Remote Installation¶

passwd root

nohup dd if=/dev/zero of=/dev/sda bs=512  &
nohup dd if=/dev/zero of=/dev/sdb bs=512  &

parted -s -a optimal /dev/sda
parted -s -a optimal /dev/sdb

parted -s /dev/sda mklabel gpt
parted -s /dev/sdb mklabel gpt

parted -s /dev/sda mkpart primary 4096s 8191s
parted -s /dev/sdb mkpart primary 4096s 8191s

parted -s /dev/sda mkpart primary 8192s 1056767s
parted -s /dev/sdb mkpart primary 8192s 1056767s

parted -s /dev/sda mkpart primary 1056768s 34611199s
parted -s /dev/sdb mkpart primary 1056768s 34611199s

parted -s /dev/sda mkpart primary 34611200s 51388415s
parted -s /dev/sdb mkpart primary 34611200s 51388415s

parted -s /dev/sda mkpart primary 51388416s 59777023s
parted -s /dev/sdb mkpart primary 51388416s 59777923s

parted -s /dev/sda name 1 grub
parted -s /dev/sdb name 1 grub

parted -s /dev/sda name 2 boot
parted -s /dev/sdb name 2 boot

parted -s /dev/sda name 3 rootfs
parted -s /dev/sdb name 3 rootfs

parted -s /dev/sda name 4 data
parted -s /dev/sdb name 4 data

parted -s /dev/sda name 5 swap
parted -s /dev/sdb name 5 swap

parted -s /dev/sda set 1 bios_grub on
parted -s /dev/sdb set 1 bios_grub on

mknod /dev/md2 b 9 2
mknod /dev/md3 b 9 3
mknod /dev/md4 b 9 4
mknod /dev/md5 b 9 5

cat >> /etc/mdadm.conf << "EOF"
MAILADDR root@localhost
MAILFROM root@localhost
CREATE metadata=1.2
HOMEHOST <none>
DEVICE /dev/sd*[0-9]
EOF

mdadm --create /dev/md2 --name=boot --bitmap=internal --level=raid1 --raid-devices=2 --metadata=1.2 /dev/sd[ab]2
mdadm --create /dev/md3 --name=root --bitmap=internal --level=raid1 --raid-devices=2 --metadata=1.2 /dev/sd[ab]3
mdadm --create /dev/md4 --name=data --bitmap=internal --level=raid1 --raid-devices=2 --metadata=1.2 /dev/sd[ab]4
mdadm --create /dev/md5 --name=swap --bitmap=internal --level=raid1 --raid-devices=2 --metadata=1.2 /dev/sd[ab]5

mke2fs -c -b 4096 -t ext2 /dev/md2
tune2fs -c 0 -i 0 /dev/md2
tune2fs -e continue /dev/md2
tune2fs -O dir_index /dev/md2
tune2fs -o user_xattr,acl /dev/md2
e2fsck -D /dev/md2

mke2fs -c -b 4096 -t ext3 -j /dev/md3
tune2fs -c 0 -i 0 /dev/md3
tune2fs -e continue /dev/md3
tune2fs -O dir_index,large_file /dev/md3
tune2fs -o user_xattr,acl,journal_data /dev/md3
e2fsck -D /dev/md3

mke2fs -c -b 4096 -t ext3 -j /dev/md4
tune2fs -c 0 -i 0 /dev/md4
tune2fs -e continue /dev/md4
tune2fs -O dir_index,large_file /dev/md4
tune2fs -o user_xattr,acl,journal_data /dev/md4
e2fsck -D /dev/md4

mkswap -c /dev/md5

swapon /dev/md5

mkdir -p /mnt/gentoo
mount -t ext3 -o defaults,relatime,barrier=1 /dev/md3 /mnt/gentoo

wget -q -O - "https://gentoo.osuosl.org/releases/amd64/autobuilds/latest-stage3-amd64-hardened+nomultilib.txt" | tail -n 1 | \
     xargs -I % wget -q -O - "https://gentoo.osuosl.org/releases/amd64/autobuilds/%" | tar xpjvf - -C /mnt/gentoo/

cp /etc/resolv.conf /mnt/gentoo/etc/resolv.conf

mount -t proc none /mnt/gentoo/proc
mount -o bind /sys /mnt/gentoo/sys
mount -o bind /dev /mnt/gentoo/dev
mount -o bind /dev/pts /mnt/gentoo/dev/pts
mount -o bind /dev/shm /mnt/gentoo/dev/shm

chroot /mnt/gentoo /bin/env -i HOME=/root TERM=$TERM PS1='\u:\w\$ ' PATH=/sbin:/bin:/usr/sbin:/usr/bin /bin/bash +h

mkdir /data

mount -t ext2 -o defaults,relatime /dev/md2 /boot

echo "Europe/Berlin" > /etc/timezone
emerge --config sys-libs/timezone-data

grep -v rootfs /proc/mounts > /etc/mtab

env-update
source /etc/profile

cat > /etc/portage/make.conf << "EOF"
CHOST="x86_64-pc-linux-gnu"
CFLAGS="-O2 -pipe -fomit-frame-pointer -march=native"
CXXFLAGS="${CFLAGS}"
FFLAGS="${CFLAGS}"
FCFLAGS="${FFLAGS}"
PORTDIR="/usr/portage"
DISTDIR="${PORTDIR}/distfiles"
PKGDIR="${PORTDIR}/packages"
ACCEPT_KEYWORDS="amd64"
MAKEOPTS="-j2"
LINGUAS="en de"
PAX_MARKINGS="XT"
USE="-* acl berkdb bzip2 caps crypt cxx ecdsa fam fdformat filecaps \
    firmware-loader gcrypt gd gdbm gmp hardened iconv icu idn ipc ipv6 \
    ithreads jpeg kmod ldns libedit libssp lzma magic mime mktemp mmx \
    mpfr mudflap multicall ncurses net netifrc newnet nls nptl nscd \
    openmp openssl pax_kernel pci pcre pcre16 pcre32 perl pic png posix \
    ptpax python python2 python3 recursion-limit right_timezone sha512 \
    sharedmem sockets sse sse2 ssh ssl threads tiff tools truetype \
    tty-helpers udev unicode urandom usb utils xattr xml xsl xtpax zlib"
PYTHON_TARGETS="python2_7 python3_3 python3_4"
PYTHON_SINGLE_TARGET="python2_7"
CURL_SSL="openssl"
EOF

cat > /etc/portage/package.use << "EOF"
EOF

emerge-webrsync

cat > /etc/env.d/02locale << "EOF"
LC_ALL="en_US.UTF-8"
LANG="en_US.UTF-8"
EOF

cat >> /etc/locale.gen << "EOF"
en_US ISO-8859-1
en_US.UTF-8 UTF-8
de_DE ISO-8859-1
de_DE@euro ISO-8859-15
de_DE.UTF-8 UTF-8
EOF

locale-gen -c /etc/locale.gen

env-update
source /etc/profile

emerge portage portage-utils

emerge -C cracklib pam pambase virtual/pam tcp-wrappers
emerge @preserved-rebuild

emerge glibc

emerge binutils gcc

env-update
source /etc/profile

emerge hardened-sources

emerge -e -D @world

dispatch-conf

exit

chroot /mnt/gentoo /bin/env -i HOME=/root TERM=$TERM PS1='\u:\w\$ ' PATH=/sbin:/bin:/usr/sbin:/usr/bin /bin/bash +h

env-update
source /etc/profile

emerge -e -D @world

emerge --depclean

dispatch-conf

env-update
source /etc/profile

cat > /etc/fstab << "EOF"
/dev/disk/by-id/md-name-root   /          ext3    defaults,relatime,barrier=1    1 1
/dev/disk/by-id/md-name-boot   /boot      ext2    defaults,relatime              1 2
/dev/disk/by-id/md-name-data   /data      ext3    defaults,relatime,barrier=1    2 2
/dev/disk/by-id/md-name-swap   none       swap    sw                             0 0
EOF

openssl genpkey -genparam -algorithm DH -pkeyopt dh_paramgen_prime_len:4096 -out /etc/ssl/dh_params.pem
openssl genpkey -genparam -algorithm EC -pkeyopt ec_paramgen_curve:secp384r1 -out /etc/ssl/ec_params.pem

sed -e 's/^#\(Protocol\).*$/\1 2/' \
    -e 's/^#\(RekeyLimit\).*$/\1 500M 1h/' \
    -e 's/^#\(LoginGraceTime\).*$/\1 1m/' \
    -e 's/^#\(PermitRootLogin\).*$/\1 yes/' \
    -e 's/^#\(StrictModes\).*$/\1 yes/' \
    -e 's/^#\(MaxAuthTries\).*$/\1 3/' \
    -e 's/^#\(MaxSessions\).*$/\1 10/' \
    -e 's/^#\(RSAAuthentication\).*$/\1 no/' \
    -e 's/^#\(PubkeyAuthentication\).*$/\1 yes/' \
    -e 's/^#\(IgnoreRhosts\).*$/\1 yes/' \
    -e 's/^#\(PasswordAuthentication\).*$/\1 no/' \
    -e 's/^#\(PermitEmptyPasswords\).*$/\1 no/' \
    -e 's/^#\(ChallengeResponseAuthentication\).*$/\1 no/' \
    -e 's/^#\(UsePAM\).*$/\1 no/' \
    -e 's/^#\(AllowAgentForwarding\).*$/\1 no/' \
    -e 's/^#\(AllowTcpForwarding\).*$/\1 no/' \
    -e 's/^#\(GatewayPorts\).*$/\1 no/' \
    -e 's/^#\(X11Forwarding\).*$/\1 no/' \
    -e 's/^#\(PermitTTY\).*$/\1 yes/' \
    -e 's/^#\(UseLogin\).*$/\1 no/' \
    -e 's/^#\(UsePrivilegeSeparation\).*$/\1 sandbox/' \
    -e 's/^#\(PermitUserEnvironment\).*$/\1 no/' \
    -e 's/^#\(UseDNS\).*$/\1 yes/' \
    -e 's/^#\(MaxStartups\).*$/\1 10:30:100/' \
    -e 's/^#\(PermitTunnel\).*$/\1 no/' \
    -e 's/^#\(ChrootDirectory\).*$/\1 %h/' \
    -e 's/^\(Subsystem\).*$/\1 sftp internal-sftp -u 0027/' \
    -i /etc/ssh/sshd_config

cat >> /etc/ssh/sshd_config << "EOF"
AllowGroups wheel admin sftponly users

Match Group wheel
        ChrootDirectory none

Match Group admin
        PasswordAuthentication yes

Match Group sftponly
        ForceCommand internal-sftp
EOF

sed -e '/^# Ciphers and keying/ a\
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-cbc,aes256-ctr\
Macs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256\
KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1' -i /etc/ssh/sshd_config

cat >> /etc/ssh/ssh_config << "EOF"
Host *
        Protocol 2
        RekeyLimit 500M 1h
        Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr,aes256-cbc
        Macs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256
        KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1
        HostKeyAlgorithms ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256
        VisualHostKey yes
EOF

rc-update add sshd default

cat >> /etc/portage/package.use << "EOF"
sys-fs/lvm2  lvm1 lvm2create_initrd
EOF

emerge syslog-ng logrotate cronie iproute2 dhcpcd mdadm lvm2 mcelog

rc-update add mdraid boot
rc-update add cronie default
rc-update add syslog-ng default

cat >> /etc/mdadm.conf << "EOF"
MAILADDR root@localhost
MAILFROM root@localhost
CREATE metadata=1.2
HOMEHOST <none>
DEVICE /dev/sd*[0-9]
EOF

sed -e 's/^\(hostname=\).*$/\1"devnull"/' -i /etc/conf.d/hostname

cat >> /etc/conf.d/net << "EOF"
#
# Setup eth0
config_eth0="IPADDR4 netmask NETMASK4"
routes_eth0="default via GATEWAY4"
EOF

ln -s net.lo /etc/init.d/net.eth0

rc-update add net.eth0 boot

# IPv4
ifconfig `ip -f inet route show scope global | awk '/default/ {print $5}'` | \
    awk '/inet/ {print $2}' | xargs -I % sed -e 's/IPADDR4/%/g' -i /etc/conf.d/net
ifconfig `ip -f inet route show scope global | awk '/default/ {print $5}'` | \
    awk '/inet/ {print $4}' | xargs -I % sed -e 's/NETMASK4/%/g' -i /etc/conf.d/net
ip -f inet route show scope global | awk '/default/ {print $3}' | \
    xargs -I % sed -e 's/GATEWAY4/%/g' -i /etc/conf.d/net

# localhost
sed -e 's/my.domain/example.com/g' -i /etc/hosts

# IPv4
echo 'IPADDR4   devnull.example.com' >> /etc/hosts

ifconfig `ip -f inet route show scope global | awk '/default/ {print $5}'` | \
    awk '/inet/ {print $2}' | xargs -I % sed -e 's/IPADDR4/%/g' -i /etc/hosts

cat >> /etc/portage/package.keywords << "EOF"
sys-kernel/genkernel  ~amd64
EOF

cat >> /etc/portage/package.use << "EOF"
sys-kernel/genkernel  -crypt
EOF

emerge hardened-sources genkernel

sed -e 's/^#\(SYMLINK=\).*$/\1"no"/' \
    -e 's/^#\(CLEAR_CACHE_DIR=\).*$/\1"yes"/' \
    -e 's/^#\(POSTCLEAR=\).*$/\1"yes"/' \
    -e 's/^#\(LVM=\).*$/\1"no"/' \
    -e 's/^#\(LUKS=\).*$/\1"no"/' \
    -e 's/^#\(GPG=\).*$/\1"no"/' \
    -e 's/^#\(DMRAID=\).*$/\1"no"/' \
    -e 's/^#\(BUSYBOX=\).*$/\1"yes"/' \
    -e 's/^#\(MDADM=\).*$/\1"yes"/' \
    -e 's/^#\(MULTIPATH=\).*$/\1"no"/' \
    -e 's/^#\(ISCSI=\).*$/\1"no"/' \
    -e 's/^#\(E2FSPROGS=\).*$/\1"yes"/' \
    -e 's/^#\(UNIONFS=\).*$/\1"no"/' \
    -e 's/^#\(ZFS=\).*$/\1"no"/' \
    -e 's/^#\(FIRMWARE=\).*$/\1"no"/' \
    -e 's/^#\(BUILD_STATIC=\).*$/\1"yes"/' \
    -i /etc/genkernel.conf

mkdir -p /root/kernels

wget -q -O /root/kernels/MYKERNEL "https://raw.githubusercontent.com/RootService/configs/master/gentoo/kernel_config_hardened.txt"

cd /usr/src/linux
make mrproper
cp /root/kernels/MYKERNEL /usr/src/linux/.config
make oldconfig

make
make firmware_install
make modules_install
make install
cp /usr/src/linux/.config /root/kernels/MYKERNEL
cd /root

genkernel --kernel-config=/root/kernels/MYKERNEL --no-ramdisk-modules --mdadm --install initramfs

cat >> /etc/portage/make.conf << "EOF"
GRUB_PLATFORMS="emu efi-32 efi-64 pc"
EOF

cat >> /etc/portage/package.use << "EOF"
sys-boot/grub  -truetype efiemu mount
EOF

emerge grub

mount -o remount,rw /boot

chmod -x /etc/grub.d/{20_linux_xen,30_os-prober,40_custom,41_custom}

sed -e 's/^#\(GRUB_CMDLINE_LINUX=\).*$/\1"pax_softmode=1 domdadm"/' \
    -e 's/^#\(GRUB_CMDLINE_LINUX_DEFAULT=\).*$/\1"quiet"/' \
    -e 's/^#\(GRUB_TERMINAL=\).*$/\1console/' \
    -i /etc/default/grub

grub-install --grub-setup=/bin/true /dev/sdb
grub-install --grub-setup=/bin/true /dev/sda

grub-mkconfig -o /boot/grub/grub.cfg

cat >> /etc/portage/package.use << "EOF"
app-crypt/gnupg  -usb
net-dns/bind-tools  -xml
sys-apps/smartmontools  minimal
EOF

emerge gradm app-crypt/gnupg bind-tools ntp smartmontools

cat > /etc/cron.hourly/ntpdate << "EOF"
#!/bin/sh
/usr/sbin/ntpdate -4 -b -s ptbtime2.ptb.de
EOF

chmod 0755 /etc/cron.hourly/ntpdate

echo '/dev/sda -a -o on -S on -s (S/../.././02|L/../../6/03)' >> /etc/smartd.conf
echo '/dev/sdb -a -o on -S on -s (S/../.././02|L/../../6/03)' >> /etc/smartd.conf

sed -e 's/^#net.ipv4/net.ipv4/g' -i /etc/sysctl.conf

passwd root

groupadd -g 1000 admin
useradd -u 1000 -g admin -G users,wheel -c 'Administrator' -m -s /bin/bash admin

passwd admin

su - admin

ssh-keygen -t ed25519 -O clear -O permit-pty
cat .ssh/id_ed25519.pub >> .ssh/authorized_keys
ssh-keygen -t ecdsa -b 384 -O clear -O permit-pty
cat .ssh/id_ecdsa.pub >> .ssh/authorized_keys
ssh-keygen -t rsa -b 4096 -O clear -O permit-pty
cat .ssh/id_rsa.pub >> .ssh/authorized_keys

exit

umount /boot

exit

umount /mnt/gentoo/dev/shm
umount /mnt/gentoo/dev/pts
umount /mnt/gentoo/dev
umount /mnt/gentoo/sys
umount /mnt/gentoo/proc
umount /mnt/gentoo

shutdown -P now

su - root

gradm -P

emerge -e -D @world

dispatch-conf