102 lines
4.0 KiB
Bash
102 lines
4.0 KiB
Bash
#!/bin/bash
|
||
# SPDX-Version: 3.0
|
||
# SPDX-CreationInfo: 2025-05-05; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
|
||
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
||
# SPDX-FileCopyrightText: 2024–2025; WEIDNER, Marc S.; <msw@coresecret.dev>
|
||
# SPDX-FileType: SOURCE
|
||
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
||
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
||
# SPDX-PackageName: CISS.debian.live.builder
|
||
# SPDX-Security-Contact: security@coresecret.eu
|
||
|
||
#######################################
|
||
# Updates the Live ISO to use root password authentication for local console access.
|
||
# Globals:
|
||
# HANDLER_BUILD_DIR
|
||
# HASHED_PWD
|
||
# Arguments:
|
||
# None
|
||
# Returns:
|
||
# 0: In case no root password is desired.
|
||
#######################################
|
||
hardening_root_pw() {
|
||
if [[ -z ${HASHED_PWD} ]]; then
|
||
printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ No Root Password for Console set, skipping root password hook.\e[0m\n"
|
||
# sleep 1
|
||
return 0
|
||
fi
|
||
|
||
printf "\e[95m++++ ++++ ++++ ++++ ++++ ++++ ++ 🧪 Setup Root Password for Console ... \e[0m\n"
|
||
# sleep 1
|
||
|
||
declare cfg_dir="${HANDLER_BUILD_DIR}/config/includes.chroot/etc/live"
|
||
declare cfg_file="${cfg_dir}/config.conf"
|
||
declare dropin_dir="${cfg_dir}/config.conf.d"
|
||
declare dropin_file="${dropin_dir}/20-root-password.conf"
|
||
|
||
mkdir -p "${dropin_dir}"
|
||
|
||
cat << 'EOF' >| "${dropin_dir}"/10-disable-autologin.conf
|
||
live-config.noautologin
|
||
EOF
|
||
|
||
if ! grep -q 'LIVE_CONFIGS=.*root-password' "${cfg_file}"; then
|
||
sed -i -E 's|LIVE_CONFIGS="([^"]*)"|LIVE_CONFIGS="\1 root-password"|' "${cfg_file}"
|
||
fi
|
||
|
||
declare clean_hash="${HASHED_PWD//\"/}"
|
||
|
||
printf 'live-config.root-password-hash=%s\n' "${clean_hash}" >| "${dropin_file}"
|
||
chmod 0600 "${dropin_file}"
|
||
chown root:root "${dropin_file}"
|
||
|
||
mkdir -p "${HANDLER_BUILD_DIR}/config/includes.chroot/root"
|
||
printf '%s\n' "${clean_hash}" >| "${HANDLER_BUILD_DIR}/config/includes.chroot/root/.pwd"
|
||
chmod 0600 "${HANDLER_BUILD_DIR}/config/includes.chroot/root/.pwd"
|
||
chown root:root "${HANDLER_BUILD_DIR}/config/includes.chroot/root/.pwd"
|
||
|
||
mkdir -p "${HANDLER_BUILD_DIR}"/config/includes.chroot/etc/systemd/system/getty@tty1.service.d
|
||
cat << 'EOF' >| "${HANDLER_BUILD_DIR}"/config/includes.chroot/etc/systemd/system/getty@tty1.service.d/override.conf
|
||
[Service]
|
||
ExecStart=
|
||
#ExecStart=-/usr/sbin/agetty --noclear %I $TERM
|
||
ExecStart=-agetty --noclear %I $TERM
|
||
EOF
|
||
|
||
mkdir -p "${HANDLER_BUILD_DIR}"/config/includes.chroot/etc
|
||
cat << 'EOF' >| "${HANDLER_BUILD_DIR}"/config/includes.chroot/etc/securetty
|
||
tty1
|
||
tty2
|
||
tty3
|
||
tty4
|
||
tty5
|
||
tty6
|
||
EOF
|
||
|
||
mkdir -p "${HANDLER_BUILD_DIR}"/config/includes.chroot/usr/sbin
|
||
mkdir -p "${HANDLER_BUILD_DIR}"/config/includes.chroot/usr/bin
|
||
mkdir -p "${HANDLER_BUILD_DIR}"/config/includes.chroot/sbin
|
||
cp -af /usr/sbin/agetty "${HANDLER_BUILD_DIR}/config/includes.chroot/usr/sbin/agetty"
|
||
cp -af /usr/sbin/agetty "${HANDLER_BUILD_DIR}/config/includes.chroot/usr/bin/agetty"
|
||
cp -af /usr/sbin/agetty "${HANDLER_BUILD_DIR}/config/includes.chroot/sbin/agetty"
|
||
|
||
### Hotfix I
|
||
mkdir -p "${HANDLER_BUILD_DIR}/config/includes.chroot/usr/lib/systemd/system-generators"
|
||
cat << 'EOF' >| "${HANDLER_BUILD_DIR}/config/includes.chroot/usr/lib/systemd/system-generators/live-config-getty-generator"
|
||
#!/bin/sh
|
||
# bypass live-config-getty-generator
|
||
exit 0
|
||
EOF
|
||
chmod +x "${HANDLER_BUILD_DIR}/config/includes.chroot/usr/lib/systemd/system-generators/live-config-getty-generator"
|
||
|
||
### Hotfix II
|
||
#mkdir -p "${HANDLER_BUILD_DIR}/config/includes.chroot/usr/lib/systemd/system-generators"
|
||
#touch "${HANDLER_BUILD_DIR}/config/includes.chroot/usr/lib/systemd/system-generators/live-config-getty-generator"
|
||
#chmod -x "${HANDLER_BUILD_DIR}/config/includes.chroot/usr/lib/systemd/system-generators/live-config-getty-generator"
|
||
|
||
printf "\e[92m++++ ++++ ++++ ++++ ++++ ++++ ++ ✅ Setup Root Password for Console done. \e[0m\n"
|
||
# sleep 1
|
||
}
|
||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|