Install VM Main Server -- Debian Buster 10.1.0

# Install VM Main Server -- Debian Buster 10.1.0 ## Boot from Debian Buster 10.1.0 ISO file ### Download ISO files * Install packages | `apt-get install` || | ---------------- | --------------- | | **`jigdo-file`** | Jigsaw Download | * Download jigdo files * https://cdimage.debian.org/debian-cd/current/amd64/jigdo-bd/ * `jigdo-lite` (in `/mnt/TMGN/iso/jigdo/debian-buster-10.1.0-amd64/`) * jigdo: debian-10.1.0-amd64-BD-{1,2,3,4}.jigdo debian-edu-10.1.0-amd64-BD-1.jigdo * Files to scan: * Debian mirror [[trusted=yes]]: ftp://ftp.tw.debian.org/debian/ * Debian non-US mirror: ftp://ftp.tw.debian.org/debian/ ### Boot from USB drive * Copy ISO image to USB drive * `dd if=debian-10.1.0-amd64-BD-1.iso of=/dev/sdX bs=65536 oflag=direct` * Boot from USB drive ### Boot from ISO file in hard disk * Prepare `.iso` image file * Prepare a `ext4` disk partition * `.iso` image file exceeds 4GB limit of `vfat` file system * Copy `debian-10.1.0-amd64-BD-1.iso` into this `ext4` partition * Prepare kernel modules being accessed while installation * Prepare a `vfat` disk partition * Only `vfat` fs module exists in CD's `initrd.gz`, * Copy module packages into this `vfat` partition | `pool/main/l/linux-signed-amd64/` | Description | | --------------------------------- | ----------- | | `ext4-modules-4.19.0-5-amd64-di_4.19.37-5_amd64.udeb` | ext4 file system for storing `.iso` image file | | `loop-modules-4.19.0-5-amd64-di_4.19.37-5_amd64.udeb` | loopback device for mounting `.iso` image file * Setup GRUB to enable boot from ISO file * Prepare `/boot/grub/device.map` * Correctly map `(hdX)` in GRUB and physical disks * `grub-mkdevicemap` * `/boot/grub/device.map` ``` (hd0) /dev/disk/by-id/ata-SanDisk_SD8SN8U256G1122_160908440972 (hd1) /dev/disk/by-id/ata-CT240BX200SSD1_1614F019EDFC (hd2) /dev/disk/by-id/ata-ST1000DM003-1CH162_Z1D5CDJA ``` * `/etc/grub.d/40_custom` ``` insmod part_msdos menuentry 'Debian install image' --class debian --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-simple-c4d18e61-2ff9-46b9-9a1d-e656c6318ce6' { set isofile="/iso/Linux/debian-buster-10.1.0-amd64/debian-10.1.0-amd64-BD-1.iso" insmod ext2 loopback loop (hd2,4)$isofile echo "Starting $isofile..." linux (loop)/install.amd/vmlinuz findiso=$isofile priority=low initrd (loop)/install.amd/initrd.gz } ``` Do not use `initrd.gz` from hd-media image, just use that in CD, since there * `grub-install /dev/sdc` * Booting * GRUB: Debian install image * Alt-F2: enter a console * `mount -t vfat /dev/sdXY /mnt/custom/module` * Install kernel modules * `udpkg -i /mnt/custom/module/ext4-modules-4.19.0-5-amd64-di_4.19.37-5_amd64.udeb` * `udpkg -i /mnt/custom/module/loop-modules-4.19.0-5-amd64-di_4.19.37-5_amd64.udeb` * `depmod` * `modprobe ext4` * `mount -t ext4 /dev/sdXY /mnt/custom/iso` * `modprobe loop` ## Install Debian Buster 10.1.0 amd64 * **Debian GNU/Linux UEFI Installer menu** Install * **[!!] Select a language** Language: English * **[!!] Select your location** Country, territory or area: other Continent or region: Asia Country, territory or area: Taiwan * **[!] Configure locales** Country to base default locale settings on: United States * **[!!] Configure the keyboard** Keymap to use: American English * **[!!] Configure the network** Primary network interface: enp2s0f0: Intel Corporation 82576 Gigabit Network Connection * **[!!] Configure the network** Network autoconfiguration failed Continue * **[!!] Configure the network** Network configuration method: Configure network manually IP address: 10.0.0.2 Netmask: 255.255.255.0 Gateway: Name server addresses: * **[!] Configure the network** Hostname: vm-main Domain name: local * **[!!] Set up users and passwords** Root password: \*\*\*\*\*\*\*\* Re-enter password to verify: \*\*\*\*\*\*\*\* Full name for the new user: sysadm Username for your account: sysadm Choose a password for the new user: \*\*\*\*\*\*\*\* Re-enter password to verify: \*\*\*\*\*\*\*\* * **[!!] Partition disks** Force UEFI installation? No * **[!!] Partition disks** Partitioning method: Manual ``` SCSI5 (0, 0, 0) (sdb) – 1.0 TB ATA ST1000DM010-2EP1 1.0 MB FREE SPACE #1 931.5 GB f btrfs /home 335.4 kB FREE SPACE SCSI5 (0, 0, 0) (sdc) – 256.1 GB ATA SanDisk SD8SN8U2 1.0 MB FREE SPACE #1 254.8 MB K biosgrub #2 2.0 GB f btrfs /boot #3 20.0 GB f btrfs / #4 233.8 GB f ext4 /var/lib/docker 335.4 kB FREE SPACE ``` Finish partitioning and write changes to disk Write the changes to disks? Yes * **[!] Configuring popularity-contest** Participate in the package usage survey? No * **[!] Software selection** Choose software to install: [\*] Debian desktop environment [\*] SSH server [\*] standard system utilities * **[!] Install the GRUB boot loader on a hard disk** Install the GRUB boot loader to the master boot record? Yes * **[!] Install the GRUB boot loader on a hard disk** Device for boot loader installation: /dev/sda (ata-SanDisk_SD8SN8U256G1122_160908440972) Force GRUB installation to the EFI removable media path? Yes * **[!!] Finish the installation** Installation complete Continue ## Configure Xorg * **Install firmwares** * `dmesg -S` * `[drm:radeon_pci_probe [radeon]] *ERROR* radeon kernel modesetting for R600 or later requires firmware installed` * `dpkg -i firmware-amd-graphics_20190114-2_all.deb` * https://packages.debian.org/buster/all/firmware-amd-graphics/download * Non-free firmware for Radeon R600 driver * `/boot/initrd.img-4.19.0-6-amd64` is updated * No need to run `grub-install /dev/sda` since `initrd` is updated * **Configurations** | `/etc/pam.d/gdm-password` || | - | - | | `#auth required pam_succeed_if.so user != root quite_success` | Allow root login from GDM | | `/etc/gdm3/greeter.dconf-defaults` || | - | - | | `[org/gnome/login-screen]` `disable-user-list=true` | Do not list user accounts while login | | `[org/gnome/settings-daemon/plugins/power]` `sleep-inactive-ac-timeout=0` `sleep-inactive-ac-type='nothing'` `sleep-inactive-battery-timeout=0` `sleep-inactive-battery-type='nothing'`| Turn off power management | | `[org/gnome/desktop/screensaver]` `idle-activation-enabled=false` | Disable screen saver | * **Restart GDM** * `/etc/init.d/gdm3 restart` * **Configure clock** [Activities] [Show Applications] [Tweeks] [Top Bar] **Clock** Weekday ON Date ON Seconds ON * ~~**Configure audio**~~ [Activities] [Show Applications] [Settings] [Sound] [Output] Choose a device for sound output: RV620 HDMI Audio [Radeon HD 3400 Series] Digital Stereo (HDMI) * ~~**Disable screen saver**~~ [Activities] [Show Applications] [dconf Editor] [org.gnome.desktop.screensaver] idle-activation-enabled: [ ] ## User accounts | Account | Command | Comment | | ----------------- | ------- | ------- | | ~~**`backup`**~~ | `smbpasswd -a backup` | Used for system backups | | **`vm`** | `adduser vm` | Account for VM administration | | | `addgroup vm backup` | For accessing backup files | ## Network configuration * ~~**Install packages**~~ | `apt-get install` || | ---------------- | - | | **`resolvconf`** | | * **Configure network interfaces** * Configure `eno1` * `/etc/systemd/network/eno1.network` ``` [Match] Name=eno1 [Network] ``` * Configure `enp2s0f0` * `/etc/systemd/network/mac1@enp2s0f0.netdev` ``` [NetDev] Name=mac1@enp2s0f0 Kind=macvlan [MACVLAN] Mode=bridge ``` * `/etc/systemd/network/mac1@enp2s0f0.network` ``` [Match] Name=mac1@enp2s0f0 [Network] IPForward=yes Address=10.0.0.2/24 Gateway=10.0.0.1 ``` * `/etc/systemd/network/enp2s0f0.network` ``` [Match] Name=enp2s0f0 [Network] MACVLAN=mac1@enp2s0f0 ``` * Configure `enp2s0f1` * `/etc/systemd/network/mac1@enp2s0f1.netdev` ``` [NetDev] Name=mac1@enp2s0f1 Kind=macvlan [MACVLAN] Mode=bridge ``` * `/etc/systemd/network/mac1@enp2s0f1.network` ``` [Match] Name=mac1@enp2s0f1 [Network] IPForward=yes Address=172.16.0.2/24 ``` * `/etc/systemd/network/enp2s0f1.network` ``` [Match] Name=enp2s0f1 [Network] MACVLAN=mac1@enp2s0f1 ``` * **Modify services** * `systemctl disable network-manager` * `systemctl enable systemd-networkd` * ~~**Disable auto-configuration of eth devices (a.k.a. eth0)**~~ [Activities] [Show Applications] [Settings] [Network] Ethernet (eno1) [] Ethernet (enp2s0f0) [] Ethernet (enp2s0f1) [] ## System configurations ### Mount points * **Install packages** | `apt-get install` || | ---------------- | -------------- | | **`cifs-utils`** | CIFS utilities | * **Create mount points** | `mkdir -p` || | --------------------- | ---------------- | | **`/mnt/TMGN`** | NAS server | | **`/mnt/debian/iso` `/mnt/debian/1` `/mnt/debian/2` `/mnt/debian/3` `/mnt/debian/4`** | Debian Buster BD ISO files | | **`/mnt/vm`** | Virtual machines | | **`/mnt/db`** | Databases | | **`/mnt/vcs`** | VCSes | | **`/mnt/www`** | WWW | | **`/mnt/VirtualBox`** | VirtualBox | * **Password file for accessing NAS** * `/etc/cifs/TMGN.passwd` (chmod 600) ``` username=******** password=******** ``` * **Mount table** * `/etc/fstab` ``` + //172.16.0.16/server/iso/Linux/debian-buster-10.1.0-amd64 /mnt/debian/iso cifs credentials=/etc/cifs/TMGN.passwd,ro 0 2 + //172.16.0.16/server/vm /mnt/vm cifs credentials=/etc/cifs/TMGN.passwd,uid=vm,gid=vm 0 2 + //172.16.0.16/server/db /mnt/db cifs credentials=/etc/cifs/TMGN.passwd,uid=www-data,gid=www-data,dir_mode=0775,file_mode=0664 0 2 + //172.16.0.16/server/vcs /mnt/vcs cifs credentials=/etc/cifs/TMGN.passwd,uid=www-data,gid=www-data 0 2 + //172.16.0.16/server/www /mnt/www cifs credentials=/etc/cifs/TMGN.passwd,uid=www-data,gid=www-data 0 2 + //172.16.0.16/server/vm/VirtualBox /mnt/VirtualBox cifs credentials=/etc/cifs/TMGN.passwd,uid=vm,gid=vm,fsc 0 2 + //172.16.0.16/server /mnt/TMGN cifs credentials=/etc/cifs/TMGN.passwd,uid=sysadm 0 2 + /mnt/debian/iso/debian-10.1.0-amd64-BD-1.iso /mnt/debian/1 iso9660 ro,loop 0 0 + /mnt/debian/iso/debian-10.1.0-amd64-BD-2.iso /mnt/debian/2 iso9660 ro,loop 0 0 + /mnt/debian/iso/debian-10.1.0-amd64-BD-3.iso /mnt/debian/3 iso9660 ro,loop 0 0 + /mnt/debian/iso/debian-10.1.0-amd64-BD-4.iso /mnt/debian/4 iso9660 ro,loop 0 0 ``` * **Remount all** * `mount -a` ### APT * `/etc/apt/sources.list` ``` # deb cdrom:[.....] + deb [trusted=yes] file:///mnt/debian/1/debian/ buster main contrib + deb [trusted=yes] file:///mnt/debian/2/debian/ buster main contrib + deb [trusted=yes] file:///mnt/debian/3/debian/ buster main contrib + deb [trusted=yes] file:///mnt/debian/4/debian/ buster main contrib # deb http://security.debian.org/ buster/updates main contrib # deb-src http://security.debian.org/ buster/updates main contrib ``` * `apt-get update` * **Install packages** | `apt-get install` || | ------------------- | - | | **`vim`** | | | **`zip`** | | | **`screen`** | | | **`smartmontools`** | | | **`net-tools`** | | | ~~**`aufs-tools`**~~ | | | ~~**`genisoimage`**~~ | | ### Software configurations * **sudo** | `addgroup sysadm sudo` | Allow administrator sudo | | - | - | * **vim** | `/etc/vim/vimrc` || | ---------------- | ----------------------- | | `syntax on` | Enable syntax highlight | | `set mouse=a` | Enable mouse auto copy | | + `set hlsearch` | Enable search highlight | * **ssh daemon** | `/etc/ssh/sshd_config` || | -------------------- | ----------------------------- | | `PermitRootLogin no` | Deny root login from SSH | | `UseDNS no` | Prevent waiting for SSH login | * **Kernel modules** | `/etc/modprobe.d/loop.conf` || | -------------------------- | ----------------------------------- | | `options loop max_loop=64` | Maximum number of loop devices = 64 | * **bash** | `/root/.bashrc` || | -------------------------- | ---------------------- | | `export LS_OPTIONS='--color=auto'` `eval $(dircolors)` `alias ls='ls $LS_OPTIONS'` | Show ls colors for root sh | | + `. /etc/bash_completion` | Enable bash completion | ## Generate SSL ROOT certificate ### Generate root certificate * Prepare `openssl.cnf` * Generate root private key `abinitiogo.key` * `openssl genrsa -out private/abinitiogo.key 2048` * chmod: 640 * Generate root certificate `abinitiogo.crt` * `openssl req -new -sha512 -x509 -config openssl.cnf -key private/abinitiogo.key -out certs/abinitiogo.crt -days 7305` Country Name (2 letter code): TW State or Province Name (full name): Taiwan Locality Name (eg, city): Taipei Organization Name (eg, company): Ab Initio Go Organization Organizational Unit Name (eg, section): Certificate Common Name (e.g. server FQDN or YOUR name): abinitiogo.org Email Address: cert@abinitiogo.org * Prepare signing serial `abinitiogo.srl` * `echo 01 > certs/abinitiogo.srl` ### Install root certificate * Linux: Debian / Ubuntu * Install packages | `apt-get install` || | --------------------- | - | | **`ca-certificates`** | | * Obtain `abinitiogo.crt`, and put it in `/usr/local/share/ca-certificates/extra/` * `update-ca-certificates` ### Generate client certificate * At client side * Generate certificate private key `ssl-cert.key` * `openssl genrsa -out private/ssl-cert.key 2048` * chmod: 640 * Generate certificate request `xxxxx.csr` * `openssl req -new -sha512 -config openssl.cnf -key private/ssl-cert.key -out reqs/xxxxx.csr` * At server side * Obtain `xxxxx.csr` from client * Generate client certificate `xxxxx.pem` * `openssl x509 -req -sha512 -extfile openssl.cnf -extensions v3_req -days 3652 -in reqs/xxxxx.csr -CA certs/abinitiogo.crt -CAkey private/abinitiogo.key -out certs/xxxxx.pem` * Deliver `xxxxx.pem` to client ## Install Docker ### References https://docs.docker.com/install/linux/docker-ce/debian/ ### Install Docker engine * Install packages | `apt-get install` || | -------------------------------- | - | | **`apt-transport-https`** | | | **`curl`** | | | **`gnupg2`** | | | **`software-properties-common`** | | * Docker key * `curl -fsSL https://download.docker.com/linux/debian/gpg | apt-key add -` * `apt-key fingerprint 9DC858229FC7DD38854AE2D88D81803C0EBFCD88` * Docker repository * `/etc/apt/sources.list.d/docker.list` ``` deb [arch=amd64] https://download.docker.com/linux/debian buster stable ``` * `apt-get update` * Install Docker engine | `apt-get install` | Version | | ------------------- | ----------------------------- | | **`docker-ce`** | `5:19.03.2~3-0~debian-buster` | | **`docker-ce-cli`** | `5:19.03.2~3-0~debian-buster` | | **`containerd.io`** | `1.2.6-3` | * Configurations * Enable user `vm` to access Docker * `addgroup vm docker` * Mount `/var/lib/docker` to a separate disk partition * Link volume space * `ln -s /home/docker/volumes /var/lib/docker/volumes` * Enable Docker service * `systemctl enable docker` * `systemctl start docker` ### Install `docker-compose` * Version 1.24.1 * `curl -L "https://github.com/docker/compose/releases/download/1.24.1/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose` * `chmod +x /usr/local/bin/docker-compose` ### Configure Docker networks | Network | Command | | ------- | ------- | | eno1.docker-net eno1 172.16.1.0/24 | `docker network create --driver=macvlan --opt parent=eno1 --opt macvlan_mode=bridge --subnet=172.16.1.0/24 eno1.docker-net` | | enp2s0f0.docker-net enp2s0f0 10.0.0.0/24 | `docker network create --driver=macvlan --opt parent=enp2s0f0 --opt macvlan_mode=bridge --subnet=10.0.0.0/24 --gateway=10.0.0.1 enp2s0f0.docker-net` | | enp2s0f1.docker-net enp2s0f1 172.16.0.0/24 | `docker network create --driver=macvlan --opt parent=enp2s0f1 --opt macvlan_mode=bridge --subnet=172.16.0.0/24 --gateway=172.16.0.1 enp2s0f1.docker-net` | | dmz.docker-net 172.18.0.0/16 | `docker network create --driver=bridge --opt com.docker.network.bridge.name=br-d-dmz --opt com.docker.network.bridge.enable_ip_masquerade=false --subnet=172.18.0.0/16 --gateway=172.18.0.1 dmz.docker-net` | | adsl.docker-net 192.168.255.0/29 | `docker network create --driver=bridge --opt com.docker.network.bridge.name=br-d-adsl --opt com.docker.network.bridge.enable_ip_masquerade=false --subnet=192.168.255.0/29 --gateway=192.168.255.1 adsl.docker-net` | | l2tpd.docker-net 192.168.255.8/29 | `docker network create --driver=bridge --opt com.docker.network.bridge.name=br-d-l2tpd --opt com.docker.network.bridge.enable_ip_masquerade=false --subnet=192.168.255.8/29 --gateway=192.168.255.9 l2tpd.docker-net` | | pptpd.docker-net 192.168.255.16/29 | `docker network create --driver=bridge --opt com.docker.network.bridge.name=br-d-pptpd --opt com.docker.network.bridge.enable_ip_masquerade=false --subnet=192.168.255.16/29 --gateway=192.168.255.17 pptpd.docker-net` | ### Setup boot * `/etc/rc.local (chmod 755)` ``` #!/bin/sh DOCKER_network_wait_ready() { network=$1 for i in 0 1 2; do for j in 0 1 2 3 4 5 6 7 8 9; do if docker network inspect $network > /dev/null; then return 0 fi sleep 1 done done return 1 } DOCKER_network_wait_ready dmz.docker-net || exit 1 ip addr del 172.18.0.1/16 dev br-d-dmz ip addr add 172.18.255.254/16 dev br-d-dmz DOCKER_network_wait_ready adsl.docker-net || exit 1 ip addr del 192.168.255.1/29 dev br-d-adsl DOCKER_network_wait_ready l2tpd.docker-net || exit 1 ip addr del 192.168.255.9/29 dev br-d-l2tpd DOCKER_network_wait_ready pptpd.docker-net || exit 1 ip addr del 192.168.255.17/29 dev br-d-pptpd (cd ~vm/docker/network && runuser -u vm -- docker-compose up -d) iptables -D DOCKER-ISOLATION-STAGE-1 -i br-d-dmz ! -o br-d-dmz -j DOCKER-ISOLATION-STAGE-2 ```