17dcee7e52
Add complete build infrastructure for football secure access system: - Minimal Debian base with only IceWM and Remmina - WireGuard-only networking with strict firewall (eth0 allows only WireGuard) - All network traffic routed through mandatory VPN tunnel - Secure Boot enforced for physical deployments - Zero remote access - SSH, telnet disabled and blocked - AppArmor, auditd, and fail2ban for security hardening Build system generates both VM (qcow2) and physical (raw) images. WireGuard endpoint IP and port configurable via build script variables. Includes: - Package list with minimal dependencies - System hardening scripts - WireGuard client and server configuration tools - Comprehensive documentation (README.md, QUICKSTART.md) - systemd services for firewall enforcement - User environment with automatic IceWM startup 💘 Generated with Crush Assisted-by: GLM-4.7 via Crush <crush@charm.land>
43 lines
1.5 KiB
Plaintext
43 lines
1.5 KiB
Plaintext
# Football Secure Access System
|
|
|
|
This system is configured for secure access to remote privileged access workstations through a WireGuard VPN tunnel.
|
|
|
|
**SYSTEM CHARACTERISTICS:**
|
|
- Remote access: DISABLED (no SSH, no network services)
|
|
- Local console access only
|
|
- Automatic IceWM window manager startup
|
|
- Remmina remote desktop client
|
|
- Secure Boot enforced
|
|
- **ALL network traffic MUST go through WireGuard VPN**
|
|
- **Direct network access BLOCKED - only WireGuard allowed**
|
|
|
|
**NETWORK CONFIGURATION:**
|
|
- Physical interface (eth0): ONLY allows WireGuard to configured endpoint
|
|
- WireGuard tunnel (wg0): ALL outbound traffic goes through this tunnel
|
|
- Inbound traffic: BLOCKED (except WireGuard keepalives)
|
|
- DHCP: Allowed on eth0 only for initial IP acquisition
|
|
|
|
**USAGE:**
|
|
1. Login with local user account
|
|
2. IceWM and Remmina start automatically
|
|
3. WireGuard tunnel is established automatically
|
|
4. Use Remmina to connect to PAW (Privileged Access Workstation) through VPN
|
|
5. Close Remmina when done
|
|
6. System locks automatically on inactivity
|
|
|
|
**SECURITY:**
|
|
- No remote administration permitted
|
|
- All direct network connections blocked
|
|
- Only WireGuard tunnel traffic allowed to configured endpoint
|
|
- System logs all actions
|
|
- Secure Boot verifies kernel integrity
|
|
- Firewall strictly enforced
|
|
|
|
**WIREGUARD ENDPOINT:**
|
|
- Configured during build (see build script variables)
|
|
- Only endpoint allowed: WG_ENDPOINT_IP:WG_ENDPOINT_PORT
|
|
- All traffic routes through VPN after connection
|
|
|
|
**CONTACT:**
|
|
For system issues, contact infrastructure security team.
|