V8.02.512.2025.05.30

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

config/includes.chroot/root/.bashrc

@@ -0,0 +1,92 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-05-05; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024–2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.live.builder
+# SPDX-Security-Contact: security@coresecret.eu
+
+# ~/.bashrc: executed by bash(1) for non-login shells.
+
+# Note: PS1 and umask are already set in /etc/profile. You should not
+# need this unless you want different defaults for root.
+# PS1='${debian_chroot:+($debian_chroot)}\h:\w\$ '
+# umask 022
+
+# You may uncomment the following lines if you want `ls' to be colorized:
+# export LS_OPTIONS='--color=auto'
+# eval "$(dircolors)"
+# alias ls='ls $LS_OPTIONS'
+# alias ll='ls $LS_OPTIONS -l'
+# alias l='ls $LS_OPTIONS -lA'
+#
+# Some more alias to avoid making mistakes:
+# alias rm='rm -i'
+# alias cp='cp -i'
+# alias mv='mv -i'
+
+[[ $- != *i* ]] && return
+
+trap ' "${SHELL}" /root/.ciss/clean_logout.sh ' 0
+source /root/.ciss/alias
+source /root/.ciss/shortcuts
+source /root/.ciss/scan_libwrap
+
+### History
+touch /tmp/.bash_history
+chmod 0660 /tmp/.bash_history
+chown root:root /tmp/.bash_history
+export HISTFILE=/tmp/.bash_history
+export HISTSIZE=2048
+export HISTFILESIZE=2048
+shopt -s histappend
+
+### Define colors for bash prompt
+export CRED='\033[1;91m'
+export CGRE='\033[1;92m'
+export CYEL='\033[1;93m'
+export CBLU='\033[1;94m'
+export CMAG='\033[1;95m'
+export CCYA='\033[1;96m'
+export CWHI='\033[1;97m'
+export CRES='\033[0m'
+
+#if [[ "${UID}" -eq 0 ]]; then
+#  export user_color="${CRED}"
+#else
+#  export user_color="${CGRE}"
+#fi
+
+### Define bash colorful prompt
+# PS1="${user_color}\d${CRES}|${user_color}\u${CRES}@${CMAG}\h${CRES}:${CCYA}\w${CRES}/>>\$(if [[ \$? -eq 0 ]]; then echo -e \"${CGRE}\$?${CRES}\"; else echo -e \"${CRED}\$?${CRES}\"; fi)|~\$ "
+PS1="\
+\[\033[1;91m\]\d\[\033[0m\]|\[\033[1;91m\]\u\[\033[0m\]@\
+\[\033[1;95m\]\h\[\033[0m\]:\
+\[\033[1;96m\]\w\[\033[0m\]/>>\
+\$(if [[ \$? -eq 0 ]]; then \
+    # Show exit status in green if zero
+    echo -e \"\[\033[1;92m\]\$?\[\033[0m\]\"; \
+  else \
+    # Show exit status in red otherwise
+    echo -e \"\[\033[1;91m\]\$?\[\033[0m\]\"; \
+  fi)\
+|~\$ "
+
+### Overwrite Protection
+set -o noclobber
+alias cp="cp -iv"
+alias mv='mv -iv'
+alias rm='rm -iv'
+
+# Welcome message after login
+printf "\n"
+printf "\e[91m🔐 Coresecret Channel Established. \e[0m\n"
+printf "\e[92m✅ Welcome back\e[0m"; printf "\e[95m '%s' \e[0m" "${USER}"; printf "\e[92m! Type\e[0m"; printf "\e[95m 'celp'\e[0m"; printf "\e[92m for shortcuts. \e[0m\n"
+printf "\n"
+printf "\n"
+
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

config/includes.chroot/root/.ciss/alias

@@ -0,0 +1,212 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-05-05; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024–2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.live.builder
+# SPDX-Security-Contact: security@coresecret.eu
+
+########################################################################################### ℵ
+#######################################
+# Outputs a 16-character random printable string
+# Arguments:
+#  None
+#######################################
+genstring() {
+  (haveged -n 1000 -f - 2>/dev/null | tr -cd '[:graph:]' | fold -w 16 && echo ) | head
+}
+
+# Generates 1,048,576 random bytes into a timestamped file
+alias genkeyfile='haveged -n 1048576 >| /tmp/secure_keyfile_$(date +%s)'
+
+########################################################################################### Bash
+alias clear="printf '\033c'"
+alias c='clear'
+alias q='exit'
+
+########################################################################################### Chrony
+alias cytr='echo "tracking -a -v" | chronyc'
+alias cysd='echo "selectdata -a -v" | chronyc'
+alias cyss='echo "sourcestats -a -v" | chronyc'
+
+########################################################################################### fail2ban & ufw
+alias f2ball='fail2ban-client status'
+alias f2bubn='fail2ban-client unban --all'
+alias f2bufw='fail2ban-client status ufw'
+alias usn='ufw status numbered'
+alias usv='ufw status verbose'
+
+########################################################################################### ls
+alias ls='eza --group-directories-first --icons=always --oneline --long --all --group --header --blocksize --inode --flags --binary --octal-permissions --total-size --sort extension'
+alias lsf='eza --group-directories-first --icons=always --oneline --long --all --absolute --group --header --blocksize --inode --flags --binary --octal-permissions --total-size --sort extension'
+alias lss='eza --group-directories-first --icons=always --oneline --long --all --absolute --group --header --blocksize --inode --flags --binary --octal-permissions --total-size --sort extension --extended'
+alias la='ls'
+alias ll=ls
+alias l=ls
+
+########################################################################################### Package Management
+alias aptac='apt autoclean'
+alias aptap='apt autopurge'
+alias aptar='apt autoremove'
+alias aptcheck='apt-get check'
+alias aptdep='apt-cache depends'
+alias aptdl='apt-get install --download-only'
+alias aptfug='apt full-upgrade'
+alias aptupd='apt update'
+alias aptupg='apt upgrade'
+alias apti='apt install'
+alias aptp='apt purge'
+alias aptr='apt remove'
+alias aptse='apt search'
+alias aptsh='apt show'
+alias aptimage='apt-cache search linux-image | grep linux-image | grep amd64 | grep -v "dbg" | grep -v "meta-package" | grep -v "cloud" | grep -v "PREEMPT"'
+
+########################################################################################### Readability
+alias df='df -h'
+alias free='free -m'
+alias mkdir='mkdir -pv'
+
+########################################################################################### Service restart
+alias rsban='systemctl restart fail2ban'
+alias rsweb='systemctl restart nginx php8.4-fpm redis'
+
+########################################################################################### System maintaining
+alias boot='reboot -h now'
+alias cscan='clamscan -r --bell -i'
+alias chkhvg='haveged -n 0 | dieharder -g 200 -a'
+alias dev='lsblk -o NAME,MAJ:MIN,FSTYPE,FSVER,SIZE,UUID,MOUNTPOINT,PATH'
+alias i='echo "$(whoami) @ $(uname -a)"'
+alias ipunused='iptables -L -v -n'
+alias jboot='journalctl --boot=0'
+alias lsadt='lynis audit system --auditor Centurion_Intelligence_Consulting_Agency'
+alias lsadtdoc='lynis audit system --auditor Centurion_Intelligence_Consulting_Agency > /root/lynis-$(date +%F_%H-%M-%S).txt 2>&1'
+alias n='nano'
+alias nstat='netstat -tlpnvWa'
+alias s='sudo -i'
+alias sas='systemd-analyze security'
+alias shut='shutdown -h now'
+alias ssa='systemctl status'
+alias ssf='systemctl status --failed'
+alias sysdr='systemctl daemon-reload'
+alias syses='systemctl edit'
+alias sysrl='systemctl reload'
+alias sysrs='systemctl restart'
+alias syssp='systemctl stop'
+alias sysst='systemctl start'
+alias v='nvim'
+alias whatdelete='lsof | grep deleted'
+alias whatimage='dpkg --list | grep linux-image'
+alias whatpurge='dpkg --get-selections | grep deinstall'
+
+########################################################################################### Functions
+
+###########################################################################################
+# Generates Secure (/dev/random) Passwords
+# Arguments:
+#  Length of Password, e.g., 32, and --base64 in case of encoding in BASE64.
+###########################################################################################
+# shellcheck disable=SC2317
+genpasswd() {
+  declare -i length=32
+  declare -i usebase64=0
+
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --base64)
+        usebase64=1
+        ;;
+      '' | *[!0-9]*) ;;
+      *)
+         length="$1"
+        ;;
+    esac
+    shift
+  done
+
+  declare passwd
+  passwd=$(tr -dc 'A-Za-z0-9_' < /dev/random | head -c "${length}")
+
+  if [[ ${usebase64} -eq 1 ]]; then
+    echo -n "${passwd}" | base64
+  else
+    echo "${passwd}"
+  fi
+}
+
+###########################################################################################
+# Generates Secure (/dev/random) Passwords
+# Arguments:
+#  none
+###########################################################################################
+# shellcheck disable=SC2317
+genpasswdhash() {
+  declare salt
+  salt=$(tr -dc 'A-Za-z0-9' < /dev/random | head -c 16)
+  mkpasswd --method=sha-512 --salt="${salt}" --rounds=8388608
+}
+
+###########################################################################################
+# Globals: Wrapper for secure curl
+# Arguments:
+#  $1: URL from which to download a specific file
+#  $2: /path/to/file to be saved to
+###########################################################################################
+# shellcheck disable=SC2317
+scurl() {
+  if [[ $# -ne 2 ]]; then
+    printf "\e[91m❌ Error: Usage: scurl <URL> <path/to/file>. \e[0m\n" >&2
+    return 1
+  fi
+
+  if ! curl --proto '=https' --tlsv1.3 -sSf -o "${2}" "${1}"; then
+    printf "\e[91m❌ Error: Download failed for URL: '%s'. \e[0m\n" "${1}" >&2
+    return 2
+  fi
+}
+
+###########################################################################################
+# Globals: Wrapper for secure wget
+# Arguments:
+#  $1: URL from which to download a specific file
+#  $2: /path/to/file to be saved to
+###########################################################################################
+# shellcheck disable=SC2317
+swget() {
+  if [[ $# -ne 2 ]]; then
+    printf "\e[91m❌ Error: Usage: swget <URL> <path/to/file>. \e[0m\n" >&2
+    return 1
+  fi
+
+  if ! wget --no-clobber --https-only --secure-protocol=TLSv1_3 -qO "${2}" "${1}"; then
+    printf "\e[91m❌ Error: Download failed for URL: '%s'. \e[0m\n" "${1}" >&2
+    return 2
+  fi
+}
+
+###########################################################################################
+# Globals: Wrapper for loading CISS.2025 hardened Kernel Parameters
+# Arguments:
+#  none
+###########################################################################################
+# shellcheck disable=SC2317
+sysp() {
+  sysctl -p /etc/sysctl.d/99_local.hardened
+  # sleep 1
+  sysctl -a | grep -E 'kernel|vm|net' > /var/log/sysctl_check"$(date +"%Y-%m-%d_%H:%M:%S")".log
+}
+
+###########################################################################################
+# Globals: Wrapper for tree
+# Arguments:
+#  $1: Depth of Directory Listing
+###########################################################################################
+# shellcheck disable=SC2317
+trel() {
+    declare depth=${1:-3}
+    tree -C -h --dirsfirst -L "${depth}"
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

config/includes.chroot/root/.ciss/clean_logout.sh

@@ -0,0 +1,39 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-05-05; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024–2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.live.builder
+# SPDX-Security-Contact: security@coresecret.eu
+clear
+
+cat << 'EOF'
+#######################################################################
+                 #                                              #
+                 ##                                             ##
+ ###### ######## ###  ## ######## ###  ## #######  ### #######  ###  ##
+###              #### ##    ###   ###  ##       ## ###       ## #### ##
+###      ####### #######    ###   ###  ##  ######  ###  ##   ## #######
+###      ###     ### ###    ###   ###  ##  ##  ##  ###  ##   ## ### ###
+ ######  ####### ###  ##    ###    #####   ##   ## ###   #####  ###  ##
+                       #                                              #
+#######################################################################
+EOF
+
+echo ""
+echo -e "\e[97m      (c) Marc S. Weidner, 2018 - 2025 \e[0m"
+echo -e "\e[97m      (p) Centurion Press, 2018 - 2025 \e[0m"
+echo -e "\e[97m          Centurion Intelligence Consulting Agency (tm) \e[0m"
+echo -e "\e[97m          https://coresecret.eu/ \e[0m"
+echo -e "\e[95m          Please consider making a donation: \e[0m"
+echo -e "\e[95m          https://coresecret.eu/spenden/ \e[0m"
+echo ""
+echo -e "\e[92m          All done" "\e[95m'${USER}'" "\e[92m! \e[0m"
+echo -e "\e[92m          Close shell with 'ENTER' to exit" "\e[95m'${HOSTNAME}'" "\e[92m! \e[0m"
+# shellcheck disable=SC2162
+read
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

config/includes.chroot/root/.ciss/scan_libwrap

@@ -0,0 +1,41 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-05-05; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024–2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.hardened.installer framework.
+# SPDX-PackageName: CISS.debian.live.builder
+# SPDX-Security-Contact: security@coresecret.eu
+
+#######################################
+# Scanner for 'libwrap' usage.
+# Arguments:
+#  None
+#######################################
+scanlw() {
+  printf "\e[92m🔍 Scanning all running processes for 'libwrap' usage ... \e[0m\n"
+  printf "\n"
+
+  # Collect binaries from all running PIDs
+  declare pid exe_path comm user
+
+  for pid in $(ps -e -o pid=); do
+    exe_path=$(readlink -f "/proc/${pid}/exe" 2>/dev/null)
+
+    # Skip if not a regular executable
+    [[ -x "${exe_path}" ]] || continue
+
+    # Check if the binary is linked with libwrap
+    if ldd "$exe_path" 2>/dev/null | grep -q "libwrap"; then
+      comm=$(ps -p "$pid" -o comm=)
+      user=$(ps -p "$pid" -o user=)
+      printf "\e[92m✅ PID: %s (%s) [User: %s] is linked with 'libwrap.so'. \e[0m\n" "${pid}" "${comm}" "${user}"
+    fi
+  done
+  printf "\n"
+  printf "\e[92m✅ Scan complete. \e[0m\n"
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

config/includes.chroot/root/.ciss/shortcuts

@@ -0,0 +1,116 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-05-05; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024–2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.hardened.installer framework.
+# SPDX-PackageName: CISS.debian.live.builder
+# SPDX-Security-Contact: security@coresecret.eu
+
+declare -ga shortcuts=(
+  "aptac: apt autoclean"
+  "aptap: apt autopurge"
+  "aptar: apt autoremove"
+  "aptcheck: apt-get check"
+  "aptdep: apt-cache depends"
+  "aptdl: apti --download-only"
+  "aptfug: apt full-upgrade"
+  "apti: apt install"
+  "aptimage: get Kernel Img"
+  "aptp: apt purge"
+  "aptr: apt remove"
+  "aptse: apt search"
+  "aptsh: apt show"
+  "aptupd: apt update"
+  "aptupg: apt upgrade"
+  "boot: reboot -h now"
+  "c: clear"
+  "clear: printf \033c"
+  "cscan: clamscan -r --bell -i"
+  "chkhvg: hvg -n 0 | dieharder -g 200 -a"
+  "cysd: chrony selectdata"
+  "cyss: chrony sourcestats"
+  "cytr: chrony tracking"
+  "dev: lsblk -o ..."
+  "df: df -h"
+  "f2ball: f2b status all"
+  "f2bubn: f2b unban --all"
+  "f2bufw: f2b status ufw"
+  "free: free -m"
+  "genkeyfile: 1MiBi"
+  "genpasswd: PWD"
+  "genpasswdhash: PWD Hash"
+  "genstring: Random String"
+  "i: who you are"
+  "ipunused: iptables -L -v -n"
+  "jboot: journalctl --boot=0"
+  "l: ls"
+  "la: ls"
+  "ll: ls"
+  "ls: eza"
+  "lsadt: lynis audit system"
+  "lsadtdoc: lynis audit system"
+  "lsf: eza --absolute"
+  "lss: eza --extended"
+  "mkdir: mkdir -pv"
+  "n: nano"
+  "nstat: netstat -tlpnvWa"
+  "q: exit"
+  "rsban: restart fail2ban"
+  "rsweb: restart nginx php8.4-fpm redis"
+  "s: sudo -i"
+  "sas: systemd-analyze security"
+  "scanlw: scan libwrap"
+  "scurl: TLS1.3 curl"
+  "shut: shutdown -h now"
+  "ssa: systemctl status"
+  "ssf: systemctl status --failed"
+  "swget: TLS1.3 wget"
+  "sysdr: systemctl daemon-reload"
+  "syses: systemctl edit"
+  "sysp: load 99_local.hardened"
+  "sysrl: systemctl reload"
+  "sysrs: systemctl restart'"
+  "syssp: systemctl stop"
+  "sysst: systemctl start"
+  "trel: tree"
+  "usn: ufw status numbered"
+  "usv: ufw status verbose"
+  "v: nvim"
+  "whatdelete: lsof | grep deleted"
+  "whatimage: dpkg --list | grep linux"
+  "whatpurge: dpkg --get-selections"
+)
+
+#######################################
+# Show available Aliases
+# Globals:
+#   CMAG
+#   CRES
+#   shortcuts
+# Arguments:
+#  None
+#######################################
+celp() {
+  declare arr=("${shortcuts[@]}")
+  declare cols=3
+  declare col_width=42
+  declare i=0
+  declare entry
+  for entry in "${arr[@]}"; do
+    # Print entry left-aligned in fixed width, colored
+    printf "${CMAG}%-${col_width}s${CRES}" "${entry}"
+    ((i++))
+    if ((i % cols == 0)); then
+      printf "\n"
+    fi
+  done
+  # If last line not full, add a newline
+  if ((i % cols != 0)); then
+    printf "\n"
+  fi
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh