diff --git a/README.html b/README.html index 6ec9b4f..9018c3b 100644 --- a/README.html +++ b/README.html @@ -1,7 +1,7 @@
Centurion Intelligence Consulting Agency Information Security Standard
Debian Live Build Generator for hardened live environment and CISS Debian Installer
Master Version: 8.02
Build: V8.03.256.2025.06.02
This shell wrapper automates the creation of a Debian Bookworm live ISO hardened according to the latest best practices in server and service security. It integrates into your build pipeline to deliver an isolated, robust environment suitable for cloud deployment or unattended installations via the forthcoming CISS.debian.installer.
This shell wrapper automates the creation of a Debian Bookworm live ISO hardened according to the latest best practices in server and service security. It integrates into your build pipeline to deliver an isolated, robust environment suitable for cloud deployment or unattended installations via the forthcoming CISS.debian.installer. The latest generic ISO is available at: CISS.debian.live.ISO_PUBLIC
Check out more:
Please note that coresecret.dev is included in the (HSTS Preload List) and always serves the headers:
add_header Expect-CT "max-age=86400, enforce" always;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
-Additionally, the entire zone is dual-signed with DNSSEC. See the current DNSSEC status at DNSSEC Audit Report
+Additionally, the entire zone is dual-signed with DNSSEC. See the current DNSSEC status at DNSSEC Audit Report
This live ISO establishes a secure, fully deterministic, integrity self-verifying boot environment based entirely on static source-code definitions. All configurations, system components, and installation routines are embedded during build time and locked for runtime immutability. This ensures that the live environment functions as a trusted Source of Truth — not only for boot-time operations, but for deploying entire systems in a secure and reproducible way.
Once booted, the environment optionally launches a fully scripted installer, via the forthcoming CISS.debian.installer, yet to deploy, that provisions the target system (the hardware the DVD is running on). The installer pulls no external dependencies besides of the necessary Debian debootstrap and Debian Packages and never exposes the target system in a not secure manner to the internet during installation. It operates strictly from within the verified image content, providing fully secured provisioning. Combined with checksum verification, activated by default, at boot and strict firewall defaults, this architecture guarantees that what is executed has not been tampered with and corresponds exactly to the intended source definition.
This approach provides a fully reproducible, audit-friendly, and tamper-resistant provisioning workflow rooted entirely in source-defined infrastructure logic.
After build and configuration, the following audit reports can be generated:
chkhvg at the prompt. See example report: Haveged Audit Reportlsadt at the prompt. See example report: Lynis Audit Reportssh-audit <IP>:<PORT>. See example report: SSH Audit Reportchkhvg at the prompt. See example report: Haveged Audit Reportlsadt at the prompt. See example report: Lynis Audit Reportssh-audit <IP>:<PORT>. See example report: SSH Audit Report