Guungle - User contributions [en]

Linux/Xen/DomU/Devuan/Devuan Beowulf

2020-12-11T23:52:39Z

Pyromania: /* Devuan Beowulf */

===Devuan Beowulf===

Start this process on a existing Devuan system. You will need to have the Devuan patched version of debootstrap installed.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=devuan_beowulf.img bs=1M count=1 seek=1024
mkfs.ext3 devuan_beowulf.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop devuan_beowulf.img /mnt/img

Start the debootstrap process. The version of 'su' that ships with beowulf no longer runs /etc/profile by default. So either run 'su -' to initiate a login shell that will source /etc/profile or add /usr/sbin to your path. 'export PATH=$PATH:/usr/sbin' debootstrap will not run correctly without /usr/sbin in your path. You will get the error message "E: Unable to execute target architecture" when trying to run debootstrap.

debootstrap --arch=i386 --variant=minbase beowulf /mnt/img http://deb.devuan.org/merged/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Here is a basic sources.list

deb http://deb.devuan.org/merged beowulf main
deb http://deb.devuan.org/merged beowulf-updates main
deb http://deb.devuan.org/merged beowulf-security main

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
/usr/sbin/chroot /mnt/img

Run updates.

apt-get update
apt-get upgrade

Install a frontend for debconf

apt-get install whiptail

Install locales and configure them.

apt-get install locales
dpkg-reconfigure locales

Configure the system timezone.

dpkg-reconfigure tzdata

The en_US.UTF-8 locale has changed the time format so it no longer displays in 24 hour time.

locale date_fmt
%a %d %b %Y %r %Z

This can be fixed by using the basic 'C' locale for time.

update-locale LC_TIME=C.UTF-8

Install networking systems

apt-get install netbase net-tools ifupdown inetutils-ping isc-dhcp-client

Install the kernel image, SSH server, full version of vim and rsyslog

apt-get install linux-image-686
apt-get install openssh-server
apt-get install vim

Beowulf defaults to mouse=a (Set via '/usr/share/vim/vim81/defaults.vim') which is great if you are using VIM in a graphical interface but breaks pasting when using a console/SSH. To fix this edit '/etc/vim/vimrc'

Uncomment 'let g:skip_defaults_vim = 1'
Uncomment 'syntax on'
Add 'set mouse=r'

apt-get install rsyslog

To use the Xen console 'xl console (domU)' you need to setup a tty on /dev/hvc0. Edit /etc/inittab and add this line.

co:2345:respawn:/sbin/getty 38400 hvc0

====Network====

Configure your '/etc/network/interfaces' for DHCP

<syntaxhighlight lang="bash">
# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto eth0
iface eth0 inet dhcp
</syntaxhighlight>

We need to allow root logins over SSH.

Edit /etc/ssh/sshd_config and change,

#PermitRootLogin prohibit-password

to

PermitRootLogin yes

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"

<syntaxhighlight lang="bash">
default 0
timeout 2

title Devuan Beowulf
root (hd0,0)
kernel /boot/vmlinuz-4.19.0-13-686-pae root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-4.19.0-13-686-pae

title Devuan Beowulf (Single-User)
root (hd0,0)
kernel /boot/vmlinuz-4.19.0-13-686-pae root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-4.19.0-13-686-pae
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Devuan won't regenerate SSH host keys if you delete them from /etc/ssh. So we need to make some changes to /etc/init.d/ssh so it regenerates the host keys.

Here is a patch for /etc/init.d/ssh

<syntaxhighlight lang="bash">
--- old_ssh 2018-12-16 21:33:01.193415639 +0000
+++ ssh 2018-12-23 19:05:39.647919366 +0000
@@ -72,6 +72,57 @@ check_privsep_dir() {
fi
}

+# Some variables to make things more readable
+KEYGEN=/usr/bin/ssh-keygen
+RSA_KEY=/etc/ssh/ssh_host_rsa_key
+ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
+ED25519_KEY=/etc/ssh/ssh_host_ed25519_key
+
+do_rsa_keygen() {
+ if [ ! -s $RSA_KEY ]; then
+ echo -n "Generating SSH2 RSA host key: "
+ rm -f $RSA_KEY
+ if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $RSA_KEY
+ chmod 644 $RSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ecdsa_keygen() {
+ if [ ! -s $ECDSA_KEY ]; then
+ echo -n "Generating SSH2 ECDSA host key: "
+ rm -f $ECDSA_KEY
+ if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ECDSA_KEY
+ chmod 644 $ECDSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ed25519_keygen() {
+ if [ ! -s $ED25519_KEY ]; then
+ echo -n "Generating SSH2 ED25519 host key: "
+ rm -f $ED25519_KEY
+ if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ED25519_KEY
+ chmod 644 $ED25519_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
check_config() {
if [ ! -e /etc/ssh/sshd_not_to_be_run ]; then
/usr/sbin/sshd $SSHD_OPTS -t || exit 1
@@ -86,6 +137,11 @@ case "$1" in
check_privsep_dir
check_for_no_start
check_dev_null
+
+ do_rsa_keygen
+ do_ecdsa_keygen
+ do_ed25519_keygen
+
log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" || true
if start-stop-daemon --start --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
log_end_msg 0 || true
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove SSH host keys so that new ones get generated on first boot.

Remove the old leases file so that the VM will request a fresh IP address each time.

Set a root password

<syntaxhighlight lang="bash">
echo 'devuan' > /etc/hostname
rm /var/lib/dhcp/dhclient.eth0.leases
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/DomU/Devuan/Devuan Beowulf

2020-12-11T22:53:29Z

Pyromania: /* Devuan Beowulf */

===Devuan Beowulf===

Start this process on a existing Devuan system. You will need to have the Devuan patched version of debootstrap installed.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=devuan_beowulf.img bs=1M count=1 seek=1024
mkfs.ext3 devuan_beowulf.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop devuan_beowulf.img /mnt/img

Start the debootstrap process. The version of 'su' that ships with beowulf no longer runs /etc/profile by default. So either run 'su -' to initiate a login shell that will source /etc/profile or add /usr/sbin to your path. 'export PATH=$PATH:/usr/sbin' debootstrap will not run correctly without /usr/sbin in your path. You will get the error message "E: Unable to execute target architecture" when trying to run debootstrap.

debootstrap --arch=i386 --variant=minbase beowulf /mnt/img http://deb.devuan.org/merged/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Here is a basic sources.list

deb http://deb.devuan.org/merged beowulf main
deb http://deb.devuan.org/merged beowulf-updates main
deb http://deb.devuan.org/merged beowulf-security main

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
/usr/sbin/chroot /mnt/img

Run updates.

apt-get update
apt-get upgrade

Install a frontend for debconf

apt-get install whiptail

Install locales and configure them.

apt-get install locales
dpkg-reconfigure locales

Configure the system timezone.

dpkg-reconfigure tzdata

The en_US.UTF-8 locale has changed the time format so it no longer displays in 24 hour time.

locale date_fmt
%a %d %b %Y %r %Z

This can be fixed by using the basic 'C' locale for time.

update-locale LC_TIME=C.UTF-8

Install networking systems

apt-get install netbase net-tools ifupdown inetutils-ping isc-dhcp-client

Install the kernel image, SSH server, full version of vim and rsyslog

apt-get install linux-image-686
apt-get install openssh-server
apt-get install vim

Beowulf defaults to mouse=a (Set via '/usr/share/vim/vim81/defaults.vim') which is great if you are using VIM in a graphical interface but breaks pasting when using a console/SSH. To fix this edit '/etc/vim/vimrc'

Uncomment 'let g:skip_defaults_vim = 1'
Uncomment 'syntax on'
Add mouse=r

apt-get install rsyslog

To use the Xen console 'xl console (domU)' you need to setup a tty on /dev/hvc0. Edit /etc/inittab and add this line.

co:2345:respawn:/sbin/getty 38400 hvc0

====Network====

Configure your '/etc/network/interfaces' for DHCP

<syntaxhighlight lang="bash">
# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto eth0
iface eth0 inet dhcp
</syntaxhighlight>

We need to allow root logins over SSH.

Edit /etc/ssh/sshd_config and change,

#PermitRootLogin prohibit-password

to

PermitRootLogin yes

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"

<syntaxhighlight lang="bash">
default 0
timeout 2

title Devuan Beowulf
root (hd0,0)
kernel /boot/vmlinuz-4.19.0-13-686-pae root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-4.19.0-13-686-pae

title Devuan Beowulf (Single-User)
root (hd0,0)
kernel /boot/vmlinuz-4.19.0-13-686-pae root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-4.19.0-13-686-pae
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Devuan won't regenerate SSH host keys if you delete them from /etc/ssh. So we need to make some changes to /etc/init.d/ssh so it regenerates the host keys.

Here is a patch for /etc/init.d/ssh

<syntaxhighlight lang="bash">
--- old_ssh 2018-12-16 21:33:01.193415639 +0000
+++ ssh 2018-12-23 19:05:39.647919366 +0000
@@ -72,6 +72,57 @@ check_privsep_dir() {
fi
}

+# Some variables to make things more readable
+KEYGEN=/usr/bin/ssh-keygen
+RSA_KEY=/etc/ssh/ssh_host_rsa_key
+ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
+ED25519_KEY=/etc/ssh/ssh_host_ed25519_key
+
+do_rsa_keygen() {
+ if [ ! -s $RSA_KEY ]; then
+ echo -n "Generating SSH2 RSA host key: "
+ rm -f $RSA_KEY
+ if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $RSA_KEY
+ chmod 644 $RSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ecdsa_keygen() {
+ if [ ! -s $ECDSA_KEY ]; then
+ echo -n "Generating SSH2 ECDSA host key: "
+ rm -f $ECDSA_KEY
+ if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ECDSA_KEY
+ chmod 644 $ECDSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ed25519_keygen() {
+ if [ ! -s $ED25519_KEY ]; then
+ echo -n "Generating SSH2 ED25519 host key: "
+ rm -f $ED25519_KEY
+ if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ED25519_KEY
+ chmod 644 $ED25519_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
check_config() {
if [ ! -e /etc/ssh/sshd_not_to_be_run ]; then
/usr/sbin/sshd $SSHD_OPTS -t || exit 1
@@ -86,6 +137,11 @@ case "$1" in
check_privsep_dir
check_for_no_start
check_dev_null
+
+ do_rsa_keygen
+ do_ecdsa_keygen
+ do_ed25519_keygen
+
log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" || true
if start-stop-daemon --start --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
log_end_msg 0 || true
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove SSH host keys so that new ones get generated on first boot.

Remove the old leases file so that the VM will request a fresh IP address each time.

Set a root password

<syntaxhighlight lang="bash">
echo 'devuan' > /etc/hostname
rm /var/lib/dhcp/dhclient.eth0.leases
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/DomU/Devuan/Devuan Beowulf

2020-12-11T22:25:31Z

Pyromania: /* GRUB */

===Devuan Beowulf===

Start this process on a existing Devuan system. You will need to have the Devuan patched version of debootstrap installed.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=devuan_beowulf.img bs=1M count=1 seek=1024
mkfs.ext3 devuan_beowulf.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop devuan_beowulf.img /mnt/img

Start the debootstrap process. The version of 'su' that ships with beowulf no longer runs /etc/profile by default. So either run 'su -' to initiate a login shell that will source /etc/profile or add /usr/sbin to your path. 'export PATH=$PATH:/usr/sbin' debootstrap will not run correctly without /usr/sbin in your path. You will get the error message "E: Unable to execute target architecture" when trying to run debootstrap.

debootstrap --arch=i386 --variant=minbase beowulf /mnt/img http://deb.devuan.org/merged/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Here is a basic sources.list

deb http://deb.devuan.org/merged beowulf main
deb http://deb.devuan.org/merged beowulf-updates main
deb http://deb.devuan.org/merged beowulf-security main

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
/usr/sbin/chroot /mnt/img

Run updates.

apt-get update
apt-get upgrade

Install a frontend for debconf

apt-get install whiptail

Install locales and configure them.

apt-get install locales
dpkg-reconfigure locales

Configure the system timezone.

dpkg-reconfigure tzdata

The en_US.UTF-8 locale has changed the time format so it no longer displays in 24 hour time.

locale date_fmt
%a %d %b %Y %r %Z

This can be fixed by using the basic 'C' locale for time.

update-locale LC_TIME=C.UTF-8

Install networking systems

apt-get install netbase net-tools ifupdown inetutils-ping

Install the kernel image, SSH server, full version of vim and rsyslog

apt-get install linux-image-686
apt-get install openssh-server
apt-get install vim

Beowulf defaults to mouse=a (Set via '/usr/share/vim/vim81/defaults.vim') which is great if you are using VIM in a graphical interface but breaks pasting when using a console/SSH. To fix this edit '/etc/vim/vimrc'

Uncomment 'let g:skip_defaults_vim = 1'
Uncomment 'syntax on'
Add mouse=r

apt-get install rsyslog

To use the Xen console 'xl console (domU)' you need to setup a tty on /dev/hvc0. Edit /etc/inittab and add this line.

co:2345:respawn:/sbin/getty 38400 hvc0

====Network====

Configure your '/etc/network/interfaces' for DHCP

<syntaxhighlight lang="bash">
# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto eth0
iface eth0 inet dhcp
</syntaxhighlight>

We need to allow root logins over SSH.

Edit /etc/ssh/sshd_config and change,

#PermitRootLogin prohibit-password

to

PermitRootLogin yes

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"

<syntaxhighlight lang="bash">
default 0
timeout 2

title Devuan Beowulf
root (hd0,0)
kernel /boot/vmlinuz-4.19.0-13-686-pae root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-4.19.0-13-686-pae

title Devuan Beowulf (Single-User)
root (hd0,0)
kernel /boot/vmlinuz-4.19.0-13-686-pae root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-4.19.0-13-686-pae
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Devuan won't regenerate SSH host keys if you delete them from /etc/ssh. So we need to make some changes to /etc/init.d/ssh so it regenerates the host keys.

Here is a patch for /etc/init.d/ssh

<syntaxhighlight lang="bash">
--- old_ssh 2018-12-16 21:33:01.193415639 +0000
+++ ssh 2018-12-23 19:05:39.647919366 +0000
@@ -72,6 +72,57 @@ check_privsep_dir() {
fi
}

+# Some variables to make things more readable
+KEYGEN=/usr/bin/ssh-keygen
+RSA_KEY=/etc/ssh/ssh_host_rsa_key
+ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
+ED25519_KEY=/etc/ssh/ssh_host_ed25519_key
+
+do_rsa_keygen() {
+ if [ ! -s $RSA_KEY ]; then
+ echo -n "Generating SSH2 RSA host key: "
+ rm -f $RSA_KEY
+ if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $RSA_KEY
+ chmod 644 $RSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ecdsa_keygen() {
+ if [ ! -s $ECDSA_KEY ]; then
+ echo -n "Generating SSH2 ECDSA host key: "
+ rm -f $ECDSA_KEY
+ if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ECDSA_KEY
+ chmod 644 $ECDSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ed25519_keygen() {
+ if [ ! -s $ED25519_KEY ]; then
+ echo -n "Generating SSH2 ED25519 host key: "
+ rm -f $ED25519_KEY
+ if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ED25519_KEY
+ chmod 644 $ED25519_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
check_config() {
if [ ! -e /etc/ssh/sshd_not_to_be_run ]; then
/usr/sbin/sshd $SSHD_OPTS -t || exit 1
@@ -86,6 +137,11 @@ case "$1" in
check_privsep_dir
check_for_no_start
check_dev_null
+
+ do_rsa_keygen
+ do_ecdsa_keygen
+ do_ed25519_keygen
+
log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" || true
if start-stop-daemon --start --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
log_end_msg 0 || true
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove SSH host keys so that new ones get generated on first boot.

Remove the old leases file so that the VM will request a fresh IP address each time.

Set a root password

<syntaxhighlight lang="bash">
echo 'devuan' > /etc/hostname
rm /var/lib/dhcp/dhclient.eth0.leases
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/DomU/Devuan/Devuan Beowulf

2020-12-11T22:21:22Z

Pyromania: /* Devuan Beowulf */

===Devuan Beowulf===

Start this process on a existing Devuan system. You will need to have the Devuan patched version of debootstrap installed.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=devuan_beowulf.img bs=1M count=1 seek=1024
mkfs.ext3 devuan_beowulf.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop devuan_beowulf.img /mnt/img

Start the debootstrap process. The version of 'su' that ships with beowulf no longer runs /etc/profile by default. So either run 'su -' to initiate a login shell that will source /etc/profile or add /usr/sbin to your path. 'export PATH=$PATH:/usr/sbin' debootstrap will not run correctly without /usr/sbin in your path. You will get the error message "E: Unable to execute target architecture" when trying to run debootstrap.

debootstrap --arch=i386 --variant=minbase beowulf /mnt/img http://deb.devuan.org/merged/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Here is a basic sources.list

deb http://deb.devuan.org/merged beowulf main
deb http://deb.devuan.org/merged beowulf-updates main
deb http://deb.devuan.org/merged beowulf-security main

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
/usr/sbin/chroot /mnt/img

Run updates.

apt-get update
apt-get upgrade

Install a frontend for debconf

apt-get install whiptail

Install locales and configure them.

apt-get install locales
dpkg-reconfigure locales

Configure the system timezone.

dpkg-reconfigure tzdata

The en_US.UTF-8 locale has changed the time format so it no longer displays in 24 hour time.

locale date_fmt
%a %d %b %Y %r %Z

This can be fixed by using the basic 'C' locale for time.

update-locale LC_TIME=C.UTF-8

Install networking systems

apt-get install netbase net-tools ifupdown inetutils-ping

Install the kernel image, SSH server, full version of vim and rsyslog

apt-get install linux-image-686
apt-get install openssh-server
apt-get install vim

Beowulf defaults to mouse=a (Set via '/usr/share/vim/vim81/defaults.vim') which is great if you are using VIM in a graphical interface but breaks pasting when using a console/SSH. To fix this edit '/etc/vim/vimrc'

Uncomment 'let g:skip_defaults_vim = 1'
Uncomment 'syntax on'
Add mouse=r

apt-get install rsyslog

To use the Xen console 'xl console (domU)' you need to setup a tty on /dev/hvc0. Edit /etc/inittab and add this line.

co:2345:respawn:/sbin/getty 38400 hvc0

====Network====

Configure your '/etc/network/interfaces' for DHCP

<syntaxhighlight lang="bash">
# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto eth0
iface eth0 inet dhcp
</syntaxhighlight>

We need to allow root logins over SSH.

Edit /etc/ssh/sshd_config and change,

#PermitRootLogin prohibit-password

to

PermitRootLogin yes

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"

<syntaxhighlight lang="bash">
default 0
timeout 2

title Devuan Beowulf
root (hd0,0)
kernel /boot/vmlinuz-4.19.0-12-686 root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-4.19.0-12-686

title Devuan Beowulf (Single-User)
root (hd0,0)
kernel /boot/vmlinuz-4.19.0-12-686 root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-4.19.0-12-686
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Devuan won't regenerate SSH host keys if you delete them from /etc/ssh. So we need to make some changes to /etc/init.d/ssh so it regenerates the host keys.

Here is a patch for /etc/init.d/ssh

<syntaxhighlight lang="bash">
--- old_ssh 2018-12-16 21:33:01.193415639 +0000
+++ ssh 2018-12-23 19:05:39.647919366 +0000
@@ -72,6 +72,57 @@ check_privsep_dir() {
fi
}

+# Some variables to make things more readable
+KEYGEN=/usr/bin/ssh-keygen
+RSA_KEY=/etc/ssh/ssh_host_rsa_key
+ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
+ED25519_KEY=/etc/ssh/ssh_host_ed25519_key
+
+do_rsa_keygen() {
+ if [ ! -s $RSA_KEY ]; then
+ echo -n "Generating SSH2 RSA host key: "
+ rm -f $RSA_KEY
+ if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $RSA_KEY
+ chmod 644 $RSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ecdsa_keygen() {
+ if [ ! -s $ECDSA_KEY ]; then
+ echo -n "Generating SSH2 ECDSA host key: "
+ rm -f $ECDSA_KEY
+ if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ECDSA_KEY
+ chmod 644 $ECDSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ed25519_keygen() {
+ if [ ! -s $ED25519_KEY ]; then
+ echo -n "Generating SSH2 ED25519 host key: "
+ rm -f $ED25519_KEY
+ if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ED25519_KEY
+ chmod 644 $ED25519_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
check_config() {
if [ ! -e /etc/ssh/sshd_not_to_be_run ]; then
/usr/sbin/sshd $SSHD_OPTS -t || exit 1
@@ -86,6 +137,11 @@ case "$1" in
check_privsep_dir
check_for_no_start
check_dev_null
+
+ do_rsa_keygen
+ do_ecdsa_keygen
+ do_ed25519_keygen
+
log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" || true
if start-stop-daemon --start --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
log_end_msg 0 || true
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove SSH host keys so that new ones get generated on first boot.

Remove the old leases file so that the VM will request a fresh IP address each time.

Set a root password

<syntaxhighlight lang="bash">
echo 'devuan' > /etc/hostname
rm /var/lib/dhcp/dhclient.eth0.leases
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/DomU/Devuan/Devuan Beowulf

2020-12-11T22:20:25Z

Pyromania: /* Devuan Beowulf */

===Devuan Beowulf===

Start this process on a existing Devuan system. You will need to have the Devuan patched version of debootstrap installed.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=devuan_beowulf.img bs=1M count=1 seek=1024
mkfs.ext3 devuan_beowulf.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop devuan_beowulf.img /mnt/img

Start the debootstrap process. The version of 'su' that ships with beowulf no longer runs /etc/profile by default. So either run 'su -' to initiate a login shell that will source /etc/profile or add /usr/sbin to your path. 'export PATH=$PATH:/usr/sbin' debootstrap will not run correctly without /usr/sbin in your path. You will get the error message "E: Unable to execute target architecture" when trying to run debootstrap.

debootstrap --arch=i386 --variant=minbase beowulf /mnt/img http://deb.devuan.org/merged/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Here is a basic sources.list

deb http://deb.devuan.org/merged beowulf main
deb http://deb.devuan.org/merged beowulf-updates main
deb http://deb.devuan.org/merged beowulf-security main

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
/usr/sbin/chroot /mnt/img

Run updates.

apt-get update
apt-get upgrade

Install a frontend for debconf

apt-get install whiptail

Install locales and configure them.

apt-get install locales
dpkg-reconfigure locales

Configure the system timezone.

dpkg-reconfigure tzdata

The en_US.UTF-8 locale has changed the time format so it no longer displays in 24 hour time.

locale date_fmt
%a %d %b %Y %r %Z

This can be fixed by using the basic 'C' locale for time.

update-locale LC_TIME=C.UTF-8

Install networking systems

apt-get install netbase net-tools ifupdown inetutils-ping

Install the kernel image, SSH server, full version of vim and rsyslog

apt-get install linux-image-686
apt-get install openssh-server
apt-get install vim

Beowulf defaults to mouse=a (Set via '/usr/share/vim/vim81/defaults.vim') which is great if you are using VIM in a graphical interface but breaks pasting when using a console/SSH. To fix this edit '/etc/vim/vimrc'

Uncomment 'let g:skip_defaults_vim = 1'
Uncomment 'syntax on'
Add mouse=r

apt-get install rsyslog

To use the Xen console 'xl console (domU)' you need to setup a tty on /dev/hvc0. Edit /etc/inittab and add this line.

co:2345:respawn:/sbin/getty 38400 hvc0

====Network====

Configure your '/etc/network/interfaces' for DHCP

<syntaxhighlight lang="bash">
# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto eth0
iface eth0 inet dhcp
</syntaxhighlight>

We need to allow root logins over SSH.

Edit /etc/ssh/sshd_config and change,

#PermitRootLogin prohibit-password

to

PermitRootLogin yes

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"

<syntaxhighlight lang="bash">
default 0
timeout 2

title Devuan Beowulf
root (hd0,0)
kernel /boot/vmlinuz-4.19.0-12-686 root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-4.19.0-12-686

title Devuan Beowulf (Single-User)
root (hd0,0)
kernel /boot/vmlinuz-4.19.0-12-686 root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-4.19.0-12-686
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Devuan won't regenerate SSH host keys if you delete them from /etc/ssh. So we need to make some changes to /etc/init.d/ssh so it regenerates the host keys.

Here is a patch for /etc/init.d/ssh

<syntaxhighlight lang="bash">
--- old_ssh 2018-12-16 21:33:01.193415639 +0000
+++ ssh 2018-12-23 19:05:39.647919366 +0000
@@ -72,6 +72,57 @@ check_privsep_dir() {
fi
}

+# Some variables to make things more readable
+KEYGEN=/usr/bin/ssh-keygen
+RSA_KEY=/etc/ssh/ssh_host_rsa_key
+ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
+ED25519_KEY=/etc/ssh/ssh_host_ed25519_key
+
+do_rsa_keygen() {
+ if [ ! -s $RSA_KEY ]; then
+ echo -n "Generating SSH2 RSA host key: "
+ rm -f $RSA_KEY
+ if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $RSA_KEY
+ chmod 644 $RSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ecdsa_keygen() {
+ if [ ! -s $ECDSA_KEY ]; then
+ echo -n "Generating SSH2 ECDSA host key: "
+ rm -f $ECDSA_KEY
+ if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ECDSA_KEY
+ chmod 644 $ECDSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ed25519_keygen() {
+ if [ ! -s $ED25519_KEY ]; then
+ echo -n "Generating SSH2 ED25519 host key: "
+ rm -f $ED25519_KEY
+ if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ED25519_KEY
+ chmod 644 $ED25519_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
check_config() {
if [ ! -e /etc/ssh/sshd_not_to_be_run ]; then
/usr/sbin/sshd $SSHD_OPTS -t || exit 1
@@ -86,6 +137,11 @@ case "$1" in
check_privsep_dir
check_for_no_start
check_dev_null
+
+ do_rsa_keygen
+ do_ecdsa_keygen
+ do_ed25519_keygen
+
log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" || true
if start-stop-daemon --start --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
log_end_msg 0 || true
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove SSH host keys so that new ones get generated on first boot.

Remove the old leases file so that the VM will request a fresh IP address each time.

Set a root password

<syntaxhighlight lang="bash">
echo 'devuan' > /etc/hostname
rm /var/lib/dhcp/dhclient.eth0.leases
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/DomU/Devuan/Devuan Beowulf

2020-12-11T21:22:29Z

Pyromania:

===Devuan Beowulf===

Start this process on a existing Devuan system. You will need to have the Devuan patched version of debootstrap installed.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=devuan_beowulf.img bs=1M count=1 seek=1024
mkfs.ext3 devuan_beowulf.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop devuan_beowulf.img /mnt/img

Start the debootstrap process. The version of 'su' that ships with beowulf no longer runs /etc/profile by default. So either run 'su -' to initiate a login shell that will source /etc/profile or add /usr/sbin to your path. 'export PATH=$PATH:/usr/sbin' debootstrap will not run correctly without /usr/sbin in your path. You will get the error message "E: Unable to execute target architecture" when trying to run debootstrap.

debootstrap --arch=i386 --variant=minbase beowulf /mnt/img http://deb.devuan.org/merged/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Here is a basic sources.list

deb http://deb.devuan.org/merged beowulf main
deb http://deb.devuan.org/merged beowulf-updates main
deb http://deb.devuan.org/merged beowulf-security main

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
/usr/sbin/chroot /mnt/img

Run updates.

apt-get update
apt-get upgrade

Install a frontend for debconf

apt-get install whiptail

Install locales and configure them.

apt-get install locales
dpkg-reconfigure locales

Configure the system timezone.

dpkg-reconfigure tzdata

Install networking systems

apt-get install netbase net-tools ifupdown inetutils-ping

Install the kernel image, SSH server, full version of vim and rsyslog

apt-get install linux-image-686
apt-get install openssh-server
apt-get install vim
apt-get install rsyslog

To use the Xen console 'xl console (domU)' you need to setup a tty on /dev/hvc0. Edit /etc/inittab and add this line.

co:2345:respawn:/sbin/getty 38400 hvc0

====Network====

Configure your '/etc/network/interfaces' for DHCP

<syntaxhighlight lang="bash">
# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto eth0
iface eth0 inet dhcp
</syntaxhighlight>

We need to allow root logins over SSH.

Edit /etc/ssh/sshd_config and change,

#PermitRootLogin prohibit-password

to

PermitRootLogin yes

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"

<syntaxhighlight lang="bash">
default 0
timeout 2

title Devuan Beowulf
root (hd0,0)
kernel /boot/vmlinuz-4.19.0-12-686 root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-4.19.0-12-686

title Devuan Beowulf (Single-User)
root (hd0,0)
kernel /boot/vmlinuz-4.19.0-12-686 root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-4.19.0-12-686
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Devuan won't regenerate SSH host keys if you delete them from /etc/ssh. So we need to make some changes to /etc/init.d/ssh so it regenerates the host keys.

Here is a patch for /etc/init.d/ssh

<syntaxhighlight lang="bash">
--- old_ssh 2018-12-16 21:33:01.193415639 +0000
+++ ssh 2018-12-23 19:05:39.647919366 +0000
@@ -72,6 +72,57 @@ check_privsep_dir() {
fi
}

+# Some variables to make things more readable
+KEYGEN=/usr/bin/ssh-keygen
+RSA_KEY=/etc/ssh/ssh_host_rsa_key
+ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
+ED25519_KEY=/etc/ssh/ssh_host_ed25519_key
+
+do_rsa_keygen() {
+ if [ ! -s $RSA_KEY ]; then
+ echo -n "Generating SSH2 RSA host key: "
+ rm -f $RSA_KEY
+ if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $RSA_KEY
+ chmod 644 $RSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ecdsa_keygen() {
+ if [ ! -s $ECDSA_KEY ]; then
+ echo -n "Generating SSH2 ECDSA host key: "
+ rm -f $ECDSA_KEY
+ if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ECDSA_KEY
+ chmod 644 $ECDSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ed25519_keygen() {
+ if [ ! -s $ED25519_KEY ]; then
+ echo -n "Generating SSH2 ED25519 host key: "
+ rm -f $ED25519_KEY
+ if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ED25519_KEY
+ chmod 644 $ED25519_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
check_config() {
if [ ! -e /etc/ssh/sshd_not_to_be_run ]; then
/usr/sbin/sshd $SSHD_OPTS -t || exit 1
@@ -86,6 +137,11 @@ case "$1" in
check_privsep_dir
check_for_no_start
check_dev_null
+
+ do_rsa_keygen
+ do_ecdsa_keygen
+ do_ed25519_keygen
+
log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" || true
if start-stop-daemon --start --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
log_end_msg 0 || true
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove SSH host keys so that new ones get generated on first boot.

Remove the old leases file so that the VM will request a fresh IP address each time.

Set a root password

<syntaxhighlight lang="bash">
echo 'devuan' > /etc/hostname
rm /var/lib/dhcp/dhclient.eth0.leases
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/DomU/Devuan/Devuan Beowulf

2020-12-11T21:16:23Z

Pyromania:

===Devuan Beowulf===

Start this process on a existing Devuan system. You will need to have the Devuan patched version of debootstrap installed.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=devuan_beowulf.img bs=1M count=1 seek=1024
mkfs.ext3 devuan_beowulf.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop devuan_beowulf.img /mnt/img

Start the debootstrap process. The version of 'su' that ships with beowulf no longer runs /etc/profile by default. So either run 'su -' to initiate a login shell that will source /etc/profile or add /usr/sbin to your path. 'export PATH=$PATH:/usr/sbin' debootstrap will not run correctly without /usr/sbin in your path. You will get the error message "E: Unable to execute target architecture" when trying to run debootstrap.

debootstrap --arch=i386 --variant=minbase beowulf /mnt/img http://deb.devuan.org/merged/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Here is a basic sources.list

deb http://deb.devuan.org/merged beowulf main
deb http://deb.devuan.org/merged beowulf-updates main
deb http://deb.devuan.org/merged beowulf-security main

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
/usr/sbin/chroot /mnt/img

Run updates and install a language pack.

apt-get update
apt-get upgrade

Install a frontend for debconf

apt-get install whiptail

Install locales and configure them.

apt-get install locales
dpkg-reconfigure locales

Configure the system timezone.

dpkg-reconfigure tzdata

Install networking systems

apt-get install netbase net-tools ifupdown inetutils-ping

Install the kernel image, SSH server, full version of vim and rsyslog

apt-get install linux-image-686
apt-get install openssh-server
apt-get install vim
apt-get install rsyslog

To use the Xen console 'xl console (domU)' you need to setup a tty on /dev/hvc0. Edit /etc/inittab and add this line.

co:2345:respawn:/sbin/getty 38400 hvc0

====Network====

Configure your '/etc/network/interfaces' for DHCP

<syntaxhighlight lang="bash">
# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto eth0
iface eth0 inet dhcp
</syntaxhighlight>

We need to allow root logins over SSH.

Edit /etc/ssh/sshd_config and change,

#PermitRootLogin prohibit-password

to

PermitRootLogin yes

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"

<syntaxhighlight lang="bash">
default 0
timeout 2

title Devuan Beowulf
root (hd0,0)
kernel /boot/vmlinuz-4.19.0-12-686 root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-4.19.0-12-686

title Devuan Beowulf (Single-User)
root (hd0,0)
kernel /boot/vmlinuz-4.19.0-12-686 root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-4.19.0-12-686
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Devuan won't regenerate SSH host keys if you delete them from /etc/ssh. So we need to make some changes to /etc/init.d/ssh so it regenerates the host keys.

Here is a patch for /etc/init.d/ssh

<syntaxhighlight lang="bash">
--- old_ssh 2018-12-16 21:33:01.193415639 +0000
+++ ssh 2018-12-23 19:05:39.647919366 +0000
@@ -72,6 +72,57 @@ check_privsep_dir() {
fi
}

+# Some variables to make things more readable
+KEYGEN=/usr/bin/ssh-keygen
+RSA_KEY=/etc/ssh/ssh_host_rsa_key
+ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
+ED25519_KEY=/etc/ssh/ssh_host_ed25519_key
+
+do_rsa_keygen() {
+ if [ ! -s $RSA_KEY ]; then
+ echo -n "Generating SSH2 RSA host key: "
+ rm -f $RSA_KEY
+ if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $RSA_KEY
+ chmod 644 $RSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ecdsa_keygen() {
+ if [ ! -s $ECDSA_KEY ]; then
+ echo -n "Generating SSH2 ECDSA host key: "
+ rm -f $ECDSA_KEY
+ if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ECDSA_KEY
+ chmod 644 $ECDSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ed25519_keygen() {
+ if [ ! -s $ED25519_KEY ]; then
+ echo -n "Generating SSH2 ED25519 host key: "
+ rm -f $ED25519_KEY
+ if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ED25519_KEY
+ chmod 644 $ED25519_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
check_config() {
if [ ! -e /etc/ssh/sshd_not_to_be_run ]; then
/usr/sbin/sshd $SSHD_OPTS -t || exit 1
@@ -86,6 +137,11 @@ case "$1" in
check_privsep_dir
check_for_no_start
check_dev_null
+
+ do_rsa_keygen
+ do_ecdsa_keygen
+ do_ed25519_keygen
+
log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" || true
if start-stop-daemon --start --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
log_end_msg 0 || true
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove SSH host keys so that new ones get generated on first boot.

Remove the old leases file so that the VM will request a fresh IP address each time.

Set a root password

<syntaxhighlight lang="bash">
echo 'devuan' > /etc/hostname
rm /var/lib/dhcp/dhclient.eth0.leases
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/DomU/Devuan/Devuan Beowulf

2020-12-11T20:54:54Z

Pyromania: /* Devuan Beowulf */

===Devuan Beowulf===

Start this process on a existing Devuan system. You will need to have the Devuan patched version of debootstrap installed.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=devuan_beowulf.img bs=1M count=1 seek=1024
mkfs.ext3 devuan_beowulf.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop devuan_beowulf.img /mnt/img

Start the debootstrap process. The PATH variable on beowulf has removed /usr/sbin so we need to add it back for debootstrap to run correctly.

export PATH=$PATH:/usr/sbin

debootstrap --arch=i386 --variant=minbase beowulf /mnt/img http://deb.devuan.org/merged/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Here is a basic sources.list

deb http://deb.devuan.org/merged beowulf main
deb http://deb.devuan.org/merged beowulf-updates main
deb http://deb.devuan.org/merged beowulf-security main

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
/usr/sbin/chroot /mnt/img

Run updates and install a language pack.

apt-get update
apt-get upgrade

Install a frontend for debconf

apt-get install whiptail

Install locales and configure them.

apt-get install locales
dpkg-reconfigure locales

Configure the system timezone.

dpkg-reconfigure tzdata

Install networking systems

apt-get install netbase net-tools ifupdown inetutils-ping

Install the kernel image, SSH server, full version of vim and rsyslog

apt-get install linux-image-686
apt-get install openssh-server
apt-get install vim
apt-get install rsyslog

To use the Xen console 'xl console (domU)' you need to setup a tty on /dev/hvc0. Edit /etc/inittab and add this line.

co:2345:respawn:/sbin/getty 38400 hvc0

====Network====

Configure your '/etc/network/interfaces' for DHCP

<syntaxhighlight lang="bash">
# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto eth0
iface eth0 inet dhcp
</syntaxhighlight>

We need to allow root logins over SSH.

Edit /etc/ssh/sshd_config and change,

#PermitRootLogin prohibit-password

to

PermitRootLogin yes

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"

<syntaxhighlight lang="bash">
default 0
timeout 2

title Devuan Beowulf
root (hd0,0)
kernel /boot/vmlinuz-4.19.0-12-686 root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-4.19.0-12-686

title Devuan Beowulf (Single-User)
root (hd0,0)
kernel /boot/vmlinuz-4.19.0-12-686 root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-4.19.0-12-686
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Devuan won't regenerate SSH host keys if you delete them from /etc/ssh. So we need to make some changes to /etc/init.d/ssh so it regenerates the host keys.

Here is a patch for /etc/init.d/ssh

<syntaxhighlight lang="bash">
--- old_ssh 2018-12-16 21:33:01.193415639 +0000
+++ ssh 2018-12-23 19:05:39.647919366 +0000
@@ -72,6 +72,57 @@ check_privsep_dir() {
fi
}

+# Some variables to make things more readable
+KEYGEN=/usr/bin/ssh-keygen
+RSA_KEY=/etc/ssh/ssh_host_rsa_key
+ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
+ED25519_KEY=/etc/ssh/ssh_host_ed25519_key
+
+do_rsa_keygen() {
+ if [ ! -s $RSA_KEY ]; then
+ echo -n "Generating SSH2 RSA host key: "
+ rm -f $RSA_KEY
+ if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $RSA_KEY
+ chmod 644 $RSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ecdsa_keygen() {
+ if [ ! -s $ECDSA_KEY ]; then
+ echo -n "Generating SSH2 ECDSA host key: "
+ rm -f $ECDSA_KEY
+ if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ECDSA_KEY
+ chmod 644 $ECDSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ed25519_keygen() {
+ if [ ! -s $ED25519_KEY ]; then
+ echo -n "Generating SSH2 ED25519 host key: "
+ rm -f $ED25519_KEY
+ if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ED25519_KEY
+ chmod 644 $ED25519_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
check_config() {
if [ ! -e /etc/ssh/sshd_not_to_be_run ]; then
/usr/sbin/sshd $SSHD_OPTS -t || exit 1
@@ -86,6 +137,11 @@ case "$1" in
check_privsep_dir
check_for_no_start
check_dev_null
+
+ do_rsa_keygen
+ do_ecdsa_keygen
+ do_ed25519_keygen
+
log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" || true
if start-stop-daemon --start --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
log_end_msg 0 || true
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove SSH host keys so that new ones get generated on first boot.

Remove the old leases file so that the VM will request a fresh IP address each time.

Set a root password

<syntaxhighlight lang="bash">
echo 'devuan' > /etc/hostname
rm /var/lib/dhcp/dhclient.eth0.leases
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/DomU/Devuan/Devuan Beowulf

2020-11-14T22:01:50Z

Pyromania: /* GRUB */

===Devuan Beowulf===

Start this process on a existing Devuan system. You will need to have the Devuan patched version of debootstrap installed.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=devuan_beowulf.img bs=1M count=1 seek=1024
mkfs.ext3 devuan_beowulf.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop devuan_beowulf.img /mnt/img

Start the debootstrap process.

debootstrap --arch=i386 --variant=minbase beowulf /mnt/img http://deb.devuan.org/merged/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Here is a basic sources.list

deb http://deb.devuan.org/merged beowulf main
deb http://deb.devuan.org/merged beowulf-updates main
deb http://deb.devuan.org/merged beowulf-security main

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
/usr/sbin/chroot /mnt/img

Run updates and install a language pack.

apt-get update
apt-get upgrade

Install a frontend for debconf

apt-get install whiptail

Install locales and configure them.

apt-get install locales
dpkg-reconfigure locales

Configure the system timezone.

dpkg-reconfigure tzdata

Install networking systems

apt-get install netbase net-tools ifupdown inetutils-ping

Install the kernel image, SSH server, full version of vim and rsyslog

apt-get install linux-image-686
apt-get install openssh-server
apt-get install vim
apt-get install rsyslog

To use the Xen console 'xl console (domU)' you need to setup a tty on /dev/hvc0. Edit /etc/inittab and add this line.

co:2345:respawn:/sbin/getty 38400 hvc0

====Network====

Configure your '/etc/network/interfaces' for DHCP

<syntaxhighlight lang="bash">
# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto eth0
iface eth0 inet dhcp
</syntaxhighlight>

We need to allow root logins over SSH.

Edit /etc/ssh/sshd_config and change,

#PermitRootLogin prohibit-password

to

PermitRootLogin yes

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"

<syntaxhighlight lang="bash">
default 0
timeout 2

title Devuan Beowulf
root (hd0,0)
kernel /boot/vmlinuz-4.19.0-12-686 root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-4.19.0-12-686

title Devuan Beowulf (Single-User)
root (hd0,0)
kernel /boot/vmlinuz-4.19.0-12-686 root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-4.19.0-12-686
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Devuan won't regenerate SSH host keys if you delete them from /etc/ssh. So we need to make some changes to /etc/init.d/ssh so it regenerates the host keys.

Here is a patch for /etc/init.d/ssh

<syntaxhighlight lang="bash">
--- old_ssh 2018-12-16 21:33:01.193415639 +0000
+++ ssh 2018-12-23 19:05:39.647919366 +0000
@@ -72,6 +72,57 @@ check_privsep_dir() {
fi
}

+# Some variables to make things more readable
+KEYGEN=/usr/bin/ssh-keygen
+RSA_KEY=/etc/ssh/ssh_host_rsa_key
+ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
+ED25519_KEY=/etc/ssh/ssh_host_ed25519_key
+
+do_rsa_keygen() {
+ if [ ! -s $RSA_KEY ]; then
+ echo -n "Generating SSH2 RSA host key: "
+ rm -f $RSA_KEY
+ if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $RSA_KEY
+ chmod 644 $RSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ecdsa_keygen() {
+ if [ ! -s $ECDSA_KEY ]; then
+ echo -n "Generating SSH2 ECDSA host key: "
+ rm -f $ECDSA_KEY
+ if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ECDSA_KEY
+ chmod 644 $ECDSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ed25519_keygen() {
+ if [ ! -s $ED25519_KEY ]; then
+ echo -n "Generating SSH2 ED25519 host key: "
+ rm -f $ED25519_KEY
+ if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ED25519_KEY
+ chmod 644 $ED25519_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
check_config() {
if [ ! -e /etc/ssh/sshd_not_to_be_run ]; then
/usr/sbin/sshd $SSHD_OPTS -t || exit 1
@@ -86,6 +137,11 @@ case "$1" in
check_privsep_dir
check_for_no_start
check_dev_null
+
+ do_rsa_keygen
+ do_ecdsa_keygen
+ do_ed25519_keygen
+
log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" || true
if start-stop-daemon --start --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
log_end_msg 0 || true
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove SSH host keys so that new ones get generated on first boot.

Remove the old leases file so that the VM will request a fresh IP address each time.

Set a root password

<syntaxhighlight lang="bash">
echo 'devuan' > /etc/hostname
rm /var/lib/dhcp/dhclient.eth0.leases
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/DomU/Devuan/Devuan Beowulf

2020-11-14T21:28:42Z

Pyromania:

===Devuan Beowulf===

Start this process on a existing Devuan system. You will need to have the Devuan patched version of debootstrap installed.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=devuan_beowulf.img bs=1M count=1 seek=1024
mkfs.ext3 devuan_beowulf.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop devuan_beowulf.img /mnt/img

Start the debootstrap process.

debootstrap --arch=i386 --variant=minbase beowulf /mnt/img http://deb.devuan.org/merged/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Here is a basic sources.list

deb http://deb.devuan.org/merged beowulf main
deb http://deb.devuan.org/merged beowulf-updates main
deb http://deb.devuan.org/merged beowulf-security main

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
/usr/sbin/chroot /mnt/img

Run updates and install a language pack.

apt-get update
apt-get upgrade

Install a frontend for debconf

apt-get install whiptail

Install locales and configure them.

apt-get install locales
dpkg-reconfigure locales

Configure the system timezone.

dpkg-reconfigure tzdata

Install networking systems

apt-get install netbase net-tools ifupdown inetutils-ping

Install the kernel image, SSH server, full version of vim and rsyslog

apt-get install linux-image-686
apt-get install openssh-server
apt-get install vim
apt-get install rsyslog

To use the Xen console 'xl console (domU)' you need to setup a tty on /dev/hvc0. Edit /etc/inittab and add this line.

co:2345:respawn:/sbin/getty 38400 hvc0

====Network====

Configure your '/etc/network/interfaces' for DHCP

<syntaxhighlight lang="bash">
# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto eth0
iface eth0 inet dhcp
</syntaxhighlight>

We need to allow root logins over SSH.

Edit /etc/ssh/sshd_config and change,

#PermitRootLogin prohibit-password

to

PermitRootLogin yes

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"

<syntaxhighlight lang="bash">
default 0
timeout 2

title Devuan ASCII
root (hd0,0)
kernel /boot/vmlinuz-4.9.0-7-686-pae root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-4.9.0-7-686-pae

title Devuan ASCII (Single-User)
root (hd0,0)
kernel /boot/vmlinuz-4.9.0-7-686-pae root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-4.9.0-7-686-pae
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Devuan won't regenerate SSH host keys if you delete them from /etc/ssh. So we need to make some changes to /etc/init.d/ssh so it regenerates the host keys.

Here is a patch for /etc/init.d/ssh

<syntaxhighlight lang="bash">
--- old_ssh 2018-12-16 21:33:01.193415639 +0000
+++ ssh 2018-12-23 19:05:39.647919366 +0000
@@ -72,6 +72,57 @@ check_privsep_dir() {
fi
}

+# Some variables to make things more readable
+KEYGEN=/usr/bin/ssh-keygen
+RSA_KEY=/etc/ssh/ssh_host_rsa_key
+ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
+ED25519_KEY=/etc/ssh/ssh_host_ed25519_key
+
+do_rsa_keygen() {
+ if [ ! -s $RSA_KEY ]; then
+ echo -n "Generating SSH2 RSA host key: "
+ rm -f $RSA_KEY
+ if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $RSA_KEY
+ chmod 644 $RSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ecdsa_keygen() {
+ if [ ! -s $ECDSA_KEY ]; then
+ echo -n "Generating SSH2 ECDSA host key: "
+ rm -f $ECDSA_KEY
+ if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ECDSA_KEY
+ chmod 644 $ECDSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ed25519_keygen() {
+ if [ ! -s $ED25519_KEY ]; then
+ echo -n "Generating SSH2 ED25519 host key: "
+ rm -f $ED25519_KEY
+ if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ED25519_KEY
+ chmod 644 $ED25519_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
check_config() {
if [ ! -e /etc/ssh/sshd_not_to_be_run ]; then
/usr/sbin/sshd $SSHD_OPTS -t || exit 1
@@ -86,6 +137,11 @@ case "$1" in
check_privsep_dir
check_for_no_start
check_dev_null
+
+ do_rsa_keygen
+ do_ecdsa_keygen
+ do_ed25519_keygen
+
log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" || true
if start-stop-daemon --start --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
log_end_msg 0 || true
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove SSH host keys so that new ones get generated on first boot.

Remove the old leases file so that the VM will request a fresh IP address each time.

Set a root password

<syntaxhighlight lang="bash">
echo 'devuan' > /etc/hostname
rm /var/lib/dhcp/dhclient.eth0.leases
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/DomU/Devuan/Devuan Beowulf

2020-11-14T21:21:55Z

Pyromania:

===Devuan Beowulf===

Start this process on a existing Devuan system. You will need to have the Devuan patched version of debootstrap installed.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=devuan_beowulf.img bs=1M count=1 seek=1024
mkfs.ext3 devuan_beowulf.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop devuan_beowulf.img /mnt/img

Start the debootstrap process.

debootstrap --arch=i386 --variant=minbase beowulf /mnt/img http://deb.devuan.org/merged/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Here is a basic sources.list

deb http://deb.devuan.org/merged beowulf main
deb http://deb.devuan.org/merged beowulf-updates main
deb http://deb.devuan.org/merged beowulf-security main

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
/usr/sbin/chroot /mnt/img

Run updates and install a language pack.

apt-get update
apt-get upgrade

Install a frontend for debconf

apt-get install whiptail

Install locales and configure them.

apt-get install locales
dpkg-reconfigure locales

Configure the system timezone.

dpkg-reconfigure tzdata

Install networking systems

apt-get install netbase net-tools ifupdown inetutils-ping

Install the kernel image, SSH server, full version of vim and rsyslog

apt-get install linux-image-`dpkg --print-architecture`
apt-get install openssh-server
apt-get install vim
apt-get install rsyslog

To use the Xen console 'xm console (domU)' you need to setup a tty on /dev/hvc0. Edit /etc/inittab and add this line.

co:2345:respawn:/sbin/getty 38400 hvc0

====Network====

Configure your '/etc/network/interfaces' for DHCP

<syntaxhighlight lang="bash">
# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto eth0
iface eth0 inet dhcp
</syntaxhighlight>

We need to allow root logins over SSH.

Edit /etc/ssh/sshd_config and change,

#PermitRootLogin prohibit-password

to

PermitRootLogin yes

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"

<syntaxhighlight lang="bash">
default 0
timeout 2

title Devuan ASCII
root (hd0,0)
kernel /boot/vmlinuz-4.9.0-7-686-pae root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-4.9.0-7-686-pae

title Devuan ASCII (Single-User)
root (hd0,0)
kernel /boot/vmlinuz-4.9.0-7-686-pae root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-4.9.0-7-686-pae
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Devuan won't regenerate SSH host keys if you delete them from /etc/ssh. So we need to make some changes to /etc/init.d/ssh so it regenerates the host keys.

Here is a patch for /etc/init.d/ssh

<syntaxhighlight lang="bash">
--- old_ssh 2018-12-16 21:33:01.193415639 +0000
+++ ssh 2018-12-23 19:05:39.647919366 +0000
@@ -72,6 +72,57 @@ check_privsep_dir() {
fi
}

+# Some variables to make things more readable
+KEYGEN=/usr/bin/ssh-keygen
+RSA_KEY=/etc/ssh/ssh_host_rsa_key
+ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
+ED25519_KEY=/etc/ssh/ssh_host_ed25519_key
+
+do_rsa_keygen() {
+ if [ ! -s $RSA_KEY ]; then
+ echo -n "Generating SSH2 RSA host key: "
+ rm -f $RSA_KEY
+ if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $RSA_KEY
+ chmod 644 $RSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ecdsa_keygen() {
+ if [ ! -s $ECDSA_KEY ]; then
+ echo -n "Generating SSH2 ECDSA host key: "
+ rm -f $ECDSA_KEY
+ if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ECDSA_KEY
+ chmod 644 $ECDSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ed25519_keygen() {
+ if [ ! -s $ED25519_KEY ]; then
+ echo -n "Generating SSH2 ED25519 host key: "
+ rm -f $ED25519_KEY
+ if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ED25519_KEY
+ chmod 644 $ED25519_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
check_config() {
if [ ! -e /etc/ssh/sshd_not_to_be_run ]; then
/usr/sbin/sshd $SSHD_OPTS -t || exit 1
@@ -86,6 +137,11 @@ case "$1" in
check_privsep_dir
check_for_no_start
check_dev_null
+
+ do_rsa_keygen
+ do_ecdsa_keygen
+ do_ed25519_keygen
+
log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" || true
if start-stop-daemon --start --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
log_end_msg 0 || true
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove SSH host keys so that new ones get generated on first boot.

Remove the old leases file so that the VM will request a fresh IP address each time.

Set a root password

<syntaxhighlight lang="bash">
echo 'devuan' > /etc/hostname
rm /var/lib/dhcp/dhclient.eth0.leases
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/DomU/Devuan/Devuan Beowulf

2020-11-14T20:43:45Z

Pyromania:

===Devuan Beowulf===

Start this process on a existing Devuan system. You will need to have the Devuan patched version of debootstrap installed.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=devuan_beowulf.img bs=1M count=1 seek=1024
mkfs.ext3 devuan_beowulf.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop devuan_beowulf.img /mnt/img

Start the debootstrap process.

debootstrap --arch=i386 --variant=minbase beowulf /mnt/img http://deb.devuan.org/merged/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Here is a basic sources.list

deb http://deb.devuan.org/merged beowulf main
deb http://deb.devuan.org/merged beowulf-updates main
deb http://deb.devuan.org/merged beowulf-security main

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
chroot /mnt/img

Run updates and install a language pack.

apt-get update
apt-get upgrade

Install a frontend for debconf

apt-get install whiptail

Install locales and configure them.

apt-get install locales
dpkg-reconfigure locales

Configure the system timezone.

dpkg-reconfigure tzdata

Install networking systems

apt-get install netbase net-tools ifupdown inetutils-ping

Install the kernel image, SSH server, full version of vim and rsyslog

apt-get install linux-image-`dpkg --print-architecture`
apt-get install openssh-server
apt-get install vim
apt-get install rsyslog

To use the Xen console 'xm console (domU)' you need to setup a tty on /dev/hvc0. Edit /etc/inittab and add this line.

co:2345:respawn:/sbin/getty 38400 hvc0

====Network====

Configure your '/etc/network/interfaces' for DHCP

<syntaxhighlight lang="bash">
# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto eth0
iface eth0 inet dhcp
</syntaxhighlight>

We need to allow root logins over SSH.

Edit /etc/ssh/sshd_config and change,

#PermitRootLogin prohibit-password

to

PermitRootLogin yes

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"

<syntaxhighlight lang="bash">
default 0
timeout 2

title Devuan ASCII
root (hd0,0)
kernel /boot/vmlinuz-4.9.0-7-686-pae root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-4.9.0-7-686-pae

title Devuan ASCII (Single-User)
root (hd0,0)
kernel /boot/vmlinuz-4.9.0-7-686-pae root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-4.9.0-7-686-pae
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Devuan won't regenerate SSH host keys if you delete them from /etc/ssh. So we need to make some changes to /etc/init.d/ssh so it regenerates the host keys.

Here is a patch for /etc/init.d/ssh

<syntaxhighlight lang="bash">
--- old_ssh 2018-12-16 21:33:01.193415639 +0000
+++ ssh 2018-12-23 19:05:39.647919366 +0000
@@ -72,6 +72,57 @@ check_privsep_dir() {
fi
}

+# Some variables to make things more readable
+KEYGEN=/usr/bin/ssh-keygen
+RSA_KEY=/etc/ssh/ssh_host_rsa_key
+ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
+ED25519_KEY=/etc/ssh/ssh_host_ed25519_key
+
+do_rsa_keygen() {
+ if [ ! -s $RSA_KEY ]; then
+ echo -n "Generating SSH2 RSA host key: "
+ rm -f $RSA_KEY
+ if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $RSA_KEY
+ chmod 644 $RSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ecdsa_keygen() {
+ if [ ! -s $ECDSA_KEY ]; then
+ echo -n "Generating SSH2 ECDSA host key: "
+ rm -f $ECDSA_KEY
+ if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ECDSA_KEY
+ chmod 644 $ECDSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ed25519_keygen() {
+ if [ ! -s $ED25519_KEY ]; then
+ echo -n "Generating SSH2 ED25519 host key: "
+ rm -f $ED25519_KEY
+ if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ED25519_KEY
+ chmod 644 $ED25519_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
check_config() {
if [ ! -e /etc/ssh/sshd_not_to_be_run ]; then
/usr/sbin/sshd $SSHD_OPTS -t || exit 1
@@ -86,6 +137,11 @@ case "$1" in
check_privsep_dir
check_for_no_start
check_dev_null
+
+ do_rsa_keygen
+ do_ecdsa_keygen
+ do_ed25519_keygen
+
log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" || true
if start-stop-daemon --start --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
log_end_msg 0 || true
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove SSH host keys so that new ones get generated on first boot.

Remove the old leases file so that the VM will request a fresh IP address each time.

Set a root password

<syntaxhighlight lang="bash">
echo 'devuan' > /etc/hostname
rm /var/lib/dhcp/dhclient.eth0.leases
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/DomU/Devuan/Devuan Beowulf

2020-11-14T20:36:54Z

Pyromania:

===Devuan Beowulf===

Start this process on a existing Devuan system. You will need to have the Devuan patched version of debootstrap installed.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=devuan_beowulf.img bs=1M count=1 seek=1024
mkfs.ext3 devuan_beowulf.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop devuan_beowulf.img /mnt/img

Start the debootstrap process.

debootstrap --arch=i386 --variant=minbase beowulf /mnt/img http://deb.devuan.org/merged/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Here is a basic sources.list

deb http://auto.mirror.devuan.org/merged beowulf main
deb http://auto.mirror.devuan.org/merged beowulf-updates main
deb http://auto.mirror.devuan.org/merged beowulf-security main

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
chroot /mnt/img

Run updates and install a language pack.

apt-get update
apt-get upgrade

Install a frontend for debconf

apt-get install whiptail

Install locales and configure them.

apt-get install locales
dpkg-reconfigure locales

Configure the system timezone.

dpkg-reconfigure tzdata

Install networking systems

apt-get install netbase net-tools ifupdown inetutils-ping

Install the kernel image, SSH server, full version of vim and rsyslog

apt-get install linux-image-`dpkg --print-architecture`
apt-get install openssh-server
apt-get install vim
apt-get install rsyslog

To use the Xen console 'xm console (domU)' you need to setup a tty on /dev/hvc0. Edit /etc/inittab and add this line.

co:2345:respawn:/sbin/getty 38400 hvc0

====Network====

Configure your '/etc/network/interfaces' for DHCP

<syntaxhighlight lang="bash">
# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto eth0
iface eth0 inet dhcp
</syntaxhighlight>

We need to allow root logins over SSH.

Edit /etc/ssh/sshd_config and change,

#PermitRootLogin prohibit-password

to

PermitRootLogin yes

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"

<syntaxhighlight lang="bash">
default 0
timeout 2

title Devuan ASCII
root (hd0,0)
kernel /boot/vmlinuz-4.9.0-7-686-pae root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-4.9.0-7-686-pae

title Devuan ASCII (Single-User)
root (hd0,0)
kernel /boot/vmlinuz-4.9.0-7-686-pae root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-4.9.0-7-686-pae
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Devuan won't regenerate SSH host keys if you delete them from /etc/ssh. So we need to make some changes to /etc/init.d/ssh so it regenerates the host keys.

Here is a patch for /etc/init.d/ssh

<syntaxhighlight lang="bash">
--- old_ssh 2018-12-16 21:33:01.193415639 +0000
+++ ssh 2018-12-23 19:05:39.647919366 +0000
@@ -72,6 +72,57 @@ check_privsep_dir() {
fi
}

+# Some variables to make things more readable
+KEYGEN=/usr/bin/ssh-keygen
+RSA_KEY=/etc/ssh/ssh_host_rsa_key
+ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
+ED25519_KEY=/etc/ssh/ssh_host_ed25519_key
+
+do_rsa_keygen() {
+ if [ ! -s $RSA_KEY ]; then
+ echo -n "Generating SSH2 RSA host key: "
+ rm -f $RSA_KEY
+ if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $RSA_KEY
+ chmod 644 $RSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ecdsa_keygen() {
+ if [ ! -s $ECDSA_KEY ]; then
+ echo -n "Generating SSH2 ECDSA host key: "
+ rm -f $ECDSA_KEY
+ if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ECDSA_KEY
+ chmod 644 $ECDSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ed25519_keygen() {
+ if [ ! -s $ED25519_KEY ]; then
+ echo -n "Generating SSH2 ED25519 host key: "
+ rm -f $ED25519_KEY
+ if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ED25519_KEY
+ chmod 644 $ED25519_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
check_config() {
if [ ! -e /etc/ssh/sshd_not_to_be_run ]; then
/usr/sbin/sshd $SSHD_OPTS -t || exit 1
@@ -86,6 +137,11 @@ case "$1" in
check_privsep_dir
check_for_no_start
check_dev_null
+
+ do_rsa_keygen
+ do_ecdsa_keygen
+ do_ed25519_keygen
+
log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" || true
if start-stop-daemon --start --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
log_end_msg 0 || true
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove SSH host keys so that new ones get generated on first boot.

Remove the old leases file so that the VM will request a fresh IP address each time.

Set a root password

<syntaxhighlight lang="bash">
echo 'devuan' > /etc/hostname
rm /var/lib/dhcp/dhclient.eth0.leases
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/DomU/Devuan/Devuan Beowulf

2020-07-04T20:18:07Z

Pyromania: Created page with "===Devuan Beowulf=== Start this process on a existing Devuan system. You will need to have the Devuan patched version of debootstrap installed. Create a empty image file and..."

===Devuan Beowulf===

Start this process on a existing Devuan system. You will need to have the Devuan patched version of debootstrap installed.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=devuan_beowulf.img bs=1M count=1 seek=1024
mkfs.ext3 devuan_beowulf.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop devuan_beowulf.img /mnt/img

Start the debootstrap process.

debootstrap --variant=minbase beowulf /mnt/img http://auto.mirror.devuan.org/merged/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Here is a basic sources.list

deb http://auto.mirror.devuan.org/merged beowulf main
deb http://auto.mirror.devuan.org/merged beowulf-updates main
deb http://auto.mirror.devuan.org/merged beowulf-security main

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
chroot /mnt/img

Run updates and install a language pack.

apt-get update
apt-get upgrade

Install a frontend for debconf

apt-get install whiptail

Install locales and configure them.

apt-get install locales
dpkg-reconfigure locales

Configure the system timezone.

dpkg-reconfigure tzdata

Install networking systems

apt-get install netbase net-tools ifupdown inetutils-ping

Install the kernel image, SSH server, full version of vim and rsyslog

apt-get install linux-image-`dpkg --print-architecture`
apt-get install openssh-server
apt-get install vim
apt-get install rsyslog

To use the Xen console 'xm console (domU)' you need to setup a tty on /dev/hvc0. Edit /etc/inittab and add this line.

co:2345:respawn:/sbin/getty 38400 hvc0

====Network====

Configure your '/etc/network/interfaces' for DHCP

<syntaxhighlight lang="bash">
# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto eth0
iface eth0 inet dhcp
</syntaxhighlight>

We need to allow root logins over SSH.

Edit /etc/ssh/sshd_config and change,

#PermitRootLogin prohibit-password

to

PermitRootLogin yes

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"

<syntaxhighlight lang="bash">
default 0
timeout 2

title Devuan ASCII
root (hd0,0)
kernel /boot/vmlinuz-4.9.0-7-686-pae root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-4.9.0-7-686-pae

title Devuan ASCII (Single-User)
root (hd0,0)
kernel /boot/vmlinuz-4.9.0-7-686-pae root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-4.9.0-7-686-pae
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Devuan won't regenerate SSH host keys if you delete them from /etc/ssh. So we need to make some changes to /etc/init.d/ssh so it regenerates the host keys.

Here is a patch for /etc/init.d/ssh

<syntaxhighlight lang="bash">
--- old_ssh 2018-12-16 21:33:01.193415639 +0000
+++ ssh 2018-12-23 19:05:39.647919366 +0000
@@ -72,6 +72,57 @@ check_privsep_dir() {
fi
}

+# Some variables to make things more readable
+KEYGEN=/usr/bin/ssh-keygen
+RSA_KEY=/etc/ssh/ssh_host_rsa_key
+ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
+ED25519_KEY=/etc/ssh/ssh_host_ed25519_key
+
+do_rsa_keygen() {
+ if [ ! -s $RSA_KEY ]; then
+ echo -n "Generating SSH2 RSA host key: "
+ rm -f $RSA_KEY
+ if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $RSA_KEY
+ chmod 644 $RSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ecdsa_keygen() {
+ if [ ! -s $ECDSA_KEY ]; then
+ echo -n "Generating SSH2 ECDSA host key: "
+ rm -f $ECDSA_KEY
+ if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ECDSA_KEY
+ chmod 644 $ECDSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ed25519_keygen() {
+ if [ ! -s $ED25519_KEY ]; then
+ echo -n "Generating SSH2 ED25519 host key: "
+ rm -f $ED25519_KEY
+ if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ED25519_KEY
+ chmod 644 $ED25519_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
check_config() {
if [ ! -e /etc/ssh/sshd_not_to_be_run ]; then
/usr/sbin/sshd $SSHD_OPTS -t || exit 1
@@ -86,6 +137,11 @@ case "$1" in
check_privsep_dir
check_for_no_start
check_dev_null
+
+ do_rsa_keygen
+ do_ecdsa_keygen
+ do_ed25519_keygen
+
log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" || true
if start-stop-daemon --start --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
log_end_msg 0 || true
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove SSH host keys so that new ones get generated on first boot.

Remove the old leases file so that the VM will request a fresh IP address each time.

Set a root password

<syntaxhighlight lang="bash">
echo 'devuan' > /etc/hostname
rm /var/lib/dhcp/dhclient.eth0.leases
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/Building Xen DomU images

2020-07-04T20:15:14Z

Pyromania: /* Devuan */

==CentOS==

===[[Linux/Xen/DomU/CentOS/CentOS 7|CentOS 7]]===

==Debian==

==Devuan==

===[[Linux/Xen/DomU/Devuan/Devuan Jessie|Devuan Jessie]]===
===[[Linux/Xen/DomU/Devuan/Devuan ASCII|Devuan ASCII]]===
===[[Linux/Xen/DomU/Devuan/Devuan Beowulf|Devuan Beowulf]]===

==Ubuntu==

===[[Linux/Xen/DomU/Ubuntu/Ubuntu 13.10|Ubuntu 13.10]]===

===[[Linux/Xen/DomU/Ubuntu/Ubuntu 14.04 LTS|Ubuntu 14.04 LTS]]===

===[[Linux/Xen/DomU/Ubuntu/Ubuntu 18.04 LTS|Ubuntu 18.04 LTS]]===

Linux/Xen/DomU/CentOS/CentOS 7

2019-02-16T19:50:07Z

Pyromania: /* Final Cleanup */

===CentOS 7===

The CentOS 7 installer won't install to a disk smaller then 10-20GB but its still possible to copy the finished install into a smaller image for easier distribution and cloning.

Create a empty image file and format it with xfs. We are making the file 20GB so CentOS will install.

dd if=/dev/zero of=centos_ks.img bs=1M count=1 seek=20000
mkfs.xfs centos_ks.img

The easiest way to install CentOS is using the kickstart system. You will need a webserver to host the kickstart config file. You will also need a kernel and ramdisk image from a CentOS mirror.

Download the vmlinuz and initrd.img files from your favorite CentOS mirror.

http://mirror.centos.org/centos/7/os/x86_64/images/pxeboot/

You will be booting the CentOS kickstart image with these files.

Here is the kickstart config that will need to be put on a webserver.

<syntaxhighlight lang="bash">
#version=1.0.0

install

# System authorization information
auth --enableshadow --passalgo=sha512
# Use network installation
url --url="http://mirror.centos.org/centos/7/os/x86_64/"
# Use text mode install
text
# Run the Setup Agent on first boot
firstboot --enable
ignoredisk --only-use=xvda
# Keyboard layouts
keyboard --vckeymap=us --xlayouts=''
# System language
lang en_US.UTF-8

# Network information
network --hostname=centos7 --bootproto=dhcp --device=eth0 --onboot=on

# Root password
rootpw --iscrypted $6$QgAmrd86o3M8qQIa$0LMJo9zwIe3j1e.hnc5G.6bXyhduRF03McofIDGSb7lrso6mbl9kt.WzxYOCXysC4Fb6Rdlu8OkXNAL22BLUW0
# System services
services --enabled="network"
# Do not configure the X Window System
skipx
# System timezone
timezone Etc/UTC --isUtc
# System bootloader configuration
bootloader --timeout=5 --driveorder=xvda --append="console=hvc0"
# Partition clearing information
zerombr
clearpart --all --initlabel --drives=xvda
part / --fstype=xfs --grow --size=1 --asprimary --ondisk=xvda

# Shutdown when the kickstart is done
halt

%packages
@core --nodefaults
-grub2
-chrony
-NetworkManager
-NetworkManager-team
-NetworkManager-tui
-NetworkManager-libnm
-wireless-tools
-plymouth
-fprintd-pam
-*-firmware

%end

%addon com_redhat_kdump --disable --reserve-mb='auto'

%end

%anaconda
pwpolicy root --minlen=6 --minquality=1 --notstrict --nochanges --notempty
pwpolicy user --minlen=6 --minquality=1 --notstrict --nochanges --emptyok
pwpolicy luks --minlen=6 --minquality=1 --notstrict --nochanges --notempty
%end
</syntaxhighlight>

====Kickstart Xen Config====

Once you have the kickstart config file on a webserver you need to create a new Xen config file that will be used to install the base image.

The Xen config will look something like this. You will need to edit the "disk", "kernel" and "ramdisk" paths to match where you are storing the files.
Also in the "extra" section, "inst.ks" will be the URL to the kickstart config file.

<syntaxhighlight lang="bash">
name="centos7ks"
vcpus=2
memory=2048
disk=['file:/mnt/xen_images/centos/centos_ks.img,xvda,w' ]
vif=['bridge=xenbr0']
on_reboot="restart"
on_crash="restart"
kernel="/mnt/xen_images/centos/x86_64/vmlinuz"
ramdisk="/mnt/xen_images/centos/x86_64/initrd.img"
extra="inst.repo=http://mirror.centos.org/centos/7/os/x86_64/ ip=eth0:dhcp inst.ks=http://192.168.1.80/kickstart/centos_domu.cfg"
</syntaxhighlight>

If you are not using DHCP you can set a static IP in the "extra" section like this,

<syntaxhighlight lang="bash">
extra="inst.repo=http://mirror.centos.org/centos/7/os/x86_64/ ip=192.168.1.20::192.168.1.1:255.255.255.0:centos7ks:eth0:none nameserver=192.168.1.1 inst.ks=http://192.168.1.80/kickstart/centos_domu.cfg"
</syntaxhighlight>

Boot the Xen config and access the console.

xl create centos7_ks.cfg -c

The virtual machine should boot up and launch anaconda to begin the automated install process.

You will get an error when it tries to install the bootloader. Since we don't use GRUB2 with Xen you can safely say "yes" to continue the installation.

It will ask you to hit Return to finish and then the virtual machine will shutdown and halt.

====Building the compact image====

The installation has finished but the virtual machine file size had to be 20G for CentOS to install. The installation can be copied into a smaller image for easier cloning and distribution.

Create a 1G image and format it with XFS

dd if=/dev/zero of=centos7.img bs=1M count=1 seek=1024
mkfs.xfs centos7.img

The finished installation image was partitioned during the install so we have to use kpartx to access the filesystem.

kpartx -av centos_ks.img

This will create a loopback device ( /dev/mapper/loop0p1 ) that you can mount.

mount /dev/mapper/loop0p1 /mnt/img

Mount the compact image

mount centos7.img /mnt/img2

Use rsync to copy everything from the finished installation to the compact image.

rsync -avH /mnt/img/ /mnt/img2/

CentOS defaults to using the UUID syntax for /etc/fstab. This won't work since we copied the OS to a new file system.

vi /mnt/img2/etc/fstab

Make fstab look like this,

/dev/sda1 / xfs defaults 0 0

You can remove the UUID section from /mnt/img2/etc/sysconfig/network-scripts/ifcfg-eth0 since we won't be using NetworkManager.
DHCP_HOSTNAME can also be removed.

When the OS was copied to the compact image, the SELinux contexts were not copied over. If you were to try and boot the compact image now, things would fail to start and you would not be able to login because SELinux would prevent you from running a shell. So we need to set SELinux to permissive for the first boot so we can fix the contexts.

vi /mnt/img2/etc/selinux/config

Change 'SELINUX=' to permissive.

<syntaxhighlight lang="bash">
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=permissive
</syntaxhighlight>

Create a basic Xen config so we can boot the image.

<syntaxhighlight lang="python">
name="centos7base"
vcpus=2
memory=512
disk=['file:/mnt/xen_images/centos/centos7.img,xvda1,w' ]
vif=['bridge=xenbr0']
on_reboot="restart"
on_crash="restart"
bootloader = "pygrub"
root = "/dev/xvda1 ro"
</syntaxhighlight>

Boot the compact image and log in. Then run the command,

restorecon -R -v /

This will reset all the SELinux contexts for the file system. When that finishes you can set SELinux back to enforcing.

vi /etc/selinux/config

Change 'SELINUX=' to enforcing.

====Final Cleanup====

Remove the DHCP lease file for eth0

rm /var/lib/dhclient/dhclient--eth0.lease

Remove the SSH host keys so you don't get duplicates when cloning the image.

rm /etc/ssh/ssh_host*

Zero out log files to save space.

<pre>
echo '' > /var/log/dmesg
echo '' > /var/log/maillog
echo '' > /var/log/boot.log
echo '' > /var/log/secure
echo '' > /var/log/cron
echo '' > /var/log/messages
</pre>

Shutdown the virtual machine and you can start cloning this image.

Linux/Xen/DomU/CentOS/CentOS 7

2019-02-16T19:47:34Z

Pyromania:

===CentOS 7===

The CentOS 7 installer won't install to a disk smaller then 10-20GB but its still possible to copy the finished install into a smaller image for easier distribution and cloning.

Create a empty image file and format it with xfs. We are making the file 20GB so CentOS will install.

dd if=/dev/zero of=centos_ks.img bs=1M count=1 seek=20000
mkfs.xfs centos_ks.img

The easiest way to install CentOS is using the kickstart system. You will need a webserver to host the kickstart config file. You will also need a kernel and ramdisk image from a CentOS mirror.

Download the vmlinuz and initrd.img files from your favorite CentOS mirror.

http://mirror.centos.org/centos/7/os/x86_64/images/pxeboot/

You will be booting the CentOS kickstart image with these files.

Here is the kickstart config that will need to be put on a webserver.

<syntaxhighlight lang="bash">
#version=1.0.0

install

# System authorization information
auth --enableshadow --passalgo=sha512
# Use network installation
url --url="http://mirror.centos.org/centos/7/os/x86_64/"
# Use text mode install
text
# Run the Setup Agent on first boot
firstboot --enable
ignoredisk --only-use=xvda
# Keyboard layouts
keyboard --vckeymap=us --xlayouts=''
# System language
lang en_US.UTF-8

# Network information
network --hostname=centos7 --bootproto=dhcp --device=eth0 --onboot=on

# Root password
rootpw --iscrypted $6$QgAmrd86o3M8qQIa$0LMJo9zwIe3j1e.hnc5G.6bXyhduRF03McofIDGSb7lrso6mbl9kt.WzxYOCXysC4Fb6Rdlu8OkXNAL22BLUW0
# System services
services --enabled="network"
# Do not configure the X Window System
skipx
# System timezone
timezone Etc/UTC --isUtc
# System bootloader configuration
bootloader --timeout=5 --driveorder=xvda --append="console=hvc0"
# Partition clearing information
zerombr
clearpart --all --initlabel --drives=xvda
part / --fstype=xfs --grow --size=1 --asprimary --ondisk=xvda

# Shutdown when the kickstart is done
halt

%packages
@core --nodefaults
-grub2
-chrony
-NetworkManager
-NetworkManager-team
-NetworkManager-tui
-NetworkManager-libnm
-wireless-tools
-plymouth
-fprintd-pam
-*-firmware

%end

%addon com_redhat_kdump --disable --reserve-mb='auto'

%end

%anaconda
pwpolicy root --minlen=6 --minquality=1 --notstrict --nochanges --notempty
pwpolicy user --minlen=6 --minquality=1 --notstrict --nochanges --emptyok
pwpolicy luks --minlen=6 --minquality=1 --notstrict --nochanges --notempty
%end
</syntaxhighlight>

====Kickstart Xen Config====

Once you have the kickstart config file on a webserver you need to create a new Xen config file that will be used to install the base image.

The Xen config will look something like this. You will need to edit the "disk", "kernel" and "ramdisk" paths to match where you are storing the files.
Also in the "extra" section, "inst.ks" will be the URL to the kickstart config file.

<syntaxhighlight lang="bash">
name="centos7ks"
vcpus=2
memory=2048
disk=['file:/mnt/xen_images/centos/centos_ks.img,xvda,w' ]
vif=['bridge=xenbr0']
on_reboot="restart"
on_crash="restart"
kernel="/mnt/xen_images/centos/x86_64/vmlinuz"
ramdisk="/mnt/xen_images/centos/x86_64/initrd.img"
extra="inst.repo=http://mirror.centos.org/centos/7/os/x86_64/ ip=eth0:dhcp inst.ks=http://192.168.1.80/kickstart/centos_domu.cfg"
</syntaxhighlight>

If you are not using DHCP you can set a static IP in the "extra" section like this,

<syntaxhighlight lang="bash">
extra="inst.repo=http://mirror.centos.org/centos/7/os/x86_64/ ip=192.168.1.20::192.168.1.1:255.255.255.0:centos7ks:eth0:none nameserver=192.168.1.1 inst.ks=http://192.168.1.80/kickstart/centos_domu.cfg"
</syntaxhighlight>

Boot the Xen config and access the console.

xl create centos7_ks.cfg -c

The virtual machine should boot up and launch anaconda to begin the automated install process.

You will get an error when it tries to install the bootloader. Since we don't use GRUB2 with Xen you can safely say "yes" to continue the installation.

It will ask you to hit Return to finish and then the virtual machine will shutdown and halt.

====Building the compact image====

The installation has finished but the virtual machine file size had to be 20G for CentOS to install. The installation can be copied into a smaller image for easier cloning and distribution.

Create a 1G image and format it with XFS

dd if=/dev/zero of=centos7.img bs=1M count=1 seek=1024
mkfs.xfs centos7.img

The finished installation image was partitioned during the install so we have to use kpartx to access the filesystem.

kpartx -av centos_ks.img

This will create a loopback device ( /dev/mapper/loop0p1 ) that you can mount.

mount /dev/mapper/loop0p1 /mnt/img

Mount the compact image

mount centos7.img /mnt/img2

Use rsync to copy everything from the finished installation to the compact image.

rsync -avH /mnt/img/ /mnt/img2/

CentOS defaults to using the UUID syntax for /etc/fstab. This won't work since we copied the OS to a new file system.

vi /mnt/img2/etc/fstab

Make fstab look like this,

/dev/sda1 / xfs defaults 0 0

You can remove the UUID section from /mnt/img2/etc/sysconfig/network-scripts/ifcfg-eth0 since we won't be using NetworkManager.
DHCP_HOSTNAME can also be removed.

When the OS was copied to the compact image, the SELinux contexts were not copied over. If you were to try and boot the compact image now, things would fail to start and you would not be able to login because SELinux would prevent you from running a shell. So we need to set SELinux to permissive for the first boot so we can fix the contexts.

vi /mnt/img2/etc/selinux/config

Change 'SELINUX=' to permissive.

<syntaxhighlight lang="bash">
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=permissive
</syntaxhighlight>

Create a basic Xen config so we can boot the image.

<syntaxhighlight lang="python">
name="centos7base"
vcpus=2
memory=512
disk=['file:/mnt/xen_images/centos/centos7.img,xvda1,w' ]
vif=['bridge=xenbr0']
on_reboot="restart"
on_crash="restart"
bootloader = "pygrub"
root = "/dev/xvda1 ro"
</syntaxhighlight>

Boot the compact image and log in. Then run the command,

restorecon -R -v /

This will reset all the SELinux contexts for the file system. When that finishes you can set SELinux back to enforcing.

vi /etc/selinux/config

Change 'SELINUX=' to enforcing.

====Final Cleanup====

Remove the DHCP lease file for eth0

rm /var/lib/dhclient/dhclient--eth0.lease

Remove the SSH host keys so you don't get duplicates when cloning the image.

rm /etc/ssh/ssh_host*

Zero out log files to save space.

echo '' > /var/log/dmesg
echo '' > /var/log/maillog
echo '' > /var/log/boot.log
echo '' > /var/log/secure
echo '' > /var/log/cron
echo '' > /var/log/messages

Shutdown the virtual machine and you can start cloning this image.

Linux/Xen/DomU/CentOS/CentOS 7

2019-02-16T19:42:49Z

Pyromania: /* Building the compact image */

Linux/Xen/DomU/CentOS/CentOS 7

2019-02-16T18:39:23Z

Pyromania: /* Building the compact image */

===CentOS 7===

The CentOS 7 installer won't install to a disk smaller then 10-20GB but its still possible to copy the finished install into a smaller image for easier distribution and cloning.

Create a empty image file and format it with xfs. We are making the file 20GB so CentOS will install.

dd if=/dev/zero of=centos_ks.img bs=1M count=1 seek=20000
mkfs.xfs centos_ks.img

The easiest way to install CentOS is using the kickstart system. You will need a webserver to host the kickstart config file. You will also need a kernel and ramdisk image from a CentOS mirror.

Download the vmlinuz and initrd.img files from your favorite CentOS mirror.

http://mirror.centos.org/centos/7/os/x86_64/images/pxeboot/

You will be booting the CentOS kickstart image with these files.

Here is the kickstart config that will need to be put on a webserver.

<syntaxhighlight lang="bash">
#version=1.0.0

install

# System authorization information
auth --enableshadow --passalgo=sha512
# Use network installation
url --url="http://mirror.centos.org/centos/7/os/x86_64/"
# Use text mode install
text
# Run the Setup Agent on first boot
firstboot --enable
ignoredisk --only-use=xvda
# Keyboard layouts
keyboard --vckeymap=us --xlayouts=''
# System language
lang en_US.UTF-8

# Network information
network --hostname=centos7 --bootproto=dhcp --device=eth0 --onboot=on

# Root password
rootpw --iscrypted $6$QgAmrd86o3M8qQIa$0LMJo9zwIe3j1e.hnc5G.6bXyhduRF03McofIDGSb7lrso6mbl9kt.WzxYOCXysC4Fb6Rdlu8OkXNAL22BLUW0
# System services
services --enabled="network"
# Do not configure the X Window System
skipx
# System timezone
timezone Etc/UTC --isUtc
# System bootloader configuration
bootloader --timeout=5 --driveorder=xvda --append="console=hvc0"
# Partition clearing information
zerombr
clearpart --all --initlabel --drives=xvda
part / --fstype=xfs --grow --size=1 --asprimary --ondisk=xvda

# Shutdown when the kickstart is done
halt

%packages
@core --nodefaults
-grub2
-chrony
-NetworkManager
-NetworkManager-team
-NetworkManager-tui
-NetworkManager-libnm
-wireless-tools
-plymouth
-fprintd-pam
-*-firmware

%end

%addon com_redhat_kdump --disable --reserve-mb='auto'

%end

%anaconda
pwpolicy root --minlen=6 --minquality=1 --notstrict --nochanges --notempty
pwpolicy user --minlen=6 --minquality=1 --notstrict --nochanges --emptyok
pwpolicy luks --minlen=6 --minquality=1 --notstrict --nochanges --notempty
%end
</syntaxhighlight>

====Kickstart Xen Config====

Once you have the kickstart config file on a webserver you need to create a new Xen config file that will be used to install the base image.

The Xen config will look something like this. You will need to edit the "disk", "kernel" and "ramdisk" paths to match where you are storing the files.
Also in the "extra" section, "inst.ks" will be the URL to the kickstart config file.

<syntaxhighlight lang="bash">
name="centos7ks"
vcpus=2
memory=2048
disk=['file:/mnt/xen_images/centos/centos_ks.img,xvda,w' ]
vif=['bridge=xenbr0']
on_reboot="restart"
on_crash="restart"
kernel="/mnt/xen_images/centos/x86_64/vmlinuz"
ramdisk="/mnt/xen_images/centos/x86_64/initrd.img"
extra="inst.repo=http://mirror.centos.org/centos/7/os/x86_64/ ip=eth0:dhcp inst.ks=http://192.168.1.80/kickstart/centos_domu.cfg"
</syntaxhighlight>

If you are not using DHCP you can set a static IP in the "extra" section like this,

<syntaxhighlight lang="bash">
extra="inst.repo=http://mirror.centos.org/centos/7/os/x86_64/ ip=192.168.1.20::192.168.1.1:255.255.255.0:centos7ks:eth0:none nameserver=192.168.1.1 inst.ks=http://192.168.1.80/kickstart/centos_domu.cfg"
</syntaxhighlight>

Boot the Xen config and access the console.

xl create centos7_ks.cfg -c

The virtual machine should boot up and launch anaconda to begin the automated install process.

You will get an error when it tries to install the bootloader. Since we don't use GRUB2 with Xen you can safely say "yes" to continue the installation.

It will ask you to hit Return to finish and then the virtual machine will shutdown and halt.

====Building the compact image====

The installation has finished but the virtual machine file size had to be 20G for CentOS to install. The installation can be copied into a smaller image for easier cloning and distribution.

Create a 1G image and format it with XFS

dd if=/dev/zero of=centos7.img bs=1M count=1 seek=1024
mkfs.xfs centos7.img

The finished installation image was partitioned during the install so we have to use kpartx to access the filesystem.

kpartx -av centos_ks.img

This will create a loopback device ( /dev/mapper/loop0p1 ) that you can mount.

mount /dev/mapper/loop0p1 /mnt/img

Mount the compact image

mount centos7.img /mnt/img2

Use rsync to copy everything from the finished installation to the compact image.

rsync -avH /mnt/img/ /mnt/img2/

CentOS defaults to using the UUID syntac for /etc/fstab. This won't work since we copied the OS to a new filesystem.

vi /mnt/img2/etc/fstab

Make fstab look like this,

/dev/sda1 / xfs defaults 0 0

When the OS was copied to the compact image, the SELinux contexts were not copied over. If you were to try and boot the compact image now, things would fail to start and you would not be able to login because SELinux would prevent you from running a shell. So we need to set SELinux to permissive for the first boot so we can fix the contexts.

vi /mnt/img2/etc/selinux/config

Change 'SELINUX=' to permissive.

<syntaxhighlight lang="bash">
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=permissive
</syntaxhighlight>

Create a basic Xen config so we can boot the image.

<syntaxhighlight lang="python">
name="centos7base"
vcpus=2
memory=512
disk=['file:/mnt/xen_images/centos/centos7.img,xvda1,w' ]
vif=['bridge=xenbr0']
on_reboot="restart"
on_crash="restart"
bootloader = "pygrub"
root = "/dev/xvda1 ro"
</syntaxhighlight>

Linux/Xen/DomU/CentOS/CentOS 7

2019-02-16T18:38:16Z

Pyromania: /* Building the compact image */

===CentOS 7===

The CentOS 7 installer won't install to a disk smaller then 10-20GB but its still possible to copy the finished install into a smaller image for easier distribution and cloning.

Create a empty image file and format it with xfs. We are making the file 20GB so CentOS will install.

dd if=/dev/zero of=centos_ks.img bs=1M count=1 seek=20000
mkfs.xfs centos_ks.img

The easiest way to install CentOS is using the kickstart system. You will need a webserver to host the kickstart config file. You will also need a kernel and ramdisk image from a CentOS mirror.

Download the vmlinuz and initrd.img files from your favorite CentOS mirror.

http://mirror.centos.org/centos/7/os/x86_64/images/pxeboot/

You will be booting the CentOS kickstart image with these files.

Here is the kickstart config that will need to be put on a webserver.

<syntaxhighlight lang="bash">
#version=1.0.0

install

# System authorization information
auth --enableshadow --passalgo=sha512
# Use network installation
url --url="http://mirror.centos.org/centos/7/os/x86_64/"
# Use text mode install
text
# Run the Setup Agent on first boot
firstboot --enable
ignoredisk --only-use=xvda
# Keyboard layouts
keyboard --vckeymap=us --xlayouts=''
# System language
lang en_US.UTF-8

# Network information
network --hostname=centos7 --bootproto=dhcp --device=eth0 --onboot=on

# Root password
rootpw --iscrypted $6$QgAmrd86o3M8qQIa$0LMJo9zwIe3j1e.hnc5G.6bXyhduRF03McofIDGSb7lrso6mbl9kt.WzxYOCXysC4Fb6Rdlu8OkXNAL22BLUW0
# System services
services --enabled="network"
# Do not configure the X Window System
skipx
# System timezone
timezone Etc/UTC --isUtc
# System bootloader configuration
bootloader --timeout=5 --driveorder=xvda --append="console=hvc0"
# Partition clearing information
zerombr
clearpart --all --initlabel --drives=xvda
part / --fstype=xfs --grow --size=1 --asprimary --ondisk=xvda

# Shutdown when the kickstart is done
halt

%packages
@core --nodefaults
-grub2
-chrony
-NetworkManager
-NetworkManager-team
-NetworkManager-tui
-NetworkManager-libnm
-wireless-tools
-plymouth
-fprintd-pam
-*-firmware

%end

%addon com_redhat_kdump --disable --reserve-mb='auto'

%end

%anaconda
pwpolicy root --minlen=6 --minquality=1 --notstrict --nochanges --notempty
pwpolicy user --minlen=6 --minquality=1 --notstrict --nochanges --emptyok
pwpolicy luks --minlen=6 --minquality=1 --notstrict --nochanges --notempty
%end
</syntaxhighlight>

====Kickstart Xen Config====

Once you have the kickstart config file on a webserver you need to create a new Xen config file that will be used to install the base image.

The Xen config will look something like this. You will need to edit the "disk", "kernel" and "ramdisk" paths to match where you are storing the files.
Also in the "extra" section, "inst.ks" will be the URL to the kickstart config file.

<syntaxhighlight lang="bash">
name="centos7ks"
vcpus=2
memory=2048
disk=['file:/mnt/xen_images/centos/centos_ks.img,xvda,w' ]
vif=['bridge=xenbr0']
on_reboot="restart"
on_crash="restart"
kernel="/mnt/xen_images/centos/x86_64/vmlinuz"
ramdisk="/mnt/xen_images/centos/x86_64/initrd.img"
extra="inst.repo=http://mirror.centos.org/centos/7/os/x86_64/ ip=eth0:dhcp inst.ks=http://192.168.1.80/kickstart/centos_domu.cfg"
</syntaxhighlight>

If you are not using DHCP you can set a static IP in the "extra" section like this,

<syntaxhighlight lang="bash">
extra="inst.repo=http://mirror.centos.org/centos/7/os/x86_64/ ip=192.168.1.20::192.168.1.1:255.255.255.0:centos7ks:eth0:none nameserver=192.168.1.1 inst.ks=http://192.168.1.80/kickstart/centos_domu.cfg"
</syntaxhighlight>

Boot the Xen config and access the console.

xl create centos7_ks.cfg -c

The virtual machine should boot up and launch anaconda to begin the automated install process.

You will get an error when it tries to install the bootloader. Since we don't use GRUB2 with Xen you can safely say "yes" to continue the installation.

It will ask you to hit Return to finish and then the virtual machine will shutdown and halt.

====Building the compact image====

The installation has finished but the virtual machine file size had to be 20G for CentOS to install. The installation can be copied into a smaller image for easier cloning and distribution.

Create a 1G image and format it with XFS

dd if=/dev/zero of=centos7.img bs=1M count=1 seek=1024
mkfs.xfs centos7.img

The finished installation image was partitioned during the install so we have to use kpartx to access the filesystem.

kpartx -av centos_ks.img

This will create a loopback device ( /dev/mapper/loop0p1 ) that you can mount.

mount /dev/mapper/loop0p1 /mnt/img

Mount the compact image

mount centos7.img /mnt/img2

Use rsync to copy everything from the finished installation to the compact image.

rsync -avH /mnt/img/ /mnt/img2/

CentOS defaults to using the UUID syntac for /etc/fstab. This won't work since we copied the OS to a new filesystem.

vi /mnt/img2/etc/fstab

Make fstab look like this,

/dev/sda1 / xfs defaults 0 0

When the OS was copied to the compact image, the SELinux contexts were not copied over. If you were to try and boot the compact image now, things would fail to start and you would not be able to login because SELinux would prevent you from running a shell. So we need to set SELinux to permissive for the first boot so we can fix the contexts.

vi /mnt/img2/etc/selinux/config

Change 'SELINUX=' to permissive.

<syntaxhighlight type="bash">
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=permissive
</syntaxhighlight>

Create a basic Xen config so we can boot the image.

<syntaxhighlight type="python">
name="centos7base"
vcpus=2
memory=512
disk=['file:/mnt/xen_images/centos/centos7.img,xvda1,w' ]
vif=['bridge=xenbr0']
on_reboot="restart"
on_crash="restart"
bootloader = "pygrub"
root = "/dev/xvda1 ro"
</syntaxhighlight>

Linux/Xen/DomU/CentOS/CentOS 7

2019-02-16T18:21:30Z

Pyromania: /* Building the compact image */

===CentOS 7===

The CentOS 7 installer won't install to a disk smaller then 10-20GB but its still possible to copy the finished install into a smaller image for easier distribution and cloning.

Create a empty image file and format it with xfs. We are making the file 20GB so CentOS will install.

dd if=/dev/zero of=centos_ks.img bs=1M count=1 seek=20000
mkfs.xfs centos_ks.img

The easiest way to install CentOS is using the kickstart system. You will need a webserver to host the kickstart config file. You will also need a kernel and ramdisk image from a CentOS mirror.

Download the vmlinuz and initrd.img files from your favorite CentOS mirror.

http://mirror.centos.org/centos/7/os/x86_64/images/pxeboot/

You will be booting the CentOS kickstart image with these files.

Here is the kickstart config that will need to be put on a webserver.

<syntaxhighlight lang="bash">
#version=1.0.0

install

# System authorization information
auth --enableshadow --passalgo=sha512
# Use network installation
url --url="http://mirror.centos.org/centos/7/os/x86_64/"
# Use text mode install
text
# Run the Setup Agent on first boot
firstboot --enable
ignoredisk --only-use=xvda
# Keyboard layouts
keyboard --vckeymap=us --xlayouts=''
# System language
lang en_US.UTF-8

# Network information
network --hostname=centos7 --bootproto=dhcp --device=eth0 --onboot=on

# Root password
rootpw --iscrypted $6$QgAmrd86o3M8qQIa$0LMJo9zwIe3j1e.hnc5G.6bXyhduRF03McofIDGSb7lrso6mbl9kt.WzxYOCXysC4Fb6Rdlu8OkXNAL22BLUW0
# System services
services --enabled="network"
# Do not configure the X Window System
skipx
# System timezone
timezone Etc/UTC --isUtc
# System bootloader configuration
bootloader --timeout=5 --driveorder=xvda --append="console=hvc0"
# Partition clearing information
zerombr
clearpart --all --initlabel --drives=xvda
part / --fstype=xfs --grow --size=1 --asprimary --ondisk=xvda

# Shutdown when the kickstart is done
halt

%packages
@core --nodefaults
-grub2
-chrony
-NetworkManager
-NetworkManager-team
-NetworkManager-tui
-NetworkManager-libnm
-wireless-tools
-plymouth
-fprintd-pam
-*-firmware

%end

%addon com_redhat_kdump --disable --reserve-mb='auto'

%end

%anaconda
pwpolicy root --minlen=6 --minquality=1 --notstrict --nochanges --notempty
pwpolicy user --minlen=6 --minquality=1 --notstrict --nochanges --emptyok
pwpolicy luks --minlen=6 --minquality=1 --notstrict --nochanges --notempty
%end
</syntaxhighlight>

====Kickstart Xen Config====

Once you have the kickstart config file on a webserver you need to create a new Xen config file that will be used to install the base image.

The Xen config will look something like this. You will need to edit the "disk", "kernel" and "ramdisk" paths to match where you are storing the files.
Also in the "extra" section, "inst.ks" will be the URL to the kickstart config file.

<syntaxhighlight lang="bash">
name="centos7ks"
vcpus=2
memory=2048
disk=['file:/mnt/xen_images/centos/centos_ks.img,xvda,w' ]
vif=['bridge=xenbr0']
on_reboot="restart"
on_crash="restart"
kernel="/mnt/xen_images/centos/x86_64/vmlinuz"
ramdisk="/mnt/xen_images/centos/x86_64/initrd.img"
extra="inst.repo=http://mirror.centos.org/centos/7/os/x86_64/ ip=eth0:dhcp inst.ks=http://192.168.1.80/kickstart/centos_domu.cfg"
</syntaxhighlight>

If you are not using DHCP you can set a static IP in the "extra" section like this,

<syntaxhighlight lang="bash">
extra="inst.repo=http://mirror.centos.org/centos/7/os/x86_64/ ip=192.168.1.20::192.168.1.1:255.255.255.0:centos7ks:eth0:none nameserver=192.168.1.1 inst.ks=http://192.168.1.80/kickstart/centos_domu.cfg"
</syntaxhighlight>

Boot the Xen config and access the console.

xl create centos7_ks.cfg -c

The virtual machine should boot up and launch anaconda to begin the automated install process.

You will get an error when it tries to install the bootloader. Since we don't use GRUB2 with Xen you can safely say "yes" to continue the installation.

It will ask you to hit Return to finish and then the virtual machine will shutdown and halt.

====Building the compact image====

The installation has finished but the virtual machine file size had to be 20G for CentOS to install. The installation can be copied into a smaller image for easier cloning and distribution.

Create a 1G image and format it with XFS

dd if=/dev/zero of=centos7.img bs=1M count=1 seek=1024
mkfs.xfs centos7.img

The finished installation image was partitioned during the install so we have to use kpartx to access the filesystem.

kpartx -av centos_ks.img

This will create a loopback device ( /dev/mapper/loop0p1 ) that you can mount.

mount /dev/mapper/loop0p1 /mnt/img

Mount the compact image

mount centos7.img /mnt/img2

Use rsync to copy everything from the finished installation to the compact image.

rsync -avH /mnt/img/ /mnt/img2/

When the OS was copied to the compact image, the SELinux contexts were not copied over. If you were to try and boot the compact image now, things would fail to start and you would not be able to login because SELinux would prevent you from running a shell. So we need to set SELinux to permissive for the first boot so we can fix the contexts.

vi /mnt/img2/etc/selinux/config

Change 'SELINUX=' to permissive.

<syntaxhighlight type="bash">
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=permissive
</syntaxhighlight>

Linux/Xen/DomU/CentOS/CentOS 7

2019-02-02T22:20:06Z

Pyromania: /* CentOS 7 */

Linux/Xen/DomU/CentOS/CentOS 7

2019-02-02T21:42:54Z

Pyromania: /* Kickstart Xen Config */

Linux/Xen/DomU/CentOS/CentOS 7

2019-02-02T21:11:54Z

Pyromania: /* CentOS 7 */

Linux/Xen/DomU/CentOS/CentOS 7

2019-01-20T23:01:20Z

Pyromania: /* CentOS 7 */

Linux/Xen/DomU/CentOS/CentOS 7

2019-01-20T22:51:48Z

Pyromania:

Linux/Xen/DomU/CentOS/CentOS 7

2019-01-20T20:37:22Z

Pyromania: Created page with "===CentOS 7=== The CentOS 7 installer won't install to a disk smaller then 10-20GB but its still possible to copy the finished install into a smaller image for easier distrib..."

Linux/Xen/Building Xen DomU images

2019-01-20T19:55:52Z

Pyromania:

==CentOS==

===[[Linux/Xen/DomU/CentOS/CentOS 7|CentOS 7]]===

==Debian==

==Devuan==

===[[Linux/Xen/DomU/Devuan/Devuan Jessie|Devuan Jessie]]===
===[[Linux/Xen/DomU/Devuan/Devuan ASCII|Devuan ASCII]]===

==Ubuntu==

===[[Linux/Xen/DomU/Ubuntu/Ubuntu 13.10|Ubuntu 13.10]]===

===[[Linux/Xen/DomU/Ubuntu/Ubuntu 14.04 LTS|Ubuntu 14.04 LTS]]===

===[[Linux/Xen/DomU/Ubuntu/Ubuntu 18.04 LTS|Ubuntu 18.04 LTS]]===

Linux/Xen/DomU/Devuan/Devuan ASCII

2018-12-23T19:21:00Z

Pyromania: /* Final Cleanup */

===Devuan ASCII===

Start this process on a existing Devuan system. You will need to have the Devuan patched version of debootstrap installed.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=devuan_ascii.img bs=1M count=1 seek=1024
mkfs.ext3 devuan_ascii.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop devuan_ascii.img /mnt/img

Start the debootstrap process.

debootstrap --variant=minbase ascii /mnt/img http://auto.mirror.devuan.org/merged/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Here is a basic sources.list

deb http://auto.mirror.devuan.org/merged ascii main
deb http://auto.mirror.devuan.org/merged ascii-updates main
deb http://auto.mirror.devuan.org/merged ascii-security main

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
chroot /mnt/img

Run updates and install a language pack.

apt-get update
apt-get upgrade

Install a frontend for debconf

apt-get install whiptail

Install locales and configure them.

apt-get install locales
dpkg-reconfigure locales

Configure the system timezone.

dpkg-reconfigure tzdata

Install networking systems

apt-get install netbase net-tools ifupdown inetutils-ping

Install the kernel image, SSH server, full version of vim and rsyslog

apt-get install linux-image-`dpkg --print-architecture`
apt-get install openssh-server
apt-get install vim
apt-get install rsyslog

To use the Xen console 'xm console (domU)' you need to setup a tty on /dev/hvc0. Edit /etc/inittab and add this line.

co:2345:respawn:/sbin/getty 38400 hvc0

====Network====

Configure your '/etc/network/interfaces' for DHCP

<syntaxhighlight lang="bash">
# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto eth0
iface eth0 inet dhcp
</syntaxhighlight>

We need to allow root logins over SSH.

Edit /etc/ssh/sshd_config and change,

#PermitRootLogin prohibit-password

to

PermitRootLogin yes

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"

<syntaxhighlight lang="bash">
default 0
timeout 2

title Devuan ASCII
root (hd0,0)
kernel /boot/vmlinuz-4.9.0-7-686-pae root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-4.9.0-7-686-pae

title Devuan ASCII (Single-User)
root (hd0,0)
kernel /boot/vmlinuz-4.9.0-7-686-pae root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-4.9.0-7-686-pae
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Devuan won't regenerate SSH host keys if you delete them from /etc/ssh. So we need to make some changes to /etc/init.d/ssh so it regenerates the host keys.

Here is a patch for /etc/init.d/ssh

<syntaxhighlight lang="bash">
--- old_ssh 2018-12-16 21:33:01.193415639 +0000
+++ ssh 2018-12-23 19:05:39.647919366 +0000
@@ -72,6 +72,57 @@ check_privsep_dir() {
fi
}

+# Some variables to make things more readable
+KEYGEN=/usr/bin/ssh-keygen
+RSA_KEY=/etc/ssh/ssh_host_rsa_key
+ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
+ED25519_KEY=/etc/ssh/ssh_host_ed25519_key
+
+do_rsa_keygen() {
+ if [ ! -s $RSA_KEY ]; then
+ echo -n "Generating SSH2 RSA host key: "
+ rm -f $RSA_KEY
+ if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $RSA_KEY
+ chmod 644 $RSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ecdsa_keygen() {
+ if [ ! -s $ECDSA_KEY ]; then
+ echo -n "Generating SSH2 ECDSA host key: "
+ rm -f $ECDSA_KEY
+ if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ECDSA_KEY
+ chmod 644 $ECDSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ed25519_keygen() {
+ if [ ! -s $ED25519_KEY ]; then
+ echo -n "Generating SSH2 ED25519 host key: "
+ rm -f $ED25519_KEY
+ if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ED25519_KEY
+ chmod 644 $ED25519_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
check_config() {
if [ ! -e /etc/ssh/sshd_not_to_be_run ]; then
/usr/sbin/sshd $SSHD_OPTS -t || exit 1
@@ -86,6 +137,11 @@ case "$1" in
check_privsep_dir
check_for_no_start
check_dev_null
+
+ do_rsa_keygen
+ do_ecdsa_keygen
+ do_ed25519_keygen
+
log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" || true
if start-stop-daemon --start --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
log_end_msg 0 || true
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove SSH host keys so that new ones get generated on first boot.

Remove the old leases file so that the VM will request a fresh IP address each time.

Set a root password

<syntaxhighlight lang="bash">
echo 'devuan' > /etc/hostname
rm /var/lib/dhcp/dhclient.eth0.leases
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/DomU/Devuan/Devuan ASCII

2018-12-23T19:08:14Z

Pyromania: /* SSH host keys fix */

===Devuan ASCII===

Start this process on a existing Devuan system. You will need to have the Devuan patched version of debootstrap installed.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=devuan_ascii.img bs=1M count=1 seek=1024
mkfs.ext3 devuan_ascii.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop devuan_ascii.img /mnt/img

Start the debootstrap process.

debootstrap --variant=minbase ascii /mnt/img http://auto.mirror.devuan.org/merged/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Here is a basic sources.list

deb http://auto.mirror.devuan.org/merged ascii main
deb http://auto.mirror.devuan.org/merged ascii-updates main
deb http://auto.mirror.devuan.org/merged ascii-security main

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
chroot /mnt/img

Run updates and install a language pack.

apt-get update
apt-get upgrade

Install a frontend for debconf

apt-get install whiptail

Install locales and configure them.

apt-get install locales
dpkg-reconfigure locales

Configure the system timezone.

dpkg-reconfigure tzdata

Install networking systems

apt-get install netbase net-tools ifupdown inetutils-ping

Install the kernel image, SSH server, full version of vim and rsyslog

apt-get install linux-image-`dpkg --print-architecture`
apt-get install openssh-server
apt-get install vim
apt-get install rsyslog

To use the Xen console 'xm console (domU)' you need to setup a tty on /dev/hvc0. Edit /etc/inittab and add this line.

co:2345:respawn:/sbin/getty 38400 hvc0

====Network====

Configure your '/etc/network/interfaces' for DHCP

<syntaxhighlight lang="bash">
# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto eth0
iface eth0 inet dhcp
</syntaxhighlight>

We need to allow root logins over SSH.

Edit /etc/ssh/sshd_config and change,

#PermitRootLogin prohibit-password

to

PermitRootLogin yes

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"

<syntaxhighlight lang="bash">
default 0
timeout 2

title Devuan ASCII
root (hd0,0)
kernel /boot/vmlinuz-4.9.0-7-686-pae root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-4.9.0-7-686-pae

title Devuan ASCII (Single-User)
root (hd0,0)
kernel /boot/vmlinuz-4.9.0-7-686-pae root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-4.9.0-7-686-pae
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Devuan won't regenerate SSH host keys if you delete them from /etc/ssh. So we need to make some changes to /etc/init.d/ssh so it regenerates the host keys.

Here is a patch for /etc/init.d/ssh

<syntaxhighlight lang="bash">
--- old_ssh 2018-12-16 21:33:01.193415639 +0000
+++ ssh 2018-12-23 19:05:39.647919366 +0000
@@ -72,6 +72,57 @@ check_privsep_dir() {
fi
}

+# Some variables to make things more readable
+KEYGEN=/usr/bin/ssh-keygen
+RSA_KEY=/etc/ssh/ssh_host_rsa_key
+ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
+ED25519_KEY=/etc/ssh/ssh_host_ed25519_key
+
+do_rsa_keygen() {
+ if [ ! -s $RSA_KEY ]; then
+ echo -n "Generating SSH2 RSA host key: "
+ rm -f $RSA_KEY
+ if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $RSA_KEY
+ chmod 644 $RSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ecdsa_keygen() {
+ if [ ! -s $ECDSA_KEY ]; then
+ echo -n "Generating SSH2 ECDSA host key: "
+ rm -f $ECDSA_KEY
+ if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ECDSA_KEY
+ chmod 644 $ECDSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ed25519_keygen() {
+ if [ ! -s $ED25519_KEY ]; then
+ echo -n "Generating SSH2 ED25519 host key: "
+ rm -f $ED25519_KEY
+ if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ED25519_KEY
+ chmod 644 $ED25519_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
check_config() {
if [ ! -e /etc/ssh/sshd_not_to_be_run ]; then
/usr/sbin/sshd $SSHD_OPTS -t || exit 1
@@ -86,6 +137,11 @@ case "$1" in
check_privsep_dir
check_for_no_start
check_dev_null
+
+ do_rsa_keygen
+ do_ecdsa_keygen
+ do_ed25519_keygen
+
log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" || true
if start-stop-daemon --start --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
log_end_msg 0 || true
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove SSH host keys so that new ones get generated on first boot.

Set a root password

<syntaxhighlight lang="bash">
echo 'devuan' > /etc/hostname
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/DomU/Devuan/Devuan ASCII

2018-12-23T19:03:48Z

Pyromania: /* Devuan ASCII */

===Devuan ASCII===

Start this process on a existing Devuan system. You will need to have the Devuan patched version of debootstrap installed.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=devuan_ascii.img bs=1M count=1 seek=1024
mkfs.ext3 devuan_ascii.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop devuan_ascii.img /mnt/img

Start the debootstrap process.

debootstrap --variant=minbase ascii /mnt/img http://auto.mirror.devuan.org/merged/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Here is a basic sources.list

deb http://auto.mirror.devuan.org/merged ascii main
deb http://auto.mirror.devuan.org/merged ascii-updates main
deb http://auto.mirror.devuan.org/merged ascii-security main

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
chroot /mnt/img

Run updates and install a language pack.

apt-get update
apt-get upgrade

Install a frontend for debconf

apt-get install whiptail

Install locales and configure them.

apt-get install locales
dpkg-reconfigure locales

Configure the system timezone.

dpkg-reconfigure tzdata

Install networking systems

apt-get install netbase net-tools ifupdown inetutils-ping

Install the kernel image, SSH server, full version of vim and rsyslog

apt-get install linux-image-`dpkg --print-architecture`
apt-get install openssh-server
apt-get install vim
apt-get install rsyslog

To use the Xen console 'xm console (domU)' you need to setup a tty on /dev/hvc0. Edit /etc/inittab and add this line.

co:2345:respawn:/sbin/getty 38400 hvc0

====Network====

Configure your '/etc/network/interfaces' for DHCP

<syntaxhighlight lang="bash">
# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto eth0
iface eth0 inet dhcp
</syntaxhighlight>

We need to allow root logins over SSH.

Edit /etc/ssh/sshd_config and change,

#PermitRootLogin prohibit-password

to

PermitRootLogin yes

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"

<syntaxhighlight lang="bash">
default 0
timeout 2

title Devuan ASCII
root (hd0,0)
kernel /boot/vmlinuz-4.9.0-7-686-pae root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-4.9.0-7-686-pae

title Devuan ASCII (Single-User)
root (hd0,0)
kernel /boot/vmlinuz-4.9.0-7-686-pae root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-4.9.0-7-686-pae
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Devuan won't regenerate SSH host keys if you delete them from /etc/ssh. So we need to make some changes to /etc/init.d/ssh so it regenerates the host keys.

Here is a patch for /etc/init.d/ssh

<syntaxhighlight lang="bash">
--- old_ssh 2018-12-16 21:33:01.193415639 +0000
+++ ssh 2018-12-23 18:52:01.653415639 +0000
@@ -72,6 +72,57 @@ check_privsep_dir() {
fi
}

+# Some variables to make things more readable
+KEYGEN=/usr/bin/ssh-keygen
+RSA_KEY=/etc/ssh/ssh_host_rsa_key
+ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
+ED25519_KEY=/etc/ssh/ssh_host_ed25519_key
+
+do_rsa_keygen() {
+ if [ ! -s $RSA_KEY ]; then
+ echo -n "Generating SSH2 RSA host key: "
+ rm -f $RSA_KEY
+ if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $RSA_KEY
+ chmod 644 $RSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ecdsa_keygen() {
+ if [ ! -s $ECDSA_KEY ]; then
+ echo -n "Generating SSH2 ECDSA host key: "
+ rm -f $ECDSA_KEY
+ if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ECDSA_KEY
+ chmod 644 $ECDSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ed25519_keygen() {
+ if [ ! -s $ED25519_KEY ]; then
+ echo -n "Generating SSH2 ED25519 host key: "
+ rm -f $ED25519_KEY
+ if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ED25519_KEY
+ chmod 644 $ED25519_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
check_config() {
if [ ! -e /etc/ssh/sshd_not_to_be_run ]; then
/usr/sbin/sshd $SSHD_OPTS -t || exit 1
@@ -86,6 +137,12 @@ case "$1" in
check_privsep_dir
check_for_no_start
check_dev_null
+
+ do_rsa_keygen
+ do_dsa_keygen
+ do_ecdsa_keygen
+ do_ed25519_keygen
+
log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" || true
if start-stop-daemon --start --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
log_end_msg 0 || true
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove SSH host keys so that new ones get generated on first boot.

Set a root password

<syntaxhighlight lang="bash">
echo 'devuan' > /etc/hostname
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/DomU/Devuan/Devuan ASCII

2018-12-23T19:02:49Z

Pyromania: /* Final Cleanup */

===Devuan ASCII===

Start this process on a existing Devuan system. You will need to have the Devuan patched version of debootstrap installed.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=devuan_ascii.img bs=1M count=1 seek=1024
mkfs.ext3 devuan_ascii.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop devuan_ascii.img /mnt/img

Start the debootstrap process.

debootstrap --variant=minbase ascii /mnt/img http://auto.mirror.devuan.org/merged/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Here is a basic sources.list

deb http://auto.mirror.devuan.org/merged ascii main
deb http://auto.mirror.devuan.org/merged ascii-updates main
deb http://auto.mirror.devuan.org/merged ascii-security main

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
chroot /mnt/img

Run updates and install a language pack.

apt-get update
apt-get upgrade

Install a frontend for debconf

apt-get install whiptail

Install locales and configure them.

apt-get install locales
dpkg-reconfigure locales

Configure the system timezone.

dpkg-reconfigure tzdata

Install networking systems

apt-get install netbase net-tools ifupdown inetutils-ping

Install the kernel image, SSH server, full version of vim and rsyslog

apt-get install linux-image-`dpkg --print-architecture`
apt-get install openssh-server
apt-get install vim
apt-get install rsyslog

To use the Xen console 'xm console (domU)' you need to setup a tty on /dev/hvc0. Edit /etc/inittab and add this line.

co:2345:respawn:/sbin/getty 38400 hvc0

The default udev rules for Devuan ignore Xen generated MAC addresses so you won't get a '/etc/udev/rules.d/70-persistent-net.rules' This causes your network interfaces not to come up.

Edit '/lib/udev/rules.d/75-persistent-net-generator.rules' and comment these lines. Here's the changes in patch/diff format.

<syntaxhighlight lang="diff">
--- 75-persistent-net-generator.rules.old 2018-10-20 12:40:48.812000000 -0500
+++ 75-persistent-net-generator.rules 2018-10-20 12:41:35.264000000 -0500
@@ -26,7 +26,7 @@
GOTO="persistent_net_generator_end"

# ignore Xen virtual interfaces
-SUBSYSTEMS=="xen", GOTO="persistent_net_generator_end"
+#SUBSYSTEMS=="xen", GOTO="persistent_net_generator_end"

# ignore UML virtual interfaces
DRIVERS=="uml-netdev", GOTO="persistent_net_generator_end"
@@ -78,7 +78,7 @@
ENV{MATCHADDR}=="00:15:5d:*", ENV{MATCHADDR}=""
ENV{MATCHADDR}=="52:54:00:*|54:52:00:*", ENV{MATCHADDR}=""
ENV{MATCHADDR}=="08:00:27:*", ENV{MATCHADDR}=""
-ENV{MATCHADDR}=="00:16:3e:*", ENV{MATCHADDR}=""
+#ENV{MATCHADDR}=="00:16:3e:*", ENV{MATCHADDR}=""

# ignore Windows Azure Hyper-V virtual interfaces
ENV{MATCHADDR}=="00:03:ff:*", ENV{MATCHADDR}=""
</syntaxhighlight>

====Network====

Configure your '/etc/network/interfaces' for DHCP

<syntaxhighlight lang="bash">
# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto eth0
iface eth0 inet dhcp
</syntaxhighlight>

We need to allow root logins over SSH.

Edit /etc/ssh/sshd_config and change,

#PermitRootLogin prohibit-password

to

PermitRootLogin yes

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"

<syntaxhighlight lang="bash">
default 0
timeout 2

title Devuan ASCII
root (hd0,0)
kernel /boot/vmlinuz-4.9.0-7-686-pae root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-4.9.0-7-686-pae

title Devuan ASCII (Single-User)
root (hd0,0)
kernel /boot/vmlinuz-4.9.0-7-686-pae root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-4.9.0-7-686-pae
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Devuan won't regenerate SSH host keys if you delete them from /etc/ssh. So we need to make some changes to /etc/init.d/ssh so it regenerates the host keys.

Here is a patch for /etc/init.d/ssh

<syntaxhighlight lang="bash">
--- old_ssh 2018-12-16 21:33:01.193415639 +0000
+++ ssh 2018-12-23 18:52:01.653415639 +0000
@@ -72,6 +72,57 @@ check_privsep_dir() {
fi
}

+# Some variables to make things more readable
+KEYGEN=/usr/bin/ssh-keygen
+RSA_KEY=/etc/ssh/ssh_host_rsa_key
+ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
+ED25519_KEY=/etc/ssh/ssh_host_ed25519_key
+
+do_rsa_keygen() {
+ if [ ! -s $RSA_KEY ]; then
+ echo -n "Generating SSH2 RSA host key: "
+ rm -f $RSA_KEY
+ if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $RSA_KEY
+ chmod 644 $RSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ecdsa_keygen() {
+ if [ ! -s $ECDSA_KEY ]; then
+ echo -n "Generating SSH2 ECDSA host key: "
+ rm -f $ECDSA_KEY
+ if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ECDSA_KEY
+ chmod 644 $ECDSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ed25519_keygen() {
+ if [ ! -s $ED25519_KEY ]; then
+ echo -n "Generating SSH2 ED25519 host key: "
+ rm -f $ED25519_KEY
+ if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ED25519_KEY
+ chmod 644 $ED25519_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
check_config() {
if [ ! -e /etc/ssh/sshd_not_to_be_run ]; then
/usr/sbin/sshd $SSHD_OPTS -t || exit 1
@@ -86,6 +137,12 @@ case "$1" in
check_privsep_dir
check_for_no_start
check_dev_null
+
+ do_rsa_keygen
+ do_dsa_keygen
+ do_ecdsa_keygen
+ do_ed25519_keygen
+
log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" || true
if start-stop-daemon --start --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
log_end_msg 0 || true
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove SSH host keys so that new ones get generated on first boot.

Set a root password

<syntaxhighlight lang="bash">
echo 'devuan' > /etc/hostname
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/DomU/Devuan/Devuan ASCII

2018-12-23T18:59:19Z

Pyromania: /* SSH host keys fix */

===Devuan ASCII===

Start this process on a existing Devuan system. You will need to have the Devuan patched version of debootstrap installed.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=devuan_ascii.img bs=1M count=1 seek=1024
mkfs.ext3 devuan_ascii.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop devuan_ascii.img /mnt/img

Start the debootstrap process.

debootstrap --variant=minbase ascii /mnt/img http://auto.mirror.devuan.org/merged/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Here is a basic sources.list

deb http://auto.mirror.devuan.org/merged ascii main
deb http://auto.mirror.devuan.org/merged ascii-updates main
deb http://auto.mirror.devuan.org/merged ascii-security main

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
chroot /mnt/img

Run updates and install a language pack.

apt-get update
apt-get upgrade

Install a frontend for debconf

apt-get install whiptail

Install locales and configure them.

apt-get install locales
dpkg-reconfigure locales

Configure the system timezone.

dpkg-reconfigure tzdata

Install networking systems

apt-get install netbase net-tools ifupdown inetutils-ping

Install the kernel image, SSH server, full version of vim and rsyslog

apt-get install linux-image-`dpkg --print-architecture`
apt-get install openssh-server
apt-get install vim
apt-get install rsyslog

To use the Xen console 'xm console (domU)' you need to setup a tty on /dev/hvc0. Edit /etc/inittab and add this line.

co:2345:respawn:/sbin/getty 38400 hvc0

The default udev rules for Devuan ignore Xen generated MAC addresses so you won't get a '/etc/udev/rules.d/70-persistent-net.rules' This causes your network interfaces not to come up.

Edit '/lib/udev/rules.d/75-persistent-net-generator.rules' and comment these lines. Here's the changes in patch/diff format.

<syntaxhighlight lang="diff">
--- 75-persistent-net-generator.rules.old 2018-10-20 12:40:48.812000000 -0500
+++ 75-persistent-net-generator.rules 2018-10-20 12:41:35.264000000 -0500
@@ -26,7 +26,7 @@
GOTO="persistent_net_generator_end"

# ignore Xen virtual interfaces
-SUBSYSTEMS=="xen", GOTO="persistent_net_generator_end"
+#SUBSYSTEMS=="xen", GOTO="persistent_net_generator_end"

# ignore UML virtual interfaces
DRIVERS=="uml-netdev", GOTO="persistent_net_generator_end"
@@ -78,7 +78,7 @@
ENV{MATCHADDR}=="00:15:5d:*", ENV{MATCHADDR}=""
ENV{MATCHADDR}=="52:54:00:*|54:52:00:*", ENV{MATCHADDR}=""
ENV{MATCHADDR}=="08:00:27:*", ENV{MATCHADDR}=""
-ENV{MATCHADDR}=="00:16:3e:*", ENV{MATCHADDR}=""
+#ENV{MATCHADDR}=="00:16:3e:*", ENV{MATCHADDR}=""

# ignore Windows Azure Hyper-V virtual interfaces
ENV{MATCHADDR}=="00:03:ff:*", ENV{MATCHADDR}=""
</syntaxhighlight>

====Network====

Configure your '/etc/network/interfaces' for DHCP

<syntaxhighlight lang="bash">
# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto eth0
iface eth0 inet dhcp
</syntaxhighlight>

We need to allow root logins over SSH.

Edit /etc/ssh/sshd_config and change,

#PermitRootLogin prohibit-password

to

PermitRootLogin yes

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"

<syntaxhighlight lang="bash">
default 0
timeout 2

title Devuan ASCII
root (hd0,0)
kernel /boot/vmlinuz-4.9.0-7-686-pae root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-4.9.0-7-686-pae

title Devuan ASCII (Single-User)
root (hd0,0)
kernel /boot/vmlinuz-4.9.0-7-686-pae root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-4.9.0-7-686-pae
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Devuan won't regenerate SSH host keys if you delete them from /etc/ssh. So we need to make some changes to /etc/init.d/ssh so it regenerates the host keys.

Here is a patch for /etc/init.d/ssh

<syntaxhighlight lang="bash">
--- old_ssh 2018-12-16 21:33:01.193415639 +0000
+++ ssh 2018-12-23 18:52:01.653415639 +0000
@@ -72,6 +72,57 @@ check_privsep_dir() {
fi
}

+# Some variables to make things more readable
+KEYGEN=/usr/bin/ssh-keygen
+RSA_KEY=/etc/ssh/ssh_host_rsa_key
+ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
+ED25519_KEY=/etc/ssh/ssh_host_ed25519_key
+
+do_rsa_keygen() {
+ if [ ! -s $RSA_KEY ]; then
+ echo -n "Generating SSH2 RSA host key: "
+ rm -f $RSA_KEY
+ if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $RSA_KEY
+ chmod 644 $RSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ecdsa_keygen() {
+ if [ ! -s $ECDSA_KEY ]; then
+ echo -n "Generating SSH2 ECDSA host key: "
+ rm -f $ECDSA_KEY
+ if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ECDSA_KEY
+ chmod 644 $ECDSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ed25519_keygen() {
+ if [ ! -s $ED25519_KEY ]; then
+ echo -n "Generating SSH2 ED25519 host key: "
+ rm -f $ED25519_KEY
+ if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ED25519_KEY
+ chmod 644 $ED25519_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
check_config() {
if [ ! -e /etc/ssh/sshd_not_to_be_run ]; then
/usr/sbin/sshd $SSHD_OPTS -t || exit 1
@@ -86,6 +137,12 @@ case "$1" in
check_privsep_dir
check_for_no_start
check_dev_null
+
+ do_rsa_keygen
+ do_dsa_keygen
+ do_ecdsa_keygen
+ do_ed25519_keygen
+
log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" || true
if start-stop-daemon --start --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
log_end_msg 0 || true
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove /etc/udev/rules.d/70-persistent-net.rules so that network comes up clean when the image is booted for the first time.

Remove SSH host keys so that new ones get generated on first boot.

Set a root password

<syntaxhighlight lang="bash">
echo 'devuan' > /etc/hostname
rm /etc/udev/rules.d/70-persistent-net.rules
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/DomU/Devuan/Devuan ASCII

2018-12-23T18:56:59Z

Pyromania:

===Devuan ASCII===

Start this process on a existing Devuan system. You will need to have the Devuan patched version of debootstrap installed.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=devuan_ascii.img bs=1M count=1 seek=1024
mkfs.ext3 devuan_ascii.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop devuan_ascii.img /mnt/img

Start the debootstrap process.

debootstrap --variant=minbase ascii /mnt/img http://auto.mirror.devuan.org/merged/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Here is a basic sources.list

deb http://auto.mirror.devuan.org/merged ascii main
deb http://auto.mirror.devuan.org/merged ascii-updates main
deb http://auto.mirror.devuan.org/merged ascii-security main

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
chroot /mnt/img

Run updates and install a language pack.

apt-get update
apt-get upgrade

Install a frontend for debconf

apt-get install whiptail

Install locales and configure them.

apt-get install locales
dpkg-reconfigure locales

Configure the system timezone.

dpkg-reconfigure tzdata

Install networking systems

apt-get install netbase net-tools ifupdown inetutils-ping

Install the kernel image, SSH server, full version of vim and rsyslog

apt-get install linux-image-`dpkg --print-architecture`
apt-get install openssh-server
apt-get install vim
apt-get install rsyslog

To use the Xen console 'xm console (domU)' you need to setup a tty on /dev/hvc0. Edit /etc/inittab and add this line.

co:2345:respawn:/sbin/getty 38400 hvc0

The default udev rules for Devuan ignore Xen generated MAC addresses so you won't get a '/etc/udev/rules.d/70-persistent-net.rules' This causes your network interfaces not to come up.

Edit '/lib/udev/rules.d/75-persistent-net-generator.rules' and comment these lines. Here's the changes in patch/diff format.

<syntaxhighlight lang="diff">
--- 75-persistent-net-generator.rules.old 2018-10-20 12:40:48.812000000 -0500
+++ 75-persistent-net-generator.rules 2018-10-20 12:41:35.264000000 -0500
@@ -26,7 +26,7 @@
GOTO="persistent_net_generator_end"

# ignore Xen virtual interfaces
-SUBSYSTEMS=="xen", GOTO="persistent_net_generator_end"
+#SUBSYSTEMS=="xen", GOTO="persistent_net_generator_end"

# ignore UML virtual interfaces
DRIVERS=="uml-netdev", GOTO="persistent_net_generator_end"
@@ -78,7 +78,7 @@
ENV{MATCHADDR}=="00:15:5d:*", ENV{MATCHADDR}=""
ENV{MATCHADDR}=="52:54:00:*|54:52:00:*", ENV{MATCHADDR}=""
ENV{MATCHADDR}=="08:00:27:*", ENV{MATCHADDR}=""
-ENV{MATCHADDR}=="00:16:3e:*", ENV{MATCHADDR}=""
+#ENV{MATCHADDR}=="00:16:3e:*", ENV{MATCHADDR}=""

# ignore Windows Azure Hyper-V virtual interfaces
ENV{MATCHADDR}=="00:03:ff:*", ENV{MATCHADDR}=""
</syntaxhighlight>

====Network====

Configure your '/etc/network/interfaces' for DHCP

<syntaxhighlight lang="bash">
# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto eth0
iface eth0 inet dhcp
</syntaxhighlight>

We need to allow root logins over SSH.

Edit /etc/ssh/sshd_config and change,

#PermitRootLogin prohibit-password

to

PermitRootLogin yes

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"

<syntaxhighlight lang="bash">
default 0
timeout 2

title Devuan ASCII
root (hd0,0)
kernel /boot/vmlinuz-4.9.0-7-686-pae root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-4.9.0-7-686-pae

title Devuan ASCII (Single-User)
root (hd0,0)
kernel /boot/vmlinuz-4.9.0-7-686-pae root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-4.9.0-7-686-pae
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Devuan won't regenerate SSH host keys if you delete them from /etc/ssh. So we need to make some changes to /etc/init.d/ssh so it regenerates the host keys.

Here is a patch for /etc/init.d/ssh

<syntaxhighlight lang="bash">
--- old_ssh 2017-01-15 10:04:56.399284075 -0600
+++ ssh 2017-01-15 10:09:02.999284075 -0600
@@ -78,6 +78,74 @@
fi
}

+# Some variables to make things more readable
+KEYGEN=/usr/bin/ssh-keygen
+RSA1_KEY=/etc/ssh/ssh_host_key
+RSA_KEY=/etc/ssh/ssh_host_rsa_key
+DSA_KEY=/etc/ssh/ssh_host_dsa_key
+ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
+ED25519_KEY=/etc/ssh/ssh_host_ed25519_key
+
+do_rsa_keygen() {
+ if [ ! -s $RSA_KEY ]; then
+ echo -n "Generating SSH2 RSA host key: "
+ rm -f $RSA_KEY
+ if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $RSA_KEY
+ chmod 644 $RSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_dsa_keygen() {
+ if [ ! -s $DSA_KEY ]; then
+ echo -n "Generating SSH2 DSA host key: "
+ rm -f $DSA_KEY
+ if test ! -f $DSA_KEY && $KEYGEN -q -t dsa -f $DSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $DSA_KEY
+ chmod 644 $DSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ecdsa_keygen() {
+ if [ ! -s $ECDSA_KEY ]; then
+ echo -n "Generating SSH2 ECDSA host key: "
+ rm -f $ECDSA_KEY
+ if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ECDSA_KEY
+ chmod 644 $ECDSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ed25519_keygen() {
+ if [ ! -s $ED25519_KEY ]; then
+ echo -n "Generating SSH2 ED25519 host key: "
+ rm -f $ED25519_KEY
+ if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ED25519_KEY
+ chmod 644 $ED25519_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
export PATH="${PATH:+$PATH:}/usr/sbin:/sbin"

case "$1" in
@@ -86,6 +154,12 @@
check_privsep_dir
check_for_no_start
check_dev_null
+
+ do_rsa_keygen
+ do_dsa_keygen
+ do_ecdsa_keygen
+ do_ed25519_keygen
+
log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" || true
if start-stop-daemon --start --quiet --oknodo --pidfile /var/run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
log_end_msg 0 || true
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove /etc/udev/rules.d/70-persistent-net.rules so that network comes up clean when the image is booted for the first time.

Remove SSH host keys so that new ones get generated on first boot.

Set a root password

<syntaxhighlight lang="bash">
echo 'devuan' > /etc/hostname
rm /etc/udev/rules.d/70-persistent-net.rules
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/DomU/Ubuntu/Ubuntu 18.04 LTS

2018-12-14T18:50:33Z

Pyromania: /* SSH host keys fix */

===Ubuntu 18.04 LTS===

Start this process on a existing Ubuntu system. Does not have to be a 18.04 system. You will need to have debootstrap installed and may need to update debootstrap so it has the correct script for 18.04.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=ubuntu_bionic.img bs=1M count=1 seek=1024
mkfs.ext3 ubuntu_bionic.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop ubuntu_bionic.img /mnt/img

Start the debootstrap process.m

debootstrap --variant=minbase --include=iproute2,net-tools,isc-dhcp-client,isc-dhcp-common,rsyslog bionic /mnt/img/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
chroot /mnt/img

Run updates and install a language pack.

apt-get update
apt-get install language-pack-en-base
apt-get upgrade

Install a frontend for debconf

apt-get install whiptail

Install Timezone data

apt-get install tzdata

Configure the system timezone.

dpkg-reconfigure tzdata

Install the kernel image, SSH server and the full version of vim

apt-get install linux-image-4.15.0-42-generic
apt-get install openssh-server
apt-get install vim

====Network====

Ubuntu 18.04 no longer used the traditional, '/etc/network/interfaces'. They have switched to netplan.io

apt-get install netplan.io

Configure /etc/netplan/01-netcfg.yaml for DHCP

<syntaxhighlight lang="bash">
# This file describes the network interfaces available on your system
# For more information, see netplan(5).
network:
version: 2
renderer: networkd
ethernets:
eth0:
dhcp4: yes
</syntaxhighlight>

We need to allow root logins over SSH.

Edit /etc/ssh/sshd_config and change,

#PermitRootLogin prohibit-password

to

PermitRootLogin yes

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"
In order for "xl console" to work we need to spawn a console on hvc0. So add "console=hvc0" to the kernel lines.

<syntaxhighlight lang="bash">
default 0
timeout 2

title Ubuntu 18.04.1 LTS, kernel 4.15.0-42-generic
root (hd0)
kernel /boot/vmlinuz-4.15.0-42-generic root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-4.15.0-42-generic

title Ubuntu 18.04.1 LTS, kernel 4.15.0-42-generic (recovery mode)
root (hd0)
kernel /boot/vmlinuz-4.15.0-42-generic root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-4.15.0-42-generic
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Ubuntu won't regenerate SSH host keys if you delete them from /etc/ssh. So we need a script to check the host keys and regenerate them if needed. The script will get called by systemd during sshd start/restart

Ubuntu 18.04 is running OpenSSH version 7 and DSA keys are being deprecated so we don't need to generate a DSA host key.

Create /usr/sbin/rebuild-sshd-keys and paste this in,

<syntaxhighlight lang="bash">
#!/bin/sh

# Some variables to make things more readable
KEYGEN=/usr/bin/ssh-keygen
RSA_KEY=/etc/ssh/ssh_host_rsa_key
ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
ED25519_KEY=/etc/ssh/ssh_host_ed25519_key

do_rsa_keygen() {
if [ ! -s $RSA_KEY ]; then
echo -n "Generating SSH2 RSA host key: "
rm -f $RSA_KEY
if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
chmod 600 $RSA_KEY
chmod 644 $RSA_KEY.pub
echo "OK"
else
echo "FAIL"
exit 1
fi
fi
}

do_ecdsa_keygen() {
if [ ! -s $ECDSA_KEY ]; then
echo -n "Generating SSH2 ECDSA host key: "
rm -f $ECDSA_KEY
if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
chmod 600 $ECDSA_KEY
chmod 644 $ECDSA_KEY.pub
echo "OK"
else
echo "FAIL"
exit 1
fi
fi
}

do_ed25519_keygen() {
if [ ! -s $ED25519_KEY ]; then
echo -n "Generating SSH2 ED25519 host key: "
rm -f $ED25519_KEY
if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
chmod 600 $ED25519_KEY
chmod 644 $ED25519_KEY.pub
echo "OK"
else
echo "FAIL"
exit 1
fi
fi
}

do_rsa_keygen
do_ecdsa_keygen
do_ed25519_keygen
</syntaxhighlight>

chmod 755 /usr/sbin/rebuild-sshd-keys

Create a new systemd unit file, "/lib/systemd/system/rebuild-sshd-keys.service" and paste this in,

<syntaxhighlight lang="bash">
[Unit]
Description=OpenSSH Server Key Generation
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_rsa_key
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ecdsa_key
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ed25519_key
PartOf=ssh.service ssh.socket

[Service]
ExecStart=/usr/sbin/rebuild-sshd-keys
Type=oneshot
RemainAfterExit=yes
</syntaxhighlight>

Edit "/lib/systemd/system/ssh.service" and make these changes to use the new rebuild-sshd-keys.service unit file.

<syntaxhighlight lang="bash">
--- ssh.service.old 2018-12-09 23:51:39.687140401 +0000
+++ ssh.service 2018-12-09 23:53:14.364249439 +0000
@@ -1,7 +1,8 @@
[Unit]
Description=OpenBSD Secure Shell server
-After=network.target auditd.service
+After=network.target auditd.service rebuild-sshd-keys.service
ConditionPathExists=!/etc/ssh/sshd_not_to_be_run
+Wants=rebuild-sshd-keys.service

[Service]
EnvironmentFile=-/etc/default/ssh
</syntaxhighlight>

Enable the new systemd unit files.

systemctl enable rebuild-sshd-keys.service
systemctl enable ssh.service

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove SSH host keys so that new ones get generated on first boot.

Set a root password

<syntaxhighlight lang="bash">
echo 'bionic' > /etc/hostname
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/DomU/Ubuntu/Ubuntu 18.04 LTS

2018-12-14T17:36:53Z

Pyromania: /* Network */

===Ubuntu 18.04 LTS===

Start this process on a existing Ubuntu system. Does not have to be a 18.04 system. You will need to have debootstrap installed and may need to update debootstrap so it has the correct script for 18.04.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=ubuntu_bionic.img bs=1M count=1 seek=1024
mkfs.ext3 ubuntu_bionic.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop ubuntu_bionic.img /mnt/img

Start the debootstrap process.m

debootstrap --variant=minbase --include=iproute2,net-tools,isc-dhcp-client,isc-dhcp-common,rsyslog bionic /mnt/img/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
chroot /mnt/img

Run updates and install a language pack.

apt-get update
apt-get install language-pack-en-base
apt-get upgrade

Install a frontend for debconf

apt-get install whiptail

Install Timezone data

apt-get install tzdata

Configure the system timezone.

dpkg-reconfigure tzdata

Install the kernel image, SSH server and the full version of vim

apt-get install linux-image-4.15.0-42-generic
apt-get install openssh-server
apt-get install vim

====Network====

Ubuntu 18.04 no longer used the traditional, '/etc/network/interfaces'. They have switched to netplan.io

apt-get install netplan.io

Configure /etc/netplan/01-netcfg.yaml for DHCP

<syntaxhighlight lang="bash">
# This file describes the network interfaces available on your system
# For more information, see netplan(5).
network:
version: 2
renderer: networkd
ethernets:
eth0:
dhcp4: yes
</syntaxhighlight>

We need to allow root logins over SSH.

Edit /etc/ssh/sshd_config and change,

#PermitRootLogin prohibit-password

to

PermitRootLogin yes

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"
In order for "xl console" to work we need to spawn a console on hvc0. So add "console=hvc0" to the kernel lines.

<syntaxhighlight lang="bash">
default 0
timeout 2

title Ubuntu 18.04.1 LTS, kernel 4.15.0-42-generic
root (hd0)
kernel /boot/vmlinuz-4.15.0-42-generic root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-4.15.0-42-generic

title Ubuntu 18.04.1 LTS, kernel 4.15.0-42-generic (recovery mode)
root (hd0)
kernel /boot/vmlinuz-4.15.0-42-generic root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-4.15.0-42-generic
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Ubuntu won't regenerate SSH host keys if you delete them from /etc/ssh. So we need a script to check the host keys and regenerate them if needed. The script will get called by systemd during sshd start/restart

Ubuntu 18.04 is running OpenSSH version 7 and DSA keys are being deprecated so we don't need to generate a DSA host key.

Create /usr/sbin/rebuild-sshd-keys and paste this in,

<syntaxhighlight lang="bash">
#!/bin/sh

# Some variables to make things more readable
KEYGEN=/usr/bin/ssh-keygen
RSA_KEY=/etc/ssh/ssh_host_rsa_key
ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
ED25519_KEY=/etc/ssh/ssh_host_ed25519_key

do_rsa_keygen() {
if [ ! -s $RSA_KEY ]; then
echo -n "Generating SSH2 RSA host key: "
rm -f $RSA_KEY
if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
chmod 600 $RSA_KEY
chmod 644 $RSA_KEY.pub
echo "OK"
else
echo "FAIL"
exit 1
fi
fi
}

do_ecdsa_keygen() {
if [ ! -s $ECDSA_KEY ]; then
echo -n "Generating SSH2 ECDSA host key: "
rm -f $ECDSA_KEY
if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
chmod 600 $ECDSA_KEY
chmod 644 $ECDSA_KEY.pub
echo "OK"
else
echo "FAIL"
exit 1
fi
fi
}

do_ed25519_keygen() {
if [ ! -s $ED25519_KEY ]; then
echo -n "Generating SSH2 ED25519 host key: "
rm -f $ED25519_KEY
if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
chmod 600 $ED25519_KEY
chmod 644 $ED25519_KEY.pub
echo "OK"
else
echo "FAIL"
exit 1
fi
fi
}

do_rsa_keygen
do_ecdsa_keygen
do_ed25519_keygen
</syntaxhighlight>

chmod 755 /usr/sbin/rebuild-sshd-keys

Create a new systemd unit file, "/lib/systemd/system/rebuild-sshd-keys.service" and paste this in,

<syntaxhighlight lang="bash">
[Unit]
Description=OpenSSH Server Key Generation
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_rsa_key
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ecdsa_key
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ed25519_key
PartOf=ssh.service ssh.socket

[Service]
ExecStart=/usr/sbin/rebuild-sshd-keys
Type=oneshot
RemainAfterExit=yes
</syntaxhighlight>

Edit "/lib/systemd/system/ssh.service" and make these changes to use the new rebuild-sshd-keys.service unit file.

<syntaxhighlight lang="bash">
--- ssh.service.old 2018-12-09 23:51:39.687140401 +0000
+++ ssh.service 2018-12-09 23:53:14.364249439 +0000
@@ -1,7 +1,8 @@
[Unit]
Description=OpenBSD Secure Shell server
-After=network.target auditd.service
+After=network.target auditd.service rebuild-sshd-keys.service
ConditionPathExists=!/etc/ssh/sshd_not_to_be_run
+Wants=rebuild-sshd-keys.service

[Service]
EnvironmentFile=-/etc/default/ssh
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove SSH host keys so that new ones get generated on first boot.

Set a root password

<syntaxhighlight lang="bash">
echo 'bionic' > /etc/hostname
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/DomU/Ubuntu/Ubuntu 18.04 LTS

2018-12-14T17:36:16Z

Pyromania: /* Network */

===Ubuntu 18.04 LTS===

Start this process on a existing Ubuntu system. Does not have to be a 18.04 system. You will need to have debootstrap installed and may need to update debootstrap so it has the correct script for 18.04.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=ubuntu_bionic.img bs=1M count=1 seek=1024
mkfs.ext3 ubuntu_bionic.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop ubuntu_bionic.img /mnt/img

Start the debootstrap process.m

debootstrap --variant=minbase --include=iproute2,net-tools,isc-dhcp-client,isc-dhcp-common,rsyslog bionic /mnt/img/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
chroot /mnt/img

Run updates and install a language pack.

apt-get update
apt-get install language-pack-en-base
apt-get upgrade

Install a frontend for debconf

apt-get install whiptail

Install Timezone data

apt-get install tzdata

Configure the system timezone.

dpkg-reconfigure tzdata

Install the kernel image, SSH server and the full version of vim

apt-get install linux-image-4.15.0-42-generic
apt-get install openssh-server
apt-get install vim

====Network====

Ubuntu 18.04 no longer used the traditional, '/etc/network/interfaces'. They have switched to netplan.io

apt-get install netplan.io

Configure /etc/netplan/01-netcfg.yaml for DHCP

<syntaxhighlight lang="bash">
# This file describes the network interfaces available on your system
# For more information, see netplan(5).
network:
version: 2
renderer: networkd
ethernets:
eth0:
dhcp4: yes
</syntaxhighlight>

We need to allow root logins over SSH.

Edit /etc/ssh/sshd_config and change,

#PermitRootLogin prohibit-password

to

PermitRootLogin yes

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"
In order for "xl console" to work we need to spawn a console on hvc0. So add "console=hvc0" to the kernel lines.

<syntaxhighlight lang="bash">
default 0
timeout 2

title Ubuntu 18.04.1 LTS, kernel 4.15.0-42-generic
root (hd0)
kernel /boot/vmlinuz-4.15.0-42-generic root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-4.15.0-42-generic

title Ubuntu 18.04.1 LTS, kernel 4.15.0-42-generic (recovery mode)
root (hd0)
kernel /boot/vmlinuz-4.15.0-42-generic root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-4.15.0-42-generic
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Ubuntu won't regenerate SSH host keys if you delete them from /etc/ssh. So we need a script to check the host keys and regenerate them if needed. The script will get called by systemd during sshd start/restart

Ubuntu 18.04 is running OpenSSH version 7 and DSA keys are being deprecated so we don't need to generate a DSA host key.

Create /usr/sbin/rebuild-sshd-keys and paste this in,

<syntaxhighlight lang="bash">
#!/bin/sh

# Some variables to make things more readable
KEYGEN=/usr/bin/ssh-keygen
RSA_KEY=/etc/ssh/ssh_host_rsa_key
ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
ED25519_KEY=/etc/ssh/ssh_host_ed25519_key

do_rsa_keygen() {
if [ ! -s $RSA_KEY ]; then
echo -n "Generating SSH2 RSA host key: "
rm -f $RSA_KEY
if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
chmod 600 $RSA_KEY
chmod 644 $RSA_KEY.pub
echo "OK"
else
echo "FAIL"
exit 1
fi
fi
}

do_ecdsa_keygen() {
if [ ! -s $ECDSA_KEY ]; then
echo -n "Generating SSH2 ECDSA host key: "
rm -f $ECDSA_KEY
if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
chmod 600 $ECDSA_KEY
chmod 644 $ECDSA_KEY.pub
echo "OK"
else
echo "FAIL"
exit 1
fi
fi
}

do_ed25519_keygen() {
if [ ! -s $ED25519_KEY ]; then
echo -n "Generating SSH2 ED25519 host key: "
rm -f $ED25519_KEY
if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
chmod 600 $ED25519_KEY
chmod 644 $ED25519_KEY.pub
echo "OK"
else
echo "FAIL"
exit 1
fi
fi
}

do_rsa_keygen
do_ecdsa_keygen
do_ed25519_keygen
</syntaxhighlight>

chmod 755 /usr/sbin/rebuild-sshd-keys

Create a new systemd unit file, "/lib/systemd/system/rebuild-sshd-keys.service" and paste this in,

<syntaxhighlight lang="bash">
[Unit]
Description=OpenSSH Server Key Generation
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_rsa_key
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ecdsa_key
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ed25519_key
PartOf=ssh.service ssh.socket

[Service]
ExecStart=/usr/sbin/rebuild-sshd-keys
Type=oneshot
RemainAfterExit=yes
</syntaxhighlight>

Edit "/lib/systemd/system/ssh.service" and make these changes to use the new rebuild-sshd-keys.service unit file.

<syntaxhighlight lang="bash">
--- ssh.service.old 2018-12-09 23:51:39.687140401 +0000
+++ ssh.service 2018-12-09 23:53:14.364249439 +0000
@@ -1,7 +1,8 @@
[Unit]
Description=OpenBSD Secure Shell server
-After=network.target auditd.service
+After=network.target auditd.service rebuild-sshd-keys.service
ConditionPathExists=!/etc/ssh/sshd_not_to_be_run
+Wants=rebuild-sshd-keys.service

[Service]
EnvironmentFile=-/etc/default/ssh
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove SSH host keys so that new ones get generated on first boot.

Set a root password

<syntaxhighlight lang="bash">
echo 'bionic' > /etc/hostname
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/DomU/Ubuntu/Ubuntu 18.04 LTS

2018-12-14T00:55:56Z

Pyromania: /* Ubuntu 18.04 LTS */

===Ubuntu 18.04 LTS===

Start this process on a existing Ubuntu system. Does not have to be a 18.04 system. You will need to have debootstrap installed and may need to update debootstrap so it has the correct script for 18.04.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=ubuntu_bionic.img bs=1M count=1 seek=1024
mkfs.ext3 ubuntu_bionic.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop ubuntu_bionic.img /mnt/img

Start the debootstrap process.m

debootstrap --variant=minbase --include=iproute2,net-tools,isc-dhcp-client,isc-dhcp-common,rsyslog bionic /mnt/img/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
chroot /mnt/img

Run updates and install a language pack.

apt-get update
apt-get install language-pack-en-base
apt-get upgrade

Install a frontend for debconf

apt-get install whiptail

Install Timezone data

apt-get install tzdata

Configure the system timezone.

dpkg-reconfigure tzdata

Install the kernel image, SSH server and the full version of vim

apt-get install linux-image-4.15.0-42-generic
apt-get install openssh-server
apt-get install vim

====Network====

Ubuntu 18.04 no longer used the traditional, '/etc/network/interfaces'. They have switched to netplan.io

apt-get install netplan.io

Configure /etc/netplan/01-netcfg.yaml for DHCP

<syntaxhighlight lang="bash">
# This file describes the network interfaces available on your system
# For more information, see netplan(5).
network:
version: 2
renderer: networkd
ethernets:
eth0:
dhcp4: yes
</syntaxhighlight>

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"
In order for "xl console" to work we need to spawn a console on hvc0. So add "console=hvc0" to the kernel lines.

<syntaxhighlight lang="bash">
default 0
timeout 2

title Ubuntu 18.04.1 LTS, kernel 4.15.0-42-generic
root (hd0)
kernel /boot/vmlinuz-4.15.0-42-generic root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-4.15.0-42-generic

title Ubuntu 18.04.1 LTS, kernel 4.15.0-42-generic (recovery mode)
root (hd0)
kernel /boot/vmlinuz-4.15.0-42-generic root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-4.15.0-42-generic
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Ubuntu won't regenerate SSH host keys if you delete them from /etc/ssh. So we need a script to check the host keys and regenerate them if needed. The script will get called by systemd during sshd start/restart

Ubuntu 18.04 is running OpenSSH version 7 and DSA keys are being deprecated so we don't need to generate a DSA host key.

Create /usr/sbin/rebuild-sshd-keys and paste this in,

<syntaxhighlight lang="bash">
#!/bin/sh

# Some variables to make things more readable
KEYGEN=/usr/bin/ssh-keygen
RSA_KEY=/etc/ssh/ssh_host_rsa_key
ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
ED25519_KEY=/etc/ssh/ssh_host_ed25519_key

do_rsa_keygen() {
if [ ! -s $RSA_KEY ]; then
echo -n "Generating SSH2 RSA host key: "
rm -f $RSA_KEY
if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
chmod 600 $RSA_KEY
chmod 644 $RSA_KEY.pub
echo "OK"
else
echo "FAIL"
exit 1
fi
fi
}

do_ecdsa_keygen() {
if [ ! -s $ECDSA_KEY ]; then
echo -n "Generating SSH2 ECDSA host key: "
rm -f $ECDSA_KEY
if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
chmod 600 $ECDSA_KEY
chmod 644 $ECDSA_KEY.pub
echo "OK"
else
echo "FAIL"
exit 1
fi
fi
}

do_ed25519_keygen() {
if [ ! -s $ED25519_KEY ]; then
echo -n "Generating SSH2 ED25519 host key: "
rm -f $ED25519_KEY
if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
chmod 600 $ED25519_KEY
chmod 644 $ED25519_KEY.pub
echo "OK"
else
echo "FAIL"
exit 1
fi
fi
}

do_rsa_keygen
do_ecdsa_keygen
do_ed25519_keygen
</syntaxhighlight>

chmod 755 /usr/sbin/rebuild-sshd-keys

Create a new systemd unit file, "/lib/systemd/system/rebuild-sshd-keys.service" and paste this in,

<syntaxhighlight lang="bash">
[Unit]
Description=OpenSSH Server Key Generation
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_rsa_key
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ecdsa_key
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ed25519_key
PartOf=ssh.service ssh.socket

[Service]
ExecStart=/usr/sbin/rebuild-sshd-keys
Type=oneshot
RemainAfterExit=yes
</syntaxhighlight>

Edit "/lib/systemd/system/ssh.service" and make these changes to use the new rebuild-sshd-keys.service unit file.

<syntaxhighlight lang="bash">
--- ssh.service.old 2018-12-09 23:51:39.687140401 +0000
+++ ssh.service 2018-12-09 23:53:14.364249439 +0000
@@ -1,7 +1,8 @@
[Unit]
Description=OpenBSD Secure Shell server
-After=network.target auditd.service
+After=network.target auditd.service rebuild-sshd-keys.service
ConditionPathExists=!/etc/ssh/sshd_not_to_be_run
+Wants=rebuild-sshd-keys.service

[Service]
EnvironmentFile=-/etc/default/ssh
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove SSH host keys so that new ones get generated on first boot.

Set a root password

<syntaxhighlight lang="bash">
echo 'bionic' > /etc/hostname
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/DomU/Ubuntu/Ubuntu 18.04 LTS

2018-12-10T00:03:18Z

Pyromania:

===Ubuntu 18.04 LTS===

Start this process on a existing Ubuntu system. Does not have to be a 18.04 system. You will need to have debootstrap installed and may need to update debootstrap so it has the correct script for 18.04.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=ubuntu_bionic.img bs=1M count=1 seek=1024
mkfs.ext3 ubuntu_bionic.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop ubuntu_bionic.img /mnt/img

Start the debootstrap process.m

debootstrap --variant=minbase --include=iproute2,net-tools,isc-dhcp-client,isc-dhcp-common bionic /mnt/img/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
chroot /mnt/img

Run updates and install a language pack.

apt-get update
apt-get install language-pack-en-base
apt-get upgrade

Install a frontend for debconf

apt-get install whiptail

Install Timezone data

apt-get install tzdata

Configure the system timezone.

dpkg-reconfigure tzdata

Install the kernel image, SSH server and the full version of vim

apt-get install linux-image-4.15.0-42-generic
apt-get install openssh-server
apt-get install vim

====Network====

Ubuntu 18.04 no longer used the traditional, '/etc/network/interfaces'. They have switched to netplan.io

apt-get install netplan.io

Configure /etc/netplan/01-netcfg.yaml for DHCP

<syntaxhighlight lang="bash">
# This file describes the network interfaces available on your system
# For more information, see netplan(5).
network:
version: 2
renderer: networkd
ethernets:
eth0:
dhcp4: yes
</syntaxhighlight>

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"
In order for "xl console" to work we need to spawn a console on hvc0. So add "console=hvc0" to the kernel lines.

<syntaxhighlight lang="bash">
default 0
timeout 2

title Ubuntu 18.04.1 LTS, kernel 4.15.0-42-generic
root (hd0)
kernel /boot/vmlinuz-4.15.0-42-generic root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-4.15.0-42-generic

title Ubuntu 18.04.1 LTS, kernel 4.15.0-42-generic (recovery mode)
root (hd0)
kernel /boot/vmlinuz-4.15.0-42-generic root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-4.15.0-42-generic
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Ubuntu won't regenerate SSH host keys if you delete them from /etc/ssh. So we need a script to check the host keys and regenerate them if needed. The script will get called by systemd during sshd start/restart

Ubuntu 18.04 is running OpenSSH version 7 and DSA keys are being deprecated so we don't need to generate a DSA host key.

Create /usr/sbin/rebuild-sshd-keys and paste this in,

<syntaxhighlight lang="bash">
#!/bin/sh

# Some variables to make things more readable
KEYGEN=/usr/bin/ssh-keygen
RSA_KEY=/etc/ssh/ssh_host_rsa_key
ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
ED25519_KEY=/etc/ssh/ssh_host_ed25519_key

do_rsa_keygen() {
if [ ! -s $RSA_KEY ]; then
echo -n "Generating SSH2 RSA host key: "
rm -f $RSA_KEY
if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
chmod 600 $RSA_KEY
chmod 644 $RSA_KEY.pub
echo "OK"
else
echo "FAIL"
exit 1
fi
fi
}

do_ecdsa_keygen() {
if [ ! -s $ECDSA_KEY ]; then
echo -n "Generating SSH2 ECDSA host key: "
rm -f $ECDSA_KEY
if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
chmod 600 $ECDSA_KEY
chmod 644 $ECDSA_KEY.pub
echo "OK"
else
echo "FAIL"
exit 1
fi
fi
}

do_ed25519_keygen() {
if [ ! -s $ED25519_KEY ]; then
echo -n "Generating SSH2 ED25519 host key: "
rm -f $ED25519_KEY
if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
chmod 600 $ED25519_KEY
chmod 644 $ED25519_KEY.pub
echo "OK"
else
echo "FAIL"
exit 1
fi
fi
}

do_rsa_keygen
do_ecdsa_keygen
do_ed25519_keygen
</syntaxhighlight>

chmod 755 /usr/sbin/rebuild-sshd-keys

Create a new systemd unit file, "/lib/systemd/system/rebuild-sshd-keys.service" and paste this in,

<syntaxhighlight lang="bash">
[Unit]
Description=OpenSSH Server Key Generation
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_rsa_key
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ecdsa_key
ConditionFileNotEmpty=|!/etc/ssh/ssh_host_ed25519_key
PartOf=ssh.service ssh.socket

[Service]
ExecStart=/usr/sbin/rebuild-sshd-keys
Type=oneshot
RemainAfterExit=yes
</syntaxhighlight>

Edit "/lib/systemd/system/ssh.service" and make these changes to use the new rebuild-sshd-keys.service unit file.

<syntaxhighlight lang="bash">
--- ssh.service.old 2018-12-09 23:51:39.687140401 +0000
+++ ssh.service 2018-12-09 23:53:14.364249439 +0000
@@ -1,7 +1,8 @@
[Unit]
Description=OpenBSD Secure Shell server
-After=network.target auditd.service
+After=network.target auditd.service rebuild-sshd-keys.service
ConditionPathExists=!/etc/ssh/sshd_not_to_be_run
+Wants=rebuild-sshd-keys.service

[Service]
EnvironmentFile=-/etc/default/ssh
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove SSH host keys so that new ones get generated on first boot.

Set a root password

<syntaxhighlight lang="bash">
echo 'bionic' > /etc/hostname
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/DomU/Devuan/Devuan ASCII

2018-11-18T21:31:55Z

Pyromania:

===Devuan ASCII===

Start this process on a existing Devuan system. You will need to have the Devuan patched version of debootstrap installed.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=devuan_ascii.img bs=1M count=1 seek=1024
mkfs.ext3 devuan_ascii.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop devuan_ascii.img /mnt/img

Start the debootstrap process.

debootstrap --variant=minbase ascii /mnt/img http://auto.mirror.devuan.org/merged/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Here is a basic sources.list

deb http://auto.mirror.devuan.org/merged ascii main
deb http://auto.mirror.devuan.org/merged ascii-updates main
deb http://auto.mirror.devuan.org/merged ascii-security main

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
chroot /mnt/img

Run updates and install a language pack.

apt-get update
apt-get upgrade

Install a frontend for debconf

apt-get install whiptail

Install locales and configure them.

apt-get install locales
dpkg-reconfigure locales

Configure the system timezone.

dpkg-reconfigure tzdata

Install networking systems

apt-get install netbase net-tools ifupdown inetutils-ping

Install the kernel image, SSH server, full version of vim and rsyslog

apt-get install linux-image-`dpkg --print-architecture`
apt-get install openssh-server
apt-get install vim
apt-get install rsyslog

To use the Xen console 'xm console (domU)' you need to setup a tty on /dev/hvc0. Edit /etc/inittab and add this line.

co:2345:respawn:/sbin/getty 38400 hvc0

The default udev rules for Devuan ignore Xen generated MAC addresses so you won't get a '/etc/udev/rules.d/70-persistent-net.rules' This causes your network interfaces not to come up.

Edit '/lib/udev/rules.d/75-persistent-net-generator.rules' and comment these lines. Here's the changes in patch/diff format.

<syntaxhighlight lang="diff">
--- 75-persistent-net-generator.rules.old 2018-10-20 12:40:48.812000000 -0500
+++ 75-persistent-net-generator.rules 2018-10-20 12:41:35.264000000 -0500
@@ -26,7 +26,7 @@
GOTO="persistent_net_generator_end"

# ignore Xen virtual interfaces
-SUBSYSTEMS=="xen", GOTO="persistent_net_generator_end"
+#SUBSYSTEMS=="xen", GOTO="persistent_net_generator_end"

# ignore UML virtual interfaces
DRIVERS=="uml-netdev", GOTO="persistent_net_generator_end"
@@ -78,7 +78,7 @@
ENV{MATCHADDR}=="00:15:5d:*", ENV{MATCHADDR}=""
ENV{MATCHADDR}=="52:54:00:*|54:52:00:*", ENV{MATCHADDR}=""
ENV{MATCHADDR}=="08:00:27:*", ENV{MATCHADDR}=""
-ENV{MATCHADDR}=="00:16:3e:*", ENV{MATCHADDR}=""
+#ENV{MATCHADDR}=="00:16:3e:*", ENV{MATCHADDR}=""

# ignore Windows Azure Hyper-V virtual interfaces
ENV{MATCHADDR}=="00:03:ff:*", ENV{MATCHADDR}=""
</syntaxhighlight>

Configure your '/etc/network/interfaces' for DHCP

<syntaxhighlight lang="bash">
# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto eth0
iface eth0 inet dhcp
</syntaxhighlight>

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"

<syntaxhighlight lang="bash">
default 0
timeout 2

title Devuan ASCII
root (hd0,0)
kernel /boot/vmlinuz-4.9.0-7-686-pae root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-4.9.0-7-686-pae

title Devuan ASCII (Single-User)
root (hd0,0)
kernel /boot/vmlinuz-4.9.0-7-686-pae root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-4.9.0-7-686-pae
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Devuan won't regenerate SSH host keys if you delete them from /etc/ssh. So we need to make some changes to /etc/init.d/ssh so it regenerates the host keys.

Here is a patch for /etc/init.d/ssh

<syntaxhighlight lang="bash">
--- old_ssh 2017-01-15 10:04:56.399284075 -0600
+++ ssh 2017-01-15 10:09:02.999284075 -0600
@@ -78,6 +78,74 @@
fi
}

+# Some variables to make things more readable
+KEYGEN=/usr/bin/ssh-keygen
+RSA1_KEY=/etc/ssh/ssh_host_key
+RSA_KEY=/etc/ssh/ssh_host_rsa_key
+DSA_KEY=/etc/ssh/ssh_host_dsa_key
+ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
+ED25519_KEY=/etc/ssh/ssh_host_ed25519_key
+
+do_rsa_keygen() {
+ if [ ! -s $RSA_KEY ]; then
+ echo -n "Generating SSH2 RSA host key: "
+ rm -f $RSA_KEY
+ if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $RSA_KEY
+ chmod 644 $RSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_dsa_keygen() {
+ if [ ! -s $DSA_KEY ]; then
+ echo -n "Generating SSH2 DSA host key: "
+ rm -f $DSA_KEY
+ if test ! -f $DSA_KEY && $KEYGEN -q -t dsa -f $DSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $DSA_KEY
+ chmod 644 $DSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ecdsa_keygen() {
+ if [ ! -s $ECDSA_KEY ]; then
+ echo -n "Generating SSH2 ECDSA host key: "
+ rm -f $ECDSA_KEY
+ if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ECDSA_KEY
+ chmod 644 $ECDSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ed25519_keygen() {
+ if [ ! -s $ED25519_KEY ]; then
+ echo -n "Generating SSH2 ED25519 host key: "
+ rm -f $ED25519_KEY
+ if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ED25519_KEY
+ chmod 644 $ED25519_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
export PATH="${PATH:+$PATH:}/usr/sbin:/sbin"

case "$1" in
@@ -86,6 +154,12 @@
check_privsep_dir
check_for_no_start
check_dev_null
+
+ do_rsa_keygen
+ do_dsa_keygen
+ do_ecdsa_keygen
+ do_ed25519_keygen
+
log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" || true
if start-stop-daemon --start --quiet --oknodo --pidfile /var/run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
log_end_msg 0 || true
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove /etc/udev/rules.d/70-persistent-net.rules so that network comes up clean when the image is booted for the first time.

Remove SSH host keys so that new ones get generated on first boot.

Set a root password

<syntaxhighlight lang="bash">
echo 'devuan' > /etc/hostname
rm /etc/udev/rules.d/70-persistent-net.rules
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/DomU/Ubuntu/Ubuntu 18.04 LTS

2018-11-18T21:14:49Z

Pyromania:

===Ubuntu 18.04 LTS===

Start this process on a existing Ubuntu system. Does not have to be a 18.04 system. You will need to have debootstrap installed and may need to update debootstrap so it has the correct script for 18.04.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=ubuntu_bionic.img bs=1M count=1 seek=1024
mkfs.ext3 ubuntu_bionic.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop ubuntu_bionic.img /mnt/img

Start the debootstrap process.

debootstrap bionic /mnt/img/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
chroot /mnt/img

Run updates and install a language pack.

apt-get update
apt-get install language-pack-en-base
apt-get upgrade

Install a frontend for debconf

apt-get install whiptail

Install Timezone data

apt-get install tzdata

Configure the system timezone.

dpkg-reconfigure tzdata

Install the kernel image, SSH server and the full version of vim

apt-get install linux-image-generic
apt-get install openssh-server
apt-get install vim

To use the Xen console 'xm console (domU)' you need to setup a tty on /dev/hvc0. Create the file '/etc/init/hvc0.conf' with this content.

<syntaxhighlight lang="bash">
# This service maintains a getty on hvc0 from the point the system is
# started until it is shut down again.

start on stopped rc RUNLEVEL=[2345] and (
not-container or
container CONTAINER=lxc or
container CONTAINER=lxc-libvirt)

stop on runlevel [!2345]

respawn
exec /sbin/getty -8 38400 hvc0
</syntaxhighlight>

The default udev rules for 13.10 ignore Xen generated MAC addresses so you won't get a '/etc/udev/rules.d/70-persistent-net.rules' This causes your network interfaces not to come up.

Edit '/lib/udev/rules.d/75-persistent-net-generator.rules' and comment these lines. Here's the changes in patch/diff format.

<syntaxhighlight lang="diff">
@@ -21,7 +21,7 @@ KERNEL!="eth*|ath*|wlan*[0-9]|msh*|ra*|s
GOTO="persistent_net_generator_end"

# ignore Xen virtual interfaces
-SUBSYSTEMS=="xen", GOTO="persistent_net_generator_end"
+#SUBSYSTEMS=="xen", GOTO="persistent_net_generator_end"

# ignore UML virtual interfaces
DRIVERS=="uml-netdev", GOTO="persistent_net_generator_end"
@@ -75,7 +75,7 @@ ENV{MATCHADDR}=="00:0c:29:*|00:50:56:*|0
ENV{MATCHADDR}=="00:15:5d:*", ENV{MATCHADDR}=""
ENV{MATCHADDR}=="52:54:00:*|54:52:00:*", ENV{MATCHADDR}=""
ENV{MATCHADDR}=="08:00:27:*", ENV{MATCHADDR}=""
-ENV{MATCHADDR}=="00:16:3e:*", ENV{MATCHADDR}=""
+#ENV{MATCHADDR}=="00:16:3e:*", ENV{MATCHADDR}=""

# ignore Windows Azure Hyper-V virtual interfaces
ENV{MATCHADDR}=="00:03:ff:*", ENV{MATCHADDR}=""
</syntaxhighlight>

Configure your '/etc/network/interfaces' for DHCP

<syntaxhighlight lang="bash">
# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto eth0
iface eth0 inet dhcp
</syntaxhighlight>

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"

<syntaxhighlight lang="bash">
default 0
timeout 2

title Ubuntu 14.04
root (hd0,0)
kernel /boot/vmlinuz-3.13.0-24-generic root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-3.13.0-24-generic

title Ubuntu 14.04 (Single-User)
root (hd0,0)
kernel /boot/vmlinuz-3.13.0-24-generic root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-3.13.0-24-generic
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Ubuntu won't regenerate SSH host keys if you delete them from /etc/ssh. So we need a script to check the host keys and regenerate them if needed.

Create /lib/init/ssh_gen_key and paste this in,

<syntaxhighlight lang="bash">
#!/bin/sh

# Some variables to make things more readable
KEYGEN=/usr/bin/ssh-keygen
RSA1_KEY=/etc/ssh/ssh_host_key
RSA_KEY=/etc/ssh/ssh_host_rsa_key
DSA_KEY=/etc/ssh/ssh_host_dsa_key
ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
ED25519_KEY=/etc/ssh/ssh_host_ed25519_key

do_rsa_keygen() {
if [ ! -s $RSA_KEY ]; then
echo -n "Generating SSH2 RSA host key: "
rm -f $RSA_KEY
if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
chmod 600 $RSA_KEY
chmod 644 $RSA_KEY.pub
echo "OK"
else
echo "FAIL"
exit 1
fi
fi
}

do_dsa_keygen() {
if [ ! -s $DSA_KEY ]; then
echo -n "Generating SSH2 DSA host key: "
rm -f $DSA_KEY
if test ! -f $DSA_KEY && $KEYGEN -q -t dsa -f $DSA_KEY -C '' -N '' >/dev/null; then
chmod 600 $DSA_KEY
chmod 644 $DSA_KEY.pub
echo "OK"
else
echo "FAIL"
exit 1
fi
fi
}

do_ecdsa_keygen() {
if [ ! -s $ECDSA_KEY ]; then
echo -n "Generating SSH2 ECDSA host key: "
rm -f $ECDSA_KEY
if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
chmod 600 $ECDSA_KEY
chmod 644 $ECDSA_KEY.pub
echo "OK"
else
echo "FAIL"
exit 1
fi
fi
}

do_ed25519_keygen() {
if [ ! -s $ED25519_KEY ]; then
echo -n "Generating SSH2 ED25519 host key: "
rm -f $ED25519_KEY
if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
chmod 600 $ED25519_KEY
chmod 644 $ED25519_KEY.pub
echo "OK"
else
echo "FAIL"
exit 1
fi
fi
}

do_rsa_keygen
do_dsa_keygen
do_ecdsa_keygen
do_ed25519_keygen
</syntaxhighlight>

chmod 755 /lib/init/ssh_gen_keys

Edit /etc/init/ssh.conf

<syntaxhighlight lang="bash">
@@ -20,6 +20,7 @@ pre-start script
test -c /dev/null || { stop; exit 0; }

mkdir -p -m0755 /var/run/sshd
+ /lib/init/ssh_gen_keys
end script

# if you used to set SSHD_OPTS in /etc/default/ssh, you can change the
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove /etc/udev/rules.d/70-persistent-net.rules so that network comes up clean when the image is booted for the first time.

Remove SSH host keys so that new ones get generated on first boot.

Set a root password

<syntaxhighlight lang="bash">
echo 'trusy' > /etc/hostname
rm /etc/udev/rules.d/70-persistent-net.rules
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/DomU/Ubuntu/Ubuntu 18.04 LTS

2018-11-18T20:45:06Z

Pyromania: Created page with "===Ubuntu 18.04 LTS=== Start this process on a existing Ubuntu system. Does not have to be a 18.04 system. You will need to have debootstrap installed and may need to update..."

===Ubuntu 18.04 LTS===

Start this process on a existing Ubuntu system. Does not have to be a 18.04 system. You will need to have debootstrap installed and may need to update debootstrap so it has the correct script for 18.04.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=ubuntu_bionic.img bs=1M count=1 seek=1024
mkfs.ext3 ubuntu_bionic.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop ubuntu_bionic.img /mnt/img

Start the debootstrap process.

debootstrap bionic /mnt/img/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
chroot /mnt/img

Run updates and install a language pack.

apt-get update
apt-get install language-pack-en-base
apt-get upgrade

Configure the system timezone.

dpkg-reconfigure tzdata

Install the kernel image, SSH server and the full version of vim

apt-get install linux-image-generic
apt-get install openssh-server
apt-get install vim

To use the Xen console 'xm console (domU)' you need to setup a tty on /dev/hvc0. Create the file '/etc/init/hvc0.conf' with this content.

<syntaxhighlight lang="bash">
# This service maintains a getty on hvc0 from the point the system is
# started until it is shut down again.

start on stopped rc RUNLEVEL=[2345] and (
not-container or
container CONTAINER=lxc or
container CONTAINER=lxc-libvirt)

stop on runlevel [!2345]

respawn
exec /sbin/getty -8 38400 hvc0
</syntaxhighlight>

The default udev rules for 13.10 ignore Xen generated MAC addresses so you won't get a '/etc/udev/rules.d/70-persistent-net.rules' This causes your network interfaces not to come up.

Edit '/lib/udev/rules.d/75-persistent-net-generator.rules' and comment these lines. Here's the changes in patch/diff format.

<syntaxhighlight lang="diff">
@@ -21,7 +21,7 @@ KERNEL!="eth*|ath*|wlan*[0-9]|msh*|ra*|s
GOTO="persistent_net_generator_end"

# ignore Xen virtual interfaces
-SUBSYSTEMS=="xen", GOTO="persistent_net_generator_end"
+#SUBSYSTEMS=="xen", GOTO="persistent_net_generator_end"

# ignore UML virtual interfaces
DRIVERS=="uml-netdev", GOTO="persistent_net_generator_end"
@@ -75,7 +75,7 @@ ENV{MATCHADDR}=="00:0c:29:*|00:50:56:*|0
ENV{MATCHADDR}=="00:15:5d:*", ENV{MATCHADDR}=""
ENV{MATCHADDR}=="52:54:00:*|54:52:00:*", ENV{MATCHADDR}=""
ENV{MATCHADDR}=="08:00:27:*", ENV{MATCHADDR}=""
-ENV{MATCHADDR}=="00:16:3e:*", ENV{MATCHADDR}=""
+#ENV{MATCHADDR}=="00:16:3e:*", ENV{MATCHADDR}=""

# ignore Windows Azure Hyper-V virtual interfaces
ENV{MATCHADDR}=="00:03:ff:*", ENV{MATCHADDR}=""
</syntaxhighlight>

Configure your '/etc/network/interfaces' for DHCP

<syntaxhighlight lang="bash">
# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto eth0
iface eth0 inet dhcp
</syntaxhighlight>

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"

<syntaxhighlight lang="bash">
default 0
timeout 2

title Ubuntu 14.04
root (hd0,0)
kernel /boot/vmlinuz-3.13.0-24-generic root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-3.13.0-24-generic

title Ubuntu 14.04 (Single-User)
root (hd0,0)
kernel /boot/vmlinuz-3.13.0-24-generic root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-3.13.0-24-generic
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Ubuntu won't regenerate SSH host keys if you delete them from /etc/ssh. So we need a script to check the host keys and regenerate them if needed.

Create /lib/init/ssh_gen_key and paste this in,

<syntaxhighlight lang="bash">
#!/bin/sh

# Some variables to make things more readable
KEYGEN=/usr/bin/ssh-keygen
RSA1_KEY=/etc/ssh/ssh_host_key
RSA_KEY=/etc/ssh/ssh_host_rsa_key
DSA_KEY=/etc/ssh/ssh_host_dsa_key
ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
ED25519_KEY=/etc/ssh/ssh_host_ed25519_key

do_rsa_keygen() {
if [ ! -s $RSA_KEY ]; then
echo -n "Generating SSH2 RSA host key: "
rm -f $RSA_KEY
if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
chmod 600 $RSA_KEY
chmod 644 $RSA_KEY.pub
echo "OK"
else
echo "FAIL"
exit 1
fi
fi
}

do_dsa_keygen() {
if [ ! -s $DSA_KEY ]; then
echo -n "Generating SSH2 DSA host key: "
rm -f $DSA_KEY
if test ! -f $DSA_KEY && $KEYGEN -q -t dsa -f $DSA_KEY -C '' -N '' >/dev/null; then
chmod 600 $DSA_KEY
chmod 644 $DSA_KEY.pub
echo "OK"
else
echo "FAIL"
exit 1
fi
fi
}

do_ecdsa_keygen() {
if [ ! -s $ECDSA_KEY ]; then
echo -n "Generating SSH2 ECDSA host key: "
rm -f $ECDSA_KEY
if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
chmod 600 $ECDSA_KEY
chmod 644 $ECDSA_KEY.pub
echo "OK"
else
echo "FAIL"
exit 1
fi
fi
}

do_ed25519_keygen() {
if [ ! -s $ED25519_KEY ]; then
echo -n "Generating SSH2 ED25519 host key: "
rm -f $ED25519_KEY
if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
chmod 600 $ED25519_KEY
chmod 644 $ED25519_KEY.pub
echo "OK"
else
echo "FAIL"
exit 1
fi
fi
}

do_rsa_keygen
do_dsa_keygen
do_ecdsa_keygen
do_ed25519_keygen
</syntaxhighlight>

chmod 755 /lib/init/ssh_gen_keys

Edit /etc/init/ssh.conf

<syntaxhighlight lang="bash">
@@ -20,6 +20,7 @@ pre-start script
test -c /dev/null || { stop; exit 0; }

mkdir -p -m0755 /var/run/sshd
+ /lib/init/ssh_gen_keys
end script

# if you used to set SSHD_OPTS in /etc/default/ssh, you can change the
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove /etc/udev/rules.d/70-persistent-net.rules so that network comes up clean when the image is booted for the first time.

Remove SSH host keys so that new ones get generated on first boot.

Set a root password

<syntaxhighlight lang="bash">
echo 'trusy' > /etc/hostname
rm /etc/udev/rules.d/70-persistent-net.rules
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/Building Xen DomU images

2018-11-18T20:32:20Z

Pyromania: /* Ubuntu */

==Debian==

==Devuan==

===[[Linux/Xen/DomU/Devuan/Devuan Jessie|Devuan Jessie]]===
===[[Linux/Xen/DomU/Devuan/Devuan ASCII|Devuan ASCII]]===

==Ubuntu==

===[[Linux/Xen/DomU/Ubuntu/Ubuntu 13.10|Ubuntu 13.10]]===

===[[Linux/Xen/DomU/Ubuntu/Ubuntu 14.04 LTS|Ubuntu 14.04 LTS]]===

===[[Linux/Xen/DomU/Ubuntu/Ubuntu 18.04 LTS|Ubuntu 18.04 LTS]]===

Linux/Xen/DomU/Devuan/Devuan ASCII

2018-10-20T17:46:32Z

Pyromania: /* Devuan ASCII */

===Devuan ASCII===

Start this process on a existing Devuan system. You will need to have the Devuan patched version of debootstrap installed.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=devuan_ascii.img bs=1M count=1 seek=1024
mkfs.ext3 devuan_ascii.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop devuan_ascii.img /mnt/img

Start the debootstrap process.

debootstrap --variant=minbase ascii /mnt/img http://auto.mirror.devuan.org/merged/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Here is a basic sources.list

deb http://auto.mirror.devuan.org/merged ascii main
deb http://auto.mirror.devuan.org/merged ascii-updates main
deb http://auto.mirror.devuan.org/merged ascii-security main

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
chroot /mnt/img

Run updates and install a language pack.

apt-get update
apt-get upgrade

Install a frontend for depconf

apt-get install whiptail

Install locales and configure them.

apt-get install locales
dpkg-reconfigure locales

Configure the system timezone.

dpkg-reconfigure tzdata

Install networking systems

apt-get install netbase net-tools ifupdown inetutils-ping

Install the kernel image, SSH server, full version of vim and rsyslog

apt-get install linux-image-`dpkg --print-architecture`
apt-get install openssh-server
apt-get install vim
apt-get install rsyslog

To use the Xen console 'xm console (domU)' you need to setup a tty on /dev/hvc0. Edit /etc/inittab and add this line.

co:2345:respawn:/sbin/getty 38400 hvc0

The default udev rules for Devuan ignore Xen generated MAC addresses so you won't get a '/etc/udev/rules.d/70-persistent-net.rules' This causes your network interfaces not to come up.

Edit '/lib/udev/rules.d/75-persistent-net-generator.rules' and comment these lines. Here's the changes in patch/diff format.

<syntaxhighlight lang="diff">
--- 75-persistent-net-generator.rules.old 2018-10-20 12:40:48.812000000 -0500
+++ 75-persistent-net-generator.rules 2018-10-20 12:41:35.264000000 -0500
@@ -26,7 +26,7 @@
GOTO="persistent_net_generator_end"

# ignore Xen virtual interfaces
-SUBSYSTEMS=="xen", GOTO="persistent_net_generator_end"
+#SUBSYSTEMS=="xen", GOTO="persistent_net_generator_end"

# ignore UML virtual interfaces
DRIVERS=="uml-netdev", GOTO="persistent_net_generator_end"
@@ -78,7 +78,7 @@
ENV{MATCHADDR}=="00:15:5d:*", ENV{MATCHADDR}=""
ENV{MATCHADDR}=="52:54:00:*|54:52:00:*", ENV{MATCHADDR}=""
ENV{MATCHADDR}=="08:00:27:*", ENV{MATCHADDR}=""
-ENV{MATCHADDR}=="00:16:3e:*", ENV{MATCHADDR}=""
+#ENV{MATCHADDR}=="00:16:3e:*", ENV{MATCHADDR}=""

# ignore Windows Azure Hyper-V virtual interfaces
ENV{MATCHADDR}=="00:03:ff:*", ENV{MATCHADDR}=""
</syntaxhighlight>

Configure your '/etc/network/interfaces' for DHCP

<syntaxhighlight lang="bash">
# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto eth0
iface eth0 inet dhcp
</syntaxhighlight>

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"

<syntaxhighlight lang="bash">
default 0
timeout 2

title Devuan ASCII
root (hd0,0)
kernel /boot/vmlinuz-4.9.0-7-686-pae root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-4.9.0-7-686-pae

title Devuan ASCII (Single-User)
root (hd0,0)
kernel /boot/vmlinuz-4.9.0-7-686-pae root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-4.9.0-7-686-pae
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Devuan won't regenerate SSH host keys if you delete them from /etc/ssh. So we need to make some changes to /etc/init.d/ssh so it regenerates the host keys.

Here is a patch for /etc/init.d/ssh

<syntaxhighlight lang="bash">
--- old_ssh 2017-01-15 10:04:56.399284075 -0600
+++ ssh 2017-01-15 10:09:02.999284075 -0600
@@ -78,6 +78,74 @@
fi
}

+# Some variables to make things more readable
+KEYGEN=/usr/bin/ssh-keygen
+RSA1_KEY=/etc/ssh/ssh_host_key
+RSA_KEY=/etc/ssh/ssh_host_rsa_key
+DSA_KEY=/etc/ssh/ssh_host_dsa_key
+ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
+ED25519_KEY=/etc/ssh/ssh_host_ed25519_key
+
+do_rsa_keygen() {
+ if [ ! -s $RSA_KEY ]; then
+ echo -n "Generating SSH2 RSA host key: "
+ rm -f $RSA_KEY
+ if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $RSA_KEY
+ chmod 644 $RSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_dsa_keygen() {
+ if [ ! -s $DSA_KEY ]; then
+ echo -n "Generating SSH2 DSA host key: "
+ rm -f $DSA_KEY
+ if test ! -f $DSA_KEY && $KEYGEN -q -t dsa -f $DSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $DSA_KEY
+ chmod 644 $DSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ecdsa_keygen() {
+ if [ ! -s $ECDSA_KEY ]; then
+ echo -n "Generating SSH2 ECDSA host key: "
+ rm -f $ECDSA_KEY
+ if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ECDSA_KEY
+ chmod 644 $ECDSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ed25519_keygen() {
+ if [ ! -s $ED25519_KEY ]; then
+ echo -n "Generating SSH2 ED25519 host key: "
+ rm -f $ED25519_KEY
+ if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ED25519_KEY
+ chmod 644 $ED25519_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
export PATH="${PATH:+$PATH:}/usr/sbin:/sbin"

case "$1" in
@@ -86,6 +154,12 @@
check_privsep_dir
check_for_no_start
check_dev_null
+
+ do_rsa_keygen
+ do_dsa_keygen
+ do_ecdsa_keygen
+ do_ed25519_keygen
+
log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" || true
if start-stop-daemon --start --quiet --oknodo --pidfile /var/run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
log_end_msg 0 || true
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove /etc/udev/rules.d/70-persistent-net.rules so that network comes up clean when the image is booted for the first time.

Remove SSH host keys so that new ones get generated on first boot.

Set a root password

<syntaxhighlight lang="bash">
echo 'devuan' > /etc/hostname
rm /etc/udev/rules.d/70-persistent-net.rules
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/DomU/Devuan/Devuan ASCII

2018-10-19T23:46:02Z

Pyromania: /* GRUB */

===Devuan ASCII===

Start this process on a existing Devuan system. You will need to have the Devuan patched version of debootstrap installed.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=devuan_ascii.img bs=1M count=1 seek=1024
mkfs.ext3 devuan_ascii.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop devuan_ascii.img /mnt/img

Start the debootstrap process.

debootstrap --variant=minbase ascii /mnt/img http://auto.mirror.devuan.org/merged/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Here is a basic sources.list

deb http://auto.mirror.devuan.org/merged ascii main
deb http://auto.mirror.devuan.org/merged ascii-updates main
deb http://auto.mirror.devuan.org/merged ascii-security main

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
chroot /mnt/img

Run updates and install a language pack.

apt-get update
apt-get upgrade

Install a frontend for depconf

apt-get install whiptail

Install locales and configure them.

apt-get install locales
dpkg-reconfigure locales

Configure the system timezone.

dpkg-reconfigure tzdata

Install networking systems

apt-get install netbase net-tools ifupdown inetutils-ping

Install the kernel image, SSH server, full version of vim and rsyslog

apt-get install linux-image-`dpkg --print-architecture`
apt-get install openssh-server
apt-get install vim
apt-get install rsyslog

To use the Xen console 'xm console (domU)' you need to setup a tty on /dev/hvc0. Edit /etc/inittab and add this line.

co:2345:respawn:/sbin/getty 38400 hvc0

The default udev rules for Devuan ignore Xen generated MAC addresses so you won't get a '/etc/udev/rules.d/70-persistent-net.rules' This causes your network interfaces not to come up.

Edit '/lib/udev/rules.d/75-persistent-net-generator.rules' and comment these lines. Here's the changes in patch/diff format.

<syntaxhighlight lang="diff">
@@ -21,7 +21,7 @@ KERNEL!="eth*|ath*|wlan*[0-9]|msh*|ra*|s
GOTO="persistent_net_generator_end"

# ignore Xen virtual interfaces
-SUBSYSTEMS=="xen", GOTO="persistent_net_generator_end"
+#SUBSYSTEMS=="xen", GOTO="persistent_net_generator_end"

# ignore UML virtual interfaces
DRIVERS=="uml-netdev", GOTO="persistent_net_generator_end"
@@ -75,7 +75,7 @@ ENV{MATCHADDR}=="00:0c:29:*|00:50:56:*|0
ENV{MATCHADDR}=="00:15:5d:*", ENV{MATCHADDR}=""
ENV{MATCHADDR}=="52:54:00:*|54:52:00:*", ENV{MATCHADDR}=""
ENV{MATCHADDR}=="08:00:27:*", ENV{MATCHADDR}=""
-ENV{MATCHADDR}=="00:16:3e:*", ENV{MATCHADDR}=""
+#ENV{MATCHADDR}=="00:16:3e:*", ENV{MATCHADDR}=""

# ignore Windows Azure Hyper-V virtual interfaces
ENV{MATCHADDR}=="00:03:ff:*", ENV{MATCHADDR}=""
</syntaxhighlight>

Configure your '/etc/network/interfaces' for DHCP

<syntaxhighlight lang="bash">
# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto eth0
iface eth0 inet dhcp
</syntaxhighlight>

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"

<syntaxhighlight lang="bash">
default 0
timeout 2

title Devuan ASCII
root (hd0,0)
kernel /boot/vmlinuz-4.9.0-7-686-pae root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-4.9.0-7-686-pae

title Devuan ASCII (Single-User)
root (hd0,0)
kernel /boot/vmlinuz-4.9.0-7-686-pae root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-4.9.0-7-686-pae
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Devuan won't regenerate SSH host keys if you delete them from /etc/ssh. So we need to make some changes to /etc/init.d/ssh so it regenerates the host keys.

Here is a patch for /etc/init.d/ssh

<syntaxhighlight lang="bash">
--- old_ssh 2017-01-15 10:04:56.399284075 -0600
+++ ssh 2017-01-15 10:09:02.999284075 -0600
@@ -78,6 +78,74 @@
fi
}

+# Some variables to make things more readable
+KEYGEN=/usr/bin/ssh-keygen
+RSA1_KEY=/etc/ssh/ssh_host_key
+RSA_KEY=/etc/ssh/ssh_host_rsa_key
+DSA_KEY=/etc/ssh/ssh_host_dsa_key
+ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
+ED25519_KEY=/etc/ssh/ssh_host_ed25519_key
+
+do_rsa_keygen() {
+ if [ ! -s $RSA_KEY ]; then
+ echo -n "Generating SSH2 RSA host key: "
+ rm -f $RSA_KEY
+ if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $RSA_KEY
+ chmod 644 $RSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_dsa_keygen() {
+ if [ ! -s $DSA_KEY ]; then
+ echo -n "Generating SSH2 DSA host key: "
+ rm -f $DSA_KEY
+ if test ! -f $DSA_KEY && $KEYGEN -q -t dsa -f $DSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $DSA_KEY
+ chmod 644 $DSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ecdsa_keygen() {
+ if [ ! -s $ECDSA_KEY ]; then
+ echo -n "Generating SSH2 ECDSA host key: "
+ rm -f $ECDSA_KEY
+ if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ECDSA_KEY
+ chmod 644 $ECDSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ed25519_keygen() {
+ if [ ! -s $ED25519_KEY ]; then
+ echo -n "Generating SSH2 ED25519 host key: "
+ rm -f $ED25519_KEY
+ if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ED25519_KEY
+ chmod 644 $ED25519_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
export PATH="${PATH:+$PATH:}/usr/sbin:/sbin"

case "$1" in
@@ -86,6 +154,12 @@
check_privsep_dir
check_for_no_start
check_dev_null
+
+ do_rsa_keygen
+ do_dsa_keygen
+ do_ecdsa_keygen
+ do_ed25519_keygen
+
log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" || true
if start-stop-daemon --start --quiet --oknodo --pidfile /var/run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
log_end_msg 0 || true
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove /etc/udev/rules.d/70-persistent-net.rules so that network comes up clean when the image is booted for the first time.

Remove SSH host keys so that new ones get generated on first boot.

Set a root password

<syntaxhighlight lang="bash">
echo 'devuan' > /etc/hostname
rm /etc/udev/rules.d/70-persistent-net.rules
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/DomU/Devuan/Devuan ASCII

2018-10-19T22:43:21Z

Pyromania: Created page with "===Devuan ASCII=== Start this process on a existing Devuan system. You will need to have the Devuan patched version of debootstrap installed. Create a empty image file and f..."

===Devuan ASCII===

Start this process on a existing Devuan system. You will need to have the Devuan patched version of debootstrap installed.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=devuan_ascii.img bs=1M count=1 seek=1024
mkfs.ext3 devuan_ascii.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop devuan_ascii.img /mnt/img

Start the debootstrap process.

debootstrap --variant=minbase ascii /mnt/img http://auto.mirror.devuan.org/merged/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Here is a basic sources.list

deb http://auto.mirror.devuan.org/merged ascii main
deb http://auto.mirror.devuan.org/merged ascii-updates main
deb http://auto.mirror.devuan.org/merged ascii-security main

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
chroot /mnt/img

Run updates and install a language pack.

apt-get update
apt-get upgrade

Install a frontend for depconf

apt-get install whiptail

Install locales and configure them.

apt-get install locales
dpkg-reconfigure locales

Configure the system timezone.

dpkg-reconfigure tzdata

Install networking systems

apt-get install netbase net-tools ifupdown inetutils-ping

Install the kernel image, SSH server, full version of vim and rsyslog

apt-get install linux-image-`dpkg --print-architecture`
apt-get install openssh-server
apt-get install vim
apt-get install rsyslog

To use the Xen console 'xm console (domU)' you need to setup a tty on /dev/hvc0. Edit /etc/inittab and add this line.

co:2345:respawn:/sbin/getty 38400 hvc0

The default udev rules for Devuan ignore Xen generated MAC addresses so you won't get a '/etc/udev/rules.d/70-persistent-net.rules' This causes your network interfaces not to come up.

Edit '/lib/udev/rules.d/75-persistent-net-generator.rules' and comment these lines. Here's the changes in patch/diff format.

<syntaxhighlight lang="diff">
@@ -21,7 +21,7 @@ KERNEL!="eth*|ath*|wlan*[0-9]|msh*|ra*|s
GOTO="persistent_net_generator_end"

# ignore Xen virtual interfaces
-SUBSYSTEMS=="xen", GOTO="persistent_net_generator_end"
+#SUBSYSTEMS=="xen", GOTO="persistent_net_generator_end"

# ignore UML virtual interfaces
DRIVERS=="uml-netdev", GOTO="persistent_net_generator_end"
@@ -75,7 +75,7 @@ ENV{MATCHADDR}=="00:0c:29:*|00:50:56:*|0
ENV{MATCHADDR}=="00:15:5d:*", ENV{MATCHADDR}=""
ENV{MATCHADDR}=="52:54:00:*|54:52:00:*", ENV{MATCHADDR}=""
ENV{MATCHADDR}=="08:00:27:*", ENV{MATCHADDR}=""
-ENV{MATCHADDR}=="00:16:3e:*", ENV{MATCHADDR}=""
+#ENV{MATCHADDR}=="00:16:3e:*", ENV{MATCHADDR}=""

# ignore Windows Azure Hyper-V virtual interfaces
ENV{MATCHADDR}=="00:03:ff:*", ENV{MATCHADDR}=""
</syntaxhighlight>

Configure your '/etc/network/interfaces' for DHCP

<syntaxhighlight lang="bash">
# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto eth0
iface eth0 inet dhcp
</syntaxhighlight>

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"

<syntaxhighlight lang="bash">
default 0
timeout 2

title Devuan ASCII
root (hd0,0)
kernel /boot/vmlinuz-3.16.0-4-amd64 root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-3.16.0-4-amd64

title Devuan ASCII (Single-User)
root (hd0,0)
kernel /boot/vmlinuz-3.16.0-4-amd64 root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-3.16.0-4-amd64
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Devuan won't regenerate SSH host keys if you delete them from /etc/ssh. So we need to make some changes to /etc/init.d/ssh so it regenerates the host keys.

Here is a patch for /etc/init.d/ssh

<syntaxhighlight lang="bash">
--- old_ssh 2017-01-15 10:04:56.399284075 -0600
+++ ssh 2017-01-15 10:09:02.999284075 -0600
@@ -78,6 +78,74 @@
fi
}

+# Some variables to make things more readable
+KEYGEN=/usr/bin/ssh-keygen
+RSA1_KEY=/etc/ssh/ssh_host_key
+RSA_KEY=/etc/ssh/ssh_host_rsa_key
+DSA_KEY=/etc/ssh/ssh_host_dsa_key
+ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
+ED25519_KEY=/etc/ssh/ssh_host_ed25519_key
+
+do_rsa_keygen() {
+ if [ ! -s $RSA_KEY ]; then
+ echo -n "Generating SSH2 RSA host key: "
+ rm -f $RSA_KEY
+ if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $RSA_KEY
+ chmod 644 $RSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_dsa_keygen() {
+ if [ ! -s $DSA_KEY ]; then
+ echo -n "Generating SSH2 DSA host key: "
+ rm -f $DSA_KEY
+ if test ! -f $DSA_KEY && $KEYGEN -q -t dsa -f $DSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $DSA_KEY
+ chmod 644 $DSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ecdsa_keygen() {
+ if [ ! -s $ECDSA_KEY ]; then
+ echo -n "Generating SSH2 ECDSA host key: "
+ rm -f $ECDSA_KEY
+ if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ECDSA_KEY
+ chmod 644 $ECDSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ed25519_keygen() {
+ if [ ! -s $ED25519_KEY ]; then
+ echo -n "Generating SSH2 ED25519 host key: "
+ rm -f $ED25519_KEY
+ if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ED25519_KEY
+ chmod 644 $ED25519_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
export PATH="${PATH:+$PATH:}/usr/sbin:/sbin"

case "$1" in
@@ -86,6 +154,12 @@
check_privsep_dir
check_for_no_start
check_dev_null
+
+ do_rsa_keygen
+ do_dsa_keygen
+ do_ecdsa_keygen
+ do_ed25519_keygen
+
log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" || true
if start-stop-daemon --start --quiet --oknodo --pidfile /var/run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
log_end_msg 0 || true
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove /etc/udev/rules.d/70-persistent-net.rules so that network comes up clean when the image is booted for the first time.

Remove SSH host keys so that new ones get generated on first boot.

Set a root password

<syntaxhighlight lang="bash">
echo 'devuan' > /etc/hostname
rm /etc/udev/rules.d/70-persistent-net.rules
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/Building Xen DomU images

2018-10-19T22:37:38Z

Pyromania: /* Devuan */

Linux/Xen/DomU/Devuan/Devuan Jessie

2017-01-15T22:05:04Z

Pyromania: /* Devuan Jessie */

===Devuan Jessie===

Start this process on a existing Devuan system. You will need to have the Devuan patched version of debootstrap installed.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=devuan_jessie.img bs=1M count=1 seek=1024
mkfs.ext3 devuan_jessie.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop devuan_jessie.img /mnt/img

Start the debootstrap process.

debootstrap --variant=minbase jessie /mnt/img http://auto.mirror.devuan.org/merged/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Here is a basic sources.list

deb http://auto.mirror.devuan.org/merged jessie main
deb http://auto.mirror.devuan.org/merged jessie-updates main
deb http://auto.mirror.devuan.org/merged jessie-security main

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
chroot /mnt/img

Run updates and install a language pack.

apt-get update
apt-get upgrade

Install a frontend for depconf

apt-get install whiptail

Install locales and configure them.

apt-get install locales
dpkg-reconfigure locales

Configure the system timezone.

dpkg-reconfigure tzdata

Install networking systems

apt-get install netbase net-tools ifupdown inetutils-ping

Install the kernel image, SSH server, full version of vim and rsyslog

apt-get install linux-image-`dpkg --print-architecture`
apt-get install openssh-server
apt-get install vim
apt-get install rsyslog

To use the Xen console 'xm console (domU)' you need to setup a tty on /dev/hvc0. Edit /etc/inittab and add this line.

co:2345:respawn:/sbin/getty 38400 hvc0

The default udev rules for Devuan ignore Xen generated MAC addresses so you won't get a '/etc/udev/rules.d/70-persistent-net.rules' This causes your network interfaces not to come up.

Edit '/lib/udev/rules.d/75-persistent-net-generator.rules' and comment these lines. Here's the changes in patch/diff format.

<syntaxhighlight lang="diff">
@@ -21,7 +21,7 @@ KERNEL!="eth*|ath*|wlan*[0-9]|msh*|ra*|s
GOTO="persistent_net_generator_end"

# ignore Xen virtual interfaces
-SUBSYSTEMS=="xen", GOTO="persistent_net_generator_end"
+#SUBSYSTEMS=="xen", GOTO="persistent_net_generator_end"

# ignore UML virtual interfaces
DRIVERS=="uml-netdev", GOTO="persistent_net_generator_end"
@@ -75,7 +75,7 @@ ENV{MATCHADDR}=="00:0c:29:*|00:50:56:*|0
ENV{MATCHADDR}=="00:15:5d:*", ENV{MATCHADDR}=""
ENV{MATCHADDR}=="52:54:00:*|54:52:00:*", ENV{MATCHADDR}=""
ENV{MATCHADDR}=="08:00:27:*", ENV{MATCHADDR}=""
-ENV{MATCHADDR}=="00:16:3e:*", ENV{MATCHADDR}=""
+#ENV{MATCHADDR}=="00:16:3e:*", ENV{MATCHADDR}=""

# ignore Windows Azure Hyper-V virtual interfaces
ENV{MATCHADDR}=="00:03:ff:*", ENV{MATCHADDR}=""
</syntaxhighlight>

Configure your '/etc/network/interfaces' for DHCP

<syntaxhighlight lang="bash">
# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto eth0
iface eth0 inet dhcp
</syntaxhighlight>

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"

<syntaxhighlight lang="bash">
default 0
timeout 2

title Devuan Jessie
root (hd0,0)
kernel /boot/vmlinuz-3.16.0-4-amd64 root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-3.16.0-4-amd64

title Devuan Jessie (Single-User)
root (hd0,0)
kernel /boot/vmlinuz-3.16.0-4-amd64 root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-3.16.0-4-amd64
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Devuan won't regenerate SSH host keys if you delete them from /etc/ssh. So we need to make some changes to /etc/init.d/ssh so it regenerates the host keys.

Here is a patch for /etc/init.d/ssh

<syntaxhighlight lang="bash">
--- old_ssh 2017-01-15 10:04:56.399284075 -0600
+++ ssh 2017-01-15 10:09:02.999284075 -0600
@@ -78,6 +78,74 @@
fi
}

+# Some variables to make things more readable
+KEYGEN=/usr/bin/ssh-keygen
+RSA1_KEY=/etc/ssh/ssh_host_key
+RSA_KEY=/etc/ssh/ssh_host_rsa_key
+DSA_KEY=/etc/ssh/ssh_host_dsa_key
+ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
+ED25519_KEY=/etc/ssh/ssh_host_ed25519_key
+
+do_rsa_keygen() {
+ if [ ! -s $RSA_KEY ]; then
+ echo -n "Generating SSH2 RSA host key: "
+ rm -f $RSA_KEY
+ if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $RSA_KEY
+ chmod 644 $RSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_dsa_keygen() {
+ if [ ! -s $DSA_KEY ]; then
+ echo -n "Generating SSH2 DSA host key: "
+ rm -f $DSA_KEY
+ if test ! -f $DSA_KEY && $KEYGEN -q -t dsa -f $DSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $DSA_KEY
+ chmod 644 $DSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ecdsa_keygen() {
+ if [ ! -s $ECDSA_KEY ]; then
+ echo -n "Generating SSH2 ECDSA host key: "
+ rm -f $ECDSA_KEY
+ if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ECDSA_KEY
+ chmod 644 $ECDSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ed25519_keygen() {
+ if [ ! -s $ED25519_KEY ]; then
+ echo -n "Generating SSH2 ED25519 host key: "
+ rm -f $ED25519_KEY
+ if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ED25519_KEY
+ chmod 644 $ED25519_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
export PATH="${PATH:+$PATH:}/usr/sbin:/sbin"

case "$1" in
@@ -86,6 +154,12 @@
check_privsep_dir
check_for_no_start
check_dev_null
+
+ do_rsa_keygen
+ do_dsa_keygen
+ do_ecdsa_keygen
+ do_ed25519_keygen
+
log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" || true
if start-stop-daemon --start --quiet --oknodo --pidfile /var/run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
log_end_msg 0 || true
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove /etc/udev/rules.d/70-persistent-net.rules so that network comes up clean when the image is booted for the first time.

Remove SSH host keys so that new ones get generated on first boot.

Set a root password

<syntaxhighlight lang="bash">
echo 'devuan' > /etc/hostname
rm /etc/udev/rules.d/70-persistent-net.rules
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/DomU/Devuan/Devuan Jessie

2017-01-15T21:59:13Z

Pyromania: /* Devuan Jessie */

===Devuan Jessie===

Start this process on a existing Devuan system. You will need to have the Devuan patched version of debootstrap installed.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=devuan_jessie.img bs=1M count=1 seek=1024
mkfs.ext3 devuan_jessie.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop devuan_jessie.img /mnt/img

Start the debootstrap process.

debootstrap --variant=minbase jessie /mnt/img http://auto.mirror.devuan.org/merged/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Here is a basic sources.list

deb http://auto.mirror.devuan.org/merged jessie main
deb http://auto.mirror.devuan.org/merged jessie-updates main
deb http://auto.mirror.devuan.org/merged jessie-security main

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
chroot /mnt/img

Run updates and install a language pack.

apt-get update
apt-get upgrade

Install a frontend for depconf

apt-get install whiptail

Install locales and configure them.

apt-get install locales
dpkg-reconfigure locales

Configure the system timezone.

dpkg-reconfigure tzdata

Install the kernel image, SSH server and the full version of vim

apt-get install linux-image-`dpkg --print-architecture`
apt-get install openssh-server
apt-get install vim

To use the Xen console 'xm console (domU)' you need to setup a tty on /dev/hvc0. Edit /etc/inittab and add this line.

co:2345:respawn:/sbin/getty 38400 hvc0

The default udev rules for Devuan ignore Xen generated MAC addresses so you won't get a '/etc/udev/rules.d/70-persistent-net.rules' This causes your network interfaces not to come up.

Edit '/lib/udev/rules.d/75-persistent-net-generator.rules' and comment these lines. Here's the changes in patch/diff format.

<syntaxhighlight lang="diff">
@@ -21,7 +21,7 @@ KERNEL!="eth*|ath*|wlan*[0-9]|msh*|ra*|s
GOTO="persistent_net_generator_end"

# ignore Xen virtual interfaces
-SUBSYSTEMS=="xen", GOTO="persistent_net_generator_end"
+#SUBSYSTEMS=="xen", GOTO="persistent_net_generator_end"

# ignore UML virtual interfaces
DRIVERS=="uml-netdev", GOTO="persistent_net_generator_end"
@@ -75,7 +75,7 @@ ENV{MATCHADDR}=="00:0c:29:*|00:50:56:*|0
ENV{MATCHADDR}=="00:15:5d:*", ENV{MATCHADDR}=""
ENV{MATCHADDR}=="52:54:00:*|54:52:00:*", ENV{MATCHADDR}=""
ENV{MATCHADDR}=="08:00:27:*", ENV{MATCHADDR}=""
-ENV{MATCHADDR}=="00:16:3e:*", ENV{MATCHADDR}=""
+#ENV{MATCHADDR}=="00:16:3e:*", ENV{MATCHADDR}=""

# ignore Windows Azure Hyper-V virtual interfaces
ENV{MATCHADDR}=="00:03:ff:*", ENV{MATCHADDR}=""
</syntaxhighlight>

Configure your '/etc/network/interfaces' for DHCP

<syntaxhighlight lang="bash">
# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto eth0
iface eth0 inet dhcp
</syntaxhighlight>

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"

<syntaxhighlight lang="bash">
default 0
timeout 2

title Devuan Jessie
root (hd0,0)
kernel /boot/vmlinuz-3.16.0-4-amd64 root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-3.16.0-4-amd64

title Devuan Jessie (Single-User)
root (hd0,0)
kernel /boot/vmlinuz-3.16.0-4-amd64 root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-3.16.0-4-amd64
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Devuan won't regenerate SSH host keys if you delete them from /etc/ssh. So we need to make some changes to /etc/init.d/ssh so it regenerates the host keys.

Here is a patch for /etc/init.d/ssh

<syntaxhighlight lang="bash">
--- old_ssh 2017-01-15 10:04:56.399284075 -0600
+++ ssh 2017-01-15 10:09:02.999284075 -0600
@@ -78,6 +78,74 @@
fi
}

+# Some variables to make things more readable
+KEYGEN=/usr/bin/ssh-keygen
+RSA1_KEY=/etc/ssh/ssh_host_key
+RSA_KEY=/etc/ssh/ssh_host_rsa_key
+DSA_KEY=/etc/ssh/ssh_host_dsa_key
+ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
+ED25519_KEY=/etc/ssh/ssh_host_ed25519_key
+
+do_rsa_keygen() {
+ if [ ! -s $RSA_KEY ]; then
+ echo -n "Generating SSH2 RSA host key: "
+ rm -f $RSA_KEY
+ if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $RSA_KEY
+ chmod 644 $RSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_dsa_keygen() {
+ if [ ! -s $DSA_KEY ]; then
+ echo -n "Generating SSH2 DSA host key: "
+ rm -f $DSA_KEY
+ if test ! -f $DSA_KEY && $KEYGEN -q -t dsa -f $DSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $DSA_KEY
+ chmod 644 $DSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ecdsa_keygen() {
+ if [ ! -s $ECDSA_KEY ]; then
+ echo -n "Generating SSH2 ECDSA host key: "
+ rm -f $ECDSA_KEY
+ if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ECDSA_KEY
+ chmod 644 $ECDSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ed25519_keygen() {
+ if [ ! -s $ED25519_KEY ]; then
+ echo -n "Generating SSH2 ED25519 host key: "
+ rm -f $ED25519_KEY
+ if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ED25519_KEY
+ chmod 644 $ED25519_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
export PATH="${PATH:+$PATH:}/usr/sbin:/sbin"

case "$1" in
@@ -86,6 +154,12 @@
check_privsep_dir
check_for_no_start
check_dev_null
+
+ do_rsa_keygen
+ do_dsa_keygen
+ do_ecdsa_keygen
+ do_ed25519_keygen
+
log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" || true
if start-stop-daemon --start --quiet --oknodo --pidfile /var/run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
log_end_msg 0 || true
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove /etc/udev/rules.d/70-persistent-net.rules so that network comes up clean when the image is booted for the first time.

Remove SSH host keys so that new ones get generated on first boot.

Set a root password

<syntaxhighlight lang="bash">
echo 'devuan' > /etc/hostname
rm /etc/udev/rules.d/70-persistent-net.rules
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>

Linux/Xen/DomU/Devuan/Devuan Jessie

2017-01-15T21:28:47Z

Pyromania:

===Devuan Jessie===

Start this process on a existing Devuan system. You will need to have the Devuan patched version of debootstrap installed.

Create a empty image file and format it with ext3.

dd if=/dev/zero of=devuan_jessie.img bs=1M count=1 seek=1024
mkfs.ext3 devuan_jessie.img

Create a directory to mount the image on. Using '/mnt/img' for this example.

mkdir /mnt/img
mount -oloop devuan_jessie.img /mnt/img

Start the debootstrap process.

debootstrap --variant=minbase jessie /mnt/img http://auto.mirror.devuan.org/merged/

Once that completes, copy your existing /etc/apt/sources.list to the new image so we can run updates.

cp /etc/apt/sources.list /mnt/img/etc/apt/

Here is a basic sources.list

deb http://auto.mirror.devuan.org/merged jessie main
deb http://auto.mirror.devuan.org/merged jessie-updates main
deb http://auto.mirror.devuan.org/merged jessie-security main

Mount the necessary system files so that we can enter the new root filesystem with chroot.

mount --bind /dev /mnt/img/dev
mount --bind /dev/pts /mnt/img/dev/pts
mount -t proc proc /mnt/img/proc
mount -t sysfs sys /mnt/img/sys
chroot /mnt/img

Run updates and install a language pack.

apt-get update
apt-get upgrade

Configure the system timezone.

dpkg-reconfigure tzdata

Install the kernel image, SSH server and the full version of vim

apt-get install linux-image-`dpkg --print-architecture`
apt-get install openssh-server
apt-get install vim

To use the Xen console 'xm console (domU)' you need to setup a tty on /dev/hvc0. Edit /etc/inittab and add this line.

co:2345:respawn:/sbin/getty 38400 hvc0

The default udev rules for Devuan ignore Xen generated MAC addresses so you won't get a '/etc/udev/rules.d/70-persistent-net.rules' This causes your network interfaces not to come up.

Edit '/lib/udev/rules.d/75-persistent-net-generator.rules' and comment these lines. Here's the changes in patch/diff format.

<syntaxhighlight lang="diff">
@@ -21,7 +21,7 @@ KERNEL!="eth*|ath*|wlan*[0-9]|msh*|ra*|s
GOTO="persistent_net_generator_end"

# ignore Xen virtual interfaces
-SUBSYSTEMS=="xen", GOTO="persistent_net_generator_end"
+#SUBSYSTEMS=="xen", GOTO="persistent_net_generator_end"

# ignore UML virtual interfaces
DRIVERS=="uml-netdev", GOTO="persistent_net_generator_end"
@@ -75,7 +75,7 @@ ENV{MATCHADDR}=="00:0c:29:*|00:50:56:*|0
ENV{MATCHADDR}=="00:15:5d:*", ENV{MATCHADDR}=""
ENV{MATCHADDR}=="52:54:00:*|54:52:00:*", ENV{MATCHADDR}=""
ENV{MATCHADDR}=="08:00:27:*", ENV{MATCHADDR}=""
-ENV{MATCHADDR}=="00:16:3e:*", ENV{MATCHADDR}=""
+#ENV{MATCHADDR}=="00:16:3e:*", ENV{MATCHADDR}=""

# ignore Windows Azure Hyper-V virtual interfaces
ENV{MATCHADDR}=="00:03:ff:*", ENV{MATCHADDR}=""
</syntaxhighlight>

Configure your '/etc/network/interfaces' for DHCP

<syntaxhighlight lang="bash">
# interfaces(5) file used by ifup(8) and ifdown(8)
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto eth0
iface eth0 inet dhcp
</syntaxhighlight>

====GRUB====

Setup a basic grub config in "/boot/grub/menu.lst"

<syntaxhighlight lang="bash">
default 0
timeout 2

title Devuan Jessie
root (hd0,0)
kernel /boot/vmlinuz-3.16.0-4-amd64 root=/dev/xvda1 ro console=hvc0
initrd /boot/initrd.img-3.16.0-4-amd64

title Devuan Jessie (Single-User)
root (hd0,0)
kernel /boot/vmlinuz-3.16.0-4-amd64 root=/dev/xvda1 ro single console=hvc0
initrd /boot/initrd.img-3.16.0-4-amd64
</syntaxhighlight>

Configure a basic fstab

<syntaxhighlight lang="bash">
# Begin /etc/fstab
# <file system> <mount-point> <type> <options> <dump> <pass>
/dev/sda1 / ext3 defaults,errors=remount-ro 0 0
proc /proc proc defaults 0 0

# End /etc/fstab
</syntaxhighlight>

====SSH host keys fix====

Since this image will get cloned and used to create new virtual machines we don't want to re-use the same keys for every virtual machine. Devuan won't regenerate SSH host keys if you delete them from /etc/ssh. So we need to make some changes to /etc/init.d/ssh so it regenerates the host keys.

Here is a patch for /etc/init.d/ssh

<syntaxhighlight lang="bash">
--- old_ssh 2017-01-15 10:04:56.399284075 -0600
+++ ssh 2017-01-15 10:09:02.999284075 -0600
@@ -78,6 +78,74 @@
fi
}

+# Some variables to make things more readable
+KEYGEN=/usr/bin/ssh-keygen
+RSA1_KEY=/etc/ssh/ssh_host_key
+RSA_KEY=/etc/ssh/ssh_host_rsa_key
+DSA_KEY=/etc/ssh/ssh_host_dsa_key
+ECDSA_KEY=/etc/ssh/ssh_host_ecdsa_key
+ED25519_KEY=/etc/ssh/ssh_host_ed25519_key
+
+do_rsa_keygen() {
+ if [ ! -s $RSA_KEY ]; then
+ echo -n "Generating SSH2 RSA host key: "
+ rm -f $RSA_KEY
+ if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $RSA_KEY
+ chmod 644 $RSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_dsa_keygen() {
+ if [ ! -s $DSA_KEY ]; then
+ echo -n "Generating SSH2 DSA host key: "
+ rm -f $DSA_KEY
+ if test ! -f $DSA_KEY && $KEYGEN -q -t dsa -f $DSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $DSA_KEY
+ chmod 644 $DSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ecdsa_keygen() {
+ if [ ! -s $ECDSA_KEY ]; then
+ echo -n "Generating SSH2 ECDSA host key: "
+ rm -f $ECDSA_KEY
+ if test ! -f $ECDSA_KEY && $KEYGEN -q -t ecdsa -f $ECDSA_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ECDSA_KEY
+ chmod 644 $ECDSA_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
+do_ed25519_keygen() {
+ if [ ! -s $ED25519_KEY ]; then
+ echo -n "Generating SSH2 ED25519 host key: "
+ rm -f $ED25519_KEY
+ if test ! -f $ED25519_KEY && $KEYGEN -q -t ed25519 -f $ED25519_KEY -C '' -N '' >/dev/null; then
+ chmod 600 $ED25519_KEY
+ chmod 644 $ED25519_KEY.pub
+ echo "OK"
+ else
+ echo "FAIL"
+ exit 1
+ fi
+ fi
+}
+
export PATH="${PATH:+$PATH:}/usr/sbin:/sbin"

case "$1" in
@@ -86,6 +154,12 @@
check_privsep_dir
check_for_no_start
check_dev_null
+
+ do_rsa_keygen
+ do_dsa_keygen
+ do_ecdsa_keygen
+ do_ed25519_keygen
+
log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" || true
if start-stop-daemon --start --quiet --oknodo --pidfile /var/run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
log_end_msg 0 || true
</syntaxhighlight>

====Firewall====

<syntaxhighlight lang="bash">
apt-get install iptables
apt-get install ufw

ufw allow OpenSSH
ufw enable
</syntaxhighlight>

====Final Cleanup====

Set a hostname.

Remove /etc/udev/rules.d/70-persistent-net.rules so that network comes up clean when the image is booted for the first time.

Remove SSH host keys so that new ones get generated on first boot.

Set a root password

<syntaxhighlight lang="bash">
echo 'devuan' > /etc/hostname
rm /etc/udev/rules.d/70-persistent-net.rules
rm /etc/ssh/ssh_host_*
passwd root
</syntaxhighlight>