Charles N Wyble
3fc85b8130
- Add project directory structure with config, src, tests directories - Implement run.sh host wrapper script for Docker-based workflow - Create Dockerfile for build/test environment with live-build - Add basic live-build configuration with preseed and package lists - Add .gitignore and .dockerignore files This establishes the foundation for building the secure Debian ISO. 💘 Generated with Crush Assisted-by: GLM-4.6 via Crush <crush@charm.land>
159 lines
7.3 KiB
Markdown
159 lines
7.3 KiB
Markdown
# KNEL-Football Pre-Flight Discussion - Questions, Comments, and Concerns
|
|
|
|
## Questions:
|
|
|
|
### 1. Debian 13 Availability ✅ RESOLVED
|
|
- **Original**: Debian 13 (Trixie) is currently in testing
|
|
- **Status**: RESOLVED - Debian 13.3.0 is released and stable
|
|
- **Action**: Updated spec to use debian-13.3.0-amd64-netinst.iso
|
|
|
|
### 2. USB Automounting and Package Inclusion ✅ RESOLVED
|
|
- **Original**: How will the system access USB mounting utilities without network access?
|
|
- **Status**: RESOLVED - All packages must be pre-included in ISO
|
|
- **Action**: Updated spec to clarify all utilities pre-installed
|
|
|
|
### 3. Compliance Specificity
|
|
- **Question**: Which specific CMMC levels, FedRAMP authorization levels, or STIG IDs should we target?
|
|
- **Concern**: Without specific controls, we may implement security measures that don't meet actual requirements
|
|
- **Options**:
|
|
- CMMC Level 3, 4, or 5?
|
|
- FedRAMP Moderate or High?
|
|
- Specific DISA STIG for Debian 13?
|
|
|
|
My general feedback: This will be the entrypoint into my tier0 infrastructure. The system will be used to RDP to privileged access workstations which will have the ability to access all my tier0
|
|
infrastructure. The tier0 systems will be supporting systems which handle ITAR data. Also SECRET systems (supporting a couple of SCIFs we are building out).
|
|
|
|
Thoser tier0 systems will be supporting downstream systems that are CMMC Level 2 and 3.
|
|
|
|
Re FedRAMP, lets go with LI-SaaS. We have a product called RackRental.net that we want to sell to federal government. It wont process any sensitive data.
|
|
Re DISA STIG , I am not sure. I believe we need to implement CIS as the controls? I am not fully certain on STIG/CIS and how it all fits together. Can you help?
|
|
|
|
|
|
### 4. WireGuard Configuration Management
|
|
- **Question**: Should we assume WireGuard config will be provided via USB, or include a default template?
|
|
- **Concern**: Without a config, the system will have no network connectivity at all
|
|
- **Options**:
|
|
- Include sample/template configuration
|
|
- Include QR code import capability
|
|
- Assume user provides complete config via USB
|
|
|
|
Ah yes! I very much want to support QR code import capability! I forgot about that functionality. The laptop will have a web cam, so will be able to scan the QR code.
|
|
The user may also provide the config via USB.
|
|
|
|
## Technical Concerns:
|
|
|
|
### 5. Docker Build Context and Package Availability
|
|
- **Concern**: The current Dockerfile may not have all required packages for Debian 13.3.0
|
|
- **Issue**: Package names or availability may differ between Debian versions
|
|
- **Need**: Verify all packages in Dockerfile exist in Debian 13.3.0
|
|
|
|
### 6. Test Environment Privileges
|
|
- **Concern**: Some tests (firewall, system services) require elevated privileges
|
|
- **Issue**: Container environment may not support all required test scenarios
|
|
- **Need**: Determine how to test privileged operations in containers
|
|
|
|
Well the test suite will need to run on the installed system. It makes no sense to run it in the build environment. Unless I am missing something? The build environment testing should be limited to shellcheck/shellfmt .
|
|
|
|
### 7. ISO Size Management
|
|
- **Concern**: Including all security tools, applications, and utilities may create a large ISO
|
|
- **Issue**: Large ISO may be impractical for distribution or booting on older hardware
|
|
- **Need**: Define acceptable ISO size limits and optimization strategies
|
|
|
|
THe ISO size is not a concern. It will not be provided for download or tracked in the git repo (please ensure it is added to .gitignore)
|
|
|
|
## Missing Details:
|
|
|
|
### 8. Complete Package List
|
|
- **Missing**: Exact package list for base system and applications
|
|
- **Need**: Define all packages to include in the ISO (not just applications like Remmina, etc.)
|
|
- **Examples**: Which kernel packages? Which security tools? Which system utilities?
|
|
|
|
The system must be VERY minimal. The bare minimum of packages to meet the functional needs. Start minimal and I can tweak as we go.
|
|
|
|
### 9. Live-build Configuration Details
|
|
- **Missing**: Specific live-build configuration parameters
|
|
- **Need**: Kernel parameters, boot options, system settings
|
|
- **Examples**: Security kernel parameters, initrd options, bootloader security
|
|
|
|
### 10. Error Handling and Recovery
|
|
- **Missing**: Comprehensive error handling strategy
|
|
- **Need**: How to handle build failures, configuration errors, system boot issues
|
|
- **Examples**: Build failures, corrupted configs, boot problems
|
|
|
|
I leave the above two items to your best judgement. I dont have any specific feedback.
|
|
|
|
### 11. Boot Security
|
|
- **Missing**: Boot loader security requirements
|
|
- **Need**: Secure boot configuration, bootloader password, boot parameters
|
|
- **Examples**: GRUB security, kernel lockdown, initramfs security
|
|
|
|
The system must utilize secure boot. It must refuse to boot if anything has been altered. The system will never have apt-get update/upgrade run on it. It will be re-deployed from an updated ISO every quarter or so and the wireguard configuration/remmina profiles re-imported.
|
|
|
|
## Additional Considerations:
|
|
|
|
### 12. User Experience and Documentation
|
|
- **Concern**: Security-focused system may be difficult for users
|
|
- **Need**: Clear documentation for secure workflows
|
|
- **Question**: Should we include user guides in the ISO?
|
|
|
|
No.
|
|
|
|
### 13. System Updates and Maintenance
|
|
- **Question**: How will the system receive security updates without general internet access?
|
|
- **Options**:
|
|
- Air-gapped update process
|
|
- USB-based update distribution
|
|
- No updates after initial deployment
|
|
|
|
No updates after initial deployment (via the internet). The system will be re-imaged from ISO.
|
|
|
|
### 14. Hardware Compatibility
|
|
- **Concern**: Minimal desktop may have hardware compatibility issues
|
|
- **Need**: Define supported hardware scope
|
|
- **Question**: Should we include additional drivers or keep it minimal?
|
|
|
|
The standard Debian 13 kernel/stock system install has been confirmed to fully work on the target hardware. Display, network etc all worked.
|
|
|
|
### 15. Testing Strategy for Air-Gapped Environment
|
|
- **Challenge**: How to test an ISO designed for air-gapped use
|
|
- **Need**: Testing methodology that doesn't require internet
|
|
- **Question**: Should we simulate air-gapped environment during testing?
|
|
|
|
The ISO will be installed into a VM that you define/boot. Initially I will do some manual testing. Later on , we can have a test suite that gets baked into the ISO/install.
|
|
|
|
Oh the install needs to be mostly automated with a preseed file. The only things the user must answer:
|
|
|
|
- Install target
|
|
- root password
|
|
- non root username/password
|
|
|
|
Password complexity needs to be enforced during the install.
|
|
|
|
---
|
|
|
|
## Priority Assessment:
|
|
|
|
**High Priority (Blockers):**
|
|
- Q3: Compliance specificity
|
|
- Q4: WireGuard configuration approach
|
|
- M8: Complete package list
|
|
- M9: Live-build configuration details
|
|
|
|
**Medium Priority (Implementation Challenges):**
|
|
- TC5: Docker package availability
|
|
- TC6: Test environment privileges
|
|
- TC7: ISO size management
|
|
|
|
**Low Priority (Nice to Have):**
|
|
- M10: Error handling strategy
|
|
- M11: Boot security details
|
|
- A12-A15: Additional considerations
|
|
|
|
---
|
|
|
|
**Status**: Awaiting your feedback on the above questions and concerns
|
|
**Next Action**: Review your inline edits and address any additional points
|
|
**Ready for Implementation**: NO - Need to resolve high priority items first
|
|
|
|
**Copyright © 2026 Known Element Enterprises LLC**
|
|
**License: GNU Affero General Public License v3.0 only** |