V8.03.768.2025.06.18
All checks were successful
🛡️ Retrieve DNSSEC status of coresecret.dev. / 🛡️ Retrieve DNSSEC status of coresecret.dev. (push) Successful in 36s
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m38s

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
2025-06-18 20:00:50 +02:00
parent 3e5681cb90
commit 742d0579d7
38 changed files with 120 additions and 76 deletions

View File

@@ -13,24 +13,20 @@
#######################################
# Usage Wrapper CISS.debian.live.builder
# Globals:
# ERR_UNCRITICAL
# none
# Arguments:
# $0: Script name
#######################################
usage() {
clear
cat << EOF
$(echo -e "\e[92mCISS.debian.live.builder\e[0m")
$(echo -e "\e[92mMaster V8.03.768.2025.06.17\e[0m")
$(echo -e "\e[92mMaster V8.03.768.2025.06.18\e[0m")
$(echo -e "\e[92mA lightweight Shell Wrapper for building a hardened Debian Bookworm Live ISO Image.\e[0m")
$(echo -e "\e[97m(c) Marc S. Weidner, 2018 - 2025\e[0m")
$(echo -e "\e[97m(p) Centurion Press, 2024 - 2025\e[0m")
$(echo -e "\e[95mhttps://coresecret.eu/\e[0m")
$(echo -e "\e[97mA lightweight Shell Wrapper for building a hardened Debian Bookworm Live ISO Image.\e[0m")
"${0} <option>", where <option> is one or more of:
--help, -h
@@ -39,7 +35,7 @@ $(echo -e "\e[97mA lightweight Shell Wrapper for building a hardened Debian Book
--autobuild=*, -a=*
Headless mode. Skip the dialog wrapper, provider note screen and interactive kernel
selector dialog. Change '*' to your desired Linux kernel and trim the
'linux-image-' string to select a specific kernel, e.g. '--autobuild=6.12.22+bpo-amd64'.
'linux-image-' string to select a specific kernel, e.g. '--autobuild=6.12.30+bpo-amd64'.
--architecture <STRING> one of <amd64 | arm64>
A string reflecting the architecture of the Live System.
@@ -72,14 +68,15 @@ $(echo -e "\e[97mA lightweight Shell Wrapper for building a hardened Debian Book
--dhcp-centurion
If a DHCP lease is provided, the provider's nameserver will be overridden,
and only the hardened, privacy-focused Centurion DNS servers will be used:
- https://dns01.eddns.eu/
- https://dns02.eddns.de/
- https://dns01.eddns.eu/
- https://dns02.eddns.de/
- https://dns03.eddns.eu/
--jump-host <IP | IP | ... >
Provide up to 10 IPs for /etc/host.allow whitelisting of SSH access.
Could be either IPv4 and / or IPv6 addresses and / or CCDIR notation.
If provided, than it MUST be a <SPACE> separated list.
IPv6 addresses MUST be encapsulated with [], e.g., [1234::abcd/64].
IPv6 addresses MUST be encapsulated with [], e.g., [1234::abcd]/64.
--log-statistics-only
Provides statistic only after successful building a
@@ -90,22 +87,23 @@ $(echo -e "\e[97mA lightweight Shell Wrapper for building a hardened Debian Book
--provider-netcup-ipv6
Activates IPv6 support for Netcup Root Server. One unique
IPv6 address MUST be provided in this case.
IPv6 address MUST be encapsulated with [], e.g., [1234::abcd].
--renice-priority <PRIORITY>
Reset the nice priority value of the script and all its children
to the desired PRIORITY. MUST be an integer (between "-19" and 19).
to the desired <PRIORITY>. MUST be an integer (between "-19" and 19).
Negative (higher) values MUST be enclosed in double quotes '"'.
--reionice-priority <CLASS> <PRIORITY>
Reset the ionice priority value of the script and all its children
to the desired CLASS. MUST be an integer:
1: realtime
2: best-effort
3: idle
defaults to "2".
PRIORITY MUST be an integer:
between 0 (highest) and 7 (lowest) priority.
defaults to "4".
to the desired <CLASS>. MUST be an integer:
1: realtime
2: best-effort
3: idle
Defaults to '2'.
<PRIORITY> MUST be an integer:
Between '0' (highest) and '7' (lowest) priority.
Defaults to '4'.
A real-time I/O process can significantly slow down other processes
or even cause them to starve if it continuously requests I/O.
@@ -132,14 +130,11 @@ $(echo -e "\e[97mA lightweight Shell Wrapper for building a hardened Debian Book
--version, -v
Displays version of ${0}.
$(echo -e "\e[93mNOTES:\e[0m")
- You MUST be 'root' to run this script.
$(echo -e "\e[93m💡 Notes:\e[0m")
You MUST be 'root' to run this script.
$(echo -e "\e[92mContact:\e[0m")
$(echo -e "\e[95m - https://coresecret.eu/ \e[0m")
$(echo -e "\e[95m - security@coresecret.eu \e[0m")
$(echo -e "\e[95m - PGP Key 2D98 07F4 1030 1776 597E BDC9 9F54 8853 35A3 C9AD \e[0m")
$(echo -e "\e[95m - https://keys.openpgp.org/vks/v1/by-fingerprint/2D9807F410301776597EBDC99F54885335A3C9AD \e[0m")
$(echo -e "\e[95m💷 Please consider donating to my work at:\e[0m")
$(echo -e "\e[95m🌐 https://coresecret.eu/spenden/ \e[0m")
EOF
}