manuel
/
gentoo-install
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Updated readme; Conditionalized sshd installation

This commit is contained in:
oddlama 2020-01-06 21:34:44 +01:00
parent 08f815a3f1
commit 03a117f201
No known key found for this signature in database
GPG Key ID: 88EA325D51D53908
4 changed files with 114 additions and 93 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

171
README.md
View File

@ -1,107 +1,122 @@
# Gentoo installation script # Gentoo installation script
TODO clarify: This script performs a reasonably minimal installation of gentoo for an EFI system.
It does everything from the ground up, including creating partitions, downloading
and extracting the stage3 archive, initial system configuration and optionally installing
some additional software. The script only supports OpenRC and not systemd.
* /boot will not be mounted to efi partition, instead /boot/efi ist the mountpoint. The system will temporarily use `sys-kernel/vanilla-kernel-bin`, which should be suitable
this prevents /boot from getting full by automated installs, and allows the kernel to boot most systems out of the box. I strongly recommend you to replace this kernel
script to keep exactly two versions (last working kernel), and new one. with a custom built one, when the system is functional. If you are looking for a way
* kernel without module loading capability for security. localyesconfig to properly manage your kernel configuration parameters, have a look at [kernconf](https://github.com/oddlama/kernconf).
There you will also find information on how to select the correct options for your system,
and information on kernel hardening.
## Overview
Recommendations: Here is a quick overview of what this script does:
* Use umask 0077 * Does everything minus something
* Edit sshd_config, change port and create a sshusers group for users which may use ssh. * Partition the device (efi, optional swap, linux root)
* Use LUKS encryption on the disk * Download and cryptographically verify the newest stage3 tarball
* Use a properly configured kernel, at best restrict even USB! * Extract the stage3 tarball
* Adjust make.conf (default parallel emerge, cpu flags, binhost?) * Sync portage tree
* Configure the base system
- Set hostname
- Set timezone
- Set keymap
- Generate and select locale
- Prepare `zz-autounmask` files for portage autounmasking
* Select best 4 gentoo portage mirrors
* Install git (so you can add your portage overlays later)
* Install `sys-kernel/vanilla-kernel-bin` (temporarily, until you replace it)
* Copy kernel to efi partition
* Create boot entry using efibootmgr
* Generate fstab
* Lets you set a root password
Also, optionally the following will be done:
**TL;DR:** Installs gentoo on a new system, suited for both servers and desktops. * Install sshd with secure config
Optionally prepares ansible for automatic system configuration. * Install dhcpcd
See [Install](#Install) for usage instructions. * Install ansible, create ansible user and add authorized ssh key
* Install additional packages provided in config
--- Anything else is probably out of scope for this script,
but you can obviously do anything later on when the system is booted.
I highly recommend building a custom kernel and maybe encrypting your
root filesystem. Have a look at the [Recommendations](#Recommendations) section.
This script will install a minimal EFI bootable gentoo system, without additional bloat. ## Config
It will stick closely to the [Gentoo AMD64 Handbook](https://wiki.gentoo.org/wiki/Handbook:AMD64)
and [Sakaki's EFI Install Guide](https://wiki.gentoo.org/wiki/Sakaki%27s_EFI_Install_Guide).
What you will get: The config file `scripts/config.sh` allows you to adjust some parameters of the installation.
The most important ones will probably be the device to partition, and the stage3 tarball name
to install. By default you will get hardened nomultilib
* Minimal system configuration ### Using existing partitions
* Temporary vanilla kernel (precompiled by gentoo), in my opinion you
should replace this kernel with a custom made kernel for your system.
See [Kernel](#Kernel) for details on how to achieve that with low effort.
What you can get optionally: If you want to use existing partitions, you will have to set `ENABLE_PARTITIONING=false`.
As the script uses uuids to refer to partitions, you will have to set the corresponding
partition uuid variables in the config (all variables beginning with `PARTITION_UUID_`).
* LUKS ## (Optional) sshd
* EFI secure boot
* Initramfs (compiled into the kernel for EFIstub)
* Preconfigured sshd
* Ansible ready (packages, user, ssh)
* Additional packages of your choice (only trivial installations without use flag changes)
What you will **NOT** get: (i.e. you will have to do it yourself) The script can provide a fully configured ssh daemon with reasonably good security settings.
It will by default only allow ed25519 keys, restrict the key exchange algorithms, disable
any password based authentication, and only allow specifically mentioned users to use ssh
(none by default).
* X11 desktop environment To add a user to the list of allowed users, append `AllowUsers myuser` to `/etc/ssh/sshd_config`.
* A user for yourself (except `root` obviously) I recommend to create a separate group for all ssh users (like `sshusers`) and
* Any form of RAID to use `AllowGroups sshusers`. You should adjust this to your preferences when
* A specialized kernel, see [Kernel](#Kernel) for details on how to get one. the system is installed.
Only necessary configuration is applied to provide a common baseline system. ## (Optional) Ansible
If you need advanced features such as an initramfs or a different
partitioning scheme, you can definitely use this script but will
have to make some adjustments to it.
The main purpose of this script is to provide a universal setup This script can install ansible, create a system user for ansible and add an ssh key of
which should be suitable for most use-cases (desktop and server installations). you choice to the `.authorized_keys` file. This allows you to directly use ansible when
the new system is up to configure the rest of the system.
#### Overview of executed tasks ## (Optional) Additional packages
* Check live system You can enter any amount of additional packages to be installed on the target system.
* Sync time These will simply be passed to a final `emerge` call before the script is done.
* Partition disks Autounmasking will be done automatically.
* Format partitions
* Download stage3
* Extract stage3
* Chroot into new system
* Update portage tree
* ... TODO MISSING!
#### GPT # Install
The script will create GPT partition tables. If your system cannot use GPT, Installing gentoo with this script is simple.
this script is not suited for it.
#### EFI 1. Boot into the live system of your choice. As the script requires some utilities,
I recommend using a live system where you can quickly install new software.
Any [Arch Linux](https://www.archlinux.org/download/) live iso works fine.
2. Clone this repository
3. Edit `gentoo-bootstrap/scripts/config.sh`, and particularily pay attention to
the device which will be partitioned. The script will ask before partitioning,
but better be safe than sorry.
4. Execute `bash gentoo-bootstrap/install`. The script will tell you if your live
system is missing any required software.
It is assumed that your system can (and will) be booted via EFI. # Recommendations
This is not a strict requirement, but otherwise you will be responsible
to make the system bootable.
This probably involves the following steps: There are some things that you probably want to do after installing the base system,
or should consider:
* Change partition type of `efi` partition to `ef02` (BIOS boot partition) * Use a custom kernel (config and hardening, see [kernconf](https://github.com/oddlama/kernconf)), and remove `vanilla-kernel-bin`
* Change partition name and filesystem name to `boot` * Adjust `/etc/portage/make.conf`
* Install and configure syslinux - Set `CFLAGS` to `-O2 -pipe -march=native` for native builds
* Adjust make.conf - Set `CPU_FLAGS_X86` using the `cpuid2cpuflags` tool
- Set `MAKEOPTS` to `-jN` with N being the amount of threads used for building
Maybe there will be a convenience script for this at some point. - Set `EMERGE_DEFAULT_OPTS` to `-jN` if you want parallel emerging
No promises though. - Set `FEATURES="buildpkg"` if you want to build binary packages
* Use a safe umask like `umask 0077`
# Optional: Ansible ready * Edit `/etc/ssh/sshd_config`, change the port and create a `sshusers` group.
* Encrypt your system using LUKS
Optionally, this script can make the new system ready to be - Remount the root fs read-only
used with ansible. - Use `rsync -axHAWXS --numeric-ids --info=progress2 / /path/to/backup` to safely backup the whole
system including all extended attributes.
It will do the following steps for you: - Encrypt partition with LUKS
- Use rsync to restore the saved system root.
* Create an ansible user
* Generate an ssh keypair (type configurable)
* Setup a secure sshd (safe ciphers, login only with keypair)
* Install ansible
# References # References

6
scripts/config.sh
View File

@ -79,12 +79,12 @@ STAGE3_BASENAME="stage3-$GENTOO_ARCH-hardened+nomultilib"
# List of additional packages to install (will be directly passed to emerge) # List of additional packages to install (will be directly passed to emerge)
ADDITIONAL_PACKAGES="app-editors/neovim" ADDITIONAL_PACKAGES="app-editors/neovim"
# Install and enable dhcpcd
INSTALL_DHCPCD=true
# Install and configure sshd (a reasonably secure config is provided, which # Install and configure sshd (a reasonably secure config is provided, which
# only allows the use of ed25519 keys, and requires pubkey authentication) # only allows the use of ed25519 keys, and requires pubkey authentication)
INSTALL_SSHD=true INSTALL_SSHD=true
# Install ansible, and add a user for it. This requires INSTALL_SSHD=true
# Install ansible, and add a user for it
INSTALL_ANSIBLE=true INSTALL_ANSIBLE=true
# The home directory for the ansible user # The home directory for the ansible user
ANSIBLE_HOME="/var/lib/ansible" ANSIBLE_HOME="/var/lib/ansible"

2
scripts/functions.sh
View File

@ -32,6 +32,8 @@ check_config() {
|| die "'$HOSTNAME' is not a valid hostname" || die "'$HOSTNAME' is not a valid hostname"
if [[ "$INSTALL_ANSIBLE" == true ]]; then if [[ "$INSTALL_ANSIBLE" == true ]]; then
[[ "$INSTALL_SSHD" == true ]] \
|| die "You must enable INSTALL_SSHD for ansible"
[[ -n "$ANSIBLE_SSH_AUTHORIZED_KEYS" ]] \ [[ -n "$ANSIBLE_SSH_AUTHORIZED_KEYS" ]] \
|| die "Missing pubkey for ansible user" || die "Missing pubkey for ansible user"
fi fi

26
scripts/main.sh
View File

@ -1,3 +1,5 @@
#!/bin/bash
################################################ ################################################
# Initialize script environment # Initialize script environment
@ -139,12 +141,6 @@ main_install_gentoo_in_chroot() {
local efipartnum="${efidev: -1}" local efipartnum="${efidev: -1}"
try efibootmgr --verbose --create --disk "$PARTITION_DEVICE" --part "$efipartnum" --label "gentoo" --loader '\EFI\vmlinuz.efi' --unicode "root=$linuxdev initrd=\\EFI\\initramfs.img" try efibootmgr --verbose --create --disk "$PARTITION_DEVICE" --part "$efipartnum" --label "gentoo" --loader '\EFI\vmlinuz.efi' --unicode "root=$linuxdev initrd=\\EFI\\initramfs.img"
# Install additional packages, if any.
if [[ -n "$ADDITIONAL_PACKAGES" ]]; then
einfo "Installing additional packages"
try emerge --verbose --autounmask-continue=y -- $ADDITIONAL_PACKAGES
fi
# Generate a valid fstab file # Generate a valid fstab file
einfo "Generating fstab" einfo "Generating fstab"
install -m0644 -o root -g root "$GENTOO_BOOTSTRAP_DIR/configs/fstab" /etc/fstab \ install -m0644 -o root -g root "$GENTOO_BOOTSTRAP_DIR/configs/fstab" /etc/fstab \
@ -159,11 +155,13 @@ main_install_gentoo_in_chroot() {
fi fi
# Install and enable sshd # Install and enable sshd
einfo "Installing sshd" if [[ "$INSTALL_SSHD" == true ]]; then
install -m0600 -o root -g root "$GENTOO_BOOTSTRAP_DIR/configs/sshd_config" /etc/ssh/sshd_config \ einfo "Installing sshd"
|| die "Could not install /etc/ssh/sshd_config" install -m0600 -o root -g root "$GENTOO_BOOTSTRAP_DIR/configs/sshd_config" /etc/ssh/sshd_config \
rc-update add sshd default \ || die "Could not install /etc/ssh/sshd_config"
|| die "Could not add sshd to default services" rc-update add sshd default \
|| die "Could not add sshd to default services"
fi
# Install and enable dhcpcd # Install and enable dhcpcd
einfo "Installing dhcpcd" einfo "Installing dhcpcd"
@ -196,6 +194,12 @@ main_install_gentoo_in_chroot() {
|| die "Could not append to /etc/ssh/sshd_config" || die "Could not append to /etc/ssh/sshd_config"
fi fi
# Install additional packages, if any.
if [[ -n "$ADDITIONAL_PACKAGES" ]]; then
einfo "Installing additional packages"
try emerge --verbose --autounmask-continue=y -- $ADDITIONAL_PACKAGES
fi
if ask "Do you want to assign a root password now?"; then if ask "Do you want to assign a root password now?"; then
try passwd root try passwd root
einfo "Root password assigned" einfo "Root password assigned"