Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

DietPi-Pre-patch | Apply hardened Sid repo handling already with pre-patches to block Sid distro upgrades before the update itself runs any APT command #2658

Merged
merged 6 commits into from
Mar 24, 2019
Merged

DietPi-Pre-patch | Apply hardened Sid repo handling already with pre-patches to block Sid distro upgrades before the update itself runs any APT command #2658

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
eb1bff6
v6.22 (#2611)
MichaIng Mar 10, 2019
fd61fca
v6.22 (#2640)
MichaIng Mar 16, 2019
523df58
v6.22 (#2643)
MichaIng Mar 21, 2019
53eaebf
v6.22 (#2648)
MichaIng Mar 22, 2019
a3e80fe
v6.22 (#2654)
MichaIng Mar 23, 2019
ad913b1
v6.22
MichaIng Mar 24, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 16 additions & 5 deletions dietpi/pre-patch_file
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,12 +63,23 @@
fi
#-------------------------------------------------------------------------------
# Pre-patch 3: https://github.com/MichaIng/DietPi/issues/2213
if (( $G_DIETPI_VERSION_SUB < 22 )) &&
GLOBAL_PW=$(openssl enc -d -a -aes-256-cbc -nosalt -pass pass:'DietPiRocks!' -in /var/lib/dietpi/dietpi-software/.GLOBAL_PW.bin 2> /dev/null); then
# Pre-patch 4: https://github.com/MichaIng/DietPi/issues/2656
if (( $G_DIETPI_VERSION_SUB < 22 )); then

echo -e '\e[90m[\e[0m \e[33mWARN\e[0m \e[90m]\e[0m Pre-patch 3 | Storing global DietPi-Software password with enhanced security'
grep -qi 'buster' /etc/os-release && pbkdf2='-iter 10000' || pbkdf2=''
openssl enc -e -a -md sha256 -aes-256-cbc $pbkdf2 -salt -pass pass:'DietPiRocks!' -out /var/lib/dietpi/dietpi-software/.GLOBAL_PW.bin <<< $GLOBAL_PW || { EXIT_CODE=3; break; }
if GLOBAL_PW=$(openssl enc -d -a -aes-256-cbc -nosalt -pass pass:'DietPiRocks!' -in /var/lib/dietpi/dietpi-software/.GLOBAL_PW.bin 2> /dev/null); then

echo -e '\e[90m[\e[0m \e[33mWARN\e[0m \e[90m]\e[0m Pre-patch 3 | Storing global DietPi-Software password with enhanced security'
grep -qi 'buster' /etc/os-release && pbkdf2='-iter 10000' || pbkdf2=''
openssl enc -e -a -md sha256 -aes-256-cbc $pbkdf2 -salt -pass pass:'DietPiRocks!' -out /var/lib/dietpi/dietpi-software/.GLOBAL_PW.bin <<< $GLOBAL_PW || { EXIT_CODE=3; break; }

fi
if [[ -f /etc/apt/preferences.d/dietpi-wireguard ]]; then

echo -e '\e[90m[\e[0m \e[33mWARN\e[0m \e[90m]\e[0m Pre-patch 4 | Hardening Debian Sid repo usage to prevent accidental distro upgrades'
echo -e 'Package: *\nPin: release n=sid\nPin-Priority: -1\n
Package: wireguard wireguard-dkms wireguard-tools\nPin: release n=sid\nPin-Priority: 99' > /etc/apt/preferences.d/dietpi-wireguard || { EXIT_CODE=4; break; }

fi

fi
#-------------------------------------------------------------------------------
Expand Down