manuel
/
gentoo-install
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Updated readme; Conditionalized sshd installation

This commit is contained in:
oddlama 2020-01-06 21:34:44 +01:00
parent 08f815a3f1
commit 03a117f201
No known key found for this signature in database
GPG Key ID: 88EA325D51D53908
4 changed files with 114 additions and 93 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

173
README.md
View File

@ -1,107 +1,122 @@
# Gentoo installation script # Gentoo installation script
TODO clarify: This script performs a reasonably minimal installation of gentoo for an EFI system.
It does everything from the ground up, including creating partitions, downloading
and extracting the stage3 archive, initial system configuration and optionally installing
some additional software. The script only supports OpenRC and not systemd.
* /boot will not be mounted to efi partition, instead /boot/efi ist the mountpoint. The system will temporarily use `sys-kernel/vanilla-kernel-bin`, which should be suitable
this prevents /boot from getting full by automated installs, and allows the kernel to boot most systems out of the box. I strongly recommend you to replace this kernel
script to keep exactly two versions (last working kernel), and new one. with a custom built one, when the system is functional. If you are looking for a way
* kernel without module loading capability for security. localyesconfig to properly manage your kernel configuration parameters, have a look at [kernconf](https://github.com/oddlama/kernconf).
There you will also find information on how to select the correct options for your system,
and information on kernel hardening.
## Overview
Recommendations: Here is a quick overview of what this script does:
* Use umask 0077 * Does everything minus something
* Edit sshd_config, change port and create a sshusers group for users which may use ssh. * Partition the device (efi, optional swap, linux root)
* Use LUKS encryption on the disk * Download and cryptographically verify the newest stage3 tarball
* Use a properly configured kernel, at best restrict even USB! * Extract the stage3 tarball
* Adjust make.conf (default parallel emerge, cpu flags, binhost?) * Sync portage tree
* Configure the base system
- Set hostname
- Set timezone
- Set keymap
- Generate and select locale
- Prepare `zz-autounmask` files for portage autounmasking
* Select best 4 gentoo portage mirrors
* Install git (so you can add your portage overlays later)
* Install `sys-kernel/vanilla-kernel-bin` (temporarily, until you replace it)
* Copy kernel to efi partition
* Create boot entry using efibootmgr
* Generate fstab
* Lets you set a root password
Also, optionally the following will be done:
**TL;DR:** Installs gentoo on a new system, suited for both servers and desktops. * Install sshd with secure config
Optionally prepares ansible for automatic system configuration. * Install dhcpcd
See [Install](#Install) for usage instructions. * Install ansible, create ansible user and add authorized ssh key
* Install additional packages provided in config
--- Anything else is probably out of scope for this script,
but you can obviously do anything later on when the system is booted.
I highly recommend building a custom kernel and maybe encrypting your
root filesystem. Have a look at the [Recommendations](#Recommendations) section.
This script will install a minimal EFI bootable gentoo system, without additional bloat. ## Config
It will stick closely to the [Gentoo AMD64 Handbook](https://wiki.gentoo.org/wiki/Handbook:AMD64)
and [Sakaki's EFI Install Guide](https://wiki.gentoo.org/wiki/Sakaki%27s_EFI_Install_Guide).
What you will get: The config file `scripts/config.sh` allows you to adjust some parameters of the installation.
The most important ones will probably be the device to partition, and the stage3 tarball name
to install. By default you will get hardened nomultilib
* Minimal system configuration ### Using existing partitions
* Temporary vanilla kernel (precompiled by gentoo), in my opinion you
should replace this kernel with a custom made kernel for your system. If you want to use existing partitions, you will have to set `ENABLE_PARTITIONING=false`.
See [Kernel](#Kernel) for details on how to achieve that with low effort. As the script uses uuids to refer to partitions, you will have to set the corresponding
partition uuid variables in the config (all variables beginning with `PARTITION_UUID_`).
What you can get optionally: ## (Optional) sshd
* LUKS The script can provide a fully configured ssh daemon with reasonably good security settings.
* EFI secure boot It will by default only allow ed25519 keys, restrict the key exchange algorithms, disable
* Initramfs (compiled into the kernel for EFIstub) any password based authentication, and only allow specifically mentioned users to use ssh
* Preconfigured sshd (none by default).
* Ansible ready (packages, user, ssh)
* Additional packages of your choice (only trivial installations without use flag changes)
What you will **NOT** get: (i.e. you will have to do it yourself) To add a user to the list of allowed users, append `AllowUsers myuser` to `/etc/ssh/sshd_config`.
I recommend to create a separate group for all ssh users (like `sshusers`) and
to use `AllowGroups sshusers`. You should adjust this to your preferences when
the system is installed.
* X11 desktop environment ## (Optional) Ansible
* A user for yourself (except `root` obviously)
* Any form of RAID
* A specialized kernel, see [Kernel](#Kernel) for details on how to get one.
Only necessary configuration is applied to provide a common baseline system. This script can install ansible, create a system user for ansible and add an ssh key of
If you need advanced features such as an initramfs or a different you choice to the `.authorized_keys` file. This allows you to directly use ansible when
partitioning scheme, you can definitely use this script but will the new system is up to configure the rest of the system.
have to make some adjustments to it.
The main purpose of this script is to provide a universal setup ## (Optional) Additional packages
which should be suitable for most use-cases (desktop and server installations).
#### Overview of executed tasks You can enter any amount of additional packages to be installed on the target system.
These will simply be passed to a final `emerge` call before the script is done.
Autounmasking will be done automatically.
* Check live system # Install
* Sync time
* Partition disks
* Format partitions
* Download stage3
* Extract stage3
* Chroot into new system
* Update portage tree
* ... TODO MISSING!
#### GPT Installing gentoo with this script is simple.
The script will create GPT partition tables. If your system cannot use GPT, 1. Boot into the live system of your choice. As the script requires some utilities,
this script is not suited for it. I recommend using a live system where you can quickly install new software.
Any [Arch Linux](https://www.archlinux.org/download/) live iso works fine.
2. Clone this repository
3. Edit `gentoo-bootstrap/scripts/config.sh`, and particularily pay attention to
the device which will be partitioned. The script will ask before partitioning,
but better be safe than sorry.
4. Execute `bash gentoo-bootstrap/install`. The script will tell you if your live
system is missing any required software.
#### EFI # Recommendations
It is assumed that your system can (and will) be booted via EFI. There are some things that you probably want to do after installing the base system,
This is not a strict requirement, but otherwise you will be responsible or should consider:
to make the system bootable.
This probably involves the following steps: * Use a custom kernel (config and hardening, see [kernconf](https://github.com/oddlama/kernconf)), and remove `vanilla-kernel-bin`
* Adjust `/etc/portage/make.conf`
* Change partition type of `efi` partition to `ef02` (BIOS boot partition) - Set `CFLAGS` to `-O2 -pipe -march=native` for native builds
* Change partition name and filesystem name to `boot` - Set `CPU_FLAGS_X86` using the `cpuid2cpuflags` tool
* Install and configure syslinux - Set `MAKEOPTS` to `-jN` with N being the amount of threads used for building
* Adjust make.conf - Set `EMERGE_DEFAULT_OPTS` to `-jN` if you want parallel emerging
- Set `FEATURES="buildpkg"` if you want to build binary packages
Maybe there will be a convenience script for this at some point. * Use a safe umask like `umask 0077`
No promises though. * Edit `/etc/ssh/sshd_config`, change the port and create a `sshusers` group.
* Encrypt your system using LUKS
# Optional: Ansible ready - Remount the root fs read-only
- Use `rsync -axHAWXS --numeric-ids --info=progress2 / /path/to/backup` to safely backup the whole
Optionally, this script can make the new system ready to be system including all extended attributes.
used with ansible. - Encrypt partition with LUKS
- Use rsync to restore the saved system root.
It will do the following steps for you:
* Create an ansible user
* Generate an ssh keypair (type configurable)
* Setup a secure sshd (safe ciphers, login only with keypair)
* Install ansible
# References # References

6
scripts/config.sh
View File

@ -79,12 +79,12 @@ STAGE3_BASENAME="stage3-$GENTOO_ARCH-hardened+nomultilib"
# List of additional packages to install (will be directly passed to emerge) # List of additional packages to install (will be directly passed to emerge)
ADDITIONAL_PACKAGES="app-editors/neovim" ADDITIONAL_PACKAGES="app-editors/neovim"
# Install and enable dhcpcd
INSTALL_DHCPCD=true
# Install and configure sshd (a reasonably secure config is provided, which # Install and configure sshd (a reasonably secure config is provided, which
# only allows the use of ed25519 keys, and requires pubkey authentication) # only allows the use of ed25519 keys, and requires pubkey authentication)
INSTALL_SSHD=true INSTALL_SSHD=true
# Install ansible, and add a user for it. This requires INSTALL_SSHD=true
# Install ansible, and add a user for it
INSTALL_ANSIBLE=true INSTALL_ANSIBLE=true
# The home directory for the ansible user # The home directory for the ansible user
ANSIBLE_HOME="/var/lib/ansible" ANSIBLE_HOME="/var/lib/ansible"

2
scripts/functions.sh
View File

@ -32,6 +32,8 @@ check_config() {
|| die "'$HOSTNAME' is not a valid hostname" || die "'$HOSTNAME' is not a valid hostname"
if [[ "$INSTALL_ANSIBLE" == true ]]; then if [[ "$INSTALL_ANSIBLE" == true ]]; then
[[ "$INSTALL_SSHD" == true ]] \
|| die "You must enable INSTALL_SSHD for ansible"
[[ -n "$ANSIBLE_SSH_AUTHORIZED_KEYS" ]] \ [[ -n "$ANSIBLE_SSH_AUTHORIZED_KEYS" ]] \
|| die "Missing pubkey for ansible user" || die "Missing pubkey for ansible user"
fi fi

26
scripts/main.sh
View File

@ -1,3 +1,5 @@
#!/bin/bash
################################################ ################################################
# Initialize script environment # Initialize script environment
@ -139,12 +141,6 @@ main_install_gentoo_in_chroot() {
local efipartnum="${efidev: -1}" local efipartnum="${efidev: -1}"
try efibootmgr --verbose --create --disk "$PARTITION_DEVICE" --part "$efipartnum" --label "gentoo" --loader '\EFI\vmlinuz.efi' --unicode "root=$linuxdev initrd=\\EFI\\initramfs.img" try efibootmgr --verbose --create --disk "$PARTITION_DEVICE" --part "$efipartnum" --label "gentoo" --loader '\EFI\vmlinuz.efi' --unicode "root=$linuxdev initrd=\\EFI\\initramfs.img"
# Install additional packages, if any.
if [[ -n "$ADDITIONAL_PACKAGES" ]]; then
einfo "Installing additional packages"
try emerge --verbose --autounmask-continue=y -- $ADDITIONAL_PACKAGES
fi
# Generate a valid fstab file # Generate a valid fstab file
einfo "Generating fstab" einfo "Generating fstab"
install -m0644 -o root -g root "$GENTOO_BOOTSTRAP_DIR/configs/fstab" /etc/fstab \ install -m0644 -o root -g root "$GENTOO_BOOTSTRAP_DIR/configs/fstab" /etc/fstab \
@ -159,11 +155,13 @@ main_install_gentoo_in_chroot() {
fi fi
# Install and enable sshd # Install and enable sshd
einfo "Installing sshd" if [[ "$INSTALL_SSHD" == true ]]; then
install -m0600 -o root -g root "$GENTOO_BOOTSTRAP_DIR/configs/sshd_config" /etc/ssh/sshd_config \ einfo "Installing sshd"
|| die "Could not install /etc/ssh/sshd_config" install -m0600 -o root -g root "$GENTOO_BOOTSTRAP_DIR/configs/sshd_config" /etc/ssh/sshd_config \
rc-update add sshd default \ || die "Could not install /etc/ssh/sshd_config"
|| die "Could not add sshd to default services" rc-update add sshd default \
|| die "Could not add sshd to default services"
fi
# Install and enable dhcpcd # Install and enable dhcpcd
einfo "Installing dhcpcd" einfo "Installing dhcpcd"
@ -196,6 +194,12 @@ main_install_gentoo_in_chroot() {
|| die "Could not append to /etc/ssh/sshd_config" || die "Could not append to /etc/ssh/sshd_config"
fi fi
# Install additional packages, if any.
if [[ -n "$ADDITIONAL_PACKAGES" ]]; then
einfo "Installing additional packages"
try emerge --verbose --autounmask-continue=y -- $ADDITIONAL_PACKAGES
fi
if ask "Do you want to assign a root password now?"; then if ask "Do you want to assign a root password now?"; then
try passwd root try passwd root
einfo "Root password assigned" einfo "Root password assigned"