diff --git a/INSTALL-ubuntu.md b/archive/INSTALL-ubuntu.md similarity index 97% rename from INSTALL-ubuntu.md rename to archive/INSTALL-ubuntu.md index b161365..187da7e 100644 --- a/INSTALL-ubuntu.md +++ b/archive/INSTALL-ubuntu.md @@ -88,7 +88,7 @@ Host Volume | Target Directory | Comment C A U T I O N : After the Ubiquity installer starts the file copy, execute 2nd step script quickly before the installer finishes. -![Partitioning](image/ubuntu_partitioning.png) +![Partitioning](../image/ubuntu_partitioning.png) ## The second script Run the following script on the shell window, during the Ubiquity runs. Otherwise, Ubiquity fails at the end of installation. If you run this script too early, it terminates with error message. This is safe. Run it again later ( but before Ubiquity finish). @@ -98,12 +98,12 @@ C A U T I O N : Do not reboot at the end of Ubiquity installation. Click "contin ```bash source 2-para-install.sh ``` -![Installing](image/ubuntu_installing.png) +![Installing](../image/ubuntu_installing.png) ## Click continue As explained above, do not reboot. Click "Continue Testing". If you reboot at here, system will ask you the passphrase twice. -![Installing](image/ubuntu_done.png) +![Installing](../image/ubuntu_done.png) ## The third script After Ubiquity finish the installation, run the 3rd script. This is fully automatic. There is nothing you have to do. diff --git a/ubuntu/1-pre-install.sh b/archive/ubuntu/1-pre-install.sh similarity index 100% rename from ubuntu/1-pre-install.sh rename to archive/ubuntu/1-pre-install.sh diff --git a/ubuntu/2-para-install.sh b/archive/ubuntu/2-para-install.sh similarity index 100% rename from ubuntu/2-para-install.sh rename to archive/ubuntu/2-para-install.sh diff --git a/ubuntu/3-post-install.sh b/archive/ubuntu/3-post-install.sh similarity index 100% rename from ubuntu/3-post-install.sh rename to archive/ubuntu/3-post-install.sh diff --git a/voidlinux/1-pre-install.sh b/archive/voidlinux/1-pre-install.sh similarity index 100% rename from voidlinux/1-pre-install.sh rename to archive/voidlinux/1-pre-install.sh diff --git a/voidlinux/2-para-install.sh b/archive/voidlinux/2-para-install.sh similarity index 100% rename from voidlinux/2-para-install.sh rename to archive/voidlinux/2-para-install.sh diff --git a/voidlinux/3-post-install.sh b/archive/voidlinux/3-post-install.sh similarity index 100% rename from voidlinux/3-post-install.sh rename to archive/voidlinux/3-post-install.sh diff --git a/script/config.sh b/script/config.sh new file mode 100644 index 0000000..f73772f --- /dev/null +++ b/script/config.sh @@ -0,0 +1,50 @@ +# Configuration parameters for YaFDE + +# Storage device to install the linux. +export DEV="/dev/sda" + +# Whether you want to erase all contents of the storage device or not. +# 1 : Yes, I want to erase all. +# 0 : No, I don't. I want to add to the existing LUKS volume. +export ERASEALL=1 + +# Logical Volume name for your Linux installation. Keep it unique from other distribution. +export LVROOTNAME="ubuntu" + +# Logical volume size of the Linux installation. +# 30% mean, new logical volume will use 30% of the free space in the LVM volume group. +# For example, assume the free space is 100GB, and LVROOTSIZE is 30%FREE. Script will create 30GB logical volume. +export LVROOTSIZE="50%FREE" + +# Set the size of EFI partition and swap partition. The unit is Byte. you can use M,G... notation. +export EFISIZE="100M" +export LVSWAPSIZE="8G" + +# Usually, these names can be left untouched. +# If you change, keep them consistent through all instllation in your system. +export CRYPTPARTNAME="luks_volume" +export VGNAME="vg1" +export LVSWAPNAME="swap" + +# Void Linux only. Ignored in Ubuntu. +# The font size of the void-installer +export XTERMFONTSIZE=11 + +# !!!!!!!!!!!!!! DO NOT EDIT FOLLOWING LINES. !!!!!!!!!!!!!! + +# Detect firmware type. 1 : EFI, 0 : BIOS +if [ -d /sys/firmware/efi ]; then +export ISEFI=1 # Yes, EFI +else +export ISEFI=0 # No, BIOS +fi # is EFI firmaare? + +# Set partition number based on the firmware type +if [ ${ISEFI} -eq 1 ] ; then +# EFI firmware +export EFIPARTITION=1 +export CRYPTPARTITION=2 +else +# BIOS firmware +export CRYPTPARTITION=1 +fi # EFI firmware diff --git a/script/yafde-ubuntu.sh b/script/yafde-ubuntu.sh new file mode 100644 index 0000000..14fc373 --- /dev/null +++ b/script/yafde-ubuntu.sh @@ -0,0 +1,273 @@ +#!/bin/bash + +# Varidate whether script is executed as sourced or not +(return 0 2>/dev/null) && sourced=1 || sourced=0 +if [ $sourced -eq 0 ] ; then + cat <&2 +***** ERROR : Must execute as source ***** +Execute as following : +source 1-pre-install.sh + +Installation terminated. +HEREDOC + exit # use "exit" instead of "return", if not "sourced" execusion +fi # "sourced" validation + +# Load configuration parameter +source config.sh + +# ----- Confirmations ----- +# Distribution check +uname -a | grep ubuntu -i > /dev/null +if [ $? -eq 1 ] ; then # "Ubuntu" is not found in the OS name. + echo "*********************************************************************************" + uname -a + cat <&2 + +Installation terminated. +HEREDOC + return + fi # if YES + +fi # "Ubuntu" is not found in the OS name. + +# For surre ask the config.sh is edited +echo "Did you edit config.sys? Are you ready to install? [Y/N]" +read YESNO +if [ ${YESNO} != "Y" -a ${YESNO} != "y" ] ; then + cat <&2 + +Installation terminated. +HEREDOC + return +fi # if YES + +# For sure ask ready to erase. +if [ ${ERASEALL} -eq 1 ] ; then + echo "Are you sure you want to erase entire ${DEV}? [Y/N]" + read YESNO + if [ ${YESNO} != "Y" -a ${YESNO} != "y" ] ; then + cat <&2 +Check config.sh. The variable ERASEALL is ${ERASEALL}. + +Installation terminated. +HEREDOC + return + fi # if YES +fi # if erase all + +# ----- Set Passphrase ----- +# Input passphrase +echo "Type passphrase for the disk encryption." +read -sr PASSPHRASE +export PASSPHRASE + +echo "Type passphrase again, to confirm." +read -sr PASSPHRASE_C + +# Validate whether both are indentical or not +if [ ${PASSPHRASE} != ${PASSPHRASE_C} ] ; then + cat <&2 +***** ERROR : Passphrase doesn't match ***** +Installation terminated. +HEREDOC + return +fi # passphrase validation + + +# ----- Erase entire disk, create partitions, format them and encrypt the LUKS partition ----- +if [ ${ERASEALL} -eq 1 ] ; then + + # Assign specified space and rest of disk to the EFI and LUKS partition, respectively. + if [ ${ISEFI} -eq 1 ] ; then + # Zap existing partition table and create new GPT + echo "...Initialize ${DEV} with GPT." + sgdisk --zap-all "${DEV}" + # Create EFI partition and format it + echo "...Create an EFI partition on ${DEV}." + sgdisk --new=${EFIPARTITION}:0:+${EFISIZE} --change-name=${EFIPARTITION}:"EFI System" --typecode=${EFIPARTITION}:ef00 "${DEV}" + echo "...Format the EFI parttion." + mkfs.vfat -F 32 -n EFI-SP "${DEV}${EFIPARTITION}" + # Create Linux partition + echo "...Create a Linux partition on ${DEV}." + sgdisk --new=${CRYPTPARTITION}:0:0 --change-name=${CRYPTPARTITION}:"Linux LUKS" --typecode=${CRYPTPARTITION}:8309 "${DEV}" + # Then print them + sgdisk --print "${DEV}" + else + # Zap existing partition table + echo "...Erase partition table of ${DEV}." + dd if=/dev/zero of=${DEV} bs=512 count=1 + # Create MBR and allocate max storage for Linux partition + echo "...Create a Linux partition on ${DEV} with MBR." + sfdisk ${DEV} <&2 +***** ERROR : Cannot open LUKS volume "${CRYPTPARTNAME}" on ${DEV}${CRYPTPARTITION}. ***** +Check passphrase and config.txt + +Installation terminated. +HEREDOC + return +fi # if crypt volume is unable to open + +# ----- Configure the LVM in LUKS volume ----- +# Check volume group ${VGNAME} exist or not +vgdisplay -s ${VGNAME} &> /dev/null +if [ $? -eq 0 ] ; then # is return value 0? ( exist ?) + echo "...Volume group ${VGNAME} already exist. Skipped to create. No problem." +else + echo "...Initialize a physical volume on \"${CRYPTPARTNAME}\"" + pvcreate /dev/mapper/${CRYPTPARTNAME} + echo "...And then create Volume group \"${VGNAME}\"." + vgcreate ${VGNAME} /dev/mapper/${CRYPTPARTNAME} +fi # if /dev/volume-groupt not exist + +# Create a SWAP Logical Volume on VG, if it doesn't exist +if [ -e /dev/mapper/${VGNAME}-${LVSWAPNAME} ] ; then + echo "...Swap volume already exist. Skipped to create. No problem." +else + echo "...Create logical volume \"${LVSWAPNAME}\" on \"${VGNAME}\"." + lvcreate -L ${LVSWAPSIZE} -n ${LVSWAPNAME} ${VGNAME} +fi # if /dev/mapper/swap volume already exit. + +# Create a ROOT Logical Volume on VG. +if [ -e /dev/mapper/${VGNAME}-${LVROOTNAME} ] ; then + cat <&2 +***** ERROR : Logical volume "${VGNAME}-${LVROOTNAME}" already exists. ***** +Check LVROOTNAME environment variable in config.txt. + +Installation terminated. +HEREDOC + return +else + echo "...Create logical volume \"${LVROOTNAME}\" on \"${VGNAME}\"." + lvcreate -l ${LVROOTSIZE} -n ${LVROOTNAME} ${VGNAME} +fi # if the root volun already exist + +# ****************************** Para-install stage ****************************** + +# Start GUI installer +ubiquity & +# Store the PID of GUI installer +ubiquity_pid=$! + +# While the /etc/default/grub in the install target is NOT existing, +# Keep sleeping +while [ ! -e /target/etc/default/grub ] +do + sleep 1 # 1sec. +done + +# Perhaps, too neuvous. Wait 1 more sectond to avoid the rece condition. +sleep 1 # 1sec. + +# Make target GRUB aware to the crypt partition +echo "...Add GRUB_ENABLE_CRYPTODISK entry to /target/etc/default/grub " +echo "GRUB_ENABLE_CRYPTODISK=y" >> /target/etc/default/grub + +# Now, we just wait the end of installation by Ubiquity. +echo "...Waiting the for GUI installer finishes" +wait $ubiquity_pid +echo "...The return value of qubiquity is : " $? + + +# For surre ask the config.sh is edited +echo "Now, final stage. Do you continue? [Y/N]" +read YESNO +if [ ${YESNO} != "Y" -a ${YESNO} != "y" ] ; then + cat <&2 + +Installation terminated. +HEREDOC + return +fi # if YES + +# ****************************** Post-install stage ****************************** + +# Varidate whether script is executed as sourced or not +(return 0 2>/dev/null) && sourced=1 || sourced=0 +if [ $sourced -eq 0 ] ; then + cat <&2 +***** ERROR : Must execute as source ***** +Execute as following : +source 3-post-install.sh + +Installation terminated. +HEREDOC + exit # use "exit" instead of "return", if not "sourced" execusion +fi # "sourced" validation + +## Mount the target file system +# /target is created by the Ubiquity installer +echo "...Mount /dev/mapper/${VGNAME}-${LVROOTNAME} on /target." +mount /dev/mapper/${VGNAME}-${LVROOTNAME} /target + +# And mount other directories +echo "...Mount all other dirs." +for n in proc sys dev etc/resolv.conf; do mount --rbind "/$n" "/target/$n"; done + +# Change root and create the keyfile and ramfs image for Linux kernel. +echo "...Chroot to /target." +cat <> /etc/cryptsetup-initramfs/conf-hook +echo "UMASK=0077" >> /etc/initramfs-tools/initramfs.conf + +# Prepare a key file to embed in to the ramfs. +echo "...Prepair key file." +mkdir /etc/luks +dd if=/dev/urandom of=/etc/luks/boot_os.keyfile bs=4096 count=1 status=none +chmod u=rx,go-rwx /etc/luks +chmod u=r,go-rwx /etc/luks/boot_os.keyfile + +# Add a key to the key file. Use the passphrase in the environment variable. +echo "...Add a key to the key file." +printf %s "${PASSPHRASE}" | cryptsetup luksAddKey -d - "${DEV}${CRYPTPARTITION}" /etc/luks/boot_os.keyfile + +# Add the LUKS volume information to /etc/crypttab to decrypt by kernel. +echo "...Add LUKS volume info to /etc/crypttab." +echo "${CRYPTPARTNAME} UUID=$(blkid -s UUID -o value ${DEV}${CRYPTPARTITION}) /etc/luks/boot_os.keyfile luks,discard" >> /etc/crypttab + +# Finally, update the ramfs initial image with the key file. +echo "...Upadte initramfs." +update-initramfs -uk all + +# Leave chroot +exit +HEREDOC + +# Finishing message +cat <> /target/etc/default/grub -``` -![Installing](image/ubuntu_installing.png) - -## Click continue -As noted above, do not reboot. Click "Continue Testing". If you reboot at here, system will ask you the passphrase twice. - -![Installing](image/ubuntu_done.png) - -## Mount the target file system -After Ubiquity finish the installation, mount the target directories and chroot to that. -```bash -# /target is created by the Ubiquity installer -mount /dev/mapper/${VGNAME}-${LVROOTNAME} /target - -# And mount other directories -for n in proc sys dev etc/resolv.conf; do mount --rbind "/$n" "/target/$n"; done - -# Change root -chroot /target /bin/bash -``` -## Add auto decryption to the target kernel -Now, we are at critical phase. To avoid system asks passphrase twice, -we have to embed the encryption key inside ramfs initial image. -This image with key is stored in the LUKS volume, so, it is in the safe storage. -GRUB decrypt this LUKS volume, upload the ramfs image to the RAM, -and pass it to the booted Linux kernel as memory pointer. - -As a result, GRUB can pass the encryption key to Linux kernel as safe way. -```bash -# Mount the rest of partitions by target /etc/fstab -mount -a - -# Set up the kernel hook of encryption -apt install -y cryptsetup-initramfs -echo "KEYFILE_PATTERN=/etc/luks/*.keyfile" >> /etc/cryptsetup-initramfs/conf-hook -echo "UMASK=0077" >> /etc/initramfs-tools/initramfs.conf - -# Prepare a key file to embed in to the ramfs. -mkdir /etc/luks -dd if=/dev/urandom of=/etc/luks/boot_os.keyfile bs=4096 count=1 -chmod u=rx,go-rwx /etc/luks -chmod u=r,go-rwx /etc/luks/boot_os.keyfile - -# Add a key to the key file. Use the passphrase in the environment variable. -printf %s "${PASSPHRASE}" | cryptsetup luksAddKey -d - "${DEV}${CRYPTPARTITION}" /etc/luks/boot_os.keyfile - -# Add the LUKS volume information to /etc/crypttab to decrypt by kernel. -echo "${CRYPTPARTNAME} UUID=$(blkid -s UUID -o value ${DEV}${CRYPTPARTITION}) /etc/luks/boot_os.keyfile luks,discard" >> /etc/crypttab - -# Finally, update the ramfs initial image with the key file. -update-initramfs -uk all -``` -## Finishing installation -Done!! - -You can reboot. Linux and GRUB are installed in a encrypted storage. The system will ask you the passphrase only once when GRUB starts. -```bash -exit -reboot -``` - -# Acknowledgments -These scripts are based on the script shared on the [myn's diary](https://myn.hatenablog.jp/entry/install-ubuntu-focal-with-lvm-on-luks). That page contains rich information, hint and techniques around the encrypted volume and Ubiquity installer. \ No newline at end of file