CISS.debian.live.builder/docs/DOCUMENTATION.md

Table of Contents

• 1. CISS.debian.live.builder
• 2.1. Usage
• 3. Booting
• 3.1. Grub Menu
• 3.2. Integrity checks
• 3.3. Console Login

1. CISS.debian.live.builder

Centurion Intelligence Consulting Agency Information Security Standard
Debian Live Build Generator for hardened live environment and CISS Debian Installer
Master Version: 8.13
Build: V8.13.536.2025.12.04

2.1. Usage

                        CDLB(1)                        CISS.debian.live.builder                        CDLB(1)

CISS.debian.live.builder from https://git.coresecret.dev/msw
Master V8.13.536.2025.12.04
A lightweight Shell Wrapper for building a hardened Debian Live ISO Image.

(c) Marc S. Weidner, 2018 - 2025
(p) Centurion Press, 2024 - 2025

./ciss_live_builder.sh <option>, where <option> is one or more of:

  --help, -h
    What you're looking at.

  --autobuild=*, -a=*
    Headless mode. Skip the dialog wrapper, provider note screen and interactive kernel selector dialog.
    Change '*' to your desired Linux kernel and trim the 'linux-image-' string to select a specific kernel,
    e.g. '--autobuild=6.12.30+bpo-amd64'.

  --architecture <STRING> one of <amd64 | arm64>
    A string reflecting the architecture of the Live System.
    MUST be provided.

  --build-directory </path/to/build_directory>
    Where the Debian Live Build Image should be generated. RECOMMENDED path: </opt/cdlb>
    MUST be provided.

  --change-splash <STRING> one of <club | hexagon>
    A string reflecting the Grub Boot Screen Splash you want to use. If omitted defaults to:
    <./.archive/background/club.png>

  --cdi
    This option creates a boot menu entry that starts the forthcoming 'CISS.debian.installer', which is executed
    once the system has successfully booted up.

  --contact, -c\ e[0m
    Show author contact information.

  --control <STRING>
    A string, that reflects the version of your Live ISO Image.
    MUST be provided.

  --debug, -d
    Enables debug logging for the main program routine. Detailed logging information are written to:
    </tmp/ciss_live_builder_1801049.log>

  --dhcp-centurion
    If a DHCP lease is provided, the provider's name server will be overridden and the hardened, privacy-focused
    Centurion DNS servers will be used instead:
      - https://dns01.eddns.eu/
      - https://dns02.eddns.de/
      - https://dns03.eddns.eu/

  --jump-host <IP | IP | ... >
    Provide up to 10 IPs for '/etc/host.allow' whitelisting of SSH access. Could be either IPv4 and / or IPv6
    addresses and / or CCDIR notation. If provided, than it MUST be a <SPACE> separated list.
    IPv6 addresses MUST be encapsulated with [], e.g., [1234::abcd]/64.

  --key_age=*
    The SOPS AGE private keyring for decryption operations. Change '*' to your desired SOPS AGE key file.
    File MUST be placed in:
    </dev/shm/cdlb_secrets>

  --key_luks=*
    The LUKS encryption / decryption passphrase for '/'-fs-encryption. Change '*' to your desired passphrase file.
    File MUST be placed in:
    </dev/shm/cdlb_secrets>

  --log-statistics-only
    Provides statistic only after successful building a CISS.debian.live-ISO. While enabling '--log-statistics-only'
    the argument '--build-directory' MUST be provided.

  --provider-netcup-ipv6
    Activates IPv6 support for Netcup Root Server. One unique IPv6 address MUST be provided in this case and MUST be
    encapsulated with [], e.g., [1234::abcd].

  --renice-priority <PRIORITY>
    Reset the nice priority value of the script and all its children to the desired <PRIORITY>. MUST be an integer
    between '-19' and 19. Negative (higher) values MUST be enclosed in double quotes '"'.

  --reionice-priority <CLASS> <PRIORITY>
    Reset the ionice priority value of the script and all its children to the desired <CLASS>. MUST be an integer:
      1: realtime
      2: best-effort
      3: idle
    Defaults to '2'.
    Whereas <PRIORITY> MUST be an integer as well between:
      0: highest priority and
      7: lowest priority.
    Defaults to '4'.
    A real-time I/O process can significantly slow down other processes or even cause them to starve if it
    continuously requests I/O.

  --root-password-file </dev/shm/cdlb_secrets/password.txt>>
    Password file for 'root', if given, MUST be a string of 42 to 64 characters.
    If the argument is omitted, no further login authentication is required for the local console.
    MUST be placed in:
    </dev/shm/cdlb_secrets/password.txt>

  --signing_key=* and --signing_key_fpr=*. Optional: --signing_key_pass=* --signing_ca=*
    The GPG private keyring that should be used for signing artifacts such as checksum hashes and scripts is
    specified via '--signing_key=*'. If the keyring is protected, then provide the passphrase in its own file.
    Specify the fingerprint of the key to use via '--signing_key_fpr=*'.
    Optionally import an offline GPG CA signing public key via: '--signing_ca=*'.
    Change '*' to your desired files / fingerprint. Files MUST be placed in:
    </dev/shm/cdlb_secrets>

  --sshfp
    Desired SSH id-files that should be incorporated in '/root/.ssh/id*'.
    Desired SSH host-files that should be incorporated in '/etc/ssh/ssh_host_*'.
    The respective id-files and / or host-files MUST be placed in:
    </dev/shm/cdlb_secrets/id*> / </dev/shm/cdlb_secrets/ssh_host_*>

  --ssh-port <INTEGER>
    The desired Port SSH should listen to.
    If not provided defaults to Port '22'.

  --ssh-pubkey </dev/shm/cdlb_secrets/>
    Imports the SSH Public Key from the file 'authorized_keys' into the Live ISO.
    Key file MUST be placed in:
    </dev/shm/cdlb_secrets/authorized_keys>

  --trixie
    Creates a Debian Trixie Live ISO. If omitted defaults to 'Trixie'. No other Debian Version is supported.

  --version, -v
    Show version of ./ciss_live_builder.sh.

💡 Notes:
🔵 You MUST be 'root' to run this script.

💷 Please consider donating to my work at:
🌐 https://coresecret.eu/spenden/

                        V8.13.536.2025.12.04                        2025-11-06                         CDLB(1)

3. Booting

3.1. Grub Menu

3.2. Integrity checks

3.3. Console Login

---

no tracking | no logging | no advertising | no profiling | no bullshit