Marc S. Weidner
9d11a1bf16
Some checks failed
💙 Generating a PUBLIC Live ISO. / 💙 Generating a PUBLIC Live ISO. (push) Has been cancelled
🔐 Generating a Private Live ISO TRIXIE. / 🔐 Generating a Private Live ISO TRIXIE. (push) Has been cancelled
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m37s
🛡️ Retrieve DNSSEC status of coresecret.dev. / 🛡️ Retrieve DNSSEC status of coresecret.dev. (push) Successful in 53s
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
168 lines
6.4 KiB
Markdown
168 lines
6.4 KiB
Markdown
---
|
|
gitea: none
|
|
include_toc: true
|
|
---
|
|
|
|
# 1. CISS.debian.live.builder
|
|
|
|
**Centurion Intelligence Consulting Agency Information Security Standard**<br>
|
|
*Debian Live Build Generator for hardened live environment and CISS Debian Installer*<br>
|
|
**Master Version**: 8.13<br>
|
|
**Build**: V8.13.520.2025.12.02<br>
|
|
|
|
# 2.1. Usage
|
|
````text
|
|
CDLB(1) CISS.debian.live.builder CDLB(1)
|
|
|
|
CISS.debian.live.builder from https://git.coresecret.dev/msw
|
|
Master V8.13.520.2025.12.02
|
|
A lightweight Shell Wrapper for building a hardened Debian Live ISO Image.
|
|
|
|
(c) Marc S. Weidner, 2018 - 2025
|
|
(p) Centurion Press, 2024 - 2025
|
|
|
|
./ciss_live_builder.sh <option>, where <option> is one or more of:
|
|
|
|
--help, -h
|
|
What you're looking at.
|
|
|
|
--autobuild=*, -a=*
|
|
Headless mode. Skip the dialog wrapper, provider note screen and interactive kernel selector dialog.
|
|
Change '*' to your desired Linux kernel and trim the 'linux-image-' string to select a specific kernel,
|
|
e.g. '--autobuild=6.12.30+bpo-amd64'.
|
|
|
|
--architecture <STRING> one of <amd64 | arm64>
|
|
A string reflecting the architecture of the Live System.
|
|
MUST be provided.
|
|
|
|
--build-directory </path/to/build_directory>
|
|
Where the Debian Live Build Image should be generated. RECOMMENDED path: </opt/cdlb>
|
|
MUST be provided.
|
|
|
|
--change-splash <STRING> one of <club | hexagon>
|
|
A string reflecting the Grub Boot Screen Splash you want to use. If omitted defaults to:
|
|
<./.archive/background/club.png>
|
|
|
|
--cdi
|
|
This option creates a boot menu entry that starts the forthcoming 'CISS.debian.installer', which is executed
|
|
once the system has successfully booted up.
|
|
|
|
--contact, -c\ e[0m
|
|
Show author contact information.
|
|
|
|
--control <STRING>
|
|
A string, that reflects the version of your Live ISO Image.
|
|
MUST be provided.
|
|
|
|
--debug, -d
|
|
Enables debug logging for the main program routine. Detailed logging information are written to:
|
|
</tmp/ciss_live_builder_1801049.log>
|
|
|
|
--dhcp-centurion
|
|
If a DHCP lease is provided, the provider's name server will be overridden and the hardened, privacy-focused
|
|
Centurion DNS servers will be used instead:
|
|
- https://dns01.eddns.eu/
|
|
- https://dns02.eddns.de/
|
|
- https://dns03.eddns.eu/
|
|
|
|
--jump-host <IP | IP | ... >
|
|
Provide up to 10 IPs for '/etc/host.allow' whitelisting of SSH access. Could be either IPv4 and / or IPv6
|
|
addresses and / or CCDIR notation. If provided, than it MUST be a <SPACE> separated list.
|
|
IPv6 addresses MUST be encapsulated with [], e.g., [1234::abcd]/64.
|
|
|
|
--key_age=*
|
|
The SOPS AGE private keyring for decryption operations. Change '*' to your desired SOPS AGE key file.
|
|
File MUST be placed in:
|
|
</dev/shm/cdlb_secrets>
|
|
|
|
--key_luks=*
|
|
The LUKS encryption / decryption passphrase for '/'-fs-encryption. Change '*' to your desired passphrase file.
|
|
File MUST be placed in:
|
|
</dev/shm/cdlb_secrets>
|
|
|
|
--log-statistics-only
|
|
Provides statistic only after successful building a CISS.debian.live-ISO. While enabling '--log-statistics-only'
|
|
the argument '--build-directory' MUST be provided.
|
|
|
|
--provider-netcup-ipv6
|
|
Activates IPv6 support for Netcup Root Server. One unique IPv6 address MUST be provided in this case and MUST be
|
|
encapsulated with [], e.g., [1234::abcd].
|
|
|
|
--renice-priority <PRIORITY>
|
|
Reset the nice priority value of the script and all its children to the desired <PRIORITY>. MUST be an integer
|
|
between '-19' and 19. Negative (higher) values MUST be enclosed in double quotes '"'.
|
|
|
|
--reionice-priority <CLASS> <PRIORITY>
|
|
Reset the ionice priority value of the script and all its children to the desired <CLASS>. MUST be an integer:
|
|
1: realtime
|
|
2: best-effort
|
|
3: idle
|
|
Defaults to '2'.
|
|
Whereas <PRIORITY> MUST be an integer as well between:
|
|
0: highest priority and
|
|
7: lowest priority.
|
|
Defaults to '4'.
|
|
A real-time I/O process can significantly slow down other processes or even cause them to starve if it
|
|
continuously requests I/O.
|
|
|
|
--root-password-file </dev/shm/cdlb_secrets/password.txt>>
|
|
Password file for 'root', if given, MUST be a string of 42 to 64 characters.
|
|
If the argument is omitted, no further login authentication is required for the local console.
|
|
MUST be placed in:
|
|
</dev/shm/cdlb_secrets/password.txt>
|
|
|
|
--signing_key=* and --signing_key_fpr=*. Optional: --signing_key_pass=* --signing_ca=*
|
|
The GPG private keyring that should be used for signing artifacts such as checksum hashes and scripts is
|
|
specified via '--signing_key=*'. If the keyring is protected, then provide the passphrase in its own file.
|
|
Specify the fingerprint of the key to use via '--signing_key_fpr=*'.
|
|
Optionally import an offline GPG CA signing public key via: '--signing_ca=*'.
|
|
Change '*' to your desired files / fingerprint. Files MUST be placed in:
|
|
</dev/shm/cdlb_secrets>
|
|
|
|
--sshfp
|
|
Desired SSH id-files that should be incorporated in '/root/.ssh/id*'.
|
|
Desired SSH host-files that should be incorporated in '/etc/ssh/ssh_host_*'.
|
|
The respective id-files and / or host-files MUST be placed in:
|
|
</dev/shm/cdlb_secrets/id*> / </dev/shm/cdlb_secrets/ssh_host_*>
|
|
|
|
--ssh-port <INTEGER>
|
|
The desired Port SSH should listen to.
|
|
If not provided defaults to Port '22'.
|
|
|
|
--ssh-pubkey </dev/shm/cdlb_secrets/>
|
|
Imports the SSH Public Key from the file 'authorized_keys' into the Live ISO.
|
|
Key file MUST be placed in:
|
|
</dev/shm/cdlb_secrets/authorized_keys>
|
|
|
|
--trixie
|
|
Creates a Debian Trixie Live ISO. If omitted defaults to 'Trixie'. No other Debian Version is supported.
|
|
|
|
--version, -v
|
|
Show version of ./ciss_live_builder.sh.
|
|
|
|
💡 Notes:
|
|
🔵 You MUST be 'root' to run this script.
|
|
|
|
💷 Please consider donating to my work at:
|
|
🌐 https://coresecret.eu/spenden/
|
|
|
|
V8.13.520.2025.12.02 2025-11-06 CDLB(1)
|
|
````
|
|
|
|
# 3. Booting
|
|
|
|
## 3.1. Grub Menu
|
|
|
|
|
|
## 3.2. Integrity checks
|
|
|
|
|
|
|
|
|
|
## 3.3. Console Login
|
|
|
|
|
|
---
|
|
**[no tracking | no logging | no advertising | no profiling | no bullshit](https://coresecret.eu/)**
|
|
<!-- vim: set number et ts=2 sw=2 sts=2 ai tw=128 ft=markdown -->
|