|
| 1 | +DISTRIBUTIONS="kernel.txz base.txz" |
| 2 | +BSDINSTALL_DISTSITE="https://download.freebsd.org/ftp/releases/amd64/13.5-RELEASE/" |
| 3 | +BSDINSTALL_DISTDIR="/tmp" |
| 4 | +INTERFACES="%%interface%%" |
| 5 | +RELEASE="13.5" |
| 6 | +GEOM="%%disks%%" |
| 7 | +export GEOM |
| 8 | +GEOMTYPE="%%disktype%%" |
| 9 | +export GEOMTYPE |
| 10 | +export ZFSBOOT_DISKS="$GEOM" |
| 11 | +export ZFSBOOT_VDEV_TYPE="$GEOMTYPE" |
| 12 | +export ZFSBOOT_FORCE_4K_SECTORS="1" |
| 13 | +export ZFSBOOT_SWAP_SIZE="8g" |
| 14 | +export ZFSBOOT_SWAP_MIRROR="1" |
| 15 | +export ZFSBOOT_POOL_CREATE_OPTIONS="-O compress=lz4 -O checksum=fletcher4" |
| 16 | +export nonInteractive="YES" |
| 17 | + |
| 18 | +#!/bin/sh |
| 19 | +ASSUME_ALWAYS_YES=yes FETCH_RETRY=5 pkg install ca_root_nss |
| 20 | +ASSUME_ALWAYS_YES=yes FETCH_RETRY=5 pkg install curl |
| 21 | +ASSUME_ALWAYS_YES=yes FETCH_RETRY=5 pkg install sudo |
| 22 | +ASSUME_ALWAYS_YES=yes FETCH_RETRY=5 pkg install bash |
| 23 | + |
| 24 | +# Disable X11 |
| 25 | +echo 'OPTIONS_UNSET+=X11' >> /etc/make.conf |
| 26 | + |
| 27 | +# Basic network options |
| 28 | +sysrc hostname=%%hostname%% |
| 29 | +sysrc ifconfig_%%interface%%_name="untrusted" |
| 30 | +sysrc ifconfig_untrusted="up" |
| 31 | +sysrc ifconfig_untrusted_ipv6="up" |
| 32 | +sysrc ifconfig_untrusted_aliases="inet %%ipv4%%/32 inet6 %%ipv6%%/64" |
| 33 | +sysrc ipv6_activate_all_interfaces="YES" |
| 34 | +sysrc static_routes="gateway default" |
| 35 | +sysrc route_gateway="-host %%gateway%% -interface untrusted" |
| 36 | +sysrc route_default="default %%gateway%%" |
| 37 | +sysrc ipv6_defaultrouter="fe80::1%untrusted" |
| 38 | + |
| 39 | +cat > /etc/resolv.conf<<EOR |
| 40 | +nameserver %%nameserveripv4one%% |
| 41 | +nameserver %%nameserveripv4two%% |
| 42 | +nameserver %%nameserveripv6one%% |
| 43 | +nameserver %%nameserveripv6two%% |
| 44 | +EOR |
| 45 | + |
| 46 | +# enable zfs |
| 47 | +sysrc zfs_enable=YES |
| 48 | + |
| 49 | +# Enable sshd by default |
| 50 | +sysrc sshd_enable=YES |
| 51 | + |
| 52 | +# Configure SSH server |
| 53 | +sed -i '' -e 's/^#UseDNS yes/UseDNS no/' \ |
| 54 | + /etc/ssh/sshd_config |
| 55 | +sed -i '' -e 's/^#Compression delayed/Compression no/' \ |
| 56 | + /etc/ssh/sshd_config |
| 57 | +sed -i '' -e 's/^PasswordAuthentication yes/PasswordAuthentication no/' \ |
| 58 | + /etc/ssh/sshd_config |
| 59 | +sed -i '' -e 's/^#ChallengeResponseAuthentication yes/ChallengeResponseAuthentication no/' \ |
| 60 | + /etc/ssh/sshd_config |
| 61 | +sed -i '' -e 's/^#KbdInteractiveAuthentication yes/KbdInteractiveAuthentication no/' \ |
| 62 | + /etc/ssh/sshd_config |
| 63 | +sed -i '' -e 's/^#UsePAM yes/UsePAM no/' \ |
| 64 | + /etc/ssh/sshd_config |
| 65 | +sed -i '' -e 's/^#VersionAddendum .*$/VersionAddendum none/' \ |
| 66 | + /etc/ssh/sshd_config |
| 67 | +sed -i '' -e 's/^#X11Forwarding yes/X11Forwarding no/' \ |
| 68 | + /etc/ssh/sshd_config |
| 69 | + |
| 70 | +# restart ssh |
| 71 | +rm -r /etc/ssh/ssh_host_* || true |
| 72 | +/usr/bin/ssh-keygen -A |
| 73 | +service sshd restart || true |
| 74 | + |
| 75 | +# removed as causing problems with user-run Ruby programs in jails |
| 76 | +# Change umask |
| 77 | +# sed -i '' -e 's/:umask=022:/:umask=027:/g' /etc/login.conf |
| 78 | + |
| 79 | +# Disable sendmail |
| 80 | +sysrc sendmail_enable=NONE |
| 81 | + |
| 82 | +# create default user |
| 83 | +pw groupadd %%username%% |
| 84 | +pw useradd -m -n %%username%% -g %%username%% -G wheel -h - -c "default user" |
| 85 | + |
| 86 | +# add pubkey to default user |
| 87 | +mkdir -p /home/%%username%%/.ssh |
| 88 | +fetch %%pubkeyurl%% -o /home/%%username%%/.ssh/authorized_keys |
| 89 | +chown -R %%username%%:%%username%% /home/%%username%%/.ssh |
| 90 | +chmod 600 /home/%%username%%/.ssh/authorized_keys |
| 91 | +chmod 700 /home/%%username%%/.ssh |
| 92 | + |
| 93 | +# update sudo access |
| 94 | +cat > /usr/local/etc/sudoers.d/wheel<<EOF |
| 95 | +%wheel ALL=(ALL) NOPASSWD: ALL |
| 96 | +EOF |
| 97 | + |
| 98 | +# Remove root password |
| 99 | +/usr/sbin/pw usermod root -h - |
| 100 | + |
| 101 | +# Secure ttys |
| 102 | +sed -i '' -e 's/ secure/ insecure/g' /etc/ttys |
| 103 | + |
| 104 | +# Secure newsyslog |
| 105 | +sed -i '' -e 's|^/var/log/init.log 644|/var/log/init.log 640|' \ |
| 106 | + /etc/newsyslog.conf |
| 107 | +sed -i '' -e 's|^/var/log/messages 644|/var/log/messages 640|' \ |
| 108 | + /etc/newsyslog.conf |
| 109 | +sed -i '' -e 's|^/var/log/devd.log 644|/var/log/devd.log 640|' \ |
| 110 | + /etc/newsyslog.conf |
| 111 | + |
| 112 | +# download the package for realtek network adaptors, save in /root/pkg |
| 113 | +# the file will be in subdir /root/pkg/All/ |
| 114 | +mkdir -p /root/pkg |
| 115 | +/usr/sbin/pkg fetch -y -d -o /root/pkg realtek-re-kmod198 |
| 116 | + |
| 117 | +# Setup firstboot magic to determine network interface |
| 118 | +mkdir -p /usr/local/etc/rc.d |
| 119 | + |
| 120 | +# See https://reviews.freebsd.org/D43350 why we use echo here |
| 121 | +echo '#!/bin/sh' >/usr/local/etc/rc.d/firstboot_depenguin |
| 122 | +cat >>/usr/local/etc/rc.d/firstboot_depenguin<<"EOF" |
| 123 | + |
| 124 | +# KEYWORD: firstboot |
| 125 | +# PROVIDE: firstboot_depenguin |
| 126 | +# REQUIRE: syslogd NETWORKING |
| 127 | +# BEFORE: LOGIN |
| 128 | + |
| 129 | +# |
| 130 | +# Script to detect the physical uplink interface and rename |
| 131 | +# it to ${firstboot_depenguin_uplink_name} ("untrusted" by default). |
| 132 | +# |
| 133 | +# Detection is based on the list of interfaces to look for and |
| 134 | +# if they are physically connected. In case an interface is |
| 135 | +# found and configured, the server is rebooted. |
| 136 | +# |
| 137 | +# (firstboot logic from firstboot-freebsd-update by cpercival) |
| 138 | +# |
| 139 | +# Add the following lines to /etc/rc.conf.local or /etc/rc.conf (in the disk |
| 140 | +# image, since this only runs on the first boot) to enable this: |
| 141 | +# |
| 142 | +# firstboot_depenguin_enable="YES" |
| 143 | +# |
| 144 | +# Options: |
| 145 | +# |
| 146 | +# firstboot_depenguin_uplink_name: Name of the uplink interface |
| 147 | +# Set to "untrusted" by default |
| 148 | +# firstboot_depenguin_interfaces: List of physical interfaces to check for |
| 149 | +# Set to "vtnet0 em0 em1 igb0 igb1 bge0 |
| 150 | +# bge1 ixl0 ixl1 re0 re1" by default |
| 151 | +# firstboot_depenguin_sleep_secs: Seconds to sleep before probing |
| 152 | +# Set to "10" by default |
| 153 | +# |
| 154 | + |
| 155 | +. /etc/rc.subr |
| 156 | + |
| 157 | +: ${firstboot_depenguin_enable:="NO"} |
| 158 | +: ${firstboot_depenguin_uplink_name:="untrusted"} |
| 159 | +: ${firstboot_depenguin_interfaces:="vtnet0 \ |
| 160 | + em0 em1 igb0 igb1 ix0 ix1 ix2 ix3 bge0 bge1 ixl0 ixl1 re0 re1 \ |
| 161 | + bnxt0 bnxt1 bxe0 bxe1"} |
| 162 | +: ${firstboot_depenguin_sleep_secs:="10"} |
| 163 | + |
| 164 | +name="firstboot_depenguin" |
| 165 | +rcvar=firstboot_depenguin_enable |
| 166 | +start_cmd="firstboot_depenguin_run | logger -s -t 'depenguin'" |
| 167 | +stop_cmd=":" |
| 168 | + |
| 169 | +firstboot_depenguin_is_realtek_ifname() |
| 170 | +{ |
| 171 | + expr "X$1" : '^Xre[0-9]' >/dev/null |
| 172 | +} |
| 173 | + |
| 174 | +firstboot_depenguin_check_realtek_pci_id() |
| 175 | +{ |
| 176 | + local if_re_count |
| 177 | + |
| 178 | + if_re_count=$(/usr/sbin/pciconf -l | \ |
| 179 | + grep "class=0x020000" | grep -c "vendor=0x10ec") |
| 180 | + [ "$if_re_count" -gt 0 ] |
| 181 | +} |
| 182 | + |
| 183 | +firstboot_depenguin_config() |
| 184 | +{ |
| 185 | + local intf=$1 |
| 186 | + local uplink=$2 |
| 187 | + |
| 188 | + sysrc "ifconfig_${intf}_name=${uplink}" |
| 189 | + echo "Requesting reboot after fixing network interface" |
| 190 | + touch "${firstboot_sentinel}-reboot" |
| 191 | + |
| 192 | + if firstboot_depenguin_is_realtek_ifname "$intf" && |
| 193 | + firstboot_depenguin_check_realtek_pci_id; then |
| 194 | + echo "Realtek device found, installing custom driver" |
| 195 | + pkg add /root/pkg/All/realtek-re-kmod198-198.00.pkg |
| 196 | + sysrc -f /boot/loader.conf if_re_load="YES" |
| 197 | + sysrc -f /boot/loader.conf if_re_name="/boot/modules/if_re.ko" |
| 198 | + # Note: The line below disables jumbo frame support |
| 199 | + echo 'hw.re.max_rx_mbuf_sz="2048"' >>/boot/loader.conf |
| 200 | + fi |
| 201 | +} |
| 202 | + |
| 203 | +firstboot_depenguin_run() |
| 204 | +{ |
| 205 | + local uplink="$firstboot_depenguin_uplink_name" |
| 206 | + local sleep_secs="$firstboot_depenguin_sleep_secs" |
| 207 | + |
| 208 | + intfs=$(ifconfig -l | tr " " "\n") |
| 209 | + if echo "$intfs" | grep -q "^${uplink}$"; then |
| 210 | + echo "Found existing interface named ${uplink}, doing nothing" |
| 211 | + return 0 |
| 212 | + fi |
| 213 | + echo "No interface named ${uplink} found, trying to determine" |
| 214 | + echo "Sleeping ${sleep_secs} seconds to allow things to settle" |
| 215 | + sleep "${sleep_secs}" |
| 216 | + for intf in $firstboot_depenguin_interfaces; do |
| 217 | + echo "$intfs" | grep -Eq "^${intf}$" || continue |
| 218 | + echo "$intf" | grep -Eq "^ix[0-9]$" && ifconfig "$intf" up |
| 219 | + if ifconfig "$intf" | grep -q "status: no carrier"; then |
| 220 | + echo "Interface ${intf} has no carrier" |
| 221 | + continue |
| 222 | + fi |
| 223 | + echo "Found interface ${intf}, configuring" |
| 224 | + firstboot_depenguin_config "${intf}" "$uplink" |
| 225 | + return 0 |
| 226 | + done |
| 227 | + # check if we should gamble for a realtek interface |
| 228 | + if firstboot_depenguin_check_realtek_pci_id; then |
| 229 | + for intf in $firstboot_depenguin_interfaces; do |
| 230 | + firstboot_depenguin_is_realtek_ifname "$intf" \ |
| 231 | + || continue |
| 232 | + echo "Configuring potential interface ${intf}" |
| 233 | + firstboot_depenguin_config "${intf}" "$uplink" |
| 234 | + return 0 |
| 235 | + done |
| 236 | + fi |
| 237 | + echo "No potential uplink interface found" |
| 238 | +} |
| 239 | + |
| 240 | +load_rc_config $name |
| 241 | +run_rc_command "$1" |
| 242 | +EOF |
| 243 | +chmod 755 /usr/local/etc/rc.d/firstboot_depenguin |
| 244 | +sysrc firstboot_depenguin_enable=YES |
| 245 | +touch /firstboot |
| 246 | + |
| 247 | +# Reboot |
| 248 | +shutdown -p now |
0 commit comments