Implemented legend

This commit is contained in:
Kevin Veen-Birkenbach 2020-04-17 21:02:07 +02:00
parent 58ac282a68
commit e2ec802119

View File

@ -4,23 +4,31 @@ This guide should show you how to set up an System with the following specificat
* btrfs * btrfs
* LUKS * LUKS
## Legend
The following symbols show you where to execute the code:
* :computer: Client
* :ambulance: Rescue System
* :ghost: Chroot from Rescue System into Arch
* :minidisc: Arch Os
## Guide ## Guide
### 1. Configure and Install Image ### 1. Configure and Install Image
#### 1.1 Login to Hetzner Rescue System #### 1.1 Login to Hetzner Rescue System
:computer: :
```bash ```bash
ssh root@your_server_ip ssh root@your_server_ip
``` ```
#### 1.2 Create the /autosetup #### 1.2 Create the /autosetup
Execute :ambulance: :
```bash ```bash
nano /autosetup nano /autosetup
``` ```
and save the following content into this file: Save the following content into this file:
```bash ```
## Hetzner Online GmbH - installimage - config ## Hetzner Online GmbH - installimage - config
DRIVE1 /dev/sda DRIVE1 /dev/sda
@ -50,38 +58,47 @@ LV vg0 root / btrfs 10G
IMAGE /root/.oldroot/nfs/install/../images/archlinux-latest-64-minimal.tar.gz IMAGE /root/.oldroot/nfs/install/../images/archlinux-latest-64-minimal.tar.gz
``` ```
#### 1.3 Install Image #### 1.3 Install Image
:ambulance: :
```bash ```bash
installimage installimage
``` ```
#### 1.4 Restart #### 1.4 Restart
:ambulance: :
```bash ```bash
reboot reboot
``` ```
### 2. Setup System ### 2. Setup System
#### 2.1 Login to server #### 2.1 Login to server
:computer: :
```bash ```bash
ssh-keygen -f "$HOME/.ssh/known_hosts" -R your_server_ip ssh-keygen -f "$HOME/.ssh/known_hosts" -R your_server_ip
ssh root@your_server_ip ssh root@your_server_ip
``` ```
#### 2.2 Update the system #### 2.2 Update the system
:minidisc: :
```bash ```bash
pacman -Syyu pacman -Syyu
``` ```
#### 2.3 Install administration tools: #### 2.3 Install administration tools:
:minidisc: :
```bash ```bash
pacman -S nano pacman -S nano
``` ```
### 3. Prepare System for Unlocking via SSH ### 3. Prepare System for Unlocking via SSH
#### 3.1 Execute the following script #### 3.1 Execute the following script
:minidisc: :
```bash ```bash
pacman -S busybox mkinitcpio-dropbear mkinitcpio-utils mkinitcpio-netconf pacman -S busybox mkinitcpio-dropbear mkinitcpio-utils mkinitcpio-netconf
cp -v ~/.ssh/authorized_keys /etc/dropbear/root_key cp -v ~/.ssh/authorized_keys /etc/dropbear/root_key
``` ```
#### 3.2 Replace line in **/etc/mkinitcpio.conf** #### 3.2 Modify /etc/mkinitcpio.conf
:minidisc: :
```bash
nano /etc/mkinitcpio.conf
```
##### Replace
Old: Old:
``` ```
HOOKS=(base udev autodetect modconf block mdadm_udev lvm2 filesystems keyboard fsck) HOOKS=(base udev autodetect modconf block mdadm_udev lvm2 filesystems keyboard fsck)
@ -97,19 +114,22 @@ Neu: BUSYBOX=y <br>
http://daemons-point.com/blog/2019/10/20/hetzner-verschluesselt/#etcinitramfs-toolsinitramfsconf-anpassen http://daemons-point.com/blog/2019/10/20/hetzner-verschluesselt/#etcinitramfs-toolsinitramfsconf-anpassen
### 4. Activate Encryption ### 4. Activate Encryption
#### 4.1 #### 4.1 Activate Rescue System
Activate the rescue system https://robot.your-server.de/server Activate the rescue system https://robot.your-server.de/server
#### 4.2 Reboot #### 4.2 Reboot
:minidisc: :
```bash ```bash
reboot reboot
``` ```
#### 4.3 Login to the rescue system #### 4.3 Login to the rescue system
:computer: :
```bash ```bash
ssh-keygen -f "$HOME/.ssh/known_hosts" -R your_server_ip ssh-keygen -f "$HOME/.ssh/known_hosts" -R your_server_ip
ssh root@your_server_ip ssh root@your_server_ip
``` ```
#### 4.4 Mount the "system" #### 4.4 Mount the "system"
:ambulance: :
```bash ```bash
vgscan -v vgscan -v
vgchange -a y vgchange -a y
@ -117,6 +137,7 @@ mount /dev/mapper/vg0-root /mnt
``` ```
#### 4.5 Copy "system" #### 4.5 Copy "system"
:ambulance: :
```bash ```bash
echo 0 >/proc/sys/dev/raid/speed_limit_max echo 0 >/proc/sys/dev/raid/speed_limit_max
mkdir /oldroot mkdir /oldroot
@ -124,22 +145,24 @@ cp -va /mnt/. /oldroot/.
echo 200000 >/proc/sys/dev/raid/speed_limit_max echo 200000 >/proc/sys/dev/raid/speed_limit_max
``` ```
#### 4.6 Unmount the "system" #### 4.6 Unmount the "system"
:ambulance: :
```bash ```bash
umount /mnt umount /mnt
``` ```
#### 4.7 Delete decrypted LVM-Volume-Group #### 4.7 Delete decrypted LVM-Volume-Group
:ambulance: :
```bash ```bash
vgremove vg0 vgremove vg0
``` ```
#### 4.8 Check drive state #### 4.8 Check drive state
:ambulance: :
```bash ```bash
cat /proc/mdstat cat /proc/mdstat
``` ```
#### 4.9 Encrypt MD1 by executing #### 4.9 Encrypt MD1 by executing
:ambulance: :
```bash ```bash
cryptsetup --cipher aes-xts-plain64 --key-size 256 --hash sha256 --iter-time=10000 luksFormat /dev/md1 cryptsetup --cipher aes-xts-plain64 --key-size 256 --hash sha256 --iter-time=10000 luksFormat /dev/md1
cryptsetup luksOpen /dev/md1 cryptroot cryptsetup luksOpen /dev/md1 cryptroot
@ -152,11 +175,13 @@ mkswap /dev/vg0/swap
``` ```
#### 4.10 Mount encrypted #### 4.10 Mount encrypted
:ambulance: :
```bash ```bash
mount /dev/vg0/root /mnt mount /dev/vg0/root /mnt
``` ```
#### 4.12 Copy "system" #### 4.12 Copy "system"
:ambulance: :
```bash ```bash
# Resync unterbrechen # Resync unterbrechen
echo 0 >/proc/sys/dev/raid/speed_limit_max echo 0 >/proc/sys/dev/raid/speed_limit_max
@ -166,6 +191,7 @@ echo 200000 >/proc/sys/dev/raid/speed_limit_max
``` ```
#### 4.13 Integrate Finale Installation #### 4.13 Integrate Finale Installation
:ambulance: :
```bash ```bash
mount /dev/md0 /mnt/boot mount /dev/md0 /mnt/boot
mount --bind /dev /mnt/dev mount --bind /dev /mnt/dev
@ -175,27 +201,34 @@ chroot /mnt
``` ```
#### 4.14 #### 4.14
:ghost: :
```bash ```bash
echo "cryptroot /dev/md1 none luks" >> /etc/crypttab echo "cryptroot /dev/md1 none luks" >> /etc/crypttab
``` ```
#### 4.15 Create an initial ramdisk #### 4.15 Create an initial ramdisk
:ghost: :
```bash ```bash
mkinitcpio -p linux mkinitcpio -p linux
``` ```
### 5 Grub ### 5 Grub
#### 5.1 Install Grub #### 5.1 Install Grub
:ghost: :
```bash ```bash
pacman -S grub pacman -S grub
``` ```
#### 5.2 Configure /etc/default/grub #### 5.2 Configure /etc/default/grub
:ghost: :
> :warning: I'm not shure if the following is correct. Please check out this [link](https://wiki.archlinux.org/index.php/Dm-crypt/Specialties#Remote_unlocking_(hooks:_netconf,_dropbear,_tinyssh,_ppp)) . I appreciate feedback :two_hearts: > :warning: I'm not shure if the following is correct. Please check out this [link](https://wiki.archlinux.org/index.php/Dm-crypt/Specialties#Remote_unlocking_(hooks:_netconf,_dropbear,_tinyssh,_ppp)) . I appreciate feedback :two_hearts:
Edit /etc/default/grub and tell the Kernel about the cryptdevice and the mdraid, and netconf that we want dhcp: Edit /etc/default/grub and tell the Kernel about the cryptdevice and the mdraid, and netconf that we want dhcp:
```bash ```bash
GRUB_CMDLINE_LINUX="cryptdevice=/dev/md0:root ip=dhcp" GRUB_CMDLINE_LINUX="cryptdevice=/dev/md0:root ip=dhcp"
``` ```
#### 5.3 Make and Install on Hard-drives #### 5.3 Make and Install on Hard-drives
:ghost: :
```bash ```bash
grub-mkconfig -o /boot/grub/grub.cfg grub-mkconfig -o /boot/grub/grub.cfg
grub-install /dev/sda grub-install /dev/sda
@ -203,28 +236,31 @@ grub-install /dev/sdb
``` ```
#### 5.4 Restart System #### 5.4 Restart System
:ghost: :ambulance: :
```bash ```bash
exit exit
umount /mnt/boot /mnt/proc /mnt/sys /mnt/dev umount /mnt/boot /mnt/proc /mnt/sys /mnt/dev
umount /mnt umount /mnt
sync sync
#Neustart
reboot reboot
``` ```
### 6. Encryption Procedure ### 6. Encryption Procedure
#### 6.1 Decrypt server #### 6.1 Decrypt server
:computer: :
```bash ```bash
ssh -o UserKnownHostsFile=/dev/null root@your_server_ip ssh -o UserKnownHostsFile=/dev/null root@your_server_ip
cryptroot-unlock cryptroot-unlock
exit exit
``` ```
#### 6.2 Login to server #### 6.2 Login to server
:computer: :
```bash ```bash
ssh-keygen -f "$HOME/.ssh/known_hosts" -R your_server_ip ssh-keygen -f "$HOME/.ssh/known_hosts" -R your_server_ip
ssh root@your_server_ip ssh root@your_server_ip
``` ```
## 7.1. Debugging ## 7.1. Debugging
### 7.2 Login to System from Rescue System ### 7.2 Login to System from Rescue System
:ambulance: :
```bash ```bash
cryptsetup luksOpen /dev/md1 cryptroot cryptsetup luksOpen /dev/md1 cryptroot
mount /dev/vg0/root /mnt mount /dev/vg0/root /mnt