freedombone-image-customise 14KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # Based on bin/freedombox-customize from freedom-maker
  12. #
  13. # License
  14. # =======
  15. #
  16. # This program is free software: you can redistribute it and/or modify
  17. # it under the terms of the GNU General Public License as published by
  18. # the Free Software Foundation, either version 3 of the License, or
  19. # (at your option) any later version.
  20. #
  21. # This program is distributed in the hope that it will be useful,
  22. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  23. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  24. # GNU General Public License for more details.
  25. #
  26. # You should have received a copy of the GNU General Public License
  27. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  28. set -e
  29. set -x
  30. PROJECT_NAME='freedombone'
  31. export TEXTDOMAIN=${PROJECT_NAME}-image-customise
  32. export TEXTDOMAINDIR="/usr/share/locale"
  33. # Whether to minimise the number of decisions during interactive install
  34. MINIMAL_INSTALL="yes"
  35. MY_USERNAME='debian'
  36. MY_PASSWORD="${PROJECT_NAME}"
  37. # IP address of the router (gateway)
  38. ROUTER_IP_ADDRESS="192.168.1.254"
  39. # The fixed IP address of the Beaglebone Black on your local network
  40. BOX_IP_ADDRESS="192.168.1.55"
  41. # DNS
  42. NAMESERVER1='213.73.91.35'
  43. NAMESERVER2='85.214.20.141'
  44. # optional configuration file containing freedombone settings
  45. CONFIG_FILENAME=
  46. # Optional ssh public key to allow
  47. SSH_PUBKEY="no"
  48. # Whether this is a generic image for mass redistribution on the interwebs
  49. GENERIC_IMAGE="no"
  50. enable_eatmydata_override() {
  51. chroot $rootdir apt-get install --no-install-recommends -y eatmydata
  52. if [ -x $rootdir/usr/bin/eatmydata ] && \
  53. [ ! -f $rootdir/etc/apt/apt.conf.d/95debian-edu-install-dpkg-eatmydata ]; then
  54. echo $"info: Adding apt config to call dpkg via eatmydata"
  55. printf "#!/bin/sh\nexec eatmydata dpkg \"\$@\"\n" \
  56. > $rootdir/var/tmp/dpkg-eatmydata
  57. chmod 755 $rootdir/var/tmp/dpkg-eatmydata
  58. cat > $rootdir/etc/apt/apt.conf.d/95debian-edu-install-dpkg-eatmydata <<EOF
  59. Dir::Bin::dpkg "/var/tmp/dpkg-eatmydata";
  60. EOF
  61. else
  62. echo $"error: unable to find /usr/bin/eatmydata after installing the eatmydata package"
  63. fi
  64. }
  65. disable_eatmydata_override() {
  66. for override in \
  67. /etc/apt/apt.conf.d/95debian-edu-install-dpkg-eatmydata \
  68. /var/tmp/dpkg-eatmydata ; do
  69. echo $"info: Removing apt config to call dpkg via eatmydata"
  70. if [ -f $rootdir$override ] ; then
  71. rm -f $rootdir$override
  72. else
  73. echo $"warning: missing $rootdir$override"
  74. fi
  75. done
  76. sync # Flush file buffers before continuing
  77. }
  78. set_apt_sources() {
  79. NEW_MIRROR="$1"
  80. COMPONENTS="main"
  81. cat <<EOF > etc/apt/sources.list
  82. deb $NEW_MIRROR $SUITE $COMPONENTS
  83. deb-src $NEW_MIRROR $SUITE $COMPONENTS
  84. #deb http://security.debian.org/ $SUITE/updates main
  85. #deb-src http://security.debian.org/ $SUITE/updates main
  86. EOF
  87. }
  88. configure_networking() {
  89. if [[ $GENERIC_IMAGE == "no" ]]; then
  90. echo "# This file describes the network interfaces available on your system
  91. # and how to activate them. For more information, see interfaces(5).
  92. # The loopback network interface
  93. auto lo
  94. iface lo inet loopback
  95. # The primary network interface
  96. auto eth0
  97. iface eth0 inet static
  98. address $BOX_IP_ADDRESS
  99. netmask 255.255.255.0
  100. gateway $ROUTER_IP_ADDRESS
  101. dns-nameservers $NAMESERVER1 $NAMESERVER2
  102. # Example to keep MAC address between reboots
  103. #hwaddress ether B5:A2:BE:3F:1A:FE
  104. # The secondary network interface
  105. #auto eth1
  106. #iface eth1 inet dhcp
  107. # WiFi Example
  108. #auto wlan0
  109. #iface wlan0 inet dhcp
  110. # wpa-ssid \"essid\"
  111. # wpa-psk \"password\"
  112. # Ethernet/RNDIS gadget (g_ether)
  113. # ... or on host side, usbnet and random hwaddr
  114. # Note on some boards, usb0 is automaticly setup with an init script
  115. #iface usb0 inet static
  116. # address 192.168.7.2
  117. # netmask 255.255.255.0
  118. # network 192.168.7.0
  119. # gateway 192.168.7.1" > $rootdir/etc/network/interfaces
  120. hexarray=( 1 2 3 4 5 6 7 8 9 0 a b c d e f )
  121. a=${hexarray[$RANDOM%16]}${hexarray[$RANDOM%16]}
  122. b=${hexarray[$RANDOM%16]}${hexarray[$RANDOM%16]}
  123. c=${hexarray[$RANDOM%16]}${hexarray[$RANDOM%16]}
  124. d=${hexarray[$RANDOM%16]}${hexarray[$RANDOM%16]}
  125. e=${hexarray[$RANDOM%16]}${hexarray[$RANDOM%16]}
  126. sed -i "s|#hwaddress ether.*|hwaddress ether de:$a:$b:$c:$d:$e|g" \
  127. $rootdir/etc/network/interfaces
  128. fi
  129. sed -i "s/nameserver.*/nameserver $NAMESERVER1/g" $rootdir/etc/resolv.conf
  130. sed -i "/nameserver $NAMESERVER1/a\nameserver $NAMESERVER2" $rootdir/etc/resolv.conf
  131. # change the motd to show further install instructions
  132. echo $"
  133. .---. . .
  134. | | |
  135. |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  136. | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  137. ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  138. Initial base install
  139. Your system is not yet installed. To complete the process run the
  140. following commands, then enter your details.
  141. sudo su
  142. ${PROJECT_NAME} menuconfig
  143. " > $rootdir/etc/motd
  144. }
  145. configure_ssh() {
  146. sed -i "s/Port .*/Port 2222/g" $rootdir/etc/ssh/sshd_config
  147. if [[ "$SSH_PUBKEY" != "no" ]]; then
  148. if [ ! -d $rootdir/home/$MY_USERNAME/.ssh ]; then
  149. mkdir $rootdir/home/$MY_USERNAME/.ssh
  150. fi
  151. echo "$SSH_PUBKEY" > $rootdir/home/$MY_USERNAME/.ssh/authorized_keys
  152. chroot $rootdir chown -R $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.ssh
  153. sed -i 's|PasswordAuthentication.*|PasswordAuthentication no|g' $rootdir/etc/ssh/sshd_config
  154. echo $"Using ssh public key:"
  155. echo $SSH_PUBKEY
  156. echo $'Password ssh authentication turned off'
  157. fi
  158. }
  159. admin_user_sudo() {
  160. echo "$MY_USERNAME ALL=(ALL) ALL" >> $rootdir/etc/sudoers
  161. }
  162. create_generic_image() {
  163. if [[ $GENERIC_IMAGE == "no" ]]; then
  164. return
  165. fi
  166. # Don't install any configuration. This will be a base system
  167. CONFIG_FILENAME=
  168. # The presence of this file indicates that the initial
  169. # setup has not yet been completed
  170. touch $rootdir/home/$MY_USERNAME/.initial_setup
  171. chroot $rootdir chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/.initial_setup
  172. touch $rootdir/root/.initial_setup
  173. cat >> $rootdir/home/$MY_USERNAME/.bashrc <<EOF
  174. # initial setup of the system
  175. if [ -f ~/.initial_setup ]; then
  176. clear
  177. echo "
  178. .---. . .
  179. | | |
  180. |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  181. | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  182. ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  183. Initial setup process
  184. Please enter your password a second time.
  185. "
  186. sudo su
  187. fi
  188. EOF
  189. cat >> $rootdir/root/.bashrc <<EOF
  190. # initial setup of the system
  191. if [ -f ~/.initial_setup ]; then
  192. EOF
  193. echo ' if [ -f ~/login.txt ]; then' >> $rootdir/root/.bashrc
  194. echo ' NEW_USER_PASSWORD=$(printf `cat ~/login.txt`)' >> $rootdir/root/.bashrc
  195. echo ' else' >> $rootdir/root/.bashrc
  196. echo ' ENTROPY=$(cat /proc/sys/kernel/random/entropy_avail)' >> $rootdir/root/.bashrc
  197. echo ' if [ $ENTROPY -lt 500 ]; then' >> $rootdir/root/.bashrc
  198. echo ' dialog --backtitle "Initial setup process" --title "Password Generation" --msgbox "WARNING: The entropy available on this system is too low to generate a password.\n\nThe installation process cannot continue." 8 50' >> $rootdir/root/.bashrc
  199. echo ' exit' >> $rootdir/root/.bashrc
  200. echo ' fi' >> $rootdir/root/.bashrc
  201. echo ' NEW_USER_PASSWORD="$(openssl rand -base64 12 | cut -c1-10)"' >> $rootdir/root/.bashrc
  202. echo ' fi' >> $rootdir/root/.bashrc
  203. echo ' echo "${NEW_USER_PASSWORD}" > ~/login.txt' >> $rootdir/root/.bashrc
  204. echo ' clear' >> $rootdir/root/.bashrc
  205. echo ' echo ""' >> $rootdir/root/.bashrc
  206. echo ' echo "Your new login password is:"' >> $rootdir/root/.bashrc
  207. echo ' echo ""' >> $rootdir/root/.bashrc
  208. echo ' toilet "${NEW_USER_PASSWORD}"' >> $rootdir/root/.bashrc
  209. echo ' echo ""' >> $rootdir/root/.bashrc
  210. echo ' echo " ${NEW_USER_PASSWORD}"' >> $rootdir/root/.bashrc
  211. echo ' echo ""' >> $rootdir/root/.bashrc
  212. echo ' echo "Use it whenever you wish to ssh into this system."' >> $rootdir/root/.bashrc
  213. echo ' echo ""' >> $rootdir/root/.bashrc
  214. echo ' echo "IMPORTANT: Please take a moment to enter the above password into a"' >> $rootdir/root/.bashrc
  215. echo ' echo "password manager or write it down somewhere."' >> $rootdir/root/.bashrc
  216. echo ' echo ""' >> $rootdir/root/.bashrc
  217. echo ' read -n1 -r -p "Press any key to continue..." key' >> $rootdir/root/.bashrc
  218. # change the password for the admin user
  219. echo -n " echo \"${MY_USERNAME}:" >> $rootdir/root/.bashrc
  220. echo '$(printf `cat ~/login.txt`)"|chpasswd' >> $rootdir/root/.bashrc
  221. if [[ $MINIMAL_INSTALL == "no" ]]; then
  222. echo " ${PROJECT_NAME} menuconfigfull" >> $rootdir/root/.bashrc
  223. else
  224. echo " ${PROJECT_NAME} menuconfig" >> $rootdir/root/.bashrc
  225. fi
  226. echo ' if [ "$?" = "0" ]; then' >> $rootdir/root/.bashrc
  227. echo " if [ -f ~/${PROJECT_NAME}-completed.txt ]; then" >> $rootdir/root/.bashrc
  228. # Remove the initial setup files
  229. echo " rm /root/.initial_setup" >> $rootdir/root/.bashrc
  230. echo " rm /home/${MY_USERNAME}/.initial_setup" >> $rootdir/root/.bashrc
  231. echo " shred -zu ~/login.txt" >> $rootdir/root/.bashrc
  232. cat >> $rootdir/root/.bashrc <<EOF
  233. fi
  234. fi
  235. exit
  236. fi
  237. EOF
  238. }
  239. continue_installation() {
  240. # If a configuration file exists then run with it
  241. # otherwise the interactive installer can be used
  242. # This is equivalent to installing freedombox-setup on freedombox
  243. if [ $CONFIG_FILENAME ]; then
  244. if [ ${#CONFIG_FILENAME} -gt 2 ]; then
  245. cp $CONFIG_FILENAME $rootdir/root/$PROJECT_NAME.cfg
  246. chroot $rootdir $PROJECT_NAME -c /root/$PROJECT_NAME.cfg
  247. fi
  248. fi
  249. }
  250. # Set to true/false to control if eatmydata is used during build
  251. use_eatmydata=true
  252. rootdir="$1"
  253. fmdir="$(pwd)"
  254. image="$fmdir"/"$2"
  255. cd "$rootdir"
  256. echo info: building $MACHINE for $ARCHITECTURE
  257. export DEBIAN_FRONTEND=noninteractive DEBCONF_NONINTERACTIVE_SEEN=true
  258. export LC_ALL=C LANGUAGE=C LANG=C
  259. # Override libpam-tmpdir setting during build, as the directories
  260. # are not created yet.
  261. export TMP=/tmp/ TMPDIR=/tmp/
  262. username=$MY_USERNAME
  263. echo $"warning: creating initial user $username with well known password!"
  264. password=$MY_PASSWORD
  265. chroot "$rootdir" adduser --gecos $username --disabled-password $username
  266. echo $username:$password | chroot $rootdir /usr/sbin/chpasswd
  267. chroot "$rootdir" adduser $username sudo
  268. case "$MACHINE" in
  269. virtualbox)
  270. # hide irrelevant console keyboard messages.
  271. echo "echo \"4 4 1 7\" > /proc/sys/kernel/printk" \
  272. >> /etc/init.d/rc.local
  273. ;;
  274. qemu)
  275. # hide irrelevant console keyboard messages.
  276. echo "echo \"4 4 1 7\" > /proc/sys/kernel/printk" \
  277. >> /etc/init.d/rc.local
  278. ;;
  279. esac
  280. set_apt_sources $BUILD_MIRROR
  281. chroot "$rootdir" apt-get update
  282. cat > $rootdir/usr/sbin/policy-rc.d <<EOF
  283. #!/bin/sh
  284. exit 101
  285. EOF
  286. chmod a+rx $rootdir/usr/sbin/policy-rc.d
  287. if $use_eatmydata ; then
  288. enable_eatmydata_override
  289. fi
  290. if [ -n "$CUSTOM_SETUP" ]; then
  291. cp "$CUSTOM_SETUP" "$rootdir"/tmp
  292. chroot "$rootdir" apt-get install -y gdebi-core
  293. chroot "$rootdir" gdebi -n /tmp/"$(basename $CUSTOM_SETUP)"
  294. fi
  295. chroot "$rootdir" apt-get install -y sudo git dialog toilet build-essential openssh-server
  296. chroot "$rootdir" apt-get install -y avahi-daemon avahi-utils avahi-discover avahi-autoipd
  297. chroot "$rootdir" apt-get install -y iptables dnsutils net-tools network-manager iputils-ping
  298. chroot "$rootdir" apt-get install -y libnss-mdns libnss-myhostname libnss-gw-name nano man ntp
  299. sed -i "s|#host-name=.*|host-name=${PROJECT_NAME}|g" $rootdir/etc/avahi/avahi-daemon.conf
  300. chroot "$rootdir" /bin/bash -x <<EOF
  301. git clone https://github.com/bashrc/freedombone /root/freedombone
  302. cd /root/freedombone
  303. make install
  304. EOF
  305. chroot "$rootdir" ${PROJECT_NAME}-image-hardware-setup 2>&1 | \
  306. tee $rootdir/var/log/${PROJECT_NAME}-image-hardware-setup.log
  307. rm $rootdir/usr/sbin/policy-rc.d
  308. # Set up HRNG for systems known to have one
  309. # Otherwise install haveged
  310. if [[ "$MACHINE" != "beaglebone" ]]; then
  311. chroot $rootdir apt-get -y install haveged
  312. else
  313. chroot $rootdir apt-get -y install rng-tools
  314. sed -i 's|#HRNGDEVICE=/dev/hwrng|HRNGDEVICE=/dev/hwrng|g' $rootdir/etc/default/rng-tools
  315. fi
  316. # copy u-boot to beginning of image
  317. case "$MACHINE" in
  318. beaglebone)
  319. dd if=$rootdir/usr/lib/u-boot/am335x_boneblack/MLO of="$image" \
  320. count=1 seek=1 conv=notrunc bs=128k
  321. dd if=$rootdir/usr/lib/u-boot/am335x_boneblack/u-boot.img of="$image" \
  322. count=2 seek=1 conv=notrunc bs=384k
  323. ;;
  324. cubieboard2)
  325. dd if=$rootdir/usr/lib/u-boot/Cubieboard2/u-boot-sunxi-with-spl.bin of="$image" \
  326. seek=8 conv=notrunc bs=1k
  327. ;;
  328. esac
  329. if $use_eatmydata ; then
  330. disable_eatmydata_override
  331. fi
  332. set_apt_sources $MIRROR
  333. chroot "$rootdir" apt-get update
  334. configure_ssh
  335. configure_networking
  336. admin_user_sudo
  337. create_generic_image
  338. continue_installation
  339. cd /
  340. echo $"info: killing leftover processes in chroot"
  341. fuser -mvk $rootdir/. || true