bootstrap-bullseye.sh 7.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283
  1. #!/bin/bash -e
  2. #----------
  3. # Interactive installation steps for Debian Bullseye from GRML using debootstrap
  4. # Design decisions
  5. # - Fokus on a simple setup, primarly for VMs
  6. # - One disk, one partion, swap-file in the same partion as safety net
  7. # - Use systemd whereever possible (network, ntp, cron, journald logging)
  8. # - Minimal number of packages & cloud kernel
  9. # - grub-pc, not efi
  10. # - random root and admin user password generation
  11. # - ssh on port 50101 limited to the admin user
  12. # Usage
  13. # Boot grml and clone repo
  14. # cp config.sh.template config.sh # copy template
  15. # vi config.sh # update installation variables
  16. # bootstrap-bullseye.sh install # start installation
  17. # !! Note down the admin passwords and reboot
  18. # sudo /installer/bootstrap-bullseye.sh postinstall # run postinstall in the new system
  19. # Variables
  20. mnt="/mnt/root" # mountpoint for the new root filesystem
  21. hostname="somehost.example.com"
  22. disk="/dev/vda" # lsblk --list
  23. disk1=$disk"1"
  24. netDev="eth0" # ip link
  25. netAddress="203.0.113.66/24"
  26. netGateway="203.0.113.1"
  27. netBroadcast="203.0.113.255"
  28. netDNS1="192.0.2.10"
  29. netDNS2="198.51.100.10"
  30. netNTP="pool.ntp.org"
  31. [ -f ./config.sh ] && source config.sh
  32. # Setup network in grml
  33. grmlnetwork(){
  34. ip link show # list interfaces
  35. ip addr add $netAddress dev $netDev
  36. ip link set $netDev up
  37. ip route add default via $netGateway
  38. echo nameserver $netDNS1 >> /etc/resolv.conf
  39. echo nameserver $netDNS2 >> /etc/resolv.conf
  40. }
  41. install(){
  42. #----------
  43. # Prepare disks
  44. # Parition disks -- pkg: parted
  45. parted $disk -s \
  46. mklabel msdos \
  47. mkpart primary ext4 512M 100% toggle 1 boot
  48. fdisk -l $disk
  49. # Format disks -- pkg: e2fsprogs dosfstools and to file system check
  50. mkfs.ext4 $disk1 && e2fsck $disk1
  51. # Prepare mount points and mount
  52. mkdir -p $mnt
  53. mount $disk1 $mnt
  54. # Create swapfile
  55. swapfile=$mnt/swapfile
  56. dd if=/dev/zero of=$swapfile bs=1M count=1024 status=progress # create 1GB file
  57. chmod 600 $swapfile #restric permissions
  58. mkswap $swapfile #format file
  59. #----------
  60. # Bootstrap -- pkg: debootstrap
  61. # Remark: Debootstrap does not install recommands!!
  62. debootstrap --variant=minbase --arch=amd64 bullseye $mnt http://ftp2.de.debian.org/debian/
  63. #----------
  64. # Configuration
  65. # Configure disk mounts
  66. # Or get UUID from blkid...
  67. cat >$mnt/etc/fstab <<EOL
  68. $disk1 / ext4 rw 0 0
  69. /swapfile none swap defaults 0 0
  70. EOL
  71. # Configure sources.list
  72. cat >$mnt/etc/apt/sources.list <<EOL
  73. deb http://ftp2.de.debian.org/debian bullseye main contrib non-free
  74. #deb-src http://ftp2.de.debian.org/debian bullseye main contrib non-free
  75. deb http://deb.debian.org/debian-security/ bullseye-security main contrib non-free
  76. #deb-src http://deb.debian.org/debian-security/ bullseye-security main contrib non-free
  77. deb http://ftp2.de.debian.org/debian bullseye-updates main contrib non-free
  78. #deb-src http://ftp2.de.debian.org/debian bullseye-updates main contrib non-free
  79. EOL
  80. # Configure hostname
  81. echo "127.0.0.1 $hostname" >> $mnt/etc/hosts
  82. echo "$hostname" > $mnt/etc/hostname
  83. #----------
  84. # Prepare chroot
  85. mount -o bind /dev $mnt/dev
  86. mount -o bind /dev/pts $mnt/dev/pts
  87. mount -t sysfs /sys $mnt/sys
  88. mount -t proc /proc $mnt/proc
  89. cp /proc/mounts $mnt/etc/mtab
  90. cp /etc/resolv.conf $mnt/etc/resolv.conf
  91. mkdir -p $mnt/installer
  92. cp $(dirname `realpath $0`)/*.sh $mnt/installer
  93. # Run script in chroot
  94. chroot $mnt /bin/bash /installer/bootstrap-bullseye.sh install2
  95. # Install bootloader
  96. $0 bootloader
  97. }
  98. #----------
  99. # Function executed within chroot
  100. install2(){
  101. source /installer/config.sh
  102. # Install basic system
  103. apt-get update
  104. apt-get install --yes \
  105. apt-utils dialog msmtp-mta \
  106. systemd-sysv locales tzdata haveged \
  107. linux-image-cloud-amd64 grub-pc \
  108. iproute2 netbase \
  109. ssh sudo molly-guard \
  110. less vim-tiny bash-completion pwgen lsof \
  111. dnsutils iputils-ping curl
  112. # Upgrade and clean up
  113. apt-get upgrade --yes
  114. apt-get autoremove --yes
  115. apt-get clean --yes
  116. # Setup users and passwords
  117. [ -z $pwdAdmin ] && pwdAdmin=`pwgen --capitalize --numerals --ambiguous 12 1`
  118. useradd admin --create-home --shell /bin/bash
  119. echo "admin:$pwdAdmin" | chpasswd
  120. usermod -a -G sudo admin
  121. echo -e "\e[1;33;4;44mPassword for the user admin: $pwdAdmin\e[0m"
  122. pass=`pwgen --capitalize --numerals --ambiguous 12 1`
  123. [ -z $pwdRoot ] && pwdRoot=`pwgen --capitalize --numerals --ambiguous 12 1`
  124. echo "root:$pwdRoot" | chpasswd
  125. echo -e "\e[1;33;4;44mPassword for the user root: $pwdRoot\e[0m"
  126. # Harden SSHD
  127. echo AllowUsers admin >> /etc/ssh/sshd_config
  128. sed -i -e 's/#Port 22/Port 50101/g' /etc/ssh/sshd_config
  129. sed -i -e 's/#PubkeyAuthentication yes/PubkeyAuthentication yes/g' /etc/ssh/sshd_config
  130. ## Configure network using systemd
  131. if [ -z $netAddress ]
  132. then
  133. ## Network OPTION 1 - DHCP
  134. cat >/etc/systemd/network/20-wired.network <<EOL
  135. [Match]
  136. Name=e*
  137. [Network]
  138. DHCP=ipv4
  139. IPv6PrivacyExtensions=false
  140. IPv6AcceptRA=false
  141. NTP=$netNTP
  142. EOL
  143. else
  144. ## Network OPTION 2 - static
  145. cat >/etc/systemd/network/20-wired.network <<EOL
  146. [Match]
  147. Name=$netDev
  148. [Network]
  149. Address=$netAddress
  150. Gateway=$netGateway
  151. Broadcast=$netBroadcast
  152. DNS=$netDNS1
  153. DNS=$netDNS2
  154. NTP=$netNTP
  155. EOL
  156. fi
  157. # Setup systemd resolver
  158. rm /etc/resolv.conf
  159. ln -s /run/systemd/resolve/resolv.conf /etc/resolv.conf
  160. systemctl enable systemd-networkd
  161. # to be checked why port 5353 is opened externally
  162. sed -i 's/#LLMNR=yes/LLMNR=no/' /etc/systemd/resolved.conf
  163. systemctl enable systemd-resolved
  164. # Limit journald logging to 1 month, 1 GB in total and split files per week
  165. cat >>/etc/systemd/journald.conf <<EOL
  166. # Custom settings
  167. MaxFileSec=1G
  168. MaxFileSec=1week
  169. MaxFileSec=1m
  170. EOL
  171. # Show errors in motd
  172. rm /etc/motd
  173. cat >/etc/update-motd.d/15-boot-errors<<EOL
  174. #!/bin/sh
  175. echo
  176. journalctl --boot --priority=3 --no-pager
  177. EOL
  178. chmod 755 /etc/update-motd.d/15-boot-errors
  179. # Setup keyboard layout
  180. cat >/etc/default/keyboard <<EOL
  181. XKBMODEL="pc105"
  182. XKBLAYOUT="de"
  183. XKBVARIANT="nodeadkeys"
  184. XKBOPTIONS=""
  185. BACKSPACE="guess"
  186. EOL
  187. # Leave chroot
  188. exit
  189. }
  190. bootloader(){
  191. # Install GRUB in /dev/vba
  192. chroot $mnt /bin/bash -c "grub-install $disk && update-grub"
  193. }
  194. unmount(){
  195. # Unmount if mounted
  196. ! mountpoint -q $mnt/proc || umount $mnt/proc
  197. ! mountpoint -q $mnt/sys || umount $mnt/sys
  198. ! mountpoint -q $mnt/dev/pts || umount $mnt/dev/pts
  199. ! mountpoint -q $mnt/dev || umount $mnt/dev
  200. ! mountpoint -q $mnt/root || umount $mnt/root
  201. ! mountpoint -q $mnt || umount $mnt
  202. # Delete mount-point if empty and not mounted
  203. [ -z "$(ls -A /mnt/)" ] && ! mountpoint -q $mnt && rm -R $mnt
  204. }
  205. postinstall(){
  206. ####----REBOOT into the new system, so we'll have dbus running
  207. localectl set-locale LANG=de_DE.UTF-8 # Default for LC_* variables not set.
  208. localectl set-locale LC_MESSAGES=en_US.UTF-8 # System messages.
  209. #localectl set-locale LC_RESPONSE=en_US.UTF-8 # How responses (such as Yes and No) appear
  210. update-locale
  211. timedatectl set-timezone Europe/Berlin
  212. }
  213. # Switch to functions...
  214. case $1 in
  215. grmlnetwork)
  216. echo Setup network in grml
  217. grmlnetwork
  218. ;;
  219. install)
  220. echo "Stage 1: Start installation"
  221. install
  222. ;;
  223. install2)
  224. echo "Stage 2: Start installation in chroot"
  225. install2
  226. ;;
  227. bootloader)
  228. echo "Stage 3: Install bootloader and unmount chroot"
  229. bootloader
  230. unmount
  231. echo "We're done and can reboot now"
  232. ;;
  233. postinstall)
  234. echo "Stage 4: Start post-installation in live system"
  235. postinstall
  236. ;;
  237. unmount)
  238. echo "Unmount chroot, e.g. in case installation fails"
  239. unmount
  240. ;;
  241. *)
  242. echo "Valid functions are: grmlnetwork, install, postinstall and unmount" >&2
  243. ;;
  244. esac