V8.02.512.2025.05.30

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

lib/lib_hardening_root_pw.sh

@@ -0,0 +1,101 @@
+#!/bin/bash
+# SPDX-Version: 3.0
+# SPDX-CreationInfo: 2025-05-05; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
+# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
+# SPDX-FileCopyrightText: 2024–2025; WEIDNER, Marc S.; <msw@coresecret.dev>
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
+# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
+# SPDX-PackageName: CISS.debian.live.builder
+# SPDX-Security-Contact: security@coresecret.eu
+
+#######################################
+# Updates the Live ISO to use root password authentication for local console access.
+# Globals:
+#   HANDLER_BUILD_DIR
+#   HASHED_PWD
+# Arguments:
+#  None
+# Returns:
+#   0: In case no root password is desired.
+#######################################
+hardening_root_pw() {
+  if [[ -z ${HASHED_PWD} ]]; then
+    printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ No Root Password for Console set, skipping root password hook.\e[0m\n"
+    # sleep 1
+    return 0
+  fi
+
+  printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 Setup Root Password for Console ... \e[0m\n"
+  # sleep 1
+
+  declare cfg_dir="${HANDLER_BUILD_DIR}/config/includes.chroot/etc/live"
+  declare cfg_file="${cfg_dir}/config.conf"
+  declare dropin_dir="${cfg_dir}/config.conf.d"
+  declare dropin_file="${dropin_dir}/20-root-password.conf"
+
+  mkdir -p "${dropin_dir}"
+
+  cat << 'EOF' >| "${dropin_dir}"/10-disable-autologin.conf
+live-config.noautologin
+EOF
+
+  if ! grep -q 'LIVE_CONFIGS=.*root-password' "${cfg_file}"; then
+    sed -i -E 's|LIVE_CONFIGS="([^"]*)"|LIVE_CONFIGS="\1 root-password"|' "${cfg_file}"
+  fi
+
+  declare clean_hash="${HASHED_PWD//\"/}"
+
+  printf 'live-config.root-password-hash=%s\n' "${clean_hash}" >| "${dropin_file}"
+  chmod 0600 "${dropin_file}"
+  chown root:root "${dropin_file}"
+
+  mkdir -p "${HANDLER_BUILD_DIR}/config/includes.chroot/root"
+  printf '%s\n' "${clean_hash}" >| "${HANDLER_BUILD_DIR}/config/includes.chroot/root/.pwd"
+  chmod 0600 "${HANDLER_BUILD_DIR}/config/includes.chroot/root/.pwd"
+  chown root:root "${HANDLER_BUILD_DIR}/config/includes.chroot/root/.pwd"
+
+  mkdir -p "${HANDLER_BUILD_DIR}"/config/includes.chroot/etc/systemd/system/getty@tty1.service.d
+  cat << 'EOF' >| "${HANDLER_BUILD_DIR}"/config/includes.chroot/etc/systemd/system/getty@tty1.service.d/override.conf
+[Service]
+ExecStart=
+#ExecStart=-/usr/sbin/agetty --noclear %I $TERM
+ExecStart=-agetty --noclear %I $TERM
+EOF
+
+  mkdir -p "${HANDLER_BUILD_DIR}"/config/includes.chroot/etc
+  cat << 'EOF' >| "${HANDLER_BUILD_DIR}"/config/includes.chroot/etc/securetty
+tty1
+tty2
+tty3
+tty4
+tty5
+tty6
+EOF
+
+  mkdir -p "${HANDLER_BUILD_DIR}"/config/includes.chroot/usr/sbin
+  mkdir -p "${HANDLER_BUILD_DIR}"/config/includes.chroot/usr/bin
+  mkdir -p "${HANDLER_BUILD_DIR}"/config/includes.chroot/sbin
+  cp -af /usr/sbin/agetty "${HANDLER_BUILD_DIR}/config/includes.chroot/usr/sbin/agetty"
+  cp -af /usr/sbin/agetty "${HANDLER_BUILD_DIR}/config/includes.chroot/usr/bin/agetty"
+  cp -af /usr/sbin/agetty "${HANDLER_BUILD_DIR}/config/includes.chroot/sbin/agetty"
+
+  ### Hotfix I
+  mkdir -p "${HANDLER_BUILD_DIR}/config/includes.chroot/usr/lib/systemd/system-generators"
+  cat << 'EOF' >| "${HANDLER_BUILD_DIR}/config/includes.chroot/usr/lib/systemd/system-generators/live-config-getty-generator"
+#!/bin/sh
+# bypass live-config-getty-generator
+exit 0
+EOF
+  chmod +x "${HANDLER_BUILD_DIR}/config/includes.chroot/usr/lib/systemd/system-generators/live-config-getty-generator"
+
+  ### Hotfix II
+  #mkdir -p "${HANDLER_BUILD_DIR}/config/includes.chroot/usr/lib/systemd/system-generators"
+  #touch "${HANDLER_BUILD_DIR}/config/includes.chroot/usr/lib/systemd/system-generators/live-config-getty-generator"
+  #chmod -x "${HANDLER_BUILD_DIR}/config/includes.chroot/usr/lib/systemd/system-generators/live-config-getty-generator"
+
+  printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ Setup Root Password for Console done. \e[0m\n"
+  # sleep 1
+}
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh