---
gitea: none
include_toc: true
---

# 1. CISS.debian.live.builder

**Centurion Intelligence Consulting Agency Information Security Standard**<br>
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
**Master Version**: 8.03<br>
**Build**: V8.03.768.2025.06.11<br>

# 2. Usage
````text
CISS.debian.live.builder
Master V8.03.768.2025.06.11

(c) Marc S. Weidner, 2018 - 2025
(p) Centurion Press, 2024 - 2025

https://coresecret.eu/

A lightweight Shell Wrapper for building a hardened Debian Bookworm Live ISO Image.

"./ciss_live_builder.sh <option>", where <option> is one or more of:

  --help, -h
    What you're looking at.
    
  --autobuild=*, -a=*
    Headless mode. Skip the dialog wrapper, provider note screen and interactive kernel
    selector dialog. Change '*' to your desired Linux kernel and trim the
    'linux-image-' string to select a specific kernel, e.g. '--autobuild=6.12.22+bpo-amd64'.

  --architecture <STRING> one of <amd64 | arm64>
    A string reflecting the architecture of the Live System.
    MUST be provided.

  --build-directory </path/to/build_directory>
    Where the Debian Live Build Image should be generated.
    MUST be provided.

  --change-splash <STRING> one of <club | hexagon>
    A string reflecting the GRub Boot Screen Splash you want to use.
    If omitted defaults to "./.archive/background/club.png".

  --cdi (Experimental Feature)
    This option generates a boot menu entry to start the forthcoming
    'CISS.debian.installer', which will be executed after
    the system has successfully booted up.

  --contact, -c
    Displays contact information of the author.

  --control <INTEGER>
    An integer that reflects the version of your Live ISO Image.
    MUST be provided.

  --debug
    Enables debug logging for the main program routine. Detailed logging
    information are written to "/tmp/ciss_live_builder_3764286.log"

  --dhcp-centurion
    If a DHCP lease is provided, the provider's nameserver will be overridden,
    and only the hardened, privacy-focused Centurion DNS servers will be used:
    - https://dns01.eddns.eu/
    - https://dns02.eddns.de/

  --jump-host <IP | IP | ... >
    Provide up to 10 IPs for /etc/host.allow whitelisting of SSH access.
    Could be either IPv4 and / or IPv6 addresses and / or CCDIR notation.
    If provided, than it MUST be a <SPACE> separated list.
    IPv6 addresses MUST be encapsulated with [], e.g., [1234::abcd/64].

  --log-statistics-only
    Provides statistic only after successful building a
    CISS.debian.live-ISO. While enabling "--log-statistics-only"
    the argument "--build-directory" MUST be provided while
    all further options MUST be omitted.

  --provider-netcup-ipv6 
    Activates IPv6 support for Netcup Root Server. One unique
    IPv6 address MUST be provided in this case.

  --renice-priority <PRIORITY>
    Reset the nice priority value of the script and all its children
    to the desired PRIORITY. MUST be an integer (between "-19" and 19).
    Negative (higher) values MUST be enclosed in double quotes '"'.

  --reionice-priority <CLASS> <PRIORITY>
    Reset the ionice priority value of the script and all its children
    to the desired CLASS. MUST be an integer:
    1: realtime
    2: best-effort
    3: idle
    defaults to "2".
    PRIORITY MUST be an integer:
    between 0 (highest) and 7 (lowest) priority.
    defaults to "4".
    A real-time I/O process can significantly slow down other processes
    or even cause them to starve if it continuously requests I/O.

  --root-password-file </path/to/password.txt>
    Password file for 'root', if given, MUST be a string of 20 to 64 characters,
    and MUST NOT contain the special character '"'.
    If the argument is omitted, no further login authentication is required for
    the local console. The root password is hashed with an 16 Byte '/dev/random'
    generated SALT and SHA512 Hashing function and 8,388,608 rounds. Immediately
    after Hash generation all Variables containing plain password fragments are
    deleted. Password file SHOULD be 0400 and root:root and is deleted without
    further prompt after password hash has been successfully generated via:
    shred -vfzu 5 -f.
    No tracing of any plain text password fragment in any debug log.

  --ssh-port <INTEGER>
    The desired Port SSH should listen to.
    If not provided defaults to Port 22.

  --ssh-pubkey </path/to/.ssh/>
    Imports the SSH Public Key(s) from the FILE 'authorized_keys' of the
    specified PATH into the Live ISO. MUST be provided.

  --version, -v
    Displays version of ./ciss_live_builder.sh.

NOTES:
  - You MUST be root to run this script.

Contact:
  - https://coresecret.eu/
  - security@coresecret.eu
    - PGP Key 2D98 07F4 1030 1776 597E BDC9 9F54 8853 35A3 C9AD
      - https://keys.openpgp.org/vks/v1/by-fingerprint/2D9807F410301776597EBDC99F54885335A3C9AD
````

# 3. Booting

## 3.1. Grub Menu
![Boot Menu](/docs/screenshots/20250517_boot_grub.jpg)

## 3.2. Integrity checks
![Integrity Check](screenshots/20250517_boot_integrity_check.jpg)

![Integrity Success](screenshots/20250517_boot_integrity_success.jpg)

## 3.3. Console Login
![Console Login](screenshots/20250517_console_login.jpg)

---
**[no tracking | no logging | no advertising | no profiling | no bullshit](https://coresecret.eu/)**
<!-- vim: set number et ts=2 sw=2 sts=2 ai tw=128 ft=markdown -->