From 205678c415d3fcd4638e08edeb8490b046894cabb5e2bf60541738ffaa4d2c6f Mon Sep 17 00:00:00 2001 From: "Marc S. Weidner" Date: Wed, 3 Dec 2025 19:15:00 +0100 Subject: [PATCH] V8.13.528.2025.12.03 Signed-off-by: Marc S. Weidner --- config/hooks/live/0900_ufw_setup.chroot | 1 + config/hooks/live/9935_hardening_ssl.chroot | 454 ++++++++++++++++++ .../lib/live/boot/0030-ciss-verify-checksums | 10 +- .../live/boot/0042_ciss_post_decrypt_attest | 91 +--- .../usr/lib/live/boot/9990-overlay.sh | 5 +- lib/lib_provider_netcup.sh | 2 +- scripts/0010_dhcp_supersede.sh | 4 +- 7 files changed, 484 insertions(+), 83 deletions(-) create mode 100644 config/hooks/live/9935_hardening_ssl.chroot diff --git a/config/hooks/live/0900_ufw_setup.chroot b/config/hooks/live/0900_ufw_setup.chroot index c78e117..45aea05 100644 --- a/config/hooks/live/0900_ufw_setup.chroot +++ b/config/hooks/live/0900_ufw_setup.chroot @@ -41,6 +41,7 @@ if [[ ${UFW_OUT_POLICY,,} == "deny" ]]; then ufw allow out 443/tcp comment 'Outgoing HTTPS' ufw allow out 465/tcp comment 'Outgoing SMTPS' ufw allow out 587/tcp comment 'Outgoing SMTPS' + ufw allow out 853/tcp comment 'Outgoing DoT' ufw allow out 993/tcp comment 'Outgoing IMAPS' ufw allow out 4460/tcp comment 'Outgoing NTS' ufw allow out "${SSHPORT}"/tcp comment 'Outgoing SSH (Custom-Port)' diff --git a/config/hooks/live/9935_hardening_ssl.chroot b/config/hooks/live/9935_hardening_ssl.chroot new file mode 100644 index 0000000..2b45299 --- /dev/null +++ b/config/hooks/live/9935_hardening_ssl.chroot @@ -0,0 +1,454 @@ +#!/bin/bash +# SPDX-Version: 3.0 +# SPDX-CreationInfo: 2025-12-03; WEIDNER, Marc S.; +# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git +# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency +# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; +# SPDX-FileType: SOURCE +# SPDX-License-Identifier: LicenseRef-CNCL-1.1 OR LicenseRef-CCLA-1.1 +# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework. +# SPDX-PackageName: CISS.debian.live.builder +# SPDX-Security-Contact: security@coresecret.eu +set -Ceuo pipefail + +printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ ๐Ÿงช '%s' starting ... \e[0m\n" "${0}" + +mkdir -p /root/.ciss/cdlb/backup/etc/ssl + +mv /etc/ssl/openssl.cnf /root/.ciss/cdlb/backup/etc/ssl/openssl.cnf.bak + +cat << 'EOF' >| /etc/ssl/openssl.cnf +# +# OpenSSL example configuration file. +# See doc/man5/config.pod for more information. +# +# This is mostly being used for generation of certificate requests, +# but may be used for autoloading of providers + +# Note that you can include other files from the main configuration +# file using the .include directive. +#.include filename + +openssl_conf = default_conf + +# This definition stops the following lines choking if HOME isn't +# defined. +HOME = . + +# Use this to automatically load providers. +openssl_conf = openssl_init + +# Comment out the next line to ignore configuration errors +config_diagnostics = 1 + +# Extra OBJECT IDENTIFIER information: +# oid_file = $ENV::HOME/.oid +oid_section = new_oids + +# To use this configuration file with the "-extfile" option of the +# "openssl x509" utility, name here the section containing the +# X.509v3 extensions to use: +# extensions = +# (Alternatively, use a configuration file that has only +# X.509v3 extensions in its main [= default] section.) + +[ new_oids ] +# We can add new OIDs in here for use by 'ca,' 'req,' and 'ts.' +# Add a simple OID like this: +# testoid1=1.2.3.4 +# Or use config file substitution like this: +# testoid2=${testoid1}.5.6 + +# Policies used by the TSA examples. +tsa_policy1 = 1.2.3.4.1 +tsa_policy2 = 1.2.3.4.5.6 +tsa_policy3 = 1.2.3.4.5.7 + +# For FIPS +# Optionally include a file that is generated by the OpenSSL fipsinstall +# application. This file contains configuration data required by the OpenSSL +# fips provider. It contains a named section e.g., [fips_sect] which is +# referenced from the [provider_sect] below. +# Refer to the OpenSSL security policy for more information. +# .include fipsmodule.cnf + +[openssl_init] +providers = provider_sect + +# List of providers to load +[provider_sect] +default = default_sect +# The fips section name should match the section name inside the +# included fipsmodule.cnf. +# fips = fips_sect + +# If no providers are activated explicitly, the default one is activated implicitly. +# See man 7 OSSL_PROVIDER-default for more details. +# +# If you add a section explicitly activating any other provider(s), you most +# probably need to explicitly activate the default provider, otherwise it +# becomes unavailable in openssl. As a consequence, applications depending on +# OpenSSL may not work correctly, which could lead to significant system +# problems including inability to remotely access the system. +[default_sect] +# activate = 1 + + +#################################################################### +[ ca ] +default_ca = CA_default # The default ca section + +#################################################################### +[ CA_default ] + +dir = ./demoCA # Where everything is kept +certs = $dir/certs # Where the issued certs are kept +crl_dir = $dir/crl # Where the issued crl are kept +database = $dir/index.txt # database index file. +#unique_subject = no # Set to 'no' to allow creation of several certs with the same subject. +new_certs_dir = $dir/newcerts # default place for new certs. + +certificate = $dir/cacert.pem # The CA certificate +serial = $dir/serial # The current serial number +crlnumber = $dir/crlnumber # the current crl number + # must be commented out to leave a V1 CRL +crl = $dir/crl.pem # The current CRL +private_key = $dir/private/cakey.pem # The private key + +x509_extensions = usr_cert # The extensions to add to the cert + +# Comment out the following two lines for the "traditional" +# (and highly broken) format. +name_opt = ca_default # Subject Name options +cert_opt = ca_default # Certificate field options + +# Extension copying option: use with caution. +# copy_extensions = copy + +# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs +# so this is commented out by default to leave a V1 CRL. +# crlnumber must also be commented out to leave a V1 CRL. +# crl_extensions = crl_ext + +default_days = 365 # how long to certify for +default_crl_days= 30 # how long before next CRL +default_md = default # use public key default MD +preserve = no # keep passed DN ordering + +# A few different ways of specifying how similar the request should look +# For type CA, the listed attributes must be the same, and the optional +# and supplied fields are just that. +policy = policy_match + +# For the CA policy +[ policy_match ] +countryName = match +stateOrProvinceName = match +organizationName = match +organizationalUnitName = optional +commonName = supplied +emailAddress = optional + +# For the 'anything' policy +# At this point in time, you must list all acceptable 'object' +# types. +[ policy_anything ] +countryName = optional +stateOrProvinceName = optional +localityName = optional +organizationName = optional +organizationalUnitName = optional +commonName = supplied +emailAddress = optional + +#################################################################### +[ req ] +default_bits = 4096 +default_keyfile = privkey.pem +distinguished_name = req_distinguished_name +attributes = req_attributes +x509_extensions = v3_ca # The extensions to add to the self-signed cert + +# Passwords for private keys if not present, they will be prompted for +# input_password = secret +# output_password = secret + +# This sets a mask for permitted string types. There are several options. +# default: PrintableString, T61String, BMPString. +# pkix : PrintableString, BMPString (PKIX recommendation before 2004) +# utf8only: only UTF8Strings (PKIX recommendation after 2004). +# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings). +# MASK:XXXX a literal mask value. +# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings. +string_mask = utf8only + +# req_extensions = v3_req # The extensions to add to a certificate request + +[ req_distinguished_name ] +countryName = Country Name (2-letter code) +countryName_default = AU +countryName_min = 2 +countryName_max = 2 + +stateOrProvinceName = State or Province Name (full name) +stateOrProvinceName_default = Some-State + +localityName = Locality Name (e.g., city) + +0.organizationName = Organization Name (e.g., company) +0.organizationName_default = Internet Widgits Pty Ltd + +# we can do this, but it is unnecessary normally +#1.organizationName = Second Organization Name (e.g., company) +#1.organizationName_default = World Wide Web Pty Ltd + +organizationalUnitName = Organizational Unit Name (e.g., section) +#organizationalUnitName_default = + +commonName = Common Name (e.g., server FQDN or YOUR name) +commonName_max = 64 + +emailAddress = Email Address +emailAddress_max = 64 + +# SET-ex3 = SET extension number 3 + +[ req_attributes ] +challengePassword = A challenge password +challengePassword_min = 4 +challengePassword_max = 20 + +unstructuredName = An optional company name + +[ usr_cert ] + +# These extensions are added when 'ca' signs a request. + +# This goes against PKIX guidelines, but some CAs do it, and some software +# requires this to avoid interpreting an end user certificate as a CA. + +basicConstraints=CA:FALSE + +# This is typical in keyUsage for a client certificate. +# keyUsage = nonRepudiation, digitalSignature, keyEncipherment + +# PKIX recommendations harmless if included in all certificates. +subjectKeyIdentifier=hash +authorityKeyIdentifier=keyid,issuer + +# This stuff is for subjectAltName and issuerAltname. +# Import the email address. +# subjectAltName=email:copy +# An alternative to produce certificates that aren't +# deprecated, according to PKIX. +# subjectAltName=email:move + +# Copy subject details +# issuerAltName=issuer:copy + +# This is required for TSA certificates. +# extendedKeyUsage = critical,timeStamping + +[ v3_req ] + +# Extensions to add to a certificate request + +basicConstraints = CA:FALSE +keyUsage = nonRepudiation, digitalSignature, keyEncipherment + +[ v3_ca ] + + +# Extensions for a typical CA + + +# PKIX recommendation. + +subjectKeyIdentifier=hash + +authorityKeyIdentifier=keyid:always,issuer + +basicConstraints = critical,CA:true + +# Key usage: this is typical for a CA certificate. However, since it will +# prevent it being used as a test self-signed certificate, it is best +# left out by default. +# keyUsage = cRLSign, keyCertSign + +# Include email address in subject alt name: another PKIX recommendation +# subjectAltName=email:copy +# Copy issuer details +# issuerAltName=issuer:copy + +# DER hex encoding of an extension: beware experts only! +# obj=DER:02:03 +# Where 'obj' is a standard or added object +# You can even override a supported extension: +# basicConstraints= critical, DER:30:03:01:01:FF + +[ crl_ext ] + +# CRL extensions. +# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL. + +# issuerAltName=issuer:copy +authorityKeyIdentifier=keyid:always + +[ proxy_cert_ext ] +# These extensions should be added when creating a proxy certificate + +# This goes against PKIX guidelines, but some CAs do it, and some software +# requires this to avoid interpreting an end user certificate as a CA. + +basicConstraints=CA:FALSE + +# This is typical in keyUsage for a client certificate. +# keyUsage = nonRepudiation, digitalSignature, keyEncipherment + +# PKIX recommendations harmless if included in all certificates. +subjectKeyIdentifier=hash +authorityKeyIdentifier=keyid,issuer + +# This stuff is for subjectAltName and issuerAltname. +# Import the email address. +# subjectAltName=email:copy +# An alternative to produce certificates that aren't +# deprecated, according to PKIX. +# subjectAltName=email:move + +# Copy subject details +# issuerAltName=issuer:copy + +# This really needs to be in place for it to be a proxy certificate. +proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo + +#################################################################### +[ tsa ] + +default_tsa = tsa_config1 # the default TSA section + +[ tsa_config1 ] + +# These are used by the TSA reply generation only. +dir = ./demoCA # TSA root directory +serial = $dir/tsaserial # The current serial number (mandatory) +crypto_device = builtin # OpenSSL engine to use for signing +signer_cert = $dir/tsacert.pem # The TSA signing certificate + # (optional) +certs = $dir/cacert.pem # Certificate chain to include in reply + # (optional) +signer_key = $dir/private/tsakey.pem # The TSA private key (optional) +signer_digest = sha256 # Signing digest to use. (Optional) +default_policy = tsa_policy1 # Policy if request did not specify it + # (optional) +other_policies = tsa_policy2, tsa_policy3 # acceptable policies (optional) +digests = sha1, sha256, sha384, sha512 # Acceptable message digests (mandatory) +accuracy = secs:1, millisecs:500, microsecs:100 # (optional) +clock_precision_digits = 0 # number of digits after dot. (optional) +ordering = yes # Is ordering defined for timestamps? + # (optional, default: no) +tsa_name = yes # Must the TSA name be included in the reply? + # (optional, default: no) +ess_cert_id_chain = no # Must the ESS cert id chain be included? + # (optional, default: no) +ess_cert_id_alg = sha256 # algorithm to compute certificate + # identifier (optional, default: sha256) + +[insta] # CMP using Insta Demo CA +# Message transfer +server = pki.certificate.fi:8700 +# proxy = # set this as far as needed, e.g., http://192.168.1.1:8080 +# tls_use = 0 +path = pkix/ + +# Server authentication +recipient = "/C=FI/O=Insta Demo/CN=Insta Demo CA" # or set srvcert or issuer +ignore_keyusage = 1 # quirk needed to accept Insta CA cert not including digitalsignature +unprotected_errors = 1 # quirk needed to accept negative responses possibly not protected +extracertsout = insta.extracerts.pem + +# Client authentication +ref = 3078 # user identification +secret = pass:insta # can be used for both client and server side + +# Generic message options +cmd = ir # default operation, can be overridden on cmd line with, e.g., kur + +# Certificate enrollment +subject = "/CN=openssl-cmp-test" +newkey = insta.priv.pem +out_trusted = apps/insta.ca.crt # does not include keyUsage digitalSignature +certout = insta.cert.pem + +[pbm] # Password-based protection for Insta CA +# Server and client authentication +ref = $insta::ref # 3078 +secret = $insta::secret # pass:insta + +[signature] # Signature-based protection for Insta CA +# Server authentication +trusted = $insta::out_trusted # apps/insta.ca.crt + +# Client authentication +secret = # disable the PBM +key = $insta::newkey # insta.priv.pem +cert = $insta::certout # insta.cert.pem + +[ir] +cmd = ir + +[cr] +cmd = cr + +[kur] +# Certificate update +cmd = kur +oldcert = $insta::certout # insta.cert.pem + +[rr] +# Certificate revocation +cmd = rr +oldcert = $insta::certout # insta.cert.pem + +##### Added by CISS.debian.live.builder ##### +[default_conf] +ssl_conf = ssl_sect + +[ssl_sect] +system_default = system_default_sect + +[system_default_sect] +# Protocol floor / ceiling: +# - only TLS 1.2 and 1.3. +# - TLS 1.3 is FS by design; +# - TLS 1.2 FS enforced via the cipher list. +MinProtocol = TLSv1.2 +MaxProtocol = TLSv1.3 + +# TLS 1.2 cipher policy: +# - Forward secrecy only: ECDHE or DHE (no static RSA kx); +# - AES-256 *GCM* only (no DHE (dheatattack), no AES-128, no CBC); +# - Keep distro default SECLEVEL=2 explicitly. +CipherString = ECDHE+AES256-GCM:ECDHE+CHACHA20:ECDHE+ARIA256-GCM:ECDHE+CAMELLIA256-GCM:!kRSA:!PSK:!SRP:!aNULL:!eNULL:@SECLEVEL=2 + +# TLS 1.3 cipher policy: AES-256 and ChaCha20-Poly1305 only: +Ciphersuites = TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 + +# Prefer strong, widely supported ECDHE groups (first = most preferred): +Groups = X448:P-521:P-384 + +SignatureAlgorithms = rsa_pss_rsae_sha512:rsa_pss_rsae_sha384:rsa_pss_rsae_sha256 + +# Operational flags: +# -SessionTicket โ‡’ disable TLS session tickets (TLS 1.2 + 1.3) +# ServerPreference โ‡’ honor server cipher order (TLS 1.2) +# NoRenegotiation โ‡’ disallow TLS 1.2 renegotiation +Options = -SessionTicket,ServerPreference,NoRenegotiation + +# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf +EOF + +printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ โœ… '%s' applied successfully. \e[0m\n" "${0}" + +exit 0 +# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh diff --git a/config/includes.chroot/usr/lib/live/boot/0030-ciss-verify-checksums b/config/includes.chroot/usr/lib/live/boot/0030-ciss-verify-checksums index a1b03db..a4292e1 100644 --- a/config/includes.chroot/usr/lib/live/boot/0030-ciss-verify-checksums +++ b/config/includes.chroot/usr/lib/live/boot/0030-ciss-verify-checksums @@ -299,16 +299,14 @@ Verify_checksums() { case "${_RETURN_PGP},${_RETURN_SHA}" in "0,0") - log_ok "Verification of [GPG signature] and [sha checksum] file successful; continuing booting in 8 seconds." - log_success_msg "Verification of [GPG signature] and [sha checksum] file successful; continuing booting in 8 seconds." - sleep 8 + log_ok "Verification of [GPG signature] and [sha checksum] file successful; continuing booting." + log_success_msg "Verification of [GPG signature] and [sha checksum] file successful; continuing booting." return 0 ;; "na,0") - log_ok "Verification of [sha checksum] file successful; continuing booting in 8 seconds." - log_success_msg "Verification of [sha checksum] file successful; continuing booting in 8 seconds." - sleep 8 + log_ok "Verification of [sha checksum] file successful; continuing booting." + log_success_msg "Verification of [sha checksum] file successful; continuing booting." return 0 ;; diff --git a/config/includes.chroot/usr/lib/live/boot/0042_ciss_post_decrypt_attest b/config/includes.chroot/usr/lib/live/boot/0042_ciss_post_decrypt_attest index 2750247..9f878e3 100644 --- a/config/includes.chroot/usr/lib/live/boot/0042_ciss_post_decrypt_attest +++ b/config/includes.chroot/usr/lib/live/boot/0042_ciss_post_decrypt_attest @@ -17,8 +17,6 @@ # Purpose: Late rootfs attestation and dmsetup health checking. # Phase : executed by live-boot inside the 9990-main.sh. -# TODO: Remove Debug Mode - _SAVED_SET_OPTS="$(set +o)" set -eu @@ -72,10 +70,26 @@ HASH_FILE="${CDLB_ATTEST_FPR_SHA}" SIGN_FILE="${CDLB_ATTEST_FPR_SIG}" KEYFILE="${CDLB_KEY_DIR}/${CDLB_EXP_FPR}.gpg" -[ -s "${KEYFILE}" ] || { log_er "0042() : No public key found under: [${CDLB_KEY_DIR}/${CDLB_EXP_FPR}.gpg]"; exit 42; } -[ -s "${HASH_FILE}" ] || { log_er "0042() : Attestation data missing: [${HASH_FILE}]"; exit 42; } -[ -s "${SIGN_FILE}" ] || { log_er "0042() : Attestation signature missing: [${SIGN_FILE}]"; exit 42; } +if [ -s "${KEYFILE}" ]; then + log_er "0042() : No public key found under: [${CDLB_KEY_DIR}/${CDLB_EXP_FPR}.gpg]" + panic "0042() : No public key found under: [${CDLB_KEY_DIR}/${CDLB_EXP_FPR}.gpg]" + +fi + +if [ -s "${HASH_FILE}" ]; then + + log_er "0042() : Attestation data missing: [${HASH_FILE}]" + panic "0042() : Attestation data missing: [${HASH_FILE}]" + +fi + +if [ -s "${SIGN_FILE}" ]; then + + log_er "0042() : Attestation signature missing: [${SIGN_FILE}]" + panic "0042() : Attestation signature missing: [${SIGN_FILE}]" + +fi log_in "0042() : Verifying rootfs attestation with 'gpgv' and inside LUKS encrypted rootfs pinned GPG FPR." _STATUS="$(/usr/bin/gpgv --keyring "${KEYFILE}" --status-fd 1 "${SIGN_FILE}" "${HASH_FILE}")" @@ -89,71 +103,8 @@ if [ "${_CDLB_SIG_FILE_FPR}" = "${CDLB_EXP_FPR}" ]; then else log_er "0042() : Signature FPR mismatch: got: [${_CDLB_SIG_FILE_FPR}] expected: [${CDLB_EXP_FPR}]" - #sleep 8 - #panic "[FATAL] Signature FPR mismatch: got: [${_CDLB_SIG_FILE_FPR}] expected: [${CDLB_EXP_FPR}]." - -fi - -### 'dmsetup' health check ----------------------------------------------------------------------------------------------------- -MAP_DEV="/dev/mapper/${CDLB_MAPPER_NAME}" -if [ -b "${MAP_DEV}" ]; then - - log_in "0042() : Checking dmsetup table for ${MAP_DEV}" - - TOP_LINE="$(/usr/sbin/dmsetup table --showkeys "${MAP_DEV}" 2>/dev/null | awk 'NR==1{print; exit}')" - if printf '%s\n' "${TOP_LINE}" | grep -q ' crypt '; then - - log_ok "0042() : Top layer is 'crypt'." - - else - - log_er "0042() : Top layer is NOT 'crypt'." - #sleep 8 - #panic "[FATAL] Top layer is NOT 'crypt'." - - fi - - if printf '%s\n' "${TOP_LINE}" | grep -Eq ' xts|aes-xts'; then - - log_ok "0042() : Cipher looks like AES-XTS." - - else - - log_er "0042() : Cipher does not look like AES-XTS." - #sleep 8 - #panic "[FATAL] Cipher does not look like AES-XTS." - - fi - - ### Extract child device token (the second last field is 'device', the last is 'offset.') -------------------------------------- - CHILD_TOK="$(printf '%s\n' "${TOP_LINE}" | awk '{print $(NF-1)}')" - CHILD_NAME="${CHILD_TOK}" - - case "${CHILD_TOK}" in - - *:* ) - if [ -e "/sys/dev/block/${CHILD_TOK}/dm/name" ]; then - CHILD_NAME="$(cat "/sys/dev/block/${CHILD_TOK}/dm/name" 2>/dev/null || true)" - [ -n "${CHILD_NAME}" ] || CHILD_NAME="${CHILD_TOK}" - fi - ;; - - /dev/* ) - CHILD_NAME="$(basename -- "${CHILD_TOK}")" - ;; - - esac - - #### Child layer must be 'integrity' with hmac and sha512 and 4096-byte sectors (best-effort greps). --------------------------- - log_in "Checking underlying integrity target: ${CHILD_NAME}" - - CHILD_TAB="$(/usr/sbin/dmsetup table --showkeys "${CHILD_NAME}" 2>/dev/null || true)" - printf '%s\n' "${CHILD_TAB}" | grep -q ' integrity ' || { log_er "0042() : Underlying layer is not 'integrity'"; } - printf '%s\n' "${CHILD_TAB}" | grep -qi 'hmac' || { log_er "0042() : Integrity target not using keyed MAC (hmac)"; } - printf '%s\n' "${CHILD_TAB}" | grep -qi 'sha512' || { log_er "0042() : Integrity algo not sha512"; } - printf '%s\n' "${CHILD_TAB}" | grep -Eq '\b4096\b' || { log_er "0042() : Expected 4096-byte sector size not found"; } - - log_ok "0042() : dm-crypt and dm-integrity(HMAC-SHA512, 4096B) chain looks healthy." + sleep 8 + panic "[FATAL] Signature FPR mismatch: got: [${_CDLB_SIG_FILE_FPR}] expected: [${CDLB_EXP_FPR}]." fi diff --git a/config/includes.chroot/usr/lib/live/boot/9990-overlay.sh b/config/includes.chroot/usr/lib/live/boot/9990-overlay.sh index ba4e0fe..7d9293a 100644 --- a/config/includes.chroot/usr/lib/live/boot/9990-overlay.sh +++ b/config/includes.chroot/usr/lib/live/boot/9990-overlay.sh @@ -488,13 +488,10 @@ setup_unionfs () done fi - # TODO: Remove Debug ### CISS override for /usr/lib/live/boot/0042_ciss_post_decrypt_attest ------------------------------------------------------- - printf "\e[92m[INFO] Calling : [/usr/lib/live/boot/0042_ciss_post_decrypt_attest] ... \n\e[0m" + printf "\e[95m[INFO] Calling : [/usr/lib/live/boot/0042_ciss_post_decrypt_attest] ... \n\e[0m" [ -x /usr/lib/live/boot/0042_ciss_post_decrypt_attest ] && /usr/lib/live/boot/0042_ciss_post_decrypt_attest printf "\e[92m[INFO] Calling : [/usr/lib/live/boot/0042_ciss_post_decrypt_attest] done. \n\e[0m" - - sleep 16 ### CISS override for /usr/lib/live/boot/0042_ciss_post_decrypt_attest ------------------------------------------------------- printf "\e[92m[INFO] Successfully applied : [/usr/lib/live/boot/9990-overlay.sh] \n\e[0m" diff --git a/lib/lib_provider_netcup.sh b/lib/lib_provider_netcup.sh index 4db323c..d68bf2c 100644 --- a/lib/lib_provider_netcup.sh +++ b/lib/lib_provider_netcup.sh @@ -56,7 +56,7 @@ DNS=138.199.237.109 DNS=2a01:4f9:c012:a813:135:181:207:105 DNS=2a0a:4cc0:1:e6:89:58:62:53 DNS=2a01:4f8:c013:8011:138:199:237:109 -DNSOverTLS=opportunistic +DNSOverTLS=yes DNSSEC=yes IPv6AcceptRA=no LinkLocalAddressing=ipv6 diff --git a/scripts/0010_dhcp_supersede.sh b/scripts/0010_dhcp_supersede.sh index 21e0893..e6167fb 100644 --- a/scripts/0010_dhcp_supersede.sh +++ b/scripts/0010_dhcp_supersede.sh @@ -21,7 +21,7 @@ fi cat << 'EOF' >| "${VAR_HANDLER_BUILD_DIR}"/config/includes.chroot/etc/systemd/network/90-ciss-ethernet.network # SPDX-Version: 3.0 -# SPDX-CreationInfo: 2025-11-26; WEIDNER, Marc S.; +# SPDX-CreationInfo: 2025-12-03; WEIDNER, Marc S.; # SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git # SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency # SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; @@ -42,7 +42,7 @@ DNS=138.199.237.109 DNS=2a01:4f9:c012:a813:135:181:207:105 DNS=2a0a:4cc0:1:e6:89:58:62:53 DNS=2a01:4f8:c013:8011:138:199:237:109 -DNSOverTLS=opportunistic +DNSOverTLS=yes DNSSEC=yes IPv6AcceptRA=yes LinkLocalAddressing=ipv6