I had a difficult time finding good, easy to digest info online on how to do preseed a Debian install with Encrypted LVM. There’s a couple of blog posts, the Debian Wiki and some Serverfault/StackOverflow questions that led the way for me to accomplish this. (the helpful links are at the bottom of this post.)
Here’s a breakdown of what I was hoping to accomplish by preseeding the Debian install.
I disable the root account which installs
sudo and adds the created user to the
sudo group. The preseed.cfg is configured to do that as well.
It is set to create a user and assign them a temporary password “insecure“. Then, at first login the password expires and asks for a new password. I feel doing it that way makes it safer for me to put the config online in a git repo. I could always change it before adding it to the ISO.
There is also an option of creating an encrypted hash of the password to put in the config file. If you want to do that you can install
whois and use the
[user@host]$ mkpasswd -m sha-512 Password: $6$MZO17vgxkwcu.$P5HHjMbHoZHVw5P.gJdhH2IFrDG.xME1tOHCNlz8/tVyP8smheehPaW4WRVNLd3qpVwFFX0dGgw5AnJyj.QwM1
If you decide to take that route, make sure to edit the bottom of the preseed.cfg to remove the code that expires the weak password.
As it sits in the git repo, it uses DHCP to assign the IP and hostname.
I’ll configure it to assign a static IP and hostname during the networking section of the install before adding it to the ISO.
I wanted to be able to re-create a UEFI Debian install that also has Encrypted LVM partitions.
Over the past few months I’ve been experimenting with different partition layouts and here is where I settled (for now):
- ~550M – /boot/efi
- ~250M – /boot
- ~15G – /
- ~120G – /home
- ~32G – Swap
- ~4G – /tmp
- ~10G – /var
- Rest of the disk on standby for future use.
When manually installing Debian on my Gaming Desktop with i3wm, I only select
Standard System Utilities and
SSH-Server at the software installation prompt.
I needed to add
contrib to the etc/apt/sources.list for installing
Adding the i386 architecture for installing Steam and a few other packages that require it was also a priority.
I figured that getting a jump on installing a desktop environment, utilities and drivers, etc. would be pretty awesome. I configured it to install
While this is still a work in progress, here’s the code that worked on a virtual machine I created in Proxmox to test it with. You can always get my latest version HERE.
Creating the ISO
You can place the preseed.cfg file on a web server of some sort and point the installer at it. I would assume that you would have to configure networking first to do that. Forget that!! This to be as hands-off as possible!
Then I read about just adding it to the ISO and it seemed easy enough to do.
I used the following packages to complete these steps:
- Download the debian iso
- Rename it to debian.iso
- Make a directory to hold the extracted iso
- Extract ISO to the isofiles directory
xorriso -osirrox on -indev debian.iso -extract / isofiles
- Add write permissions to initrd
chmod +w isofiles/install.amd/
- Unzip initrd
- Add preseed to the initrd
echo preseed.cfg | cpio -H newc -o -A -F isofiles/install.amd/initrd
- Re-zip initrd
- Remove write abilities of initrd
chmod -w -R isofiles/install.amd
- Enter isofiles directory
- Generate new md5sum.txt
md5sum `find -follow -type f` > md5sum.txt
- Move back a directory
- Generate new iso:
[user@host]$ xorriso -as mkisofs \ -isohybrid-mbr /usr/lib/ISOLINUX/isohdpfx.bin \ -c isolinux/boot.cat \ -b isolinux/isolinux.bin \ -no-emul-boot \ -boot-load-size 4 \ -boot-info-table \ -eltorito-alt-boot \ -e boot/grub/efi.img \ -no-emul-boot \ -isohybrid-gpt-basdat \ -o preseed-debian.iso \ isofiles/
After doing that a couple of times when making changes, it got a little old. I figured why not create a bash script to handle most of it for me? You can check it out at my git repo.
Using the new ISO
Take the generated iso (preseed-debian.iso if you’re using the commands from above) and write it to a USB jump drive or upload it to Proxmox.
Boot the computer/VM from it and at the menu, select Advanced Options > Automated Install.
Wait a few seconds and it should start the installation process!
There is still a small amount of human interaction necessary to install, but it sure beats doing the whole thing manually!
We still have to:
- Tell the installer to use automated install
- Accept LVM
- Enter password for encryption
- Interrupt writing random data if you want
- Select keyboard layout. (Not sure why because it’s set in the preseed file)my
Now I won’t be so hesitant to do things that may mess up my install since it’s much easier to re-install Debian. All I’ll have to do is run the preseeded iso then pull my dotfiles and stow them. Things can be back up and running in no time!