Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
It’s been nearly ten years since I posted my recipe for installing Ubuntu on a Hetzner machine. I needed to do that once again and the old instructions work pretty well! Let me post what I used this time around for completeness sake.
shred --size=1M /dev/sda* /dev/sdb* cat > postinstall.sh <<EOF mkdir -p /home/{muelli,teythoon,russell,vollkorn,mms} echo "termcapinfo xterm* ti@:te@" | tee -a /etc/screenrc sed "s/UMASK[[:space:]]\+022/UMASK 027/" -i /etc/login.defs echo "blacklist floppy" | tee /etc/modprobe.d/blacklist-floppy.conf apt-get update apt-get install -y cryptsetup apt-get install -y dropbear-initramfs cryptsetup-initramfs cat /root/.ssh/authorized_keys > /etc/dropbear-initramfs/authorized_keys ## For some weird reason, Hetzner puts swap space in the RAID. mdadm --remove /dev/md0 mdadm --stop /dev/md0 mkswap /dev/sda1 mkswap /dev/sdb1 apt install -y podman virtinst uvtool-libvirt libvirt-daemon-system-systemd libvirt-daemon-driver-qemu libnss-libvirt libvirt-clients qemu-kvm blkid -o export /dev/md3 | grep UUID= mount /dev/md3 /mnt btrfs subvolume snapshot -r /mnt/ /mnt/@root-initial-snapshot-ro mkdir /tmp/disk mount /dev/md2 /tmp/disk btrfs send /mnt/@root-initial-snapshot-ro | btrfs receive -v /tmp/disk/ umount /mnt/ EOF chmod a+x postinstall.sh installimage -a -n newhost -r yes -l 1 -p swap:swap:32G,/boot:ext3:1G,/mnt/disk:btrfs:64G,/:btrfs:all -K /root/.ssh/robot_user_keys -t yes -s en -x ./postinstall.sh -i /root/.oldroot/nfs/install/../images/Ubuntu-2604-resolute-amd64-base.tar.zst echo -n "Better provide the passphrase interactively or change later with cryptsetup luksChangeKey /dev/md3" | cryptsetup luksFormat /dev/md3 - echo -n "Better provide the passphrase interactively or change later with cryptsetup luksChangeKey /dev/md3" | cryptsetup luksOpen /dev/md3 cryptedmd3 - mkfs.btrfs /dev/mapper/cryptedmd3 mount /dev/mapper/cryptedmd3 /mnt/ mkdir /tmp/disk mount /dev/md2 /tmp/disk btrfs send /tmp/disk/@root-initial-snapshot-ro | btrfs receive -v /mnt/ btrfs subvolume snapshot /mnt/@root-initial-snapshot-ro /mnt/@ btrfs subvolume create /mnt/@home btrfs subvolume create /mnt/@var btrfs subvolume create /mnt/@images btrfs subvolume create /mnt/@userfoo btrfs subvolume create /mnt/@userbar btrfs subvolume create /mnt/@mails blkid -o export /dev/mapper/cryptedmd3 | grep UUID= # The following deletes the root partition, which used to be on the unencrypted drive. sed -i 's,.* / .*,,' /mnt/@/etc/fstab sed -i 's,.* swap .*,,' /mnt/@/etc/fstab echo /dev/sda1 none swap sw 0 0 | tee -a /mnt/@/etc/fstab echo /dev/sdb1 none swap sw 0 0 | tee -a /mnt/@/etc/fstab echo /dev/mapper/cryptedmd3 / btrfs defaults,subvol=@,noatime,compress=lzo 0 0 | tee -a /mnt/@/etc/fstab echo /dev/mapper/cryptedmd3 /home btrfs defaults,subvol=@home,compress=lzo,relatime,nodiratime 0 0 | tee -a /mnt/@/etc/fstab echo /dev/mapper/cryptedmd3 /home/userfoo btrfs defaults,subvol=@userfoo,compress=lzo,relatime,nodiratime 0 0 | tee -a /mnt/@/etc/fstab echo /dev/mapper/cryptedmd3 /home/uesrbar btrfs defaults,subvol=@userbar,compress=lzo,relatime,nodiratime 0 0 | tee -a /mnt/@/etc/fstab umount /mnt/ mount /dev/mapper/cryptedmd3 -osubvol=@ /mnt/ mount /dev/md1 /mnt/boot chroot-prepare /mnt/; chroot /mnt passwd echo cryptedmd3 $(blkid -o export /dev/md3 | grep UUID=) none luks | tee -a /etc/crypttab echo swap /dev/sda1 /dev/urandom swap,cipher=aes-cbc-essiv:sha256 | tee -a /etc/crypttab echo swap /dev/sdb1 /dev/urandom swap,cipher=aes-cbc-essiv:sha256 | tee -a /etc/crypttab cp /root/.ssh/authorized_keys /etc/dropbear/initramfs/ update-initramfs -u -k all update-grub2 sed -i s,ENABLED=1,ENABLED=0,g /etc/default/motd-news exit umount -l /mnt mount /dev/mapper/cryptedmd3 /mnt/ btrfs subvolume snapshot -r /mnt/@ /mnt/@root-after-install umount -l /mnt
Then, for unlocking, you can do something like
cat ~/.ssh/boot_key | ssh -o UserKnownHostsFile=~/.ssh/newhost.known -i ~/.ssh/id_newhost_boot root@yourip "cat - >/lib/cryptsetup/passfifo"
I found Tang and Clevis for automatic decryption during boot. That’s a pretty neat approach and I was surprised to find that even old Ubuntus ship the package.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.