Ok, lets go!
Boot from live medium and gain root at the terminal.
You need to create 2 partitions. First partition for boot with approximately 512MB and a second with the rest of the disk.
Format the boot partition with ext2 and the second partition
unformatted.
Looks like this:
Code: Select all
root@mx1:/home/demo# fdisk -l
Disk /dev/sda: 119.2 GiB, 128035675648 bytes, 250069679 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x7b703775
Device Boot Start End Sectors Size Id Type
/dev/sda1 2048 1050623 1048576 512M 83 Linux
/dev/sda2 1050624 250068991 249018368 118.8G 83 Linux
If you want to clean all data, do:
Code: Select all
root@mx1:/home/demo# dd if=/dev/urandom of=/dev/sda2 bs=4k status=progress
But it takes a while!
You need to install lvm2:
Code: Select all
root@mx1:/home/demo# apt-get install lvm2
Next step is to create LUKS disk:
Code: Select all
root@mx1:/home/demo# cryptsetup luksFormat /dev/sda2
WARNING!
========
This will overwrite data on /dev/sda2 irrevocably.
Are you sure? (Type uppercase yes): YES
Enter passphrase:
Verify passphrase:
It goes without saying to use a looooong passphrase! May you have heard about hashcat?
Mount crypt disk:
Code: Select all
root@mx1:/home/demo# cryptsetup luksOpen /dev/sda2 sda2_crypt
Enter passphrase for /dev/sda2:
Check lvms:
Code: Select all
root@mx1:/home/demo# ls -l /dev/mapper/
total 0
crw------- 1 root root 10, 236 Jun 19 05:43 control
lrwxrwxrwx 1 root root 7 Jun 19 06:13 sda2_crypt -> ../dm-0
Create a phyisical volume:
Code: Select all
root@mx1:/home/demo# pvcreate /dev/mapper/sda2_crypt
Physical volume "/dev/mapper/sda2_crypt" successfully created.
Create a volume group:
Code: Select all
root@mx1:/home/demo# vgcreate diskLVM /dev/mapper/sda2_crypt
Volume group "diskLVM" successfully created
Create the logical volumes. I used 15GB for root, 5GB for swap (should be a little bit bigger as your RAM) and the rest for home:
Code: Select all
root@mx1:/home/demo# lvcreate -n root -L 15G diskLVM -Z n
WARNING: Logical volume diskLVM/root not zeroed.
Logical volume "root" created.
root@mx1:/home/demo# lvcreate -n swap -L 5g diskLVM -Z n
WARNING: Logical volume diskLVM/swap not zeroed.
Logical volume "swap" created.
root@mx1:/home/demo# lvcreate -n home -l 100%FREE diskLVM -Z n
WARNING: Logical volume diskLVM/home not zeroed.
Logical volume "home" created.
Check your logical volumes:
Code: Select all
root@mx1:/home/demo# lvdisplay
--- Logical volume ---
LV Path /dev/diskLVM/root
LV Name root
VG Name diskLVM
LV UUID 30kSyu-0yN2-thzx-URY3-GyAf-x7Eg-7LgICf
LV Write Access read/write
LV Creation host, time mx1, 2018-06-19 06:37:54 -0400
LV Status available
# open 0
LV Size 15.00 GiB
Current LE 3840
Segments 1
Allocation inherit
Read ahead sectors auto
- currently set to 256
Block device 254:1
--- Logical volume ---
LV Path /dev/diskLVM/swap
LV Name swap
VG Name diskLVM
LV UUID QXCWmj-xYQ6-M0eE-Pt89-ujMg-mI4k-s5wHjU
LV Write Access read/write
LV Creation host, time mx1, 2018-06-19 06:39:17 -0400
LV Status available
# open 0
LV Size 5.00 GiB
Current LE 1280
Segments 1
Allocation inherit
Read ahead sectors auto
- currently set to 256
Block device 254:2
--- Logical volume ---
LV Path /dev/diskLVM/home
LV Name home
VG Name diskLVM
LV UUID OvMVTo-EkIg-FNmb-H81Z-q1mD-qp6g-Sctie7
LV Write Access read/write
LV Creation host, time mx1, 2018-06-19 06:40:51 -0400
LV Status available
# open 0
LV Size 98.74 GiB
Current LE 25277
Segments 1
Allocation inherit
Read ahead sectors auto
- currently set to 256
Block device 254:3
And your mapper devices:
Code: Select all
root@mx1:/home/demo# ls -l /dev/mapper/
total 0
crw------- 1 root root 10, 236 Jun 19 05:43 control
lrwxrwxrwx 1 root root 7 Jun 19 06:40 diskLVM-home -> ../dm-3
lrwxrwxrwx 1 root root 7 Jun 19 06:37 diskLVM-root -> ../dm-1
lrwxrwxrwx 1 root root 7 Jun 19 06:44 diskLVM-swap -> ../dm-2
lrwxrwxrwx 1 root root 7 Jun 19 06:40 sda2_crypt -> ../dm-0
About the message the device is "not zeroed", you can wipe it's with:
dd if=/dev/urandom of=/dev/mapper/diskLVM-... bs=4k
If it was a new disk don't waste your time.
Format and activate your swap volume:
Code: Select all
root@mx1:/home/demo# mkswap /dev/mapper/diskLVM-swap
Setting up swapspace version 1, size = 5 GiB (5368705024 bytes)
no label, UUID=fe655c35-f51b-434e-b793-3ac00475f2ec
root@mx1:/home/demo# swapon /dev/mapper/diskLVM-swap
Format the root and the home volume:
Code: Select all
root@mx1:/home/demo# mkfs -t ext4 /dev/mapper/diskLVM-root
mke2fs 1.43.4 (31-Jan-2017)
Creating filesystem with 3932160 4k blocks and 983040 inodes
Filesystem UUID: eff44206-ffab-4cca-b78a-b8c1954307dc
Superblock backups stored on blocks:
32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208
Allocating group tables: done
Writing inode tables: done
Creating journal (16384 blocks): done
Writing superblocks and filesystem accounting information: done
root@mx1:/home/demo# mkfs -t ext4 /dev/mapper/diskLVM-home
mke2fs 1.43.4 (31-Jan-2017)
Creating filesystem with 25883648 4k blocks and 6471680 inodes
Filesystem UUID: 443a74f0-8b04-437d-a7b5-1d27a55ac46b
Superblock backups stored on blocks:
32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,
4096000, 7962624, 11239424, 20480000, 23887872
Allocating group tables: done
Writing inode tables: done
Creating journal (131072 blocks): done
Writing superblocks and filesystem accounting information: done
Mount the root volume to /mnt:
Code: Select all
root@mx1:/home/demo# mount /dev/mapper/diskLVM-root /mnt
Create directories for boot and home:
Code: Select all
root@mx1:/home/demo# mkdir /mnt/boot /mnt/home
Mount boot partition and home volume:
Code: Select all
root@mx1:/home/demo# mount /dev/sda1 /mnt/boot/
root@mx1:/home/demo# mount /dev/mapper/diskLVM-home /mnt/home/
Copy the MX file system (it can take a while):
Code: Select all
root@mx1:/home/demo# cp -a /live/aufs/* /mnt/
Check your disk UUID's:
Code: Select all
root@mx1:/home/demo# ls -l /dev/disk/by-uuid/
total 0
lrwxrwxrwx 1 root root 9 Jun 19 06:06 2017-05-05-08-16-50-00 -> ../../sdb
lrwxrwxrwx 1 root root 10 Jun 19 06:06 23cd3220-553c-49af-ac5a-91e88ec8abed -> ../../sda1
lrwxrwxrwx 1 root root 10 Jun 19 06:47 443a74f0-8b04-437d-a7b5-1d27a55ac46b -> ../../dm-3
lrwxrwxrwx 1 root root 10 Jun 19 06:06 8D6C-E184 -> ../../sdb1
lrwxrwxrwx 1 root root 10 Jun 19 06:13 bd662f4e-01d4-4ac4-82fb-b68c1e5a20f7 -> ../../sda2
lrwxrwxrwx 1 root root 10 Jun 19 06:47 eff44206-ffab-4cca-b78a-b8c1954307dc -> ../../dm-1
lrwxrwxrwx 1 root root 10 Jun 19 06:44 fe655c35-f51b-434e-b793-3ac00475f2ec -> ../../dm-2
Now you have to edit your /mnt/etc/fstab to something like this, but with YOUR sda1 UUID:
Code: Select all
# /etc/fstab: static file system information
#
# Created by make-fstab on Tue Jun 19 05:43:39 EDT 2018
# <file system> <mount point> <type> <options> <dump/$
# My root LVM
/dev/mapper/diskLVM-root / ext4 errors=remount-ro 0 1
# My UUID /boot device with should be pointed to /dev/sda1
UUID=23cd3220-553c-49af-ac5a-91e88ec8abed /boot ext2 defaults 0 2
# My swap volume
/dev/mapper/diskLVM-swap none swap sw 0 0
# My home volume
/dev/mapper/diskLVM-home /home ext4 defaults 0 2
Edit your /mnt/etc/crypttab to something like this, but with YOUR sda2 UUID:
Code: Select all
# <target name> <source device> <key file> <options>
sda2_crypt UUID=bd662f4e-01d4-4ac4-82fb-b68c1e5a20f7 none luks,discard
Edit your /mnt/etc/lvm/lvm.conf parameter issue_discards = 0 to issue_discards = 1 if you have an SDD disk!
Copy your current resolv.conf if different (not in my case):
Code: Select all
root@mx1:/home/demo# cp /etc/resolv.conf /mnt/etc
cp: '/etc/resolv.conf' and '/mnt/etc/resolv.conf' are the same file
Mount your local services to /mnt:
Code: Select all
root@mx1:/home/demo# mount -o bind /run /mnt/run/
root@mx1:/home/demo# mount -o bind /dev /mnt/dev
root@mx1:/home/demo# mount -o bind /sys /mnt/sys
root@mx1:/home/demo# mount -t proc /proc /mnt/proc
Copy your current mounts if different (not in my case):
Code: Select all
root@mx1:/home/demo# cp /proc/mounts /mnt/etc/mtab
cp: '/proc/mounts' and '/mnt/etc/mtab' are the same file
Jump into the new root:
Code: Select all
root@mx1:/home/demo# chroot /mnt /bin/bash
Install grub:
Code: Select all
root@mx1:/# grub-install /dev/sda
Installing for i386-pc platform.
Installation finished. No error reported.
I have a different keymap, so I need to set KEYMAP=n in /etc/initramfs-tools/initramfs.conf to KEYMAP=y.
Also need to change special setting for me:
Code: Select all
root@mx1:/# dpkg-reconfigure keyboard-configuration
root@mx1:/# dpkg-reconfigure console-setup
root@mx1:/# dpkg-reconfigure locales
root@mx1:/# dpkg-reconfigure tzdata
Update your ramdisk:
Code: Select all
root@mx1:/# update-initramfs -u
update-initramfs: Generating /boot/initrd.img-4.15.0-1-amd64
Update your grub config:
Code: Select all
root@mx1:/# update-grub
Generating grub configuration file ...
using custom appearance settings
Found background image: .background_cache.png
Found linux image: /boot/vmlinuz-4.15.0-1-amd64
Found initrd image: /boot/initrd.img-4.15.0-1-amd64
Found memtest86+ image: /memtest86+.bin
Found memtest86+ multiboot image: /memtest86+_multiboot.bin
Install grub again (only for sure):
Code: Select all
root@mx1:/# grub-install /dev/sda
Installing for i386-pc platform.
Installation finished. No error reported.
Remove the demo user:
Code: Select all
root@mx1:/# deluser --remove-home demo
Looking for files to backup/remove ...
Removing files ...
Removing user `demo' ...
Warning: group `demo' has no more members.
Done.
Add a new user:
Code: Select all
root@mx1:/# adduser c4os
Adding user `c4os' ...
Adding new group `c4os' (1000) ...
Adding new user `c4os' (1000) with group `c4os' ...
Creating home directory `/home/c4os' ...
Copying files from `/etc/skel' ...
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
Changing the user information for c4os
Enter the new value, or press ENTER for the default
Full Name []:
Room Number []:
Work Phone []:
Home Phone []:
Other []:
Is the information correct? [Y/n] y
Adding new user `c4os' to extra groups ...
Adding user `c4os' to group `dialout' ...
Adding user `c4os' to group `dip' ...
adduser: The group `fuse' does not exist.
Adding user `c4os' to group `cdrom' ...
Adding user `c4os' to group `audio' ...
Adding user `c4os' to group `video' ...
Adding user `c4os' to group `plugdev' ...
Adding user `c4os' to group `users' ...
Adding user `c4os' to group `floppy' ...
Adding user `c4os' to group `netdev' ...
Adding user `c4os' to group `scanner' ...
Adding user `c4os' to group `lp' ...
Adding user `c4os' to group `lpadmin' ...
Adding user `c4os' to group `sudo' ...
Adding user `c4os' to group `vboxsf' ...
May lock the root user:
But I'm not sure if it's the correct way, because I had problems with my user sudo and his password.
Exit chroot with CRTL+D.
Unmount all mounts:
Code: Select all
root@mx1:/home/demo# umount /mnt/proc
root@mx1:/home/demo# umount /mnt/sys
root@mx1:/home/demo# umount /mnt/run
root@mx1:/home/demo# umount /mnt/dev
root@mx1:/home/demo# umount /mnt/home
root@mx1:/home/demo# umount /mnt/boot
root@mx1:/home/demo# umount /mnt
Now you have done and can reboot!
Issues:
Message at boot
Code: Select all
WARNING : Failed to connect to lvmetad. Falling back to device scanning
This message is displayed, whether running Debian stable or Debian testing.
To get rid of this message, disable lvmetad in /etc/lvm/lvm.conf
use_lvmetad=0
Update the initramfs for the current kernel your system uses :
update-initramfs -k $(uname -r) -u; sync
Code: Select all
$ sudo update-initramfs -u
update-initramfs: Generating /boot/initrd.img-4.15.0-1-amd64
I: The initramfs will attempt to resume from /dev/dm-2
I: (UUID=fe655c35-f51b-434e-b793-3ac00475f2ec)
I: Set the RESUME variable to override this.
I added this issue to the last, because I haven't test it during the installation. On next test I'll change it at the discard/lvm.conf part.
Additionally, don't know where to set the RESUME variable!
Maybe this depend the message when shutdown:
Code: Select all
Stopping remaining crypto disks ... sda2_crypt (busy) ... failed
Hopefully we will get a new feature installer at the next release. It would be great to have the FIRST linux crypt installer which can install a crypt linux behind a windows installation. ;-)
Have a nice weekend and happy testing my friends!