reachableceo
|
9459c84fbc
|
fix: resolve all audit findings in hooks, config, and package list
Security/Functional Fixes:
- firewall-setup.sh: Added WireGuard allow, established/related, DHCP
(was blocking ALL outbound including VPN - system was non-functional)
- disable-package-management.sh: Preserve /var/lib/dpkg/ for queries
(was destroying dpkg database with rm -rf)
- encryption-validation.sh: Fixed inverted motd conditional
(was creating file only if it already existed - backwards)
- kernel-hardening.sh: Removed kernel.exec-shield (Red Hat only)
Changed user.max_user_namespaces from 0 to 100
- sudo-hardening.sh: Removed Defaults requiretty
(was breaking GUI-launched sudo via pkexec)
- encryption-setup.sh: Fixed conflicting stdin in luksAddKey
- install-scripts.sh: Fixed embedded firewall (same WireGuard bug)
Replaced gutted security-hardening stub with real status checker
- GRUB config: Fixed serial_console → serial (invalid terminal name)
- Package list: Removed audispd-plugins (deprecated in Debian 13),
removed duplicate wireguard/wireguard-tools entries
Reference: Full audit findings from Session 7 JOURNAL.md
💘 Generated with Crush
Assisted-by: GLM-5.1 via Crush <crush@charm.land>
|
2026-05-07 08:41:52 -05:00 |
|
reachableceo
|
0fb9abe43e
|
feat: add dual-mode ISO builds (production vs demo) with serial console
Two build modes:
- `./run.sh iso` — production ISO (prompts for credentials, quiet boot)
- `./run.sh iso:demo` — demo/CI ISO (hardcoded test credentials, serial
console output, verbose kernel)
Changes:
- run.sh: Accept iso:demo subcommand, pass KNEL_BUILD_MODE to Docker
- run.sh: Demo mode uses verbose kernel cmdline with console=ttyS0
- config/bootloaders/grub-pc/config.cfg: GRUB serial console on ttyS0
at 115200 baud alongside VGA gfxterm (dual output)
- config/includes.installer/demo.preseed.cfg: Fully automated preseed
with hardcoded test credentials (NOT for production use)
- config/hooks/binary/0199-serial-console.hook: Ensures serial console
on Debian installer entries too
- .gitignore: Fix binary/ pattern to /binary/ (was matching config/hooks/binary/)
Demo credentials (TESTING ONLY):
- User: football / Kn3l-F00tball-D3m0!
- Root: Kn3l-R00t-D3m0!
- LUKS: Kn3l-D3m0-LUKS!
💘 Generated with Crush
Assisted-by: GLM-5.1 via Crush <crush@charm.land>
|
2026-05-01 11:35:43 -05:00 |
|