: false # This will power off the machine instead of just halting it (RECOMMENDED).
|
||
reboot: true # This will reboot the machine.
|
||
firmware:
|
||
install: true # If non-free firmware is needed for the network or other hardware, autoinstall it.
|
||
lookup: "missing" # - "never" Completely disables the firmware search.
|
||
# - "missing" Searches only when the firmware is needed. (default)
|
||
# - "always" Always searches and asks for any firmware that could be useful for the hardware.
|
||
image: "linux-image-6.16.3+deb13-amd64"
|
||
# Could be a meta-package or a specific image like:
|
||
# "linux-image-amd64" || "linux-image-arm64"
|
||
# "linux-image-cloud-amd64" || "linux-image-cloud-arm64"
|
||
# "linux-image-rt-amd64" || "linux-image-rt-arm64"
|
||
# "linux-image-6.16.3+deb13-amd64"
|
||
needrun: false # Static linking to "${TARGET}/run" can cause problems if this data is "burned" into the target.
|
||
provider: "netcup" # MUST be one of "contabo", "hetzner", "netcup" or leave empty.
|
||
security_ext: "apparmor" # MUST be one of "apparmor" or "selinux".
|
||
|
||
################################################################################################################################
|
||
# Dropbear settings
|
||
################################################################################################################################
|
||
dropbear:
|
||
boot: true # Dropbear initramfs integration.
|
||
dhcp: false # Whether the '/etc/initramfs-tools/conf.d/ip' file should be configured statically or via DHCP.
|
||
firewall: false # Yet not implemented. MUST be "false".
|
||
# Additional ultra hardening of the dropbear initramfs environment via firewall.
|
||
# The "bastion_ipv4" MUST be provided.
|
||
port: 44137 # SSH Port dropbear initramfs should listen.
|
||
pub_key: "/.preseed/unlock_wrapper_pubring.gpg"
|
||
# './path/to/unlock_wrapper_pubring.pgp' to check the signature of: 'unlock-wrapper.sh.sha512.sig'
|
||
sha_file: "/.preseed/unlock_wrapper.sh.sha512"
|
||
# './path/to/unlock_wrapper.sh.sha512' to verify the integrity of: 'unlock-wrapper.sh'
|
||
sig_file: "/.preseed/unlock_wrapper.sh.sha512.sig"
|
||
# './path/to/unlock_wrapper.sh.sha512.sig' to verify the authenticity of: 'unlock-wrapper.sh.sha512'
|
||
|
||
################################################################################################################################
|
||
# Grub Bootparameter
|
||
# https://docs.kernel.org/admin-guide/kernel-parameters.html
|
||
################################################################################################################################
|
||
grub_parameter:
|
||
##############################################################################################################################
|
||
# Audit events need to be captured on processes that start up prior to auditd, so that potential malicious activity cannot go
|
||
# undetected. During boot if audit=1, then the backlog will hold 64 records. If more than 64 records are created during boot,
|
||
# auditd records will be lost, and potential malicious activity could go undetected.
|
||
##############################################################################################################################
|
||
- "audit_backlog_limit=16384"
|
||
- "audit=1"
|
||
|
||
##############################################################################################################################
|
||
# CFI Ensures that only controlled, predefined transitions are possible in the programs' control flow.
|
||
# kcfi (Kernel Control Flow Integrity): Specific implementation of CFI for the Linux kernel that is particularly robust and
|
||
# provides accurate control flow validation. kcfi relies on compiler-based technologies (e.g., LLVM) that insert special
|
||
# checks and instrumentation into the kernel code.
|
||
# https://kspp.github.io/Recommended_Settings#kernel-command-line-options
|
||
##############################################################################################################################
|
||
- "cfi=kcfi"
|
||
|
||
##############################################################################################################################
|
||
# Prevents the debugfsfile system from being made available at boot time. This is a useful hardening measure because debugfs
|
||
# reveals a lot of potentially security-relevant kernel information by default, which can be misused by normal users and by
|
||
# exploits.
|
||
##############################################################################################################################
|
||
- "debugfs=off"
|
||
|
||
##############################################################################################################################
|
||
# Disable the busmaster bit on all PCI bridges during very early boot to avoid holes in IOMMU.
|
||
# https://mjg59.dreamwidth.org/54433.html
|
||
# https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4444f8541dad16fefd9b8807ad1451e806ef1d94
|
||
##############################################################################################################################
|
||
- "efi=disable_early_pci_dma"
|
||
|
||
##############################################################################################################################
|
||
# Checks every copy_to_user() / copy_from_user()operation. Prevents kernels from accidentally copying unallocated memory to
|
||
# userspace. Stop exploits that trigger buffer overflows or use-after-free via copy_*_user(), for example. Effect: Detects
|
||
# heap/SLOB abuse, overwrites. Leads to BUG() & stack trace if suspicious access is detected.
|
||
##############################################################################################################################
|
||
- "hardened_usercopy=1"
|
||
|
||
##############################################################################################################################
|
||
# Remove additional (32-bit) attack surface, unless you really need them.
|
||
# https://www.kernel.org/doc/html/v6.10/admin-guide/kernel-parameters.html
|
||
# https://kspp.github.io/Recommended_Settings#kernel-command-line-options
|
||
##############################################################################################################################
|
||
- "ia32_emulation=0"
|
||
|
||
##############################################################################################################################
|
||
# Zero memory at allocation and free time.
|
||
##############################################################################################################################
|
||
- "init_on_alloc=1"
|
||
- "init_on_free=1"
|
||
|
||
##############################################################################################################################
|
||
# Enables strict enforcement of IOMMU TLB invalidation, so devices will never be able to access stale data contents.
|
||
# - 'iommu.passthrough=0'
|
||
# Prevents devices from operating in identity-mapped passthrough mode. Without this parameter (or with =1), devices could be
|
||
# passed through without being monitored by the IOMMU in a truly restrictive manner. From a security standpoint,
|
||
# - 'iommu.passthrough=0' is an important step toward DMA isolation for all devices, especially for untrusted PCI(e) devices.
|
||
# - 'iommu.strict=1'
|
||
# Enables Strict Mode for dma-iommu.c (i.e., all DMA transactions are validated synchronously). Without this parameter, the
|
||
# kernel often runs in lazy mode, where mapping caches are used.
|
||
# Performance vs. security: strict=1= more secure, but potentially slower, especially with many small DMA transfers.
|
||
# https://github.com/torvalds/linux/blob/master/drivers/iommu/Kconfig#L97
|
||
# Page 11 of https://lenovopress.lenovo.com/lp1467.pdf
|
||
##############################################################################################################################
|
||
- "iommu.passthrough=0"
|
||
- "iommu.strict=1"
|
||
|
||
##############################################################################################################################
|
||
# Enables IOMMU to prevent DMA attacks. intel_iommu=on amd_iommu=force_isolation iommu=force
|
||
# Multiple IOMMU switches are redundant; iommu=force is usually sufficient. Forces an IOMMU to be initialized and used
|
||
# completely, even if the BIOS or ACPI wanted to disable it. It activates the basic DMA remapping function. However, it does
|
||
# not say anything about how restrictive the mapping strategy is, 'passthrough', 'strict', see below.
|
||
##############################################################################################################################
|
||
- "iommu=force"
|
||
|
||
##############################################################################################################################
|
||
# Kernel Electric-Fence (KFENCE) is a low-overhead sampling-based memory safety error detector. KFENCE detects a heap of
|
||
# out-of-bounds access, use-after-free, and invalid-free errors. KFENCE is designed to be enabled in production kernels and
|
||
# has near zero performance overhead. Compared to KASAN, KFENCE trades performance for precision. The main motivation behind
|
||
# KFENCE design is that with enough total uptime, KFENCE will detect bugs in code paths not typically exercised by
|
||
# non-production test workloads. One way to quickly achieve a large enough total uptime is when the tool is deployed across a
|
||
# large fleet of machines.
|
||
# https://docs.kernel.org/dev-tools/kfence.html
|
||
##############################################################################################################################
|
||
- "kfence.sample_interval=100"
|
||
|
||
##############################################################################################################################
|
||
# Mark all huge pages in the EPT as non-executable to mitigate iTLB multihit.
|
||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/multihit.html
|
||
##############################################################################################################################
|
||
- "kvm.nx_huge_pages=force"
|
||
|
||
##############################################################################################################################
|
||
# Enables the prctl interface to prevent leaks from L1D on context switches.
|
||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1d_flush.html
|
||
##############################################################################################################################
|
||
- "l1d_flush=on"
|
||
|
||
##############################################################################################################################
|
||
# If mitigations=auto,nosmt is set, see before, then these flags should not be set individually because they are redundant.
|
||
# Enable mitigations for the L1TF vulnerability through disabling SMT and L1D flush runtime control.
|
||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html
|
||
##############################################################################################################################
|
||
#- "l1tf=full,force"
|
||
|
||
##############################################################################################################################
|
||
# Enables kernel lockdown mode with a focus on confidentiality. The kernel is configured in such a way that even privileged
|
||
# users (such as root) have limited access to kernel data and debug mechanisms.
|
||
# 'confidentiality': Maximum restriction to ensure the security and integrity of the system. This prevents direct access to
|
||
# hardware and debug interfaces, for example. Useful for highly secure environments as it reduces the attack surface to kernel
|
||
# data. However, some applications that require debugging or hardware access may have problems.
|
||
# Note: Lockdown=confidentiality prevents the kernel reads required for the systemd eBPF program
|
||
# (e.g., bpf_probe_read_kernel()), the verifier aborts, Invalid argument, and bpf-restrict-fs cannot load. Functionally, this
|
||
# is "only" the failure of the systemd hardening module RestrictFileSystems= (and related BPF filters); the rest boots.
|
||
# Therefore, countermeasures without BPF/BTF:
|
||
# Strict least-privilege: CapabilityBoundingSet= (remove CAP_SYS_ADMIN), 'NoNewPrivileges=yes', 'SystemCallFilter=~mount',
|
||
# 'PrivateMounts=yes', 'ProtectKernelModules=yes'. On the network side: instead of BPF egress, nftables policies at host level
|
||
# per unit: BindToDevice=lo or disconnect network NS. File systems: 'ProtectSystem=strict', 'ReadOnlyPaths=',
|
||
# 'InaccessiblePaths=', 'ProtectHome=tmpfs|read-only'.
|
||
# Otherwise, countermeasures with 'lockdown=integrity':
|
||
# 'kernel.unprivileged_bpf_disabled=1', 'net.core.bpf_jit_harden=2', 'kernel.perf_event_paranoid=3', 'kernel.kptr_restrict=2',
|
||
# 'kernel.dmesg_restrict=1'. Optional: 'kernel.kexec_load_disabled=1'. One gets BPF hardening (Restrict-FS, Egress filter),
|
||
# but minimizes BPF abuse by unprivileged users & JIT hardening.
|
||
# https://blog.cloudflare.com/de-de/linux-kernel-hardening/
|
||
# https://www.linux-magazine.com/Issues/2020/239/Lockdown-Mode
|
||
##############################################################################################################################
|
||
- "lockdown=integrity"
|
||
|
||
##############################################################################################################################
|
||
# All Kernel Messages with a loglevel smaller than the console loglevel will be printed to the console. It can also be
|
||
# changed with 'klogd' or other programs. The log levels are defined as follows:
|
||
# 0 (KERN_EMERG) system is unusable
|
||
# 1 (KERN_ALERT) action must be taken immediately
|
||
# 2 (KERN_CRIT) critical conditions
|
||
# 3 (KERN_ERR) error conditions
|
||
# 4 (KERN_WARNING) warning conditions
|
||
# 5 (KERN_NOTICE) normal but significant condition
|
||
# 6 (KERN_INFO) informational
|
||
# 7 (KERN_DEBUG) debug-level messages
|
||
##############################################################################################################################
|
||
- "loglevel=0"
|
||
|
||
##############################################################################################################################
|
||
# If mitigations=auto,nosmt is set, see before, then these flags should not be set individually because they are redundant.
|
||
# Enable mitigations for the MDS vulnerability through clearing the buffer cache and disabling SMT.
|
||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html
|
||
##############################################################################################################################
|
||
#- "mds=full,nosmt"
|
||
|
||
##############################################################################################################################
|
||
# Enable a subset of known mitigations for CPU vulnerabilities and disable SMT.
|
||
# - 'mitigations=auto' Enables all available CPU-specific security measures based on the detected CPU, microcode version, and
|
||
# kernel build configuration, if applicable.
|
||
# - 'nosmt' Disables Simultaneous Multithreading (SMT) (e.g., Hyper-Threading on Intel) system-wide to prevent shared cache
|
||
# attacks (SMoTHER, MDS, L1TF, TAA, Snoop-assisted).
|
||
# Why is 'mitigations=auto,nosmt' better than setting everything manually?
|
||
# Automatically adjusted: Depending on CPU family, stepping, microcode.
|
||
# Consistency guaranteed: No contradictions between flags are possible
|
||
# (e.g., spec_store_bypass_disable=on vs. nospec_store_bypass_disable=off).
|
||
# Future-proof: Even new features (e.g., bhi=flush or srbds) are automatically activated without having to know about them.
|
||
##############################################################################################################################
|
||
- "mitigations=auto,nosmt"
|
||
|
||
##############################################################################################################################
|
||
# Mitigates numerous MMIO Stale Data vulnerabilities and disables SMT.
|
||
# mmio_stale_data=off No mitigation (unsafe)
|
||
# mmio_stale_data=full All known measures active
|
||
# mmio_stale_data=full,nosmt Full mitigation + SMT disabling
|
||
# mmio_stale_data=auto Activated depending on CPU/microcode
|
||
# mmio_stale_data=full,force Forces mitigation even on CPUs that are supposedly not affected.
|
||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html
|
||
##############################################################################################################################
|
||
- "mmio_stale_data=full,force"
|
||
|
||
##############################################################################################################################
|
||
# Force disable SMT as it has caused numerous CPU vulnerabilities. The only full mitigation of cross-HT attacks is disabling.
|
||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/core-scheduling.html
|
||
##############################################################################################################################
|
||
- "nosmt=force"
|
||
|
||
##############################################################################################################################
|
||
# Force the kernel to panic on "oopses" (which may be due to false positives).
|
||
# - 'panic=N' (e.g., 'panic=60'): Wait N seconds and then reboot.
|
||
# - 'panic=0' No automatic action (System remains stuck in panic state).
|
||
# - 'panic=-1' Also explicitly prevents any automatic reboot.
|
||
##############################################################################################################################
|
||
- "oops=panic"
|
||
- "panic=0"
|
||
|
||
##############################################################################################################################
|
||
# This option randomizes page allocator freelists, improving security by making page allocations less predictable. This also
|
||
# improves performance.
|
||
##############################################################################################################################
|
||
- "page_alloc.shuffle=1"
|
||
|
||
##############################################################################################################################
|
||
# When releasing (i.e., free_pages()), all bytes with a marker value (e.g., 0xAA) are overwritten. If later code
|
||
# (accidentally or maliciously) accesses this page, it will most likely crash or produce recognizable artifacts. Only
|
||
# supported if the kernel was built with CONFIG_PAGE_POISONING=y (default on Debian: enabled since Bookworm).
|
||
##############################################################################################################################
|
||
- "page_poison=1"
|
||
|
||
##############################################################################################################################
|
||
# Enables Kernel Page Table Isolation, which mitigates Meltdown, improves KASLR.
|
||
##############################################################################################################################
|
||
- "pti=on"
|
||
|
||
##############################################################################################################################
|
||
# Distrusts the bootloader for initial entropy at boot.
|
||
# https://lkml.org/lkml/2022/6/5/271
|
||
##############################################################################################################################
|
||
- "random.trust_bootloader=off"
|
||
|
||
##############################################################################################################################
|
||
# Distrusts CPU bootloader for initial entropy at boot. Distrusts the CPU for initial entropy at boot, as it is not possible
|
||
# to audit, may contain weaknesses or a backdoor.
|
||
# https://en.wikipedia.org/wiki/RDRAND#Reception
|
||
# https://twitter.com/pid_eins/status/1149649806056280069
|
||
# https://archive.nytimes.com/www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html
|
||
# https://forums.whonix.org/t/entropy-config-random-trust-cpu-yes-or-no-rng-core-default-quality/8566
|
||
# https://lkml.org/lkml/2022/6/5/271
|
||
##############################################################################################################################
|
||
- "random.trust_cpu=off"
|
||
|
||
##############################################################################################################################
|
||
# The kernel adds a small random padding offset to the stack pointer with every system call or kernel entry. The starting
|
||
# point for local variables is at a different position within the stack with every call. This makes ROP chains
|
||
# (return-oriented programming) or stack pivoting attacks significantly more difficult.
|
||
##############################################################################################################################
|
||
- "randomize_kstack_offset=on"
|
||
|
||
##############################################################################################################################
|
||
# Enable mitigations for RETBleed (Arbitrary Speculative Code Execution with Return Instructions) vulnerability and disable
|
||
# SMT. If 'mitigations=auto,nosmt' is set, the kernel already activates all retbleed-relevant mitigations, provided the CPU
|
||
# is affected; 'retbleed=auto,nosmt' explicitly overrides the internal assessment and forces full protection. If maximum
|
||
# hardening is required, and one does not want to rely on "auto-detection", then it is recommended to additionally set
|
||
# 'retbleed=auto,nosmt' otherwise, 'mitigations=auto,nosmt' is sufficient.
|
||
# https://www.suse.com/support/kb/doc/?id=000020693
|
||
##############################################################################################################################
|
||
- "retbleed=auto,nosmt"
|
||
|
||
##############################################################################################################################
|
||
# Enables 'Read-Only Data Protection', which implements read-only memory areas for kernel data structures. This protects the
|
||
# kernel from certain types of exploit (e.g., buffer overflows). 'on': Forces the corresponding areas to remain read-only.
|
||
# https://www.kernel.org/doc/html/v6.10/admin-guide/kernel-parameters.html
|
||
##############################################################################################################################
|
||
- "rodata=on"
|
||
|
||
##############################################################################################################################
|
||
# Disables the merging of slabs of similar sizes. Sometimes a slab can be used vulnerably, which an attacker can exploit.
|
||
##############################################################################################################################
|
||
- "slab_nomerge"
|
||
|
||
##############################################################################################################################
|
||
# If mitigations=auto,nosmt is set, see before, then these flags should not be set individually because they are redundant.
|
||
# Disable Speculative Store Bypass (Spectre Variant 4).
|
||
# https://www.suse.com/support/kb/doc/?id=000019189
|
||
##############################################################################################################################
|
||
#- "spec_store_bypass_disable=on"
|
||
#- "nospec_store_bypass_disable=off"
|
||
|
||
##############################################################################################################################
|
||
# If mitigations=auto,nosmt is set, see before, then these flags should not be set individually because they are redundant.
|
||
# Enable mitigations for both 'Spectre Variant 2' (indirect branch speculation) and Intel branch history injection (BHI)
|
||
# vulnerabilities.
|
||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/spectre.html
|
||
##############################################################################################################################
|
||
#- "spectre_v2=on"
|
||
#- "spectre_v2_user=on"
|
||
#- "spectre_bhi=on"
|
||
|
||
##############################################################################################################################
|
||
# If mitigations=auto,nosmt is set, see before, then these flags should not be set individually because they are redundant.
|
||
# Patches the TAA vulnerability by disabling TSX and enables mitigations using TSX Async Abort along with disabling SMT.
|
||
# https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/tsx_async_abort.html
|
||
##############################################################################################################################
|
||
#- "tsx=off"
|
||
#- "tsx_async_abort=full,nosmt"
|
||
|
||
##############################################################################################################################
|
||
# [ USB ] Default USB device authorization:
|
||
# default -1 = authorized (same as 1)
|
||
# 0 = not authorized, 1 = authorized, 2 = authorized if a device connected to an internal port.
|
||
##############################################################################################################################
|
||
- "usbcore.authorized_default=0"
|
||
|
||
##############################################################################################################################
|
||
# Removes mapping for 32-bit VDSO (for ia32binaries). On 32-bit processes that rely on VDSO, this causes a fallback to classic
|
||
# syscalls (slower) or errors. On a system without CONFIG_IA32_EMULATION or with ia32_emulation=0, vdso32=0 is effective but
|
||
# redundant.
|
||
##############################################################################################################################
|
||
- "vdso32=0"
|
||
|
||
##############################################################################################################################
|
||
# The setting 'vsyscall' is obsolete, are at fixed addresses and are a target for ROP.
|
||
##############################################################################################################################
|
||
- "vsyscall=none"
|
||
|
||
################################################################################################################################
|
||
# Grub settings
|
||
################################################################################################################################
|
||
grub:
|
||
background: # RECOMMENDED settings: JPG 1280 x 1024 px or JPG 1920 x 1080 px
|
||
enable: true # If you want to add a GRUB background.
|
||
path: "/includes/target/etc/default/grub.d/hexagon_1280_720.png"
|
||
bootdev: "/dev/sda" # Due notably to potential USB sticks, the location of the primary drive cannot be determined
|
||
# safely in general, so this needs to be specified.
|
||
force_efi: true # Force GRUB installation to the EFI removable media path?
|
||
# Some EFI firmware implementations do not meet the EFI specification (i.e., they are buggy)
|
||
# and do not support proper configuration of boot options from system hard drives.
|
||
#
|
||
# A workaround for this problem is to install an extra copy of the EFI version of the GRUB
|
||
# bootloader to a fallback location, the "removable media path". Almost all EFI systems, no
|
||
# matter how buggy, will boot GRUB that way.
|
||
#
|
||
# Warning: If the installer failed to detect another operating system that is present on your
|
||
# computer that also depends on this fallback, installing GRUB there will make that OS
|
||
# temporarily unbootable. GRUB can be manually configured later to boot it if necessary.
|
||
only_debian: true # This is fairly safe to set; it makes grub install automatically to the UEFI partition '/boot'
|
||
# record if no other operating system is detected on the machine.
|
||
other-os: true # This one makes grub-installer install to the UEFI partition '/boot' record if it also finds
|
||
# some other OS, which is less safe as it might not be able to boot that other OS.
|
||
password: true # If you want to set a password for GRUB. The password MUST be set at:
|
||
# '/.preseed/password_grub.txt'.
|
||
prober: false # OS-prober did not detect any other operating systems on your computer at this time, but you
|
||
# may still wish to enable it in case you install more in the future.
|
||
skip: false # Skip installing grub.
|
||
update_nvram: false # Update NVRAM variables to automatically boot into Debian?
|
||
# GRUB can configure your platform's NVRAM variables so that it boots into Debian automatically
|
||
# when powered on. However, you may prefer to disable this behavior and avoid changes to your
|
||
# boot configuration. For example, if your NVRAM variables have been set up such that your
|
||
# the system contacts a PXE server on every boot, this would preserve that behavior.
|
||
|
||
################################################################################################################################
|
||
# Locale settings set language, country, locale, keyboard map and timezone
|
||
################################################################################################################################
|
||
locale:
|
||
country: "US"
|
||
keyboard:
|
||
layout: "de"
|
||
xkb_keymap: "de"
|
||
language: "en"
|
||
locale: # All locales specified via override MUST be set here, too. A specified 'locale' take
|
||
# precedence over 'country' and 'language' settings.
|
||
- "en_US.UTF-8"
|
||
- "de_DE.UTF-8"
|
||
override:
|
||
address: "de_DE.UTF-8" # Address format.
|
||
collate: "en_US.UTF-8" # Sort order.
|
||
ctype: "de_DE.UTF-8" # Character set, upper/lower case, character groups.
|
||
measurement: "de_DE.UTF-8" # Metric or imperial system.
|
||
messages: "en_US.UTF-8" # System language for error messages.
|
||
monetary: "en_US.UTF-8" # Currency format and symbol.
|
||
name: "en_US.UTF-8" # Format of personal names.
|
||
numeric: "en_US.UTF-8" # Number formatting, decimal / a thousand separators.
|
||
paper: "de_DE.UTF-8" # Standard paper format.
|
||
telephone: "en_US.UTF-8" # Format for telephone numbers.
|
||
time: "de_DE.UTF-8" # Date and time format, start of week.
|
||
timezone: "Europe/Lisbon"
|
||
|
||
################################################################################################################################
|
||
# Network settings
|
||
################################################################################################################################
|
||
network:
|
||
autoconfig:
|
||
enable: true # Automatic network configuration 'dhcp' is the default. If you prefer to configure the network
|
||
# manually, change 'network.autoconfig.enable' from "true" to "false" and configure
|
||
# - 'network.choose_interface.static'
|
||
# - 'network.hostname'
|
||
# - 'network.ipv6'
|
||
# - 'network.static' section
|
||
choose_interface:
|
||
auto: true # Choose an interface that has a link if possible. Or manually configure the static NIC below.
|
||
static: "eth1" # For manual configuration, specify a particular interface.
|
||
hostname: "nsa.usic.gov" # Specify the FQDN of the server.
|
||
# If not specified and autoconfig is enabled, the given dhcp value is chosen.
|
||
ipv6: true # Specify if you want to use IPv6.
|
||
timeout:
|
||
dhcp: 60 # If the dhcp server is slow, and the installer times out waiting for it, this might be useful.
|
||
linkwait: 3 # To set a different link detection timeout (default is 3 seconds).
|
||
static:
|
||
dns_dhcp_override: true # If you want to override the DNS settings of the DHCP server.
|
||
enable: true # If you want the preconfiguration file to work on systems both with and without a dhcp
|
||
# server, change 'network.static.enable' from "false" to "true" and configure the static
|
||
# configuration below.
|
||
ipv4address: ""
|
||
ipv4netmask: ""
|
||
ipv4gateway: ""
|
||
ipv4nameserver:
|
||
- "135.181.207.105" # dns01.eddns.eu
|
||
- "89.58.62.53" # dns02.eddns.de
|
||
- "138.199.237.109" # dns03.eddns.eu
|
||
ipv4nameserver_fallback: # Only three DNS Resolvers in total are recommended.
|
||
#- "176.9.93.198" # dnsforge.de
|
||
#- "176.9.1.117" # dnsforge.de
|
||
ipv6address: "2a03:4000:10:d43:188:68:34:243"
|
||
ipv6netmask: "64"
|
||
ipv6gateway: "fe80::1"
|
||
ipv6nameserver:
|
||
- "2a01:4f9:c012:a813:135:181:207:105"
|
||
- "2a0a:4cc0:1:e6:89:58:62:53"
|
||
- "2a01:4f8:c013:8011:138:199:237:109"
|
||
ipv6nameserver_fallback: # Only three DNS Resolvers in total are recommended.
|
||
#- "2a01:4f8:151:34aa::198"
|
||
#- "2a01:4f8:141:316d::117"
|
||
|
||
################################################################################################################################
|
||
# Security settings
|
||
################################################################################################################################
|
||
security:
|
||
ufw_out: deny # Policy for ufw outbound traffic. MUST be either 'allow' or 'deny'.
|
||
unauthenticated: false # The installer will ensure that any packages are signed and authenticated.
|
||
unauthenticated_ssl: false # This ensures that the connection between the installer, and the server from which files
|
||
# are downloaded, is encrypted and signed by a trusted certificate authority.
|
||
|
||
################################################################################################################################
|
||
# Software installation
|
||
################################################################################################################################
|
||
software:
|
||
##############################################################################################################################
|
||
### Installed by 4000_debootstrap.sh
|
||
##############################################################################################################################
|
||
# adduser
|
||
# apt
|
||
# apt-utils
|
||
# base-files
|
||
# base-passwd
|
||
# bash
|
||
# bsdutils
|
||
# busybox
|
||
# ca-certificates
|
||
# coreutils
|
||
# cpio
|
||
# cron
|
||
# dash
|
||
# debconf
|
||
# debian-archive-keyring
|
||
# debianutils
|
||
# dhcpcd-base
|
||
# diffutils
|
||
# e2fsprogs
|
||
# fdisk
|
||
# findutils
|
||
# git
|
||
# grep
|
||
# gzip
|
||
# hostname
|
||
# ifupdown
|
||
# iproute2
|
||
# iputils-ping
|
||
# kmod
|
||
# less
|
||
# locales
|
||
# login
|
||
# logrotate
|
||
# nano
|
||
# openssl
|
||
# passwd
|
||
# procps
|
||
# python3
|
||
# python3-apt
|
||
# sed
|
||
# tar
|
||
# tzdata
|
||
# util-linux
|
||
# vim-common
|
||
# zstd
|
||
#
|
||
##############################################################################################################################
|
||
### Installed by 4110_update_sources.sh
|
||
##############################################################################################################################
|
||
# unattended-upgrades
|
||
#
|
||
##############################################################################################################################
|
||
### Installed by 4130_installation_toolset.sh
|
||
##############################################################################################################################
|
||
# apt-show-versions
|
||
# bc
|
||
# bind9-dnsutils
|
||
# bsdmainutils
|
||
# btrfs-progs
|
||
# bzip2
|
||
# console-setup
|
||
# curl
|
||
# dirmngr
|
||
# dmsetup
|
||
# dosfstools
|
||
# e2fsprogs
|
||
# efibootmgr
|
||
# file
|
||
# gawk
|
||
# gdisk
|
||
# gnupg
|
||
# initramfs-tools
|
||
# jitterentropy-rngd
|
||
# jq
|
||
# kbd
|
||
# keyutils
|
||
# libpam-pwquality
|
||
# lsb-release
|
||
# parted
|
||
# pciutils
|
||
# pwgen
|
||
# rsyslog
|
||
# sudo
|
||
# tree
|
||
# unzip
|
||
# usbutils
|
||
# vim-common
|
||
# wget
|
||
# whois
|
||
# zsh
|
||
#
|
||
##############################################################################################################################
|
||
### Installed by 4140_installation_microcode.sh
|
||
##############################################################################################################################
|
||
# amd64-microcode
|
||
# intel-microcode
|
||
#
|
||
##############################################################################################################################
|
||
### Installed by 4150_installation_chrony.sh
|
||
##############################################################################################################################
|
||
# chrony
|
||
#
|
||
##############################################################################################################################
|
||
### Installed by 4160_installation_eza.sh
|
||
##############################################################################################################################
|
||
# eza
|
||
#
|
||
##############################################################################################################################
|
||
### Installed by 4170_installation_lynis.sh
|
||
##############################################################################################################################
|
||
# lynis
|
||
#
|
||
##############################################################################################################################
|
||
### Installed by 4220_installation_cryptsetup.sh
|
||
##############################################################################################################################
|
||
# cryptsetup
|
||
# cryptsetup-initramfs
|
||
#
|
||
##############################################################################################################################
|
||
### Installed by 4230_installation_grub.sh
|
||
##############################################################################################################################
|
||
# grub2-common
|
||
# grub-efi-amd64 || grub-efi-arm64 || grub-efi-ia32
|
||
#
|
||
##############################################################################################################################
|
||
### Installed by 4305_installation_netsec.sh
|
||
##############################################################################################################################
|
||
# fail2ban
|
||
# ufw
|
||
#
|
||
##############################################################################################################################
|
||
### Installed by 4310_dropbear_build.sh
|
||
##############################################################################################################################
|
||
# dropbear-bin
|
||
# dropbear-initramfs
|
||
# gpgv
|
||
#
|
||
##############################################################################################################################
|
||
### Installed by 4330_installation_ssh.sh
|
||
##############################################################################################################################
|
||
# ssh
|
||
#
|
||
##############################################################################################################################
|
||
### Installed by 4480_hardening_usb.sh
|
||
##############################################################################################################################
|
||
# usbguard
|
||
#
|
||
##############################################################################################################################
|
||
### Installed by 4490_hardening_virus.sh
|
||
##############################################################################################################################
|
||
# rkhunter
|
||
#
|
||
##############################################################################################################################
|
||
# Installed by 4500_accounts_preparation.sh
|
||
##############################################################################################################################
|
||
# bash-completion
|
||
# fzf
|
||
#
|
||
##############################################################################################################################
|
||
# Installed by 4510_accounts_hardening.sh
|
||
##############################################################################################################################
|
||
# libpam-google-authenticator
|
||
# wamerican
|
||
# wbritish
|
||
# wfrench
|
||
# wngerman
|
||
#
|
||
##############################################################################################################################
|
||
# Installed by 4600_installation_packages.sh
|
||
##############################################################################################################################
|
||
- bat
|
||
- dialog
|
||
- expect
|
||
- htop
|
||
- iftop
|
||
- locate
|
||
- man-db
|
||
- mtr-tiny
|
||
- ncat
|
||
- rsync
|
||
- sysstat
|
||
- zip
|
||
##############################################################################################################################
|
||
# backup and diagnostics
|
||
##############################################################################################################################
|
||
#- borgbackup
|
||
#- borgbackup-doc
|
||
#- dhcpdump
|
||
#- dhcping
|
||
#- knot-dnssecutils
|
||
#- knot-dnsutils
|
||
#- nmap
|
||
#- rsnapshot
|
||
#- spectre-meltdown-checker
|
||
#- tshark
|
||
##############################################################################################################################
|
||
# sw dev
|
||
##############################################################################################################################
|
||
#- apt-utils
|
||
#- build-essential
|
||
#- clang
|
||
#- debconf
|
||
#- debconf-utils
|
||
#- debootstrap
|
||
#- linux-source
|
||
#- lld
|
||
#- manpages
|
||
#- manpages-dev
|
||
#- shellcheck
|
||
#- ssl-cert
|
||
##############################################################################################################################
|
||
# Installed by 4610_installation_security.sh
|
||
##############################################################################################################################
|
||
# apparmor
|
||
# apparmor-profiles
|
||
# apparmor-profiles-extra
|
||
# apparmor-utils
|
||
# OR #
|
||
# selinux-basics
|
||
# selinux-policy-default
|
||
# selinux-utils
|
||
# setools
|
||
# semodule-utils
|
||
# sepol-utils
|
||
# policycoreutils
|
||
# policycoreutils-python-utils
|
||
# checkpolicy
|
||
# python3-setools
|
||
##############################################################################################################################
|
||
# Installed by 4620_installation_verification.sh
|
||
##############################################################################################################################
|
||
# acct
|
||
# aide
|
||
# aide-common
|
||
# audit
|
||
# debsums
|
||
|
||
################################################################################################################################
|
||
# Time settings
|
||
################################################################################################################################
|
||
# Germany : https://www.ptb.de/cms/ptb/fachabteilungen/abtq/gruppe-q4/ref-q42/zeitsynchronisation-von-rechnern-mit-hilfe-des-network-time-protocol-ntp.html
|
||
# Germany : ptbtime1.ptb.de ptbtime2.ptb.de ptbtime3.ptb.de
|
||
# Germany : https://www.rrze.fau.de/serverdienste/infrastruktur/zeitserver/
|
||
# Germany : ntp0.fau.de ntp3.fau.de
|
||
# Portugal : https://si.tecnico.ulisboa.pt/en/servicos/servidores-e-dados/ntp/
|
||
# Portugal : ntp1.tecnico.ulisboa.pt ntp2.tecnico.ulisboa.pt
|
||
# Sweden : https://www.netnod.se/swedish-distributed-time-service
|
||
# Sweden : sth1.ntp.se
|
||
# Switzerland : https://www.metas.ch/metas/de/home/fabe/zeit-und-frequenz/time-dissemination.html
|
||
# Switzerland : ntp11.metas.ch ntp12.metas.ch ntp13.metas.ch
|
||
# USA : https://tf.nist.gov/tf-cgi/servers.cgi
|
||
# USA : time-a-g.nist.gov time-c-b.nist.gov utcnist3.colorado.edu
|
||
ntp:
|
||
server:
|
||
#- "ntp.ripe.net" # Time out as of 2025-10-16
|
||
- "ptbtime3.ptb.de"
|
||
- "ptbtime2.ptb.de"
|
||
- "ptbtime1.ptb.de"
|
||
#- "ntp13.metas.ch" # Time out as of 2025-10-16
|
||
#- "time-c-b.nist.gov" # Time out as of 2025-10-16
|
||
#- "sth1.ntp.se" # Time out as of 2025-10-16
|
||
- "ntp0.fau.de"
|
||
timezone: "Europe/Lisbon" # Any valid setting for $TZ; see the contents of '/usr/share/zoneinfo' for valid values.
|
||
utc: true # Controls whether the hardware clock is set to UTC.
|
||
|
||
################################################################################################################################
|
||
# SSH settings
|
||
################################################################################################################################
|
||
ssh:
|
||
allow_hardening: true # For additional hardening of SSH connections via TCP wrapper: '/etc/hosts.allow'.
|
||
# If "allow_hardening" = "true", at least one 'allow_ipv4' MUST be provided.
|
||
allow_ipv4: # Provide Bastion / Jump-Server / static VPN-Exit-Nodes IPv4: will be added: 'f2ban-ignoreip'.
|
||
# Also, ufw will be configured to ufw aggressive approach:
|
||
# Any valid client communicating with the server should be going directly to the service ports
|
||
# opened in ufw (ssh, 80, ...). Any client touching other ports is treated as malicious and
|
||
# therefore is blocked access to ALL ports after 1 attempt.
|
||
- 202.61.246.50
|
||
allow_ipv6: # Provide Bastion / Jump-Server / static VPN-Exit-Nodes IPv6: will be added: 'f2ban-ignoreip'.
|
||
- 2a03:4000:53:f:abcd:9494:0:2
|
||
port: 42137 # SSH Port.
|
||
root_ca: "/.preseed/ssh_root_ca.pub"
|
||
|
||
################################################################################################################################
|
||
# User settings
|
||
################################################################################################################################
|
||
user:
|
||
mfa:
|
||
info: "totp:v1"
|
||
salt: "CISS:CDI:OTP" # + (Server_FQDN/Username)
|
||
##############################################################################################################################
|
||
# Root: The superuser account (normally disabled for direct login).
|
||
# Key 'user.root.password' MUST contain a valid yescrypt hashed password string.
|
||
# Key 'user.root.sshpubkey' MUST be set in case dropbear is used.
|
||
##############################################################################################################################
|
||
root:
|
||
ensure: present # Must always be 'present'. (Not in use in this version of the installer.)
|
||
protected: true # Prevent unintentional edits or deletions. (Not in use in this version of the installer.)
|
||
shell: /bin/zsh # Login shell (e.g., '/bin/bash', '/bin/zsh'); use '/usr/sbin/nologin' for non-interactive users.
|
||
password: "$y$jFT$7pQlcZrgTEGrzkEm7UQW/.$QoCamalYEAV5mN4QWIE.xpHo8kvXa9sym2Uz.9oELwA"
|
||
sshpubkey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAYZDAqVZUk3LwJsqeVHKvLn8UKkFx642VBbiSS8uSY 2025_ciss.debian.live.ISO_PUBLIC_ONLY"
|
||
authentication:
|
||
access:
|
||
ssh: false # Allow SSH access.
|
||
tty: false # Allow TTY (local console) login.
|
||
password: true # Allow password login. SSH password login is always disabled.
|
||
2fa:
|
||
ssh: true # Require 2FA for SSH access.
|
||
tty: true # Require 2FA for TTY (local console) login.
|
||
privileges:
|
||
description: "Root user with full system access and administrative privileges."
|
||
restricted: false # If true, the user is limited in scope (e.g., no login, no file access, --no-create-home)
|
||
shell: true # MUST be "true" if the shell is not '/usr/sbin/nologin' or '/bin/false'.
|
||
sudo: false # Whether the user can escalate to root using sudo.
|
||
system: true # Whether this is a low-UID system user (e.g., for automation).
|
||
specific: "ciss" # Adjust the settings for the user account as required. Allowed values are 'none', 'ciss', and
|
||
# 'physnet'.
|
||
|
||
##############################################################################################################################
|
||
# Primary administrative user with full sudo access
|
||
##############################################################################################################################
|
||
user0:
|
||
ensure: present # Must always be 'present'. (Not in use in this version of the installer.)
|
||
protected: true # Prevent unintentional edits or deletions. (Not in use in this version of the installer.)
|
||
name: "msw" # The name of the user account. No ":" allowed.
|
||
fullname: "msw" # The full name of the user account holder.
|
||
uid: 1000 # Ensures that the same user has the same UID on all systems.
|
||
gid: 1000 # Ensures that the same user has the same GID on all systems.
|
||
shell: /bin/zsh # Login shell (e.g., '/bin/bash', '/bin/zsh'); use '/usr/sbin/nologin' for non-interactive users.
|
||
password: "$y$jFT$OGeZONH5ho2JSXvAbyIBQ1$5OhyHqOaMZ9BZcfMOYEwF.nMLFKd9ceiW2oNksPCHVB"
|
||
sshpubkey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAYZDAqVZUk3LwJsqeVHKvLn8UKkFx642VBbiSS8uSY 2025_ciss.debian.live.ISO_PUBLIC_ONLY"
|
||
authentication:
|
||
access:
|
||
ssh: true # Allow SSH access.
|
||
tty: true # Allow TTY (local console) login.
|
||
password: true # Allow password login. SSH password login is always disabled.
|
||
2fa:
|
||
ssh: true # Require 2FA for SSH access.
|
||
tty: true # Require 2FA for TTY (local console) login.
|
||
privileges:
|
||
description: "Primary admin user with full sudo access and interactive login."
|
||
sudo: true # Whether the user can escalate to root using sudo.
|
||
system: false # Whether this is a low-UID system user (e.g., for automation).
|
||
restricted: false # If true, the user is limited in scope (e.g., no login, no file access, --no-create-home)
|
||
shell: true # MUST be "true" if the shell is not '/usr/sbin/nologin' or '/bin/false'.
|
||
specific: "ciss" # Adjust the settings for the user account as required. Allowed values are 'none', 'ciss', and
|
||
# 'physnet'.
|
||
|
||
##############################################################################################################################
|
||
# ansible – System user for automation, no interactive shell
|
||
##############################################################################################################################
|
||
user1:
|
||
ensure: present # "present" = create user; "absent" = remove user
|
||
protected: true # Prevent unintentional edits or deletions.
|
||
name: "ansible" # The name of the user account. No ":" allowed.
|
||
fullname: "ansible" # The full name of the user account holder.
|
||
uid: 137 # Ensures that the same user has the same UID on all systems.
|
||
gid: 137 # Ensures that the same user has the same GID on all systems.
|
||
shell: /bin/bash # Login shell (e.g., '/bin/bash', '/bin/zsh'); use '/usr/sbin/nologin' for non-interactive users.
|
||
password: "" # No password set for ansible user.
|
||
sshpubkey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAYZDAqVZUk3LwJsqeVHKvLn8UKkFx642VBbiSS8uSY 2025_ciss.debian.live.ISO_PUBLIC_ONLY"
|
||
authentication:
|
||
access:
|
||
ssh: true # Allow SSH access.
|
||
tty: false # Allow TTY (local console) login.
|
||
password: false # Allow password login. SSH password login is always disabled.
|
||
2fa:
|
||
ssh: false # Require 2FA for SSH access.
|
||
tty: false # Require 2FA for TTY (local console) login.
|
||
privileges:
|
||
description: "Ansible automation user with sudo, key-only SSH, no TTY."
|
||
sudo: true # Whether the user can escalate to root using sudo.
|
||
system: true # Whether this is a low-UID system user (e.g., for automation).
|
||
restricted: false # If true, the user is limited in scope (e.g., no login, no file access, --no-create-home)
|
||
shell: true # MUST be "true" if the shell is not '/usr/sbin/nologin' or '/bin/false'.
|
||
specific: "none" # Adjust the settings for the user account as required. Allowed values are 'none', 'ciss', and
|
||
# 'physnet'.
|
||
|
||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml
|