reachableceo
2b422cf62c
Addresses findings C-02, C-05, H-01, H-02, H-03, H-04, H-07, H-08, M-01, M-02, M-05, M-07, M-08, M-12, plus encryption script fixes. Changes: - run.sh: Enforce host FDE check (C-02), make sbverify fatal (H-07), add module.sig_enforce to Docker-embedded UKI (H-08) - usb-automount.sh: Add noexec,nosuid,nodev mount options (C-05), restrict dmask/fmask, add input validation, add audit logging (M-08) - security-hardening.sh (live): Set StrictHostKeyChecking yes (H-01), remove sshd_config generation (H-02), expand WiFi blacklist (M-12) - firewall-setup.sh (live): Remove inbound ICMP echo, narrow WG port range to 51820 only (M-05) - firewall-setup.sh (src): Add ct state established,related (H-03) - security-hardening.sh (src): Fix apply_security_hardening to call configure_ssh_client and configure_fim with separate output paths (M-01) - install-scripts.sh: Remove football from sudo group (M-02) - mount-hardening.sh: Ensure /tmp,/var/tmp,/dev/shm always hardened even without existing fstab entries (M-07) - encryption-setup.sh: Fix cryptsetup stdin syntax (H-05), add dynamic LUKS device discovery (H-06), fix recovery key generation (M-04), fix crypttab sed pattern - qr-code-import.sh: Restrict temp file permissions (H-04) - Tests updated to match new security posture All 786+ tests pass. Zero shellcheck warnings. Reference: DeepReport-2026-05-08.md findings C-02, C-05, H-01 through H-08, M-01, M-02, M-05, M-07, M-08, M-12 💘 Generated with Crush Assisted-by: GLM-5.1 via Crush <crush@charm.land>
106 lines
2.7 KiB
Bash
Executable File
106 lines
2.7 KiB
Bash
Executable File
#!/bin/bash
|
|
# Install QR code scanning tools for WireGuard
|
|
set -euo pipefail
|
|
|
|
echo "Installing QR code scanning tools..."
|
|
|
|
# Install zbar for QR code scanning
|
|
apt-get update
|
|
apt-get install -y zbar-tools python3-pil
|
|
apt-get clean
|
|
|
|
# Create QR code scanning script
|
|
cat >/usr/local/bin/scan-wireguard-qr.sh <<'EOF'
|
|
#!/bin/bash
|
|
# Scan WireGuard QR code and update configuration
|
|
set -euo pipefail
|
|
|
|
# Check if webcam is available
|
|
if ! ls /dev/video* >/dev/null 2>&1; then
|
|
echo "Error: No webcam device found"
|
|
exit 1
|
|
fi
|
|
|
|
# Create temporary file for QR data with restricted permissions
|
|
qr_data=$(mktemp)
|
|
chmod 600 "$qr_data"
|
|
trap "rm -f \"$qr_data\"" EXIT
|
|
|
|
# Scan QR code
|
|
echo "Scanning QR code..."
|
|
zbarcam --raw --prescale=320x240 /dev/video0 > "$qr_data" &
|
|
zbar_pid=$!
|
|
|
|
# Wait for user to stop scanning
|
|
echo "Press Enter to stop scanning..."
|
|
read -r
|
|
kill $zbar_pid 2>/dev/null || true
|
|
|
|
# Parse QR data and update WireGuard config
|
|
if [[ -s "$qr_data" ]]; then
|
|
# Validate QR data format (basic WireGuard format)
|
|
if grep -q "private_key\|endpoint\|allowed_ips" "$qr_data"; then
|
|
# Backup existing config
|
|
if [[ -f "/etc/wireguard/wg0.conf" ]]; then
|
|
cp /etc/wireguard/wg0.conf "/etc/wireguard/wg0.conf.bak.$(date +%Y%m%d_%H%M%S)"
|
|
fi
|
|
|
|
# Convert QR data to WireGuard config format
|
|
python3 << 'PYTHON_EOF' "$qr_data"
|
|
import sys
|
|
import re
|
|
|
|
qr_data = sys.argv[1]
|
|
|
|
# Simple QR to WireGuard config conversion
|
|
config_lines = ["[Interface]"]
|
|
private_key = ""
|
|
address = ""
|
|
|
|
for line in open(qr_data):
|
|
if "private_key=" in line.lower():
|
|
private_key = line.strip()
|
|
elif "address=" in line.lower():
|
|
address = line.strip()
|
|
|
|
if private_key:
|
|
config_lines.append(f"PrivateKey = {private_key.split('=')[1].strip()}")
|
|
if address:
|
|
config_lines.append(f"Address = {address.split('=')[1].strip()}")
|
|
|
|
# Add basic peer template
|
|
config_lines.append("")
|
|
config_lines.append("[Peer]")
|
|
config_lines.append("# Add PublicKey, Endpoint, and AllowedIPs manually")
|
|
|
|
print("\n".join(config_lines))
|
|
PYTHON_EOF
|
|
|
|
echo "QR code scanned successfully. Please edit /etc/wireguard/wg0.conf to complete configuration."
|
|
else
|
|
echo "Error: Invalid WireGuard QR code format"
|
|
exit 1
|
|
fi
|
|
else
|
|
echo "Error: No QR code data captured"
|
|
exit 1
|
|
fi
|
|
EOF
|
|
|
|
chmod +x /usr/local/bin/scan-wireguard-qr.sh
|
|
|
|
# Create desktop shortcut
|
|
mkdir -p /usr/share/applications
|
|
cat >/usr/share/applications/scan-wireguard-qr.desktop <<EOF
|
|
[Desktop Entry]
|
|
Name=Import WireGuard QR Code
|
|
Comment=Scan QR code to import WireGuard configuration
|
|
Exec=pkexec /usr/local/bin/scan-wireguard-qr.sh
|
|
Icon=camera-web
|
|
Terminal=true
|
|
Type=Application
|
|
Categories=Network;System;
|
|
EOF
|
|
|
|
echo "QR code scanning tools installed successfully."
|