msw/CISS.debian.live.builder
SHA256
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

V8.03.768.2025.06.18
All checks were successful
🛡️ Retrieve DNSSEC status of coresecret.dev. / 🛡️ Retrieve DNSSEC status of coresecret.dev. (push) Successful in 36s
Details
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m38s
Details

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-06-18 20:00:50 +02:00
parent 3e5681cb90
commit 742d0579d7
38 changed files with 120 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.gitea/ISSUE_TEMPLATE/ISSUE_TEMPLATE.yaml
View File

@@ -25,7 +25,7 @@ body:
attributes: attributes:
label: "Version" label: "Version"
description: "Which version are you running? Use `./ciss_live_builder.sh -v`." description: "Which version are you running? Use `./ciss_live_builder.sh -v`."
placeholder: "e.g., Master V8.03.768.2025.06.17" placeholder: "e.g., Master V8.03.768.2025.06.18"
validations: validations:
required: true required: true

2
.gitea/TODO/dockerfile
View File

@@ -9,7 +9,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
### Version Master V8.03.768.2025.06.17 ### Version Master V8.03.768.2025.06.18
FROM debian:bookworm FROM debian:bookworm

2
.gitea/TODO/render-md-to-html.yaml
View File

@@ -9,7 +9,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
### Version Master V8.03.768.2025.06.17 ### Version Master V8.03.768.2025.06.18
name: 🔁 Render README.md to README.html. name: 🔁 Render README.md to README.html.

2
.gitea/trigger/t_generate_dns.yaml
View File

@@ -11,5 +11,5 @@
build: build:
counter: 1023 counter: 1023
version: V8.03.768.2025.06.17 version: V8.03.768.2025.06.18
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml

2
.gitea/workflows/generate_PRIVATE_iso_flavour_0.yaml
View File

@@ -9,7 +9,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
### Version Master V8.03.768.2025.06.17 ### Version Master V8.03.768.2025.06.18
name: 🔐 Generating a Private Live ISO FLV 0. name: 🔐 Generating a Private Live ISO FLV 0.

2
.gitea/workflows/generate_PRIVATE_iso_flavour_1.yaml
View File

@@ -9,7 +9,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
### Version Master V8.03.768.2025.06.17 ### Version Master V8.03.768.2025.06.18
name: 🔐 Generating a Private Live ISO FLV 1. name: 🔐 Generating a Private Live ISO FLV 1.

2
.gitea/workflows/generate_PUBLIC_iso.yaml
View File

@@ -9,7 +9,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
### Version Master V8.03.768.2025.06.17 ### Version Master V8.03.768.2025.06.18
name: 💙 Generating a PUBLIC Live ISO. name: 💙 Generating a PUBLIC Live ISO.

2
.gitea/workflows/linter_char_scripts.yaml
View File

@@ -9,7 +9,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
### Version Master V8.03.768.2025.06.17 ### Version Master V8.03.768.2025.06.18
# Gitea Workflow: Shell-Script Linting # Gitea Workflow: Shell-Script Linting
# #

2
.gitea/workflows/render-dnssec-status.yaml
View File

@@ -9,7 +9,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
### Version Master V8.03.768.2025.06.17 ### Version Master V8.03.768.2025.06.18
name: 🛡️ Retrieve DNSSEC status of coresecret.dev. name: 🛡️ Retrieve DNSSEC status of coresecret.dev.

2
.gitea/workflows/render-dot-to-png.yaml
View File

@@ -9,7 +9,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
### Version Master V8.03.768.2025.06.17 ### Version Master V8.03.768.2025.06.18
name: 🔁 Render Graphviz Diagrams. name: 🔁 Render Graphviz Diagrams.

2
.version.properties
View File

@@ -15,5 +15,5 @@ properties_SPDX-License-Identifier="EUPL-1.2 OR LicenseRef-CCLA-1.0"
properties_SPDX-LicenseComment="This file is part of the CISS.debian.installer.secure framework." properties_SPDX-LicenseComment="This file is part of the CISS.debian.installer.secure framework."
properties_SPDX-PackageName="CISS.debian.live.builder" properties_SPDX-PackageName="CISS.debian.live.builder"
properties_SPDX-Security-Contact="security@coresecret.eu" properties_SPDX-Security-Contact="security@coresecret.eu"
properties_version="V8.03.768.2025.06.17" properties_version="V8.03.768.2025.06.18"
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf

2
CISS.debian.live.builder.spdx
View File

@@ -6,7 +6,7 @@ Creator: Person: Marc S. Weidner (Centurion Intelligence Consulting Agency)
Created: 2025-05-07T12:00:00Z Created: 2025-05-07T12:00:00Z
Package: CISS.debian.live.builder Package: CISS.debian.live.builder
PackageName: CISS.debian.live.builder PackageName: CISS.debian.live.builder
PackageVersion: Master V8.03.768.2025.06.17 PackageVersion: Master V8.03.768.2025.06.18
PackageSupplier: Organization: Centurion Intelligence Consulting Agency PackageSupplier: Organization: Centurion Intelligence Consulting Agency
PackageDownloadLocation: https://git.coresecret.dev/msw/CISS.debian.live.builder PackageDownloadLocation: https://git.coresecret.dev/msw/CISS.debian.live.builder
PackageHomePage: https://git.coresecret.dev/msw/CISS.debian.live.builder PackageHomePage: https://git.coresecret.dev/msw/CISS.debian.live.builder

4
README.md
View File

@@ -2,7 +2,7 @@
gitea: none gitea: none
include_toc: true include_toc: true
--- ---
[![Static Badge](https://badges.coresecret.dev/badge/Release-V8.03.768.2025.06.17-white?style=plastic&logo=linux&logoColor=white&logoSize=auto&label=Release&color=%23FCC624)](https://git.coresecret.dev/msw/CISS.debian.live.builder) [![Static Badge](https://badges.coresecret.dev/badge/Release-V8.03.768.2025.06.18-white?style=plastic&logo=linux&logoColor=white&logoSize=auto&label=Release&color=%23FCC624)](https://git.coresecret.dev/msw/CISS.debian.live.builder)
&nbsp; &nbsp;
[![Static Badge](https://badges.coresecret.dev/badge/Licence-EUPL1.2-white?style=plastic&logo=europeanunion&logoColor=white&logoSize=auto&label=Licence&color=%23003399)](https://eupl.eu/1.2/en/) &nbsp; [![Static Badge](https://badges.coresecret.dev/badge/Licence-EUPL1.2-white?style=plastic&logo=europeanunion&logoColor=white&logoSize=auto&label=Licence&color=%23003399)](https://eupl.eu/1.2/en/) &nbsp;
[![Static Badge](https://badges.coresecret.dev/badge/opensourceinitiative-Compliant-white?style=plastic&logo=opensourceinitiative&logoColor=white&logoSize=auto&label=OSI&color=%233DA639)](https://opensource.org/license/eupl-1-2) &nbsp; [![Static Badge](https://badges.coresecret.dev/badge/opensourceinitiative-Compliant-white?style=plastic&logo=opensourceinitiative&logoColor=white&logoSize=auto&label=OSI&color=%233DA639)](https://opensource.org/license/eupl-1-2) &nbsp;
@@ -26,7 +26,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br> *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.03<br> **Master Version**: 8.03<br>
**Build**: V8.03.768.2025.06.17<br> **Build**: V8.03.768.2025.06.18<br>
This shell wrapper automates the creation of a Debian Bookworm live ISO hardened according to the latest best practices in server This shell wrapper automates the creation of a Debian Bookworm live ISO hardened according to the latest best practices in server
and service security. It integrates into your build pipeline to deliver an isolated, robust environment suitable for and service security. It integrates into your build pipeline to deliver an isolated, robust environment suitable for

24
ciss_live_builder.sh
View File

@@ -37,29 +37,31 @@
. ./var/global.var.sh; printf "\e[91m❌ Minimum requirement is bash 5.1. You are using '%s'! Bye... \e[0m\n" "${BASH_VERSION}" >&2; exit "${ERR_UNSPPTBASH}"; } . ./var/global.var.sh; printf "\e[91m❌ Minimum requirement is bash 5.1. You are using '%s'! Bye... \e[0m\n" "${BASH_VERSION}" >&2; exit "${ERR_UNSPPTBASH}"; }
[[ ${BASH_VERSINFO[0]} -le 5 ]] && [[ ${BASH_VERSINFO[1]} -le 1 ]] && { [[ ${BASH_VERSINFO[0]} -le 5 ]] && [[ ${BASH_VERSINFO[1]} -le 1 ]] && {
. ./var/global.var.sh; printf "\e[91m❌ Minimum requirement is bash 5.1. You are using '%s'! Bye... \e[0m\n" "${BASH_VERSION}" >&2; exit "${ERR_UNSPPTBASH}"; } . ./var/global.var.sh; printf "\e[91m❌ Minimum requirement is bash 5.1. You are using '%s'! Bye... \e[0m\n" "${BASH_VERSION}" >&2; exit "${ERR_UNSPPTBASH}"; }
[[ ${#} -eq 0 ]] && {
. ./lib/lib_usage.sh; usage; exit 1; }
declare -g VAR_HANDLER_AUTOBUILD="false" declare -grx VAR_CONTACT="security@coresecret.eu"
declare -gr VAR_CONTACT="security@coresecret.eu" declare -grx VAR_VERSION="Master V8.03.768.2025.06.18"
declare -gr VAR_VERSION="Master V8.03.768.2025.06.17"
for dir in /usr/local/sbin /usr/sbin; do case ":${PATH}:" in *":${dir}:"*) ;; *) PATH="${PATH}:${dir}" ;; esac; done; export PATH; unset dir
### VERY EARLY CHECK FOR AUTO-BUILD, CONTACT, USAGE, AND VERSION STRING ### VERY EARLY CHECK FOR CONTACT, HELP, AND VERSION STRING
declare arg for arg in "$@"; do case "${arg,,}" in -c|--contact) . ./lib/lib_contact.sh; contact; exit 0;; esac; done
if [[ ${#} -eq 0 ]]; then . ./lib/lib_usage.sh; usage; exit 1; fi
for arg in "$@"; do case "${arg,,}" in -a=*|--autobuild=*) declare -g VAR_HANDLER_AUTOBUILD=true; declare -g VAR_KERNEL="${arg#*=}";; esac; done
for arg in "$@"; do case "${arg,,}" in -c|--contact) printf "\e[95mCISS.debian.live.builder Contact: %s\e[0m\n" "${VAR_CONTACT}"; exit 0;; esac; done
for arg in "$@"; do case "${arg,,}" in -h|--help) . ./lib/lib_usage.sh; usage; exit 0;; esac; done for arg in "$@"; do case "${arg,,}" in -h|--help) . ./lib/lib_usage.sh; usage; exit 0;; esac; done
for arg in "$@"; do case "${arg,,}" in -v|--version) printf "\e[95mCISS.debian.live.builder Version: %s\e[0m\n" "${VAR_VERSION}"; exit 0;; esac; done for arg in "$@"; do case "${arg,,}" in -v|--version) printf "\e[95mCISS.debian.live.builder Version: %s\e[0m\n" "${VAR_VERSION}"; exit 0;; esac; done
unset arg
### VERY EARLY CHECK FOR XTRACE DEBUGGING ### VERY EARLY CHECK FOR XTRACE DEBUGGING
if [[ $* == *" --debug "* ]]; then if [[ $* == *" --debug "* ]]; then
. ./lib/lib_debug.sh . ./lib/lib_debug.sh
debugger "${@}" debugger "${@}"
else else
declare -grx VAR_EARLY_DEBUG=false declare -grx VAR_EARLY_DEBUG="false"
fi fi
### VERY EARLY CHECK FOR AUTOBUILD MODE
declare -gr VAR_HANDLER_AUTOBUILD="false"
for arg in "$@"; do case "${arg,,}" in -a=*|--autobuild=*) declare -grx VAR_HANDLER_AUTOBUILD="true"; declare -gx VAR_KERNEL="${arg#*=}";; esac; done
unset arg
for dir in /usr/local/sbin /usr/sbin; do case ":${PATH}:" in *":${dir}:"*) ;; *) PATH="${PATH}:${dir}" ;; esac; done; export PATH; unset dir
### Advisory Lock ### Advisory Lock
exec 127>/var/lock/ciss_live_builder.lock || { exec 127>/var/lock/ciss_live_builder.lock || {
. ./var/global.var.sh . ./var/global.var.sh

2
config/includes.chroot/etc/ssh/sshd_config
View File

@@ -9,7 +9,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
### Version Master V8.03.768.2025.06.17 ### Version Master V8.03.768.2025.06.18
### https://www.ssh-audit.com/ ### https://www.ssh-audit.com/
### ssh -Q cipher | cipher-auth | compression | kex | kex-gss | key | key-cert | key-plain | key-sig | mac | protocol-version | sig ### ssh -Q cipher | cipher-auth | compression | kex | kex-gss | key | key-cert | key-plain | key-sig | mac | protocol-version | sig

2
config/includes.chroot/etc/sysctl.d/99_local.hardened
View File

@@ -9,7 +9,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
### Version Master V8.03.768.2025.06.17 ### Version Master V8.03.768.2025.06.18
### https://docs.kernel.org/ ### https://docs.kernel.org/
### https://github.com/a13xp0p0v/kernel-hardening-checker/ ### https://github.com/a13xp0p0v/kernel-hardening-checker/

2
config/includes.chroot/preseed/.iso/preseed_hash_generator.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.live.builder # SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu # SPDX-Security-Contact: security@coresecret.eu
declare -gr VERSION="Master V8.03.768.2025.06.17" declare -gr VERSION="Master V8.03.768.2025.06.18"
### VERY EARLY CHECK FOR DEBUGGING ### VERY EARLY CHECK FOR DEBUGGING
if [[ $* == *" --debug "* ]]; then if [[ $* == *" --debug "* ]]; then

2
config/includes.chroot/preseed/preseed.cfg
View File

@@ -112,4 +112,4 @@ d-i preseed/late_command string sh /preseed/.ash/3_di_preseed_late_command.sh
# Please consider donating to my work at: https://coresecret.eu/spenden/ # Please consider donating to my work at: https://coresecret.eu/spenden/
########################################################################################### ###########################################################################################
# Written by: ./preseed_hash_generator.sh Version: Master V8.03.768.2025.06.17 at: 10:18:37.9542 # Written by: ./preseed_hash_generator.sh Version: Master V8.03.768.2025.06.18 at: 10:18:37.9542

2
docs/AUDIT_DNSSEC.md
View File

@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br> *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.03<br> **Master Version**: 8.03<br>
**Build**: V8.03.768.2025.06.17<br> **Build**: V8.03.768.2025.06.18<br>
# 2. DNSSEC Status # 2. DNSSEC Status

2
docs/AUDIT_HAVEGED.md
View File

@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br> *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.03<br> **Master Version**: 8.03<br>
**Build**: V8.03.768.2025.06.17<br> **Build**: V8.03.768.2025.06.18<br>
# 2. Haveged Audit on Netcup RS 2000 G11 # 2. Haveged Audit on Netcup RS 2000 G11

2
docs/AUDIT_LYNIS.md
View File

@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br> *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.03<br> **Master Version**: 8.03<br>
**Build**: V8.03.768.2025.06.17<br> **Build**: V8.03.768.2025.06.18<br>
# 2. Lynis Audit: # 2. Lynis Audit:

2
docs/AUDIT_SSH.md
View File

@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br> *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.03<br> **Master Version**: 8.03<br>
**Build**: V8.03.768.2025.06.17<br> **Build**: V8.03.768.2025.06.18<br>
# 2. SSH Audit by ssh-audit.com # 2. SSH Audit by ssh-audit.com

2
docs/AUDIT_TLS.md
View File

@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br> *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.03<br> **Master Version**: 8.03<br>
**Build**: V8.03.768.2025.06.17<br> **Build**: V8.03.768.2025.06.18<br>
# 2. TLS Audit: # 2. TLS Audit:

8
docs/CHANGELOG.md
View File

@@ -8,10 +8,16 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br> *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.03<br> **Master Version**: 8.03<br>
**Build**: V8.03.768.2025.06.17<br> **Build**: V8.03.768.2025.06.18<br>
# 2. Changelog # 2. Changelog
## V8.03.768.2025.06.18
* Minor main script improvements.
* Updated contact section.
* Integrated third ``dns03.eddns.eu`` Centurion DNS Resolver.
## V8.03.768.2025.06.17 ## V8.03.768.2025.06.17
* Updated LIVE ISO workflows to use Kernel: ``linux-image-6.12.30+bpo-amd64`` * Updated LIVE ISO workflows to use Kernel: ``linux-image-6.12.30+bpo-amd64``

2
docs/CNET.md
View File

@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br> *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.03<br> **Master Version**: 8.03<br>
**Build**: V8.03.768.2025.06.17<br> **Build**: V8.03.768.2025.06.18<br>
# 2. Centurion Net - Developer Branch Overview # 2. Centurion Net - Developer Branch Overview

2
docs/CODING_CONVENTION.md
View File

@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br> *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.03<br> **Master Version**: 8.03<br>
**Build**: V8.03.768.2025.06.17<br> **Build**: V8.03.768.2025.06.18<br>
# 2. Coding Style # 2. Coding Style

2
docs/CONTRIBUTING.md
View File

@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br> *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.03<br> **Master Version**: 8.03<br>
**Build**: V8.03.768.2025.06.17<br> **Build**: V8.03.768.2025.06.18<br>
# 2. Contributing / participating # 2. Contributing / participating

2
docs/CREDITS.md
View File

@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br> *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.03<br> **Master Version**: 8.03<br>
**Build**: V8.03.768.2025.06.17<br> **Build**: V8.03.768.2025.06.18<br>
# 2. Credits # 2. Credits

2
docs/DL_PUB_ISO.md
View File

@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br> *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.03<br> **Master Version**: 8.03<br>
**Build**: V8.03.768.2025.06.17<br> **Build**: V8.03.768.2025.06.18<br>
# 2. Download the latest PUBLIC CISS.debian.live.ISO # 2. Download the latest PUBLIC CISS.debian.live.ISO

4
docs/DOCUMENTATION.md
View File

@@ -8,12 +8,12 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br> *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.03<br> **Master Version**: 8.03<br>
**Build**: V8.03.768.2025.06.17<br> **Build**: V8.03.768.2025.06.18<br>
# 2. Usage # 2. Usage
````text ````text
CISS.debian.live.builder CISS.debian.live.builder
Master V8.03.768.2025.06.17 Master V8.03.768.2025.06.18
(c) Marc S. Weidner, 2018 - 2025 (c) Marc S. Weidner, 2018 - 2025
(p) Centurion Press, 2024 - 2025 (p) Centurion Press, 2024 - 2025

2
docs/REFERENCES.md
View File

@@ -8,7 +8,7 @@ include_toc: true
**Centurion Intelligence Consulting Agency Information Security Standard**<br> **Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br> *Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.03<br> **Master Version**: 8.03<br>
**Build**: V8.03.768.2025.06.17<br> **Build**: V8.03.768.2025.06.18<br>
# 2. Resources # 2. Resources

2
lib/lib_arg_parser.sh
View File

@@ -100,7 +100,7 @@ arg_parser() {
printf "\e[91m❌ Error: --architecture MUST be 'amd64' or 'arm64'.\e[0m\n" >&2 printf "\e[91m❌ Error: --architecture MUST be 'amd64' or 'arm64'.\e[0m\n" >&2
# shellcheck disable=SC2162 # shellcheck disable=SC2162
read -p $'\e[92m✅ Press \'ENTER\' to exit the script ... \e[0m' read -p $'\e[92m✅ Press \'ENTER\' to exit the script ... \e[0m'
exit "${ERR_UNCRITICAL}" exit "${ERR_ARG_MSMTCH}"
fi fi
;; ;;

1
lib/lib_check_pkgs.sh
View File

@@ -17,6 +17,7 @@
####################################### #######################################
check_pkgs() { check_pkgs() {
apt-get update -y apt-get update -y
if [[ -z "$(command -v lsb_release || true)" ]]; then if [[ -z "$(command -v lsb_release || true)" ]]; then
apt-get install --no-install-recommends lsb-release -y apt-get install --no-install-recommends lsb-release -y
fi fi

2
lib/lib_check_provider.sh
View File

@@ -18,7 +18,7 @@
check_provider() { check_provider() {
clear clear
cat << 'EOF' >| "${VAR_NOTES}" cat << 'EOF' >| "${VAR_NOTES}"
Build: Master V8.03.768.2025.06.17 Build: Master V8.03.768.2025.06.18
Press 'EXIT' to continue with CISS.debian.live.builder. Press 'EXIT' to continue with CISS.debian.live.builder.

40
lib/lib_contact.sh Normal file
View File

@@ -0,0 +1,40 @@
#!/bin/bash
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-05-05; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu
#######################################
# Contact Wrapper CISS.debian.live.builder
# Globals:
# none
# Arguments:
# none
#######################################
contact() {
clear
cat << EOF
$(echo -e "\e[92mCISS.debian.live.builder\e[0m")
$(echo -e "\e[92mMaster V8.03.768.2025.06.18\e[0m")
$(echo -e "\e[92mA lightweight Shell Wrapper for building a hardened Debian Bookworm Live ISO Image.\e[0m")
$(echo -e "\e[97m(c) Marc S. Weidner, 2018 - 2025\e[0m")
$(echo -e "\e[97m(p) Centurion Press, 2024 - 2025\e[0m")
$(echo -e "\e[95m💬 Contact:\e[0m")
$(echo -e "\e[95m🌐 https://coresecret.eu/ \e[0m")
$(echo -e "\e[95m📧 security@coresecret.eu \e[0m")
$(echo -e "\e[95m🔑 PGP Key 2D98 07F4 1030 1776 597E BDC9 9F54 8853 35A3 C9AD \e[0m")
$(echo -e "\e[95m🔗 https://keys.openpgp.org/vks/v1/by-fingerprint/2D9807F410301776597EBDC99F54885335A3C9AD \e[0m")
$(echo -e "\e[95m💷 Please consider donating to my work at:\e[0m")
$(echo -e "\e[95m🌐 https://coresecret.eu/spenden/ \e[0m")
EOF
}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

39
lib/lib_usage.sh
View File

@@ -13,24 +13,20 @@
####################################### #######################################
# Usage Wrapper CISS.debian.live.builder # Usage Wrapper CISS.debian.live.builder
# Globals: # Globals:
# ERR_UNCRITICAL # none
# Arguments: # Arguments:
# $0: Script name # $0: Script name
####################################### #######################################
usage() { usage() {
clear clear
cat << EOF cat << EOF
$(echo -e "\e[92mCISS.debian.live.builder\e[0m") $(echo -e "\e[92mCISS.debian.live.builder\e[0m")
$(echo -e "\e[92mMaster V8.03.768.2025.06.17\e[0m") $(echo -e "\e[92mMaster V8.03.768.2025.06.18\e[0m")
$(echo -e "\e[92mA lightweight Shell Wrapper for building a hardened Debian Bookworm Live ISO Image.\e[0m")
$(echo -e "\e[97m(c) Marc S. Weidner, 2018 - 2025\e[0m") $(echo -e "\e[97m(c) Marc S. Weidner, 2018 - 2025\e[0m")
$(echo -e "\e[97m(p) Centurion Press, 2024 - 2025\e[0m") $(echo -e "\e[97m(p) Centurion Press, 2024 - 2025\e[0m")
$(echo -e "\e[95mhttps://coresecret.eu/\e[0m")
$(echo -e "\e[97mA lightweight Shell Wrapper for building a hardened Debian Bookworm Live ISO Image.\e[0m")
"${0} <option>", where <option> is one or more of: "${0} <option>", where <option> is one or more of:
--help, -h --help, -h
@@ -39,7 +35,7 @@ $(echo -e "\e[97mA lightweight Shell Wrapper for building a hardened Debian Book
--autobuild=*, -a=* --autobuild=*, -a=*
Headless mode. Skip the dialog wrapper, provider note screen and interactive kernel Headless mode. Skip the dialog wrapper, provider note screen and interactive kernel
selector dialog. Change '*' to your desired Linux kernel and trim the selector dialog. Change '*' to your desired Linux kernel and trim the
'linux-image-' string to select a specific kernel, e.g. '--autobuild=6.12.22+bpo-amd64'. 'linux-image-' string to select a specific kernel, e.g. '--autobuild=6.12.30+bpo-amd64'.
--architecture <STRING> one of <amd64 | arm64> --architecture <STRING> one of <amd64 | arm64>
A string reflecting the architecture of the Live System. A string reflecting the architecture of the Live System.
@@ -74,12 +70,13 @@ $(echo -e "\e[97mA lightweight Shell Wrapper for building a hardened Debian Book
and only the hardened, privacy-focused Centurion DNS servers will be used: and only the hardened, privacy-focused Centurion DNS servers will be used:
- https://dns01.eddns.eu/ - https://dns01.eddns.eu/
- https://dns02.eddns.de/ - https://dns02.eddns.de/
- https://dns03.eddns.eu/
--jump-host <IP | IP | ... > --jump-host <IP | IP | ... >
Provide up to 10 IPs for /etc/host.allow whitelisting of SSH access. Provide up to 10 IPs for /etc/host.allow whitelisting of SSH access.
Could be either IPv4 and / or IPv6 addresses and / or CCDIR notation. Could be either IPv4 and / or IPv6 addresses and / or CCDIR notation.
If provided, than it MUST be a <SPACE> separated list. If provided, than it MUST be a <SPACE> separated list.
IPv6 addresses MUST be encapsulated with [], e.g., [1234::abcd/64]. IPv6 addresses MUST be encapsulated with [], e.g., [1234::abcd]/64.
--log-statistics-only --log-statistics-only
Provides statistic only after successful building a Provides statistic only after successful building a
@@ -90,22 +87,23 @@ $(echo -e "\e[97mA lightweight Shell Wrapper for building a hardened Debian Book
--provider-netcup-ipv6 --provider-netcup-ipv6
Activates IPv6 support for Netcup Root Server. One unique Activates IPv6 support for Netcup Root Server. One unique
IPv6 address MUST be provided in this case. IPv6 address MUST be provided in this case.
IPv6 address MUST be encapsulated with [], e.g., [1234::abcd].
--renice-priority <PRIORITY> --renice-priority <PRIORITY>
Reset the nice priority value of the script and all its children Reset the nice priority value of the script and all its children
to the desired PRIORITY. MUST be an integer (between "-19" and 19). to the desired <PRIORITY>. MUST be an integer (between "-19" and 19).
Negative (higher) values MUST be enclosed in double quotes '"'. Negative (higher) values MUST be enclosed in double quotes '"'.
--reionice-priority <CLASS> <PRIORITY> --reionice-priority <CLASS> <PRIORITY>
Reset the ionice priority value of the script and all its children Reset the ionice priority value of the script and all its children
to the desired CLASS. MUST be an integer: to the desired <CLASS>. MUST be an integer:
1: realtime 1: realtime
2: best-effort 2: best-effort
3: idle 3: idle
defaults to "2". Defaults to '2'.
PRIORITY MUST be an integer: <PRIORITY> MUST be an integer:
between 0 (highest) and 7 (lowest) priority. Between '0' (highest) and '7' (lowest) priority.
defaults to "4". Defaults to '4'.
A real-time I/O process can significantly slow down other processes A real-time I/O process can significantly slow down other processes
or even cause them to starve if it continuously requests I/O. or even cause them to starve if it continuously requests I/O.
@@ -132,14 +130,11 @@ $(echo -e "\e[97mA lightweight Shell Wrapper for building a hardened Debian Book
--version, -v --version, -v
Displays version of ${0}. Displays version of ${0}.
$(echo -e "\e[93mNOTES:\e[0m") $(echo -e "\e[93m💡 Notes:\e[0m")
- You MUST be 'root' to run this script. • You MUST be 'root' to run this script.
$(echo -e "\e[92mContact:\e[0m") $(echo -e "\e[95m💷 Please consider donating to my work at:\e[0m")
$(echo -e "\e[95m - https://coresecret.eu/ \e[0m") $(echo -e "\e[95m🌐 https://coresecret.eu/spenden/ \e[0m")
$(echo -e "\e[95m - security@coresecret.eu \e[0m")
$(echo -e "\e[95m - PGP Key 2D98 07F4 1030 1776 597E BDC9 9F54 8853 35A3 C9AD \e[0m")
$(echo -e "\e[95m - https://keys.openpgp.org/vks/v1/by-fingerprint/2D9807F410301776597EBDC99F54885335A3C9AD \e[0m")
EOF EOF
} }

4
scripts/0010_dhcp_supersede.sh
View File

@@ -21,9 +21,9 @@ fi
cat << 'EOF' >| "${VAR_HANDLER_BUILD_DIR}"/config/includes.chroot/etc/dhcp/dhclient.conf cat << 'EOF' >| "${VAR_HANDLER_BUILD_DIR}"/config/includes.chroot/etc/dhcp/dhclient.conf
# Custom dhclient config to override DHCP DNS # Custom dhclient config to override DHCP DNS
# dns01.eddns.eu, dns02.eddns.de; # dns01.eddns.eu, dns02.eddns.de; dns03.eddns.eu;
supersede domain-name-servers 135.181.207.105, 89.58.62.53; supersede domain-name-servers 135.181.207.105, 89.58.62.53; 138.199.237.109;
EOF EOF

2
scripts/9000-cdi-starter
View File

@@ -15,7 +15,7 @@ printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 '%s' starting ... \e[0m\n" "
# sleep 1 # sleep 1
[[ ! -d /root/.cdi/log ]] && mkdir -p /root/.cdi/log [[ ! -d /root/.cdi/log ]] && mkdir -p /root/.cdi/log
printf "CISS.debian.installer Master V8.03.768.2025.06.17 is up!" >| /root/.cdi/log/boot_finished_"$(date +"%Y-%m-%d_%H-%M-%S")".log printf "CISS.debian.installer Master V8.03.768.2025.06.18 is up!" >| /root/.cdi/log/boot_finished_"$(date +"%Y-%m-%d_%H-%M-%S")".log
if [[ -f /root/git/CISS.debian.installer/ciss_debian_installer.sh ]]; then if [[ -f /root/git/CISS.debian.installer/ciss_debian_installer.sh ]]; then
chmod 0700 /root/git/CISS.debian.installer/ciss_debian_installer.sh chmod 0700 /root/git/CISS.debian.installer/ciss_debian_installer.sh