msw/CISS.debian.live.builder
SHA256
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

V8.13.192.2025.10.18

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-10-18 18:03:07 +01:00
parent e3ef7631ef
commit 6bda13c9dc
69 changed files with 434 additions and 91 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
config/includes.chroot/etc/ssh/ssh_known_hosts
View File

@@ -9,7 +9,7 @@
# SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu
# Version Master V8.13.144.2025.10.16
# Version Master V8.13.192.2025.10.18
[git.coresecret.dev]:42842 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGQA107AVmg1D/jnyXiqbPf38zQRl8s3c+PM1zbfpeQl
[git.coresecret.dev]:42842 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDYD9ysmMWZlejUnxu0qOzeWcIYezoFLbYdo6ffGUL5kqOBAYb+5CF4bJLUpA93XFYVF+TbrcMV1yJh6JaHFL0VU5CvgAzruCeedx0c4qUV6lWcJUGNk5K0yb9n2Wosdy6F/zTOxL9KXBt/TV+cscsen2Dahvx0ctMKgNbu+vvUcWxHf9lOkbYoF/uA/nW5CVXy5XUPVUDFUhEeKXL85+6gid5AEMfYT8aRl5YDGvo1iMBmBYOljN4S7MnRe14qbAZG0GDGvF22eHbSU2pILcFIjc2Lo/S5Ox/MJpbLAqpFlLPTKgr6F7yVwfNMSNwl05ysUOZfrQKSXzCU6+lfqKYCwemLALyG/n1ernpp7/8W/2RYoz3fd+TQyfhW++rx3yUHpYCkTv9A4LRYZYGSAWKMHSBEYq3EcATQUxQi0xpwmcR+u0uC9F9eta5Bim+sBZD6F2hgPJ5xgYT8LFm880g1YadAwBoD4TAkqSvl+jYW0VA2GH9CknKHJ36gc/X4eeUHDC1Hf/E8M5RBj4D6NuHfeVRik/ahHmoCqKQUW7VU/EBsWFsngDiLEHcV71iMtWiUddWOHwoAPHIzn6p9HTeLCxTwsPMG5UDGK/S9HUozqDXxexRtqbcFa7DWuzRvZ1bcZ2VQsaafuzKCkkc4NjC7h1wssel7q9aeYPFg+1vS6Q==

10
config/includes.chroot/etc/ssh/sshd_config
View File

@@ -9,7 +9,7 @@
# SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu
# Version Master V8.13.144.2025.10.16
# Version Master V8.13.192.2025.10.18
### https://www.ssh-audit.com/
### ssh -Q cipher | cipher-auth | compression | kex | kex-gss | key | key-cert | key-plain | key-sig | mac | protocol-version | sig
@@ -43,12 +43,12 @@ PermitRootLogin prohibit-password
PasswordAuthentication no
PermitEmptyPasswords no
StrictModes yes
LoginGraceTime 2m
LoginGraceTime 30s
MaxAuthTries 3
MaxSessions 2
### Begin randomly dropping new unauthenticated connections after the 8th attempt,
### with a 64% chance to drop each additional connection, up to a hard limit of 16.
MaxStartups 08:64:16
### Begin randomly dropping new unauthenticated connections after the 2nd attempt,
### with a 64% chance to drop each additional connection, up to a hard limit of 08.
MaxStartups 02:64:08
### Restrict each individual source IP to only 4 unauthenticated connection slot
### in the concurrent MaxStartups pool, preventing one IP from monopolizing slots.
PerSourceMaxStartups 8

2
config/includes.chroot/etc/sysctl.d/99_local.hardened
View File

@@ -9,7 +9,7 @@
# SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu
# Version Master V8.13.144.2025.10.16
# Version Master V8.13.192.2025.10.18
### https://docs.kernel.org/
### https://github.com/a13xp0p0v/kernel-hardening-checker/

2
config/includes.chroot/preseed/.iso/preseed_hash_generator.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu
declare -gr VERSION="Master V8.13.144.2025.10.16"
declare -gr VERSION="Master V8.13.192.2025.10.18"
### VERY EARLY CHECK FOR DEBUGGING
if [[ $* == *" --debug "* ]]; then

2
config/includes.chroot/preseed/preseed.cfg
View File

@@ -112,4 +112,4 @@ d-i preseed/late_command string sh /preseed/.ash/3_di_preseed_late_command.sh
# Please consider donating to my work at: https://coresecret.eu/spenden/
###########################################################################################
# Written by: ./preseed_hash_generator.sh Version: Master V8.13.144.2025.10.16 at: 10:18:37.9542
# Written by: ./preseed_hash_generator.sh Version: Master V8.13.192.2025.10.18 at: 10:18:37.9542

18
config/includes.chroot/root/.bashrc
View File

@@ -14,15 +14,31 @@
### Never use 'errexit' | 'nounset' | 'pipefail' in interactive shells.
set +o errexit +o nounset +o pipefail
# shellcheck disable=SC2312
if [[ "$(id -u)" -eq 0 ]]; then
umask 0022
PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
else
umask 0077
PATH="/usr/local/bin:/usr/bin:/bin"
fi
export PATH
trap ' "${SHELL}" /root/.ciss/clean_logout.sh ' EXIT
source /root/.ciss/alias
source /root/.ciss/f2bchk.sh
source /root/.ciss/shortcuts
source /root/.ciss/scan_libwrap
### Preferred editor for local and remote sessions.
export EDITOR="nano"
# Optional, cautious filters (avoids trivial leaks, but not foolproof). Caution: HISTIGNORE is coarse-grained, don't overdo it.
export HISTIGNORE='*PASS*:*pass*:*secret*:*token*:*API_KEY*:*'
### History
touch /tmp/.bash_history
chmod 0660 /tmp/.bash_history
chmod 0600 /tmp/.bash_history
chown root:root /tmp/.bash_history
export HISTFILE=/tmp/.bash_history
export HISTSIZE=2048

3
config/includes.chroot/root/.ciss/alias
View File

@@ -10,9 +10,6 @@
# SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu
########################################################################################### Alpha
alias genkeyfile='haveged -n 1048576 >| /tmp/secure_keyfile_$(date +%s)'
########################################################################################### Bash
alias clear="printf '\033c'"
alias c='clear'

1
config/includes.chroot/root/.ciss/shortcuts
View File

@@ -41,7 +41,6 @@ declare -ga shortcuts=(
"f2bubn: f2b unban --all"
"f2bufw: f2b status ufw"
"free: free -m"
"genkeyfile: 1MiBi"
"genpasswd: PWD"
"genpasswdhash: PWD Hash"
"genstring: Random String"