Marc S. Weidner
ef87becefe
Some checks failed
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m37s
🛡️ Retrieve DNSSEC status of coresecret.dev. / 🛡️ Retrieve DNSSEC status of coresecret.dev. (push) Successful in 1m9s
🔐 Generating a Private Live ISO TRIXIE. / 🔐 Generating a Private Live ISO TRIXIE. (push) Failing after 1m0s
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
101 lines
3.9 KiB
Bash
101 lines
3.9 KiB
Bash
#!/bin/bash
|
|
# SPDX-Version: 3.0
|
|
# SPDX-CreationInfo: 2025-05-05; WEIDNER, Marc S.; <msw@coresecret.dev>
|
|
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
|
|
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
|
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
|
|
# SPDX-FileType: SOURCE
|
|
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
|
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
|
# SPDX-PackageName: CISS.debian.live.builder
|
|
# SPDX-Security-Contact: security@coresecret.eu
|
|
|
|
guard_sourcing
|
|
|
|
#######################################
|
|
# SSH hardening via TCP wrapper.
|
|
# Globals:
|
|
# ARY_HANDLER_JUMPHOST
|
|
# BASH_SOURCE
|
|
# VAR_WORKDIR
|
|
# Arguments:
|
|
# None
|
|
# Returns:
|
|
# 0: on success
|
|
#######################################
|
|
hardening_ssh_tcp() {
|
|
printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 %s starting ... \e[0m\n" "${BASH_SOURCE[0]}"
|
|
|
|
if ((${#ARY_HANDLER_JUMPHOST[@]} > 0)); then
|
|
declare allowed=""
|
|
cat << 'EOF' >| "${VAR_WORKDIR}/hosts.allow"
|
|
# SPDX-Version: 3.0
|
|
# SPDX-CreationInfo: 2025-05-05; WEIDNER, Marc S.; <msw@coresecret.dev>
|
|
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
|
|
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
|
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
|
|
# SPDX-FileType: SOURCE
|
|
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
|
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
|
# SPDX-PackageName: CISS.debian.live.builder
|
|
# SPDX-Security-Contact: security@coresecret.eu
|
|
|
|
# /etc/hosts.allow: list of hosts that are allowed to access the system.
|
|
# See the manual pages hosts_access(5) and hosts_options(5).
|
|
#
|
|
# Example: ALL: LOCAL @some_netgroup
|
|
# ALL: .foobar.edu EXCEPT terminalserver.foobar.edu
|
|
#
|
|
# If you're going to protect the portmapper use the name "rpcbind" for the
|
|
# daemon name. See rpcbind(8) and rpc.mountd(8) for further information.
|
|
#
|
|
|
|
EOF
|
|
|
|
allowed=$(echo "${ARY_HANDLER_JUMPHOST[*]}" | tr '\n' ' ')
|
|
printf 'sshd: %s\n\n# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf\n' "${allowed}" >> "${VAR_WORKDIR}/hosts.allow"
|
|
|
|
cat << 'EOF' >| "${VAR_WORKDIR}/hosts.deny"
|
|
# SPDX-Version: 3.0
|
|
# SPDX-CreationInfo: 2025-05-05; WEIDNER, Marc S.; <msw@coresecret.dev>
|
|
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
|
|
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
|
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
|
|
# SPDX-FileType: SOURCE
|
|
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
|
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
|
# SPDX-PackageName: CISS.debian.live.builder
|
|
# SPDX-Security-Contact: security@coresecret.eu
|
|
|
|
# /etc/hosts.deny: list of hosts that are _not_ allowed to access the system.
|
|
# See the manual pages hosts_access(5) and hosts_options(5).
|
|
#
|
|
# Example: ALL: some.host.name, .some.domain
|
|
# ALL EXCEPT in.fingerd: other.host.name, .other.domain
|
|
#
|
|
# If you're going to protect the portmapper use the name "rpcbind" for the
|
|
# daemon name. See rpcbind(8) and rpc.mountd(8) for further information.
|
|
#
|
|
# The PARANOID wildcard matches any host whose name does not match its
|
|
# address.
|
|
#
|
|
# You may wish to enable this to ensure any programs that don't
|
|
# validate looked-up hostnames still leave understandable logs. In past
|
|
# versions of Debian, this has been the default.
|
|
# ALL: PARANOID
|
|
|
|
ALL: ALL
|
|
|
|
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
|
|
EOF
|
|
fi
|
|
|
|
printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ %s successfully applied. \e[0m\n" "${BASH_SOURCE[0]}"
|
|
|
|
return 0
|
|
}
|
|
### Prevents accidental 'unset -f'.
|
|
# shellcheck disable=SC2034
|
|
readonly -f hardening_ssh_tcp
|
|
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|