Implements minimal, secure login without username display:
1. **LightDM Installation**:
- Added lightdm and lightdm-gtk-greeter packages
- Enabled LightDM service by default
- Set default target to graphical
- Removed .xinitrc direct X boot
2. **Minimal and Secure Greeter**:
- Configured /etc/lightdm/lightdm.conf:
* hide-users=true (no username list displayed)
* show-manual-login=true (manual username entry only)
* allow-guest=false (no guest sessions)
* XDMCP disabled (no remote X sessions)
- Greeter shows only:
* Username field (for manual entry)
* Password field
* Login button
- No account picking, no user list
3. **Security Benefits**:
- No user information leaked before authentication
- Attacker cannot enumerate users
- Manual username required (prevents user enumeration)
- Minimal attack surface (LightDM is lightweight)
- No guest sessions (strict access control)
4. **Removed Direct X Boot**:
- No longer booting directly to IceWM via .xinitrc
- Using proper display manager for authentication
- More secure and standardized login process
Files Updated:
- config/preseed.cfg (LightDM packages, enabled service, late_command)
- config/security-config.sh (LightDM configuration, removed .xinitrc)
This implements the "minimal and secure display manager"
requirement with no usernames displayed and no account picking.
💘 Generated with Crush
Assisted-by: Gemini 2.5 Flash via Crush <crush@charm.land>
Major updates for production-ready ISO:
1. **Debian Version**:
- Updated to Debian 13.3.0 stable (released)
- No longer using testing/sid
- Using debian:stable Docker image
2. **Password Complexity Enforcement**:
- Added libpam-pwquality and libpwquality packages
- Password complexity enforced during install via PAM
- Configured in security-config.sh:
* Minimum 12 characters
* Mixed case required
* At least one digit
* At least one special character
* 3 character classes required
- Preseed enforces password checks during installer
3. **Auto-Lock After 1 Minute**:
- Added xautolock and xscreensaver packages
- Configured in .xinitrc for auto-lock after 1 minute idle
- Uses xscreensaver-command -lock for screen locking
4. **USB Drive Mounting**:
- Added udisks2, gvfs-backends, gvfs-fuse packages
- Created polkit rules for USB mounting
- User added to plugdev and cdrom groups
- USB drives mountable via file manager
5. **WiFi and Bluetooth Disabling**:
- Created config/disable-wifi-bt.sh script
- Blacklists all WiFi kernel modules
- Blacklists all Bluetooth kernel modules
- Masks bluetooth service
- Removes bluez packages
6. **First-Boot Verification**:
- Created scripts/verify-system.sh
- Created config/football-first-boot.service
- Verifies all functional requirements
- Runs once on first boot
- Prevents re-running via status file
7. **ISO Build System**:
- Updated to use Debian 13.3.0 stable ISO
- Scripts and config baked into ISO
- Docker-based build process
- Corrected ISO filename throughout
8. **Preseed Configuration**:
- Manual user creation (not automated)
- Manual password prompts (enforced via PAM)
- Late_command applies all security configs
- Copies verification script to target
- Enables first-boot verification service
Files Added:
- config/disable-wifi-bt.sh (WiFi/BT disabling)
- config/security-config.sh (password complexity, auto-lock, USB mounting)
- config/football-first-boot.service (first-boot verification systemd service)
- scripts/verify-system.sh (comprehensive verification script)
Files Updated:
- config/preseed.cfg (password enforcement, security packages, late_command)
- scripts/build-iso.sh (Debian 13.3.0, correct filenames)
- docs/FUNCTIONAL-REQUIREMENTS.md (verification strategy)
- AGENTS.md (documentation references)
- README.md (documentation references)
All requirements from this session implemented:
✓ Password complexity enforced during install
✓ Auto-lock after 1 minute idle
✓ USB drive mounting enabled
✓ WiFi/Bluetooth disabled
✓ First-boot verification
✓ Scripts baked into ISO (no internet needed)
✓ All packages in ISO
✓ Debian 13.3.0 stable
💘 Generated with Crush
Assisted-by: Gemini 2.5 Flash via Crush <crush@charm.land>
Adds ISO creation capability for bare metal deployment:
- preseed.cfg: Debian installer automation file
- Automates all installation steps
- User only sets username/password, root password, target disk
- Installs minimal package set
- build-iso.sh: Docker-based ISO build script
- Downloads Debian 13 netboot ISO
- Extracts ISO contents
- Injects preseed configuration
- Creates custom football-installer.iso
- All work done in Docker container
ISO enables easy bare metal deployment with minimal user input.
💘 Generated with Crush
Assisted-by: Gemini 2.5 Flash via Crush <crush@charm.land>
Add complete build infrastructure for football secure access system:
- Minimal Debian base with only IceWM and Remmina
- WireGuard-only networking with strict firewall (eth0 allows only WireGuard)
- All network traffic routed through mandatory VPN tunnel
- Secure Boot enforced for physical deployments
- Zero remote access - SSH, telnet disabled and blocked
- AppArmor, auditd, and fail2ban for security hardening
Build system generates both VM (qcow2) and physical (raw) images.
WireGuard endpoint IP and port configurable via build script variables.
Includes:
- Package list with minimal dependencies
- System hardening scripts
- WireGuard client and server configuration tools
- Comprehensive documentation (README.md, QUICKSTART.md)
- systemd services for firewall enforcement
- User environment with automatic IceWM startup
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
