Marc S. Weidner
a813ffb66c
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 2m7s
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
90 lines
7.1 KiB
Markdown
90 lines
7.1 KiB
Markdown
---
|
|
gitea: none
|
|
include_toc: true
|
|
---
|
|
[](https://git.coresecret.dev/msw/CISS.debian.installer)
|
|
|
|
[](https://eupl.eu/1.2/en/)
|
|
[](https://opensource.org/license/eupl-1-2)
|
|
[](https://www.gnu.org/software/bash/)
|
|
[](https://shellcheck.net/)
|
|
[](https://github.com/mvdan/sh)
|
|
[](https://google.github.io/styleguide/shellguide.html)
|
|
|
|
[](https://docs.gitea.com/)
|
|
[](https://www.jetbrains.com/store/?section=personal&billing=yearly)
|
|
[](https://keepassxc.org/)
|
|
[](https://www.netcup.com/de)
|
|
[](https://coresecret.eu/)
|
|
[](https://x.com/coresecret_eu)
|
|
[](https://coresecret.eu/spenden/#sepa)
|
|
[](https://coresecret.eu/spenden/#bitcoin)
|
|
[](https://coresecret.eu/contact/#simplex)
|
|
|
|
# 1. CISS.debian.installer
|
|
|
|
**Centurion Intelligence Consulting Agency Information Security Standard**<br>
|
|
*The CISS Debian Installer provides a fully automated and hardened installation process.*<br>
|
|
**Master Version**: 8.00<br>
|
|
**Build**: V8.00.000.2025.06.17<br>
|
|
|
|
This is a digitally signed, self-verifying shell script for installing a hardened Debian Bookworm server environment, based on
|
|
the latest server and service hardening best practices. Compared to the original Debian installer, this installer offers much
|
|
greater flexibility in terms of custom partitioning schemes and is more reliable than the Calamares suite.<br>
|
|
|
|
Check out more:
|
|
* [CenturionNet Services](https://coresecret.eu/cnet/)
|
|
* [CenturionDNS Resolver](https://eddns.eu/)
|
|
* [CenturionDNS Blocklist](https://dns.eddns.eu/blocklists/centurion_titanium_ultimate.txt)
|
|
* [CenturionNet Status](https://uptime.coresecret.eu/)
|
|
* [CenturionMeet](https://talk.e2ee.li/)
|
|
* [Contact the author](https://coresecret.eu/contact/)
|
|
|
|
## 1.1. Preliminary Remarks
|
|
|
|
### 1.1.1. HSM
|
|
Please note that all my signing keys are stored in an HSM and that the signing environment is air-gapped. The next step is to
|
|
move to a room-gapped environment. ^^
|
|
|
|
### 1.1.2. DNSSEC, HSTS, TLS
|
|
|
|
Please note that `coresecret.dev` is included in the [(HSTS Preload List)](https://hstspreload.org/) and always serves the headers:
|
|
````nginx configuration pro
|
|
add_header Expect-CT "max-age=86400, enforce" always;
|
|
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
|
|
````
|
|
|
|
* Additionally, the entire zone is dual-signed with **DNSSEC**. See the current **DNSSEC** status at: **[DNSSEC Audit Report](/docs/AUDIT_DNSSEC.md)**
|
|
* A comprehensive TLS audit of the **`git.coresecret.dev`** Gitea server is also available. See: **[TLS Audit Report](/docs/AUDIT_TLS.md)**
|
|
* The infrastructure of the **`CISS.debian.installer`** building system is visualized here. See: **[Centurion Net](/docs/CNET.md)**
|
|
|
|
### 1.1.3. Gitea Action Runner Hardening
|
|
|
|
The CI runners operate on a dedicated host system located in a completely separate Autonomous System (AS). This host is solely
|
|
dedicated to providing CI runners and does not perform any other tasks. Each runner is hermetically isolated from others using
|
|
non-privileged, shell-less user accounts with no direct login capability. Additionally, each runner executes within its own
|
|
separate directory tree, employs `DynamicUser` features, and adheres to strict systemd hardening policies
|
|
(achieving a ``systemd-analyze security``rating of **``2.6``**). Docker containers used by runners do not run in privileged
|
|
mode. Security is further enhanced through the use of both UFW software firewalls and dedicated hardware firewall appliances.
|
|
|
|
### 1.2. Keywords
|
|
|
|
The keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED",
|
|
"MAY", and "OPTIONAL" in this document are to be interpreted as described in [[BCP 14](https://www.rfc-editor.org/info/bcp14)],
|
|
[[RFC2119](https://datatracker.ietf.org/doc/html/rfc2119)], [[RFC8174](https://datatracker.ietf.org/doc/html/rfc8174)] when,
|
|
and only when, they appear in all capitals, as shown here.
|
|
|
|
# 6. Licensing & Compliance
|
|
|
|
This repository is fully SPDX-compliant. All source files include appropriate SPDX license identifiers and headers to ensure
|
|
clear and unambiguous licensing. You can verify compliance by reviewing the top of each file, which follows the SPDX
|
|
standard for license expressions and metadata.
|
|
|
|
# 7. Disclaimer
|
|
|
|
This README is provided "as-is" without any warranty. Review your organization's policies before deploying to production.
|
|
|
|
---
|
|
**[no tracking | no logging | no advertising | no profiling | no bullshit](https://coresecret.eu/)**
|
|
<!-- vim: set number et ts=2 sw=2 sts=2 ai tw=128 ft=markdown -->
|