V8.13.288.2025.10.24
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m52s
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m52s
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
@@ -69,7 +69,7 @@ CISS.debian.live.builder/
|
||||
|
||||
### 2.3.2. `config/` — Live-Build Configuration
|
||||
- **`bootloaders/`**: Boot assets for GRUB in EFI and PC modes, incl. a branded splash image.
|
||||
- **`hooks/live/`**: **Ordered** `*.chroot` hooks implementing system configuration and hardening during image creation; the numeric prefixes dictate execution (e.g., `0000_basic_chroot_setup.chroot`, `0810_chrony_setup.chroot`, `0900_ufw_setup.chroot`, `9930_hardening_ssh.chroot`, `9950_fail2ban_hardening.chroot`).
|
||||
- **`hooks/live/`**: **Ordered** `*.chroot` hooks implementing system configuration and hardening during image creation; the numeric prefixes dictate execution (e.g., `0000_basic_chroot_setup.chroot`, `0810_chrony_setup.chroot`, `0900_ufw_setup.chroot`, `9930_hardening_ssh.chroot`, `9950_hardening_fail2ban.chroot`).
|
||||
- **`includes.binary/boot/grub/`**: Static GRUB configuration embedded in the binary image (`config.cfg`).
|
||||
- **`includes.chroot/`**: Files copied into the live system’s root:
|
||||
- `etc/` (APT configuration, `live/`, `modprobe.d/`, network, SSH, `sysctl.d/`, systemd drop-ins, banners),
|
||||
|
||||
@@ -16,7 +16,7 @@ include_toc: true
|
||||
* **Updated**: [0001_initramfs_modules.chroot](../config/hooks/live/0001_initramfs_modules.chroot) + nftables mods
|
||||
* **Updated**: [9950_hardening_fail2ban.chroot](../config/hooks/live/9950_hardening_fail2ban.chroot) + banaction = nftables-*
|
||||
* **Updated**: [0900_ufw_setup.chroot](../config/hooks/live/0900_ufw_setup.chroot) changed var injection
|
||||
* **Updated**: [9950_fail2ban_hardening.chroot](../config/hooks/live/9950_hardening_fail2ban.chroot) changed var injection
|
||||
* **Updated**: [9950_hardening_fail2ban.chroot](../config/hooks/live/9950_hardening_fail2ban.chroot) changed var injection
|
||||
* **Updated**: [sshd_config](../config/includes.chroot/etc/ssh/sshd_config) changed var injection
|
||||
* **Updated**: [lib_hardening_ultra.sh](../lib/lib_hardening_ultra.sh) changed var injection
|
||||
|
||||
@@ -34,13 +34,13 @@ include_toc: true
|
||||
|
||||
## V8.13.256.2025.10.21
|
||||
* **Updated**: [0007_update_logrotate.chroot](../config/hooks/live/0007_update_logrotate.chroot)
|
||||
* **Updated**: [9950_fail2ban_hardening.chroot](../config/hooks/live/9950_hardening_fail2ban.chroot)
|
||||
* **Updated**: [9950_hardening_fail2ban.chroot](../config/hooks/live/9950_hardening_fail2ban.chroot)
|
||||
* **Updated**: [.zshenv](../config/includes.chroot/root/.zshenv)
|
||||
|
||||
## V8.13.224.2025.10.19
|
||||
* **Added**: [.zshenv](../config/includes.chroot/root/.zshenv)
|
||||
* **Updated**: [0090_jitterentropy.chroot](../config/hooks/live/0090_jitterentropy.chroot)
|
||||
* **Updated**: [9950_fail2ban_hardening.chroot](../config/hooks/live/9950_hardening_fail2ban.chroot) updated ignoreip
|
||||
* **Updated**: [9950_hardening_fail2ban.chroot](../config/hooks/live/9950_hardening_fail2ban.chroot) updated ignoreip
|
||||
* **Updated**: [9999_yyyy_logrotate.chroot](../config/hooks/live/9999_yyyy_logrotate.chroot) + rsyslog
|
||||
* **Updated**: [live.list.common.chroot](../config/package-lists/live.list.common.chroot) - haveged, + jitterentropy-rngd
|
||||
|
||||
@@ -49,7 +49,7 @@ include_toc: true
|
||||
* **Added**: [9999_yyyy_logrotate.chroot](../config/hooks/live/9999_yyyy_logrotate.chroot)
|
||||
* **Added**: [9999_zzzz.chroot](../config/hooks/live/9999_zzzz.chroot)
|
||||
* **Updated**: [0000_basic_chroot_setup.chroot](../config/hooks/live/0000_basic_chroot_setup.chroot) XDG Base Directory Support
|
||||
* **Updated**: [9950_fail2ban_hardening.chroot](../config/hooks/live/9950_hardening_fail2ban.chroot)
|
||||
* **Updated**: [9950_hardening_fail2ban.chroot](../config/hooks/live/9950_hardening_fail2ban.chroot)
|
||||
* **Updated**: [sshd_config](../config/includes.chroot/etc/ssh/sshd_config) hardened MaxStartups
|
||||
* **Updated**: [alias](../config/includes.chroot/root/.ciss/alias) removed haveged alias
|
||||
* **Updated**: [shortcuts](../config/includes.chroot/root/.ciss/shortcuts) removed haveged entry
|
||||
|
||||
@@ -200,7 +200,7 @@ hardening_ultra() {
|
||||
sed -i -E "/PORT_MUST_BE_CHANGED/ s|.*|${pad}${sshport}|" "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/etc/ssh/sshd_config"
|
||||
|
||||
### /config/hooks/live/9950_hardening_fail2ban.chroot
|
||||
sed -i "s|PORT_MUST_BE_SET|${sshport}|g" "${VAR_HANDLER_BUILD_DIR}/config/hooks/live/9950_fail2ban_hardening.chroot"
|
||||
sed -i "s|PORT_MUST_BE_SET|${sshport}|g" "${VAR_HANDLER_BUILD_DIR}/config/hooks/live/9950_hardening_fail2ban.chroot"
|
||||
|
||||
### /config/hooks/live/0900_ufw_setup.chroot
|
||||
sed -i "s|SSHPORT_MUST_BE_SET|${sshport}|g" "${VAR_HANDLER_BUILD_DIR}/config/hooks/live/0900_ufw_setup.chroot"
|
||||
@@ -249,7 +249,7 @@ hardening_ultra() {
|
||||
sed -i -E "/PORT_MUST_BE_CHANGED/ s|.*|${pad}${sshport}|" "${VAR_HANDLER_BUILD_DIR}/config/includes.chroot/etc/ssh/sshd_config"
|
||||
|
||||
### /config/hooks/live/9950_hardening_fail2ban.chroot
|
||||
sed -i "s|PORT_MUST_BE_SET|${sshport}|g" "${VAR_HANDLER_BUILD_DIR}/config/hooks/live/9950_fail2ban_hardening.chroot"
|
||||
sed -i "s|PORT_MUST_BE_SET|${sshport}|g" "${VAR_HANDLER_BUILD_DIR}/config/hooks/live/9950_hardening_fail2ban.chroot"
|
||||
|
||||
### /config/hooks/live/0900_ufw_setup.chroot
|
||||
sed -i "s|SSHPORT_MUST_BE_SET|${sshport}|g" "${VAR_HANDLER_BUILD_DIR}/config/hooks/live/0900_ufw_setup.chroot"
|
||||
@@ -321,7 +321,7 @@ hardening_ultra() {
|
||||
# flat_ips now contains e.g., "123.128.111.42 2a03:ffff:0815:4711:... 2a03:.../64"
|
||||
|
||||
# Perform an in-place replacement of IGNORE_IP_MUST_BE_SET with the cleaned list
|
||||
sed -i -E "/^[[:space:]]*ignoreip[[:space:]]*=/ s|IGNORE_IP_MUST_BE_SET|${flat_ips}|g" "${VAR_HANDLER_BUILD_DIR}/config/hooks/live/9950_fail2ban_hardening.chroot"
|
||||
sed -i -E "/^[[:space:]]*ignoreip[[:space:]]*=/ s|IGNORE_IP_MUST_BE_SET|${flat_ips}|g" "${VAR_HANDLER_BUILD_DIR}/config/hooks/live/9950_hardening_fail2ban.chroot"
|
||||
|
||||
printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ Updating fail2ban Jumphosts IPs done. \e[0m\n"
|
||||
|
||||
@@ -329,7 +329,7 @@ hardening_ultra() {
|
||||
|
||||
printf "\e[93m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 No jump hosts configured, removing placeholder ... \e[0m\n"
|
||||
|
||||
sed -i 's/IGNORE_IP_MUST_BE_SET//g' "${VAR_HANDLER_BUILD_DIR}/config/hooks/live/9950_fail2ban_hardening.chroot"
|
||||
sed -i 's/IGNORE_IP_MUST_BE_SET//g' "${VAR_HANDLER_BUILD_DIR}/config/hooks/live/9950_hardening_fail2ban.chroot"
|
||||
|
||||
printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ Placeholder removed. \e[0m\n"
|
||||
|
||||
|
||||
Reference in New Issue
Block a user