msw/CISS.debian.live.builder
SHA256
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

## V8.13.128.2025.10.10
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 6m16s
Details
🔐 Generating a Private Live ISO TRIXIE. / 🔐 Generating a Private Live ISO TRIXIE. (push) Successful in 52m19s
Details
💙 Generating a PUBLIC Live ISO. / 💙 Generating a PUBLIC Live ISO. (push) Successful in 58m12s
Details

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-10-10 06:16:21 +01:00
parent a44bd771d3
commit 2d76fca675
7 changed files with 79 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.gitea/trigger/t_generate_PRIVATE_trixie_0.yaml
View File

@@ -10,6 +10,6 @@
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
build: build:
counter: 1023 counter: 1024
version: V8.13.128.2025.10.10 version: V8.13.128.2025.10.10
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml

2
.gitea/trigger/t_generate_PRIVATE_trixie_1.yaml
View File

@@ -10,6 +10,6 @@
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
build: build:
counter: 1023 counter: 1024
version: V8.13.128.2025.10.10 version: V8.13.128.2025.10.10
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml

2
.gitea/trigger/t_generate_PUBLIC.yaml
View File

@@ -10,6 +10,6 @@
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
build: build:
counter: 1023 counter: 1024
version: V8.13.128.2025.10.10 version: V8.13.128.2025.10.10
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml

44
config/hooks/live/0040_ssh_config_setup.chroot Normal file
View File

@@ -0,0 +1,44 @@
#!/bin/bash
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-10-10; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu
set -Ceuo pipefail
printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 '%s' starting ... \e[0m\n" "${0}"
cat << EOF >> /etc/ssh/ssh_config.d/10-sshfp.conf
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-10-10; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu
Host git.coresecret.dev
Port 42842
VerifyHostKeyDNS yes
StrictHostKeyChecking yes
GlobalKnownHostsFile /etc/ssh/ssh_known_hosts
UserKnownHostsFile /dev/null
HostKeyAlgorithms ssh-ed25519-cert-v01@openssh.com,ssh-ed25519,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-256
CanonicalizeHostname no
UpdateHostKeys no
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
EOF
printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ '%s' applied successfully. \e[0m\n" "${0}"
exit 0
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

42
config/hooks/live/0810_chrony_setup.chroot
View File

@@ -1,6 +1,6 @@
#!/bin/bash #!/bin/bash
# SPDX-Version: 3.0 # SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-05-05; WEIDNER, Marc S.; <msw@coresecret.dev> # SPDX-CreationInfo: 2025-10-10; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git # SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency # SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev> # SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
@@ -14,14 +14,27 @@ set -Ceuo pipefail
printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 '%s' starting ... \e[0m\n" "${0}" printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 '%s' starting ... \e[0m\n" "${0}"
mkdir -p /var/log/chrony mkdir -p /var/log/chrony
# See https://coresecret.eu/tutorials/debian-package-glossary/ for a brief description of the installed packages.
export DEBIAN_FRONTEND="noninteractive"
apt-get install chrony -y apt-get install chrony -y
systemctl enable chrony.service systemctl enable chrony.service
mv /etc/chrony/chrony.conf /root/.ciss/dlb/backup/chrony.conf.bak mv /etc/chrony/chrony.conf /root/.ciss/dlb/backup/chrony.conf.bak
chmod 644 /root/.ciss/dlb/backup/chrony.conf.bak chmod 0644 /root/.ciss/dlb/backup/chrony.conf.bak
cat << EOF >| /etc/chrony/chrony.conf
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-10-10; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu
cat << 'EOF' >| /etc/chrony/chrony.conf
# Include configuration files found in /etc/chrony/conf.d. # Include configuration files found in /etc/chrony/conf.d.
confdir /etc/chrony/conf.d confdir /etc/chrony/conf.d
driftfile /var/lib/chrony/chrony.drift driftfile /var/lib/chrony/chrony.drift
@@ -35,16 +48,14 @@ log tracking measurements statistics
authselectmode require authselectmode require
server ptbtime1.ptb.de iburst nts minpoll 5 maxpoll 9 server ntp.ripe.net iburst nts minpoll 5 maxpoll 9
server ptbtime2.ptb.de iburst nts minpoll 5 maxpoll 9 server ptbtime3.ptb.de iburst nts minpoll 5 maxpoll 9
server ptbtime3.ptb.de iburst nts minpoll 5 maxpoll 9 server ptbtime2.ptb.de iburst nts minpoll 5 maxpoll 9
server ptbtime4.ptb.de iburst nts minpoll 5 maxpoll 9 server ptbtime1.ptb.de iburst nts minpoll 5 maxpoll 9
server sth1.ntp.se iburst nts minpoll 5 maxpoll 9 server ntp13.metas.ch iburst nts minpoll 5 maxpoll 9
server ntp0.fau.de iburst nts minpoll 5 maxpoll 9 server time-c-b.nist.gov iburst nts minpoll 5 maxpoll 9
server ntp13.metas.ch iburst nts minpoll 5 maxpoll 9 server sth1.ntp.se iburst nts minpoll 5 maxpoll 9
# server ntp.ripe.net iburst nts minpoll 5 maxpoll 9 server ntp0.fau.de iburst nts minpoll 5 maxpoll 9
# server ntp2.tecnico.ulisboa.pt iburst nts minpoll 5 maxpoll 9
# server time-c-b.nist.gov iburst nts minpoll 5 maxpoll 9
leapsectz right/UTC leapsectz right/UTC
@@ -57,10 +68,9 @@ rtcsync
makestep 1 3 makestep 1 3
EOF EOF
chmod 644 /etc/chrony/chrony.conf chmod 0644 /etc/chrony/chrony.conf
printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ '%s' applied successfully. \e[0m\n" "${0}" printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ '%s' applied successfully. \e[0m\n" "${0}"
# sleep 1
exit 0 exit 0
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

10
config/includes.chroot/etc/ssh/sshd_config
View File

@@ -131,14 +131,4 @@ HostbasedAuthentication no
# PermitUserEnvironment no # PermitUserEnvironment no
# IgnoreUserKnownHosts no # IgnoreUserKnownHosts no
Host git.coresecret.dev
Port 42842
VerifyHostKeyDNS yes
StrictHostKeyChecking yes
GlobalKnownHostsFile /etc/ssh/ssh_known_hosts
UserKnownHostsFile /dev/null
HostKeyAlgorithms ssh-ed25519-cert-v01@openssh.com,ssh-ed25519,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-256
CanonicalizeHostname no
UpdateHostKeys no
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf

6
docs/CHANGELOG.md
View File

@@ -12,6 +12,12 @@ include_toc: true
# 2. Changelog # 2. Changelog
## V8.13.128.2025.10.10
* **Added**: [0040_ssh_config_setup.chroot](../config/hooks/live/0040_ssh_config_setup.chroot)
* **Updated**: [0810_chrony_setup.chroot](../config/hooks/live/0810_chrony_setup.chroot)
* **Updated**: [sshd_config](../config/includes.chroot/etc/ssh/sshd_config)
## V8.13.096.2025.10.09 ## V8.13.096.2025.10.09
* **Added**: [0010_install_apparmor.chroot](../config/hooks/live/0010_install_apparmor.chroot) * **Added**: [0010_install_apparmor.chroot](../config/hooks/live/0010_install_apparmor.chroot)
* **Added**: [10-sshfp.conf](../.archive/10-sshfp.conf) * **Added**: [10-sshfp.conf](../.archive/10-sshfp.conf)