mirror of
https://github.com/kevinveenbirkenbach/hetzner-arch-luks.git
synced 2024-11-24 02:31:04 +01:00
Implemented legend
This commit is contained in:
parent
58ac282a68
commit
e2ec802119
56
README.md
56
README.md
@ -4,23 +4,31 @@ This guide should show you how to set up an System with the following specificat
|
|||||||
* btrfs
|
* btrfs
|
||||||
* LUKS
|
* LUKS
|
||||||
|
|
||||||
|
## Legend
|
||||||
|
The following symbols show you where to execute the code:
|
||||||
|
* :computer: Client
|
||||||
|
* :ambulance: Rescue System
|
||||||
|
* :ghost: Chroot from Rescue System into Arch
|
||||||
|
* :minidisc: Arch Os
|
||||||
|
|
||||||
## Guide
|
## Guide
|
||||||
### 1. Configure and Install Image
|
### 1. Configure and Install Image
|
||||||
#### 1.1 Login to Hetzner Rescue System
|
#### 1.1 Login to Hetzner Rescue System
|
||||||
|
:computer: :
|
||||||
```bash
|
```bash
|
||||||
ssh root@your_server_ip
|
ssh root@your_server_ip
|
||||||
```
|
```
|
||||||
#### 1.2 Create the /autosetup
|
#### 1.2 Create the /autosetup
|
||||||
|
|
||||||
Execute
|
:ambulance: :
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
nano /autosetup
|
nano /autosetup
|
||||||
```
|
```
|
||||||
|
|
||||||
and save the following content into this file:
|
Save the following content into this file:
|
||||||
|
|
||||||
```bash
|
```
|
||||||
## Hetzner Online GmbH - installimage - config
|
## Hetzner Online GmbH - installimage - config
|
||||||
|
|
||||||
DRIVE1 /dev/sda
|
DRIVE1 /dev/sda
|
||||||
@ -50,38 +58,47 @@ LV vg0 root / btrfs 10G
|
|||||||
IMAGE /root/.oldroot/nfs/install/../images/archlinux-latest-64-minimal.tar.gz
|
IMAGE /root/.oldroot/nfs/install/../images/archlinux-latest-64-minimal.tar.gz
|
||||||
```
|
```
|
||||||
#### 1.3 Install Image
|
#### 1.3 Install Image
|
||||||
|
:ambulance: :
|
||||||
```bash
|
```bash
|
||||||
installimage
|
installimage
|
||||||
```
|
```
|
||||||
#### 1.4 Restart
|
#### 1.4 Restart
|
||||||
|
:ambulance: :
|
||||||
```bash
|
```bash
|
||||||
reboot
|
reboot
|
||||||
```
|
```
|
||||||
|
|
||||||
### 2. Setup System
|
### 2. Setup System
|
||||||
#### 2.1 Login to server
|
#### 2.1 Login to server
|
||||||
|
:computer: :
|
||||||
```bash
|
```bash
|
||||||
ssh-keygen -f "$HOME/.ssh/known_hosts" -R your_server_ip
|
ssh-keygen -f "$HOME/.ssh/known_hosts" -R your_server_ip
|
||||||
ssh root@your_server_ip
|
ssh root@your_server_ip
|
||||||
```
|
```
|
||||||
#### 2.2 Update the system
|
#### 2.2 Update the system
|
||||||
|
:minidisc: :
|
||||||
```bash
|
```bash
|
||||||
pacman -Syyu
|
pacman -Syyu
|
||||||
```
|
```
|
||||||
#### 2.3 Install administration tools:
|
#### 2.3 Install administration tools:
|
||||||
|
:minidisc: :
|
||||||
```bash
|
```bash
|
||||||
pacman -S nano
|
pacman -S nano
|
||||||
```
|
```
|
||||||
|
|
||||||
### 3. Prepare System for Unlocking via SSH
|
### 3. Prepare System for Unlocking via SSH
|
||||||
#### 3.1 Execute the following script
|
#### 3.1 Execute the following script
|
||||||
|
:minidisc: :
|
||||||
```bash
|
```bash
|
||||||
pacman -S busybox mkinitcpio-dropbear mkinitcpio-utils mkinitcpio-netconf
|
pacman -S busybox mkinitcpio-dropbear mkinitcpio-utils mkinitcpio-netconf
|
||||||
cp -v ~/.ssh/authorized_keys /etc/dropbear/root_key
|
cp -v ~/.ssh/authorized_keys /etc/dropbear/root_key
|
||||||
```
|
```
|
||||||
#### 3.2 Replace line in **/etc/mkinitcpio.conf**
|
#### 3.2 Modify /etc/mkinitcpio.conf
|
||||||
|
:minidisc: :
|
||||||
|
```bash
|
||||||
|
nano /etc/mkinitcpio.conf
|
||||||
|
```
|
||||||
|
##### Replace
|
||||||
Old:
|
Old:
|
||||||
```
|
```
|
||||||
HOOKS=(base udev autodetect modconf block mdadm_udev lvm2 filesystems keyboard fsck)
|
HOOKS=(base udev autodetect modconf block mdadm_udev lvm2 filesystems keyboard fsck)
|
||||||
@ -97,19 +114,22 @@ Neu: BUSYBOX=y <br>
|
|||||||
http://daemons-point.com/blog/2019/10/20/hetzner-verschluesselt/#etcinitramfs-toolsinitramfsconf-anpassen
|
http://daemons-point.com/blog/2019/10/20/hetzner-verschluesselt/#etcinitramfs-toolsinitramfsconf-anpassen
|
||||||
|
|
||||||
### 4. Activate Encryption
|
### 4. Activate Encryption
|
||||||
#### 4.1
|
#### 4.1 Activate Rescue System
|
||||||
Activate the rescue system https://robot.your-server.de/server
|
Activate the rescue system https://robot.your-server.de/server
|
||||||
#### 4.2 Reboot
|
#### 4.2 Reboot
|
||||||
|
:minidisc: :
|
||||||
```bash
|
```bash
|
||||||
reboot
|
reboot
|
||||||
```
|
```
|
||||||
#### 4.3 Login to the rescue system
|
#### 4.3 Login to the rescue system
|
||||||
|
:computer: :
|
||||||
```bash
|
```bash
|
||||||
ssh-keygen -f "$HOME/.ssh/known_hosts" -R your_server_ip
|
ssh-keygen -f "$HOME/.ssh/known_hosts" -R your_server_ip
|
||||||
ssh root@your_server_ip
|
ssh root@your_server_ip
|
||||||
```
|
```
|
||||||
|
|
||||||
#### 4.4 Mount the "system"
|
#### 4.4 Mount the "system"
|
||||||
|
:ambulance: :
|
||||||
```bash
|
```bash
|
||||||
vgscan -v
|
vgscan -v
|
||||||
vgchange -a y
|
vgchange -a y
|
||||||
@ -117,6 +137,7 @@ mount /dev/mapper/vg0-root /mnt
|
|||||||
```
|
```
|
||||||
|
|
||||||
#### 4.5 Copy "system"
|
#### 4.5 Copy "system"
|
||||||
|
:ambulance: :
|
||||||
```bash
|
```bash
|
||||||
echo 0 >/proc/sys/dev/raid/speed_limit_max
|
echo 0 >/proc/sys/dev/raid/speed_limit_max
|
||||||
mkdir /oldroot
|
mkdir /oldroot
|
||||||
@ -124,22 +145,24 @@ cp -va /mnt/. /oldroot/.
|
|||||||
echo 200000 >/proc/sys/dev/raid/speed_limit_max
|
echo 200000 >/proc/sys/dev/raid/speed_limit_max
|
||||||
```
|
```
|
||||||
#### 4.6 Unmount the "system"
|
#### 4.6 Unmount the "system"
|
||||||
|
:ambulance: :
|
||||||
```bash
|
```bash
|
||||||
umount /mnt
|
umount /mnt
|
||||||
```
|
```
|
||||||
|
|
||||||
#### 4.7 Delete decrypted LVM-Volume-Group
|
#### 4.7 Delete decrypted LVM-Volume-Group
|
||||||
|
:ambulance: :
|
||||||
```bash
|
```bash
|
||||||
vgremove vg0
|
vgremove vg0
|
||||||
```
|
```
|
||||||
|
|
||||||
#### 4.8 Check drive state
|
#### 4.8 Check drive state
|
||||||
|
:ambulance: :
|
||||||
```bash
|
```bash
|
||||||
cat /proc/mdstat
|
cat /proc/mdstat
|
||||||
```
|
```
|
||||||
#### 4.9 Encrypt MD1 by executing
|
#### 4.9 Encrypt MD1 by executing
|
||||||
|
:ambulance: :
|
||||||
```bash
|
```bash
|
||||||
cryptsetup --cipher aes-xts-plain64 --key-size 256 --hash sha256 --iter-time=10000 luksFormat /dev/md1
|
cryptsetup --cipher aes-xts-plain64 --key-size 256 --hash sha256 --iter-time=10000 luksFormat /dev/md1
|
||||||
cryptsetup luksOpen /dev/md1 cryptroot
|
cryptsetup luksOpen /dev/md1 cryptroot
|
||||||
@ -152,11 +175,13 @@ mkswap /dev/vg0/swap
|
|||||||
```
|
```
|
||||||
|
|
||||||
#### 4.10 Mount encrypted
|
#### 4.10 Mount encrypted
|
||||||
|
:ambulance: :
|
||||||
```bash
|
```bash
|
||||||
mount /dev/vg0/root /mnt
|
mount /dev/vg0/root /mnt
|
||||||
```
|
```
|
||||||
|
|
||||||
#### 4.12 Copy "system"
|
#### 4.12 Copy "system"
|
||||||
|
:ambulance: :
|
||||||
```bash
|
```bash
|
||||||
# Resync unterbrechen
|
# Resync unterbrechen
|
||||||
echo 0 >/proc/sys/dev/raid/speed_limit_max
|
echo 0 >/proc/sys/dev/raid/speed_limit_max
|
||||||
@ -166,6 +191,7 @@ echo 200000 >/proc/sys/dev/raid/speed_limit_max
|
|||||||
```
|
```
|
||||||
|
|
||||||
#### 4.13 Integrate Finale Installation
|
#### 4.13 Integrate Finale Installation
|
||||||
|
:ambulance: :
|
||||||
```bash
|
```bash
|
||||||
mount /dev/md0 /mnt/boot
|
mount /dev/md0 /mnt/boot
|
||||||
mount --bind /dev /mnt/dev
|
mount --bind /dev /mnt/dev
|
||||||
@ -175,27 +201,34 @@ chroot /mnt
|
|||||||
```
|
```
|
||||||
|
|
||||||
#### 4.14
|
#### 4.14
|
||||||
|
:ghost: :
|
||||||
```bash
|
```bash
|
||||||
echo "cryptroot /dev/md1 none luks" >> /etc/crypttab
|
echo "cryptroot /dev/md1 none luks" >> /etc/crypttab
|
||||||
```
|
```
|
||||||
|
|
||||||
#### 4.15 Create an initial ramdisk
|
#### 4.15 Create an initial ramdisk
|
||||||
|
:ghost: :
|
||||||
```bash
|
```bash
|
||||||
mkinitcpio -p linux
|
mkinitcpio -p linux
|
||||||
```
|
```
|
||||||
|
|
||||||
### 5 Grub
|
### 5 Grub
|
||||||
#### 5.1 Install Grub
|
#### 5.1 Install Grub
|
||||||
|
:ghost: :
|
||||||
```bash
|
```bash
|
||||||
pacman -S grub
|
pacman -S grub
|
||||||
```
|
```
|
||||||
#### 5.2 Configure /etc/default/grub
|
#### 5.2 Configure /etc/default/grub
|
||||||
|
:ghost: :
|
||||||
> :warning: I'm not shure if the following is correct. Please check out this [link](https://wiki.archlinux.org/index.php/Dm-crypt/Specialties#Remote_unlocking_(hooks:_netconf,_dropbear,_tinyssh,_ppp)) . I appreciate feedback :two_hearts:
|
> :warning: I'm not shure if the following is correct. Please check out this [link](https://wiki.archlinux.org/index.php/Dm-crypt/Specialties#Remote_unlocking_(hooks:_netconf,_dropbear,_tinyssh,_ppp)) . I appreciate feedback :two_hearts:
|
||||||
|
|
||||||
Edit /etc/default/grub and tell the Kernel about the cryptdevice and the mdraid, and netconf that we want dhcp:
|
Edit /etc/default/grub and tell the Kernel about the cryptdevice and the mdraid, and netconf that we want dhcp:
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
GRUB_CMDLINE_LINUX="cryptdevice=/dev/md0:root ip=dhcp"
|
GRUB_CMDLINE_LINUX="cryptdevice=/dev/md0:root ip=dhcp"
|
||||||
```
|
```
|
||||||
#### 5.3 Make and Install on Hard-drives
|
#### 5.3 Make and Install on Hard-drives
|
||||||
|
:ghost: :
|
||||||
```bash
|
```bash
|
||||||
grub-mkconfig -o /boot/grub/grub.cfg
|
grub-mkconfig -o /boot/grub/grub.cfg
|
||||||
grub-install /dev/sda
|
grub-install /dev/sda
|
||||||
@ -203,28 +236,31 @@ grub-install /dev/sdb
|
|||||||
```
|
```
|
||||||
|
|
||||||
#### 5.4 Restart System
|
#### 5.4 Restart System
|
||||||
|
:ghost: :ambulance: :
|
||||||
```bash
|
```bash
|
||||||
exit
|
exit
|
||||||
umount /mnt/boot /mnt/proc /mnt/sys /mnt/dev
|
umount /mnt/boot /mnt/proc /mnt/sys /mnt/dev
|
||||||
umount /mnt
|
umount /mnt
|
||||||
sync
|
sync
|
||||||
#Neustart
|
|
||||||
reboot
|
reboot
|
||||||
```
|
```
|
||||||
### 6. Encryption Procedure
|
### 6. Encryption Procedure
|
||||||
#### 6.1 Decrypt server
|
#### 6.1 Decrypt server
|
||||||
|
:computer: :
|
||||||
```bash
|
```bash
|
||||||
ssh -o UserKnownHostsFile=/dev/null root@your_server_ip
|
ssh -o UserKnownHostsFile=/dev/null root@your_server_ip
|
||||||
cryptroot-unlock
|
cryptroot-unlock
|
||||||
exit
|
exit
|
||||||
```
|
```
|
||||||
#### 6.2 Login to server
|
#### 6.2 Login to server
|
||||||
|
:computer: :
|
||||||
```bash
|
```bash
|
||||||
ssh-keygen -f "$HOME/.ssh/known_hosts" -R your_server_ip
|
ssh-keygen -f "$HOME/.ssh/known_hosts" -R your_server_ip
|
||||||
ssh root@your_server_ip
|
ssh root@your_server_ip
|
||||||
```
|
```
|
||||||
## 7.1. Debugging
|
## 7.1. Debugging
|
||||||
### 7.2 Login to System from Rescue System
|
### 7.2 Login to System from Rescue System
|
||||||
|
:ambulance: :
|
||||||
```bash
|
```bash
|
||||||
cryptsetup luksOpen /dev/md1 cryptroot
|
cryptsetup luksOpen /dev/md1 cryptroot
|
||||||
mount /dev/vg0/root /mnt
|
mount /dev/vg0/root /mnt
|
||||||
|
Loading…
Reference in New Issue
Block a user