Preseed Debian 9 – UEFI with Encrypted LVM

I had a difficult time finding good, easy to digest info online on how to do preseed a Debian install with Encrypted LVM. There’s a couple of blog posts, the Debian Wiki and some Serverfault/StackOverflow questions that led the way for me to accomplish this. (the helpful links are at the bottom of this post.)

The Goal

Here’s a breakdown of what I was hoping to accomplish by preseeding the Debian install.

Users

I disable the root account which installs sudo and adds the created user to the sudo group. The preseed.cfg is configured to do that as well.

It is set to create a user and assign them a temporary password “insecure“. Then, at first login the password expires and asks for a new password. I feel doing it that way makes it safer for me to put the config online in a git repo. I could always change it before adding it to the ISO.

There is also an option of creating an encrypted hash of the password to put in the config file. If you want to do that you can install whois and use the mkpasswd utility.

[user@host]$ mkpasswd -m sha-512
Password:
$6$MZO17vgxkwcu.$P5HHjMbHoZHVw5P.gJdhH2IFrDG.xME1tOHCNlz8/tVyP8smheehPaW4WRVNLd3qpVwFFX0dGgw5AnJyj.QwM1

If you decide to take that route, make sure to edit the bottom of the preseed.cfg to remove the code that expires the weak password.

Networking

As it sits in the git repo, it uses DHCP to assign the IP and hostname.

I’ll configure it to assign a static IP and hostname during the networking section of the install before adding it to the ISO.

Partitioning

I wanted to be able to re-create a UEFI Debian install that also has Encrypted LVM partitions.

Over the past few months I’ve been experimenting with different partition layouts and here is where I settled (for now):

Unencrypted
  • ~550M/boot/efi
  • ~250M/boot
Encrypted LVM
  • ~15G/
  • ~120G/home
  • ~32GSwap
  • ~4G/tmp
  • ~10G/var
  • Rest of the disk on standby for future use.

Packages

When manually installing Debian on my Gaming Desktop with i3wm, I only select Standard System Utilities and SSH-Server at the software installation prompt.

I needed to add non-free and contrib to the etc/apt/sources.list for installing nvidia-drivers and steam.

Adding the i386 architecture for installing Steam and a few other packages that require it was also a priority.

I figured that getting a jump on installing a desktop environment, utilities and drivers, etc. would be pretty awesome. I configured it to install vim and xorg.

preseed.cfg

While this is still a work in progress, here’s the code that worked on a virtual machine I created in Proxmox to test it with. You can always get my latest version HERE.

#### Contents of the preconfiguration file (for stretch)
### Localization
# Preseeding only locale sets language, country and locale.
d-i debian-installer/locale string en_US


# Keyboard selection.
d-i keyboard-configuration/xkb-keymap select us

### Network configuration

# netcfg will choose an interface that has link if possible. This makes it
# skip displaying a list if there is more than one interface.
d-i netcfg/choose_interface select auto

# To pick a particular interface instead:
#d-i netcfg/choose_interface select eth1

# If you prefer to configure the network manually, uncomment this line and
# the static network configuration below.
#d-i netcfg/disable_autoconfig boolean true

# If you want the preconfiguration file to work on systems both with and
# without a dhcp server, uncomment these lines and the static network
# configuration below.
d-i netcfg/dhcp_failed note
d-i netcfg/dhcp_options select Configure network manually

# Static network configuration.
#
# IPv4 example
#d-i netcfg/get_ipaddress string 192.168.1.1
#d-i netcfg/get_netmask string 255.255.255.255
#d-i netcfg/get_gateway string 192.168.1.1
#d-i netcfg/get_nameservers string 192.168.1.1
#d-i netcfg/confirm_static boolean true
#
# IPv6 example
#d-i netcfg/get_ipaddress string fc00::2
#d-i netcfg/get_netmask string ffff:ffff:ffff:ffff::
#d-i netcfg/get_gateway string fc00::1
#d-i netcfg/get_nameservers string fc00::1
#d-i netcfg/confirm_static boolean true

# Any hostname and domain names assigned from dhcp take precedence over
# values set here. However, setting the values still prevents the questions
# from being shown, even if values come from dhcp.
d-i netcfg/get_hostname string gaming
d-i netcfg/get_domain string home.lab

# If you want to force a hostname, regardless of what either the DHCP
# server returns or what the reverse DNS entry for the IP is, uncomment
# and adjust the following line.
d-i netcfg/hostname string gaming

# Disable that annoying WEP key dialog.
d-i netcfg/wireless_wep string

# If non-free firmware is needed for the network or other hardware, you can
# configure the installer to always try to load it, without prompting. Or
# change to false to disable asking.
d-i hw-detect/load_firmware boolean true


### Mirror settings
# If you select ftp, the mirror/country string does not need to be set.
#d-i mirror/protocol string ftp
d-i mirror/country string manual
d-i mirror/http/hostname string http.us.debian.org
d-i mirror/http/directory string /debian
d-i mirror/http/proxy string

# Suite to install.
#d-i mirror/suite string testing
# Suite to use for loading installer components (optional).
#d-i mirror/udeb/suite string testing

### Account setup
# Skip creation of a root account (normal user account will be able to
# use sudo).
d-i passwd/root-login boolean false

# To create a normal user account.
d-i passwd/user-fullname string Chuck Nemeth
d-i passwd/username string chuck
# Normal user's password, either in clear text
d-i passwd/user-password password insecure
d-i passwd/user-password-again password insecure
# or encrypted using a crypt(3) hash.
#d-i passwd/user-password-crypted password [crypted]
# Can Create with mkpasswd -m sha-512

# The user account will be added to some standard initial groups. To
# override that, use this.
#d-i passwd/user-default-groups string audio cdrom video

### Clock and time zone setup
# Controls whether or not the hardware clock is set to UTC.
d-i clock-setup/utc boolean true

# You may set this to any valid setting for $TZ; see the contents of
# /usr/share/zoneinfo/ for valid values.
d-i time/zone string US/Eastern

# Controls whether to use NTP to set the clock during the install
d-i clock-setup/ntp boolean true
# NTP server to use. The default is almost always fine here.
d-i clock-setup/ntp-server string 192.168.15.1

### Partitioning

#d-i partman-auto/disk string /dev/sda
d-i partman-lvm/device_remove_lvm boolean true
d-i partman-auto/method string crypto
d-i partman-lvm/confirm boolean true
#d-i partman-lvm/confirm_nooverwrite boolean true
d-i partman-auto/choose_recipe select boot-crypto
d-i partman-auto-lvm/guided_size string max
d-i partman-auto-lvm/new_vg_name string gaming

d-i partman-auto/expert_recipe string \
      boot-crypto :: \
              538 538 1075 free \
                    $primary \
                    $iflabel{ gpt } \
                    $reusemethod{ } \
                    method{ efi } format{ } \
              . \
              256 512 256 ext2 \
                    $primary \
                    $defaultignore{ } \
                    method{ format } format{ } \
                    use_filesystem{ } filesystem{ ext2 } \
                    label{ boot } \
                    mountpoint{ /boot } \
              . \
              14000 14000 14000 ext4 \
                    $lvmok{ } \
                    lv_name{ root } \
                    in_vg { gaming } \
                    method{ format } format{ } \
                    use_filesystem{ } filesystem{ ext4 } \
                    label{ root } \
                    mountpoint{ / } \
              . \
              120000 120000 120000 ext4 \
                    $lvmok{ } \
                    lv_name{ home } \
                    in_vg { gaming } \
                    method{ format } format{ } \
                    use_filesystem{ } filesystem{ ext4 } \
                    label{ home } \
                    mountpoint{ /home } \
              . \
              32000 32000 100% linux-swap \
                    $lvmok{ } \
                    lv_name{ swap } \
                    in_vg { gaming } \
                    method{ swap } format{ } \
              . \
              4000 4000 4000 ext4 \
                    $lvmok{ } \
                    lv_name{ tmp } \
                    in_vg { gaming } \
                    method{ format } format{ } \
                    use_filesystem{ } filesystem{ ext4 } \
                    options/nodev{ nodev } \
                    options/nosuid{ nosuid } \
                    label{ tmp } \
                    mountpoint{ /tmp } \
              . \
              10000 10000 10000 ext4 \
                    $lvmok{ } \
                    lv_name{ var } \
                    in_vg { gaming } \
                    method{ format } format{ } \
                    use_filesystem{ } filesystem{ ext4 } \
                    label{ var } \
                    mountpoint{ /var } \
              . \
              10000 1000000 10000000 ext4 \
                    $lvmok{ } \
                    $lv_name{ deleteme }  \
                    in_vg { gaming } \
                    method{ format } format{ } \
                    use_filesystem{ } filesystem{ ext4 } \
                    mountpoint{ /deleteme } \
              . \


# This makes partman automatically partition without confirmation, provided
# that you told it what to do using one of the methods above.
d-i partman-partitioning/confirm_write_new_label boolean true
d-i partman/choose_partition select finish
d-i partman/confirm boolean true
d-i partman/confirm_nooverwrite boolean true

# When disk encryption is enabled, skip wiping the partitions beforehand.
#d-i partman-auto-crypto/erase_disks boolean false

# This makes partman automatically partition without confirmation.
d-i partman-md/confirm boolean true
d-i partman-partitioning/confirm_write_new_label boolean true
d-i partman/choose_partition select finish
d-i partman/confirm boolean true
d-i partman/confirm_nooverwrite boolean true

## Controlling how partitions are mounted
# The default is to mount by UUID, but you can also choose "traditional" to
# use traditional device names, or "label" to try filesystem labels before
# falling back to UUIDs.
d-i partman/mount_style select uuid

### Base system installation

# The kernel image (meta) package to be installed; "none" can be used if no
# kernel is to be installed.
#d-i base-installer/kernel/image string linux-image-686

### Apt setup
# You can choose to install non-free and contrib software.
d-i apt-setup/non-free boolean true
d-i apt-setup/contrib boolean true
# Select which update services to use; define the mirrors to be used.
# Values shown below are the normal defaults.
d-i apt-setup/services-select multiselect security, updates
d-i apt-setup/security_host string security.debian.org

# Additional repositories, local[0-9] available
#d-i apt-setup/local0/repository string \
#       http://local.server/debian stable main
#d-i apt-setup/local0/comment string local server
# Enable deb-src lines
#d-i apt-setup/local0/source boolean true
# URL to the public key of the local repository; you must provide a key or
# apt will complain about the unauthenticated repository and so the
# sources.list line will be left commented out
#d-i apt-setup/local0/key string http://local.server/key

# Uncomment this to add multiarch configuration for i386
d-i apt-setup/multiarch string i386


### Package selection
tasksel tasksel/first multiselect standard

# Individual additional packages to install
d-i pkgsel/include string openssh-server build-essential
# Whether to upgrade packages after debootstrap.
# Allowed values: none, safe-upgrade, full-upgrade
d-i pkgsel/upgrade select safe-upgrade

# Some versions of the installer can report back on what software you have
# installed, and what software you use. The default is not to report back,
# but sending reports helps the project determine what software is most
# popular and include it on CDs.
popularity-contest popularity-contest/participate boolean false

### Boot loader installation

# This is fairly safe to set, it makes grub install automatically to the MBR
# if no other operating system is detected on the machine.
d-i grub-installer/only_debian boolean true

# This one makes grub-installer install to the MBR if it also finds some other
# OS, which is less safe as it might not be able to boot that other OS.
d-i grub-installer/with_other_os boolean true

# Due notably to potential USB sticks, the location of the MBR can not be
# determined safely in general, so this needs to be specified:
#d-i grub-installer/bootdev  string /dev/sda
# To install to the first device (assuming it is not a USB stick):
d-i grub-installer/bootdev  string default

# Alternatively, if you want to install to a location other than the mbr,
# uncomment and edit these lines:
#d-i grub-installer/only_debian boolean false
#d-i grub-installer/with_other_os boolean false
#d-i grub-installer/bootdev  string (hd0,1)
# To install grub to multiple disks:
#d-i grub-installer/bootdev  string (hd0,1) (hd1,1) (hd2,1)

# Optional password for grub, either in clear text
#d-i grub-installer/password password r00tme
#d-i grub-installer/password-again password r00tme
# or encrypted using an MD5 hash, see grub-md5-crypt(8).
#d-i grub-installer/password-crypted password [MD5 hash]

# Use the following option to add additional boot parameters for the
# installed system (if supported by the bootloader installer).
# Note: options passed to the installer will be added automatically.
#d-i debian-installer/add-kernel-opts string nousb

### Finishing up the installation
# During installations from serial console, the regular virtual consoles
# (VT1-VT6) are normally disabled in /etc/inittab. Uncomment the next
# line to prevent this.
#d-i finish-install/keep-consoles boolean true

# Avoid that last message about the install being complete.
d-i finish-install/reboot_in_progress note

### Preseeding other packages
# Depending on what software you choose to install, or if things go wrong
# during the installation process, it's possible that other questions may
# be asked. You can preseed those too, of course. To get a list of every
# possible question that could be asked during an install, do an
# installation, and then run these commands:
#   debconf-get-selections --installer > file
#   debconf-get-selections >> file


#### Advanced options
### Running custom commands during the installation

# This first command is run as early as possible, just after
# preseeding is read.
#d-i preseed/early_command string anna-install some-udeb

# This command is run immediately before the partitioner starts. It may be
# useful to apply dynamic partitioner preseeding that depends on the state
# of the disks (which may not be visible when preseed/early_command runs).
#d-i partman/early_command \
#       string debconf-set partman-auto/disk "$(list-devices disk | head -n1)"

# This command is run just before the install finishes, but when there is
# still a usable /target directory. You can chroot to /target and use it
# directly, or use the apt-install and in-target commands to easily install
# packages and run commands in the target system.
d-i preseed/late_command \
        string lvremove --force /dev/mapper/crypt-deleteme; \
        apt-install linux-headers-amd64 rxvt-unicode-256color vim xorg; \
        in-target passwd --expire chuck

 

Creating the ISO

You can place the preseed.cfg file on a web server of some sort and point the installer at it. I would assume that you would have to configure networking first to do that. Forget that!! This to be as hands-off as possible!

Then I read about just adding it to the ISO and it seemed easy enough to do.

I used the following packages to complete these steps:

  • xorriso
  • isolinux
  • zip
  • unzip

Steps

      1. Download the debian iso
      2. Rename it to debian.iso
      3. Make a directory to hold the extracted iso
        1. mkdir isofiles
      4. Extract ISO to the isofiles directory
        1. xorriso -osirrox on -indev debian.iso -extract / isofiles
      5. Add write permissions to initrd
        1. chmod +w isofiles/install.amd/
      6. Unzip initrd
        1. gunzip isofiles/install.amd/initrd.gz
      7. Add preseed to the initrd
        1. echo preseed.cfg | cpio -H newc -o -A -F isofiles/install.amd/initrd
      8. Re-zip initrd
        1. gzip isofiles/install.amd/initrd
      9. Remove write abilities of initrd
        1. chmod -w -R isofiles/install.amd
      10. Enter isofiles directory
        1. cd isofiles
      11. Generate new md5sum.txt
        1. md5sum `find -follow -type f` > md5sum.txt
      12. Move back a directory
        1. cd ..
      13. Generate new iso:
[user@host]$ xorriso -as mkisofs \
-isohybrid-mbr /usr/lib/ISOLINUX/isohdpfx.bin \
-c isolinux/boot.cat \
-b isolinux/isolinux.bin \
-no-emul-boot \
-boot-load-size 4 \
-boot-info-table \
-eltorito-alt-boot \
-e boot/grub/efi.img \
-no-emul-boot \
-isohybrid-gpt-basdat \
-o preseed-debian.iso \
isofiles/

Script it!

After doing that a couple of times when making changes, it got a little old. I figured why not create a bash script to handle most of it for me? You can check it out at my git repo.

Using the new ISO

Take the generated iso (preseed-debian.iso if you’re using the commands from above) and write it to a USB jump drive or upload it to Proxmox.

Boot the computer/VM from it and at the menu, select Advanced Options > Automated Install.

Wait a few seconds and it should start the installation process!

Final Thoughts

There is still a small amount of human interaction necessary to install, but it sure beats doing the whole thing manually!

We still have to:

  • Tell the installer to use automated install
  • Accept LVM
  • Enter password for encryption
    • Interrupt writing random data if you want
  • Select keyboard layout. (Not sure why because it’s set in the preseed file)my

Now I won’t be so hesitant to do things that may mess up my install since it’s much easier to re-install Debian. All I’ll have to do is run the preseeded iso then pull my dotfiles and stow them. Things can be back up and running in no time!

Links

 

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.