PowerEdge 1950 Debian install - Revision history

Adj: /* Open questions */

2014-12-21T00:36:11Z

Open questions

← Older revision		Revision as of 00:36, 21 December 2014
Line 131:		Line 131:
	* What's a reasonable set of stacked ciphers?		* What's a reasonable set of stacked ciphers?
	* How much usable space does the md layer metadata consume?		* How much usable space does the md layer metadata consume?
			** Appears to be 576 kibytes for a 2 disk RAID-1 array, 1Gibyte in size, with v1.2 metadata, and a 256kibyte chunk size.
	* How much usable space does the LUKS layer metadata consume?		* How much usable space does the LUKS layer metadata consume?

Adj: /* Open questions */

2014-12-20T04:22:39Z

Open questions

← Older revision		Revision as of 04:22, 20 December 2014
Line 130:		Line 130:
	* Hot to get passphrases to "cryptsetup luksOpen" ?		* Hot to get passphrases to "cryptsetup luksOpen" ?
	* What's a reasonable set of stacked ciphers?		* What's a reasonable set of stacked ciphers?
			* How much usable space does the md layer metadata consume?
			* How much usable space does the LUKS layer metadata consume?

	== Procedure ==		== Procedure ==

Adj: /* Serial access for the boot loader and tell Linux it has a serial console */

2014-04-14T17:28:09Z

Serial access for the boot loader and tell Linux it has a serial console

← Older revision		Revision as of 17:28, 14 April 2014
Line 106:		Line 106:

	Note that the IPMI Serial over LAN redirection on the PowerEdge 1950 redirects COM2, which Linux calls /dev/ttyS1 and GRUB calls "serial unit 1".		Note that the IPMI Serial over LAN redirection on the PowerEdge 1950 redirects COM2, which Linux calls /dev/ttyS1 and GRUB calls "serial unit 1".

			'''Also note:''' Make sure the BIOS console redirection is set to sent to COM2. It's easy to miss this and get nothing on your IPMI serial over LAN until the boot loader starts writing to the serial port.

	== Allow logins on the serial port ==		== Allow logins on the serial port ==

Adj: /* Procedure */

2012-02-27T22:35:47Z

Procedure

← Older revision		Revision as of 22:35, 27 February 2012
Line 205:		Line 205:
	lvcreate -v -L 4096M -n LUKSvar vg00		lvcreate -v -L 4096M -n LUKSvar vg00
	lvcreate -v -L 4096M -n LUKShome vg00		lvcreate -v -L 4096M -n LUKShome vg00
			cryptsetup -c anubis-cbc-essiv:rmd256 -h tiger -y -s 256 --iter-time 10000 --align-payload=2048 luksFormat /dev/vg00/LUKSroot
			cryptsetup -c anubis-cbc-essiv:rmd256 -h tiger -y -s 256 --iter-time 10000 --align-payload=2048 luksFormat /dev/vg00/LUKSswap
			cryptsetup -c anubis-cbc-essiv:rmd256 -h tiger -y -s 256 --iter-time 10000 --align-payload=2048 luksFormat /dev/vg00/LUKStmp
			cryptsetup -c anubis-cbc-essiv:rmd256 -h tiger -y -s 256 --iter-time 10000 --align-payload=2048 luksFormat /dev/vg00/LUKSusr
			cryptsetup -c anubis-cbc-essiv:rmd256 -h tiger -y -s 256 --iter-time 10000 --align-payload=2048 luksFormat /dev/vg00/LUKSvar
			cryptsetup -c anubis-cbc-essiv:rmd256 -h tiger -y -s 256 --iter-time 10000 --align-payload=2048 luksFormat /dev/vg00/LUKShome
			cryptsetup luksOpen /dev/vg00/LUKSroot vg00-root
			cryptsetup luksOpen /dev/vg00/LUKSswap vg00-swap
			cryptsetup luksOpen /dev/vg00/LUKStmp vg00-tmp
			cryptsetup luksOpen /dev/vg00/LUKSusr vg00-usr
			cryptsetup luksOpen /dev/vg00/LUKSvar vg00-var
			cryptsetup luksOpen /dev/vg00/LUKShome vg00-home
			mkfs.ext3 -c -c -b 4096 -i 8192 -m 10 -j -O has_journal,ext_attr,resize_inode,dir_index,filetype,sparse_super,large_file /dev/mapper/vg00-root
			mkfs.ext3 -c -c -b 4096 -i 8192 -m 10 -j -O has_journal,ext_attr,resize_inode,dir_index,filetype,sparse_super,large_file /dev/mapper/vg00-tmp
			mkfs.ext3 -c -c -b 4096 -i 8192 -m 10 -j -O has_journal,ext_attr,resize_inode,dir_index,filetype,sparse_super,large_file /dev/mapper/vg00-usr
			mkfs.ext3 -c -c -b 4096 -i 8192 -m 10 -j -O has_journal,ext_attr,resize_inode,dir_index,filetype,sparse_super,large_file /dev/mapper/vg00-var
			mkfs.ext3 -c -c -b 4096 -i 8192 -m 10 -j -O has_journal,ext_attr,resize_inode,dir_index,filetype,sparse_super,large_file /dev/mapper/vg00-home
			mkswap -c /dev/mapper/vg00-swap

Adj: /* Procedure */

2012-02-22T00:39:49Z

Procedure

← Older revision		Revision as of 00:39, 22 February 2012
Line 132:		Line 132:
	* Squeeze's cryptsetup and associated packages are woefully out of date. I have pulled in cryptsetup and its dependencies from unstable and will hope the lack of security updates does not bite me in the ass.		* Squeeze's cryptsetup and associated packages are woefully out of date. I have pulled in cryptsetup and its dependencies from unstable and will hope the lack of security updates does not bite me in the ass.
	* Create partition number 4 on each of the disks. These will be LUKS devices that will be assembled into a software RAID1.		* Create partition number 4 on each of the disks. These will be LUKS devices that will be assembled into a software RAID1.

			Partition table now looks like so:

			Number Start End Size File system Name Flags
			1 2048s 526335s 524288s gulik_sda_efi_boot bios_grub
			2 526336s 2623487s 2097152s gulik_sda_mdraid_boot raid
			3 2623488s 4720639s 2097152s gulik_sda_mdraid_root raid
			4 4720640s 143374615s 138653976s gulik_sda_luks_mdraid_member_0

	* Splat random bits onto these devices like so:		* Splat random bits onto these devices like so:
	sudo dd if=/dev/urandom of=/dev/sda4 bs=1M		sudo dd if=/dev/urandom of=/dev/sda4 bs=1M
	sudo dd if=/dev/urandom of=/dev/sdb4 bs=1M		sudo dd if=/dev/urandom of=/dev/sdb4 bs=1M

			Feel free to skip this step if desired. The risk here is that old, unencrypted data might be recoverable from sectors that are never written to.
⚫	/dev/urandom can be pretty slow (about 4Mbytes/sec on this machine). Assuming there are 4Mibytes of free space in /tmp, here's a much faster method:

		⚫	Also note that /dev/urandom can be pretty slow (about 4Mbytes/sec on this machine). Assuming there are 4Mibytes of free space in /tmp, here's a much faster method:

	dd if=/dev/urandom bs=1024 count=4096 of=/tmp/randfile		dd if=/dev/urandom bs=1024 count=4096 of=/tmp/randfile

Adj: /* Procedure */

2012-02-22T00:37:06Z

Procedure

← Older revision		Revision as of 00:37, 22 February 2012
Line 150:		Line 150:
	* perhaps multiple keys should go into a single GPG encrypted file, one per line, with a key of the block device		* perhaps multiple keys should go into a single GPG encrypted file, one per line, with a key of the block device
	* Put a LUKS header on the devices:		* Put a LUKS header on the devices:
	sudo cryptsetup -c aes-xts-plain64:sha512 -h SHA512 -y -s 256 --iter-time 5000 luksFormat /dev/sda4		sudo cryptsetup -c aes-xts-plain64:sha512 -h SHA512 -y -s 256 --iter-time 5000 --align-payload=2048 luksFormat /dev/sda4
	sudo cryptsetup -c aes-xts-plain64:sha512 -h SHA512 -y -s 256 --iter-time 5000 luksFormat /dev/sdb4		sudo cryptsetup -c aes-xts-plain64:sha512 -h SHA512 -y -s 256 --iter-time 5000 --align-payload=2048 luksFormat /dev/sdb4
	* Add some modules to the initramfs. Add the following lines to the end of /etc/initramfs-tools/modules:		* Add some modules to the initramfs. Add the following lines to the end of /etc/initramfs-tools/modules:
	dm_mod		dm_mod
Line 173:		Line 173:
	# (We'll add another physical disk, LUKS format it, and add it to the MD array at some later time.)		# (We'll add another physical disk, LUKS format it, and add it to the MD array at some later time.)
	* Put a LUKS volume on top of the software RAID device like so:		* Put a LUKS volume on top of the software RAID device like so:
	sudo cryptsetup -c twofish-xts-plain64:wp512 -h WHIRLPOOL -y -s 512 --iter-time 10000 luksFormat /dev/md/gulik_mdraid_luks_vg00_pv_0		sudo cryptsetup -c twofish-xts-plain64:wp512 -h WHIRLPOOL -y -s 512 --iter-time 10000 --align-payload=2048 luksFormat /dev/md/gulik_mdraid_luks_vg00_pv_0
	* Open the new LUKS volume so we can start putting LVM structures on it:		* Open the new LUKS volume so we can start putting LVM structures on it:
	sudo cryptsetup luksOpen /dev/md/gulik_mdraid_luks_vg00_pv_0 gulik_vg00_pv_0		sudo cryptsetup luksOpen /dev/md/gulik_mdraid_luks_vg00_pv_0 gulik_vg00_pv_0
Line 179:		Line 179:
	gulik_vg00_pv_0 /dev/md/gulik_mdraid_luks_vg00_pv_0 none luks		gulik_vg00_pv_0 /dev/md/gulik_mdraid_luks_vg00_pv_0 none luks
	* Run pvcreate:		* Run pvcreate:
	sudo pvcreate --metadatatype 2 --pvmetadatacopies 2 -v -Z y /dev/mapper/gulik_vg00_pv_0		sudo pvcreate --metadatatype 2 --pvmetadatacopies 2 -v -Z y --dataalignment 1M /dev/mapper/gulik_vg00_pv_0
	* Add two more modules to /etc/initramfs-tools/modules:		* Add two more modules to /etc/initramfs-tools/modules:
	twofish_x86_64		twofish_x86_64
Line 185:		Line 185:
	* Rebuild initramfs:		* Rebuild initramfs:
	sudo update-initramfs -v -v -u		sudo update-initramfs -v -v -u
			* Create a volume group using the physical volume that was just created:
			sudo vgcreate -l 255 -M 2 -p 255 -s 256M -v vg00 /dev/mapper/gulik_vg00_pv_0
			* Create logical volumes, put LUKS on them, open LUKS volumes, mkfs them:
			lvcreate -v -L 1024M -n LUKSroot vg00
			lvcreate -v -L 4096M -n LUKSswap vg00
			lvcreate -v -L 4096M -n LUKStmp vg00
			lvcreate -v -L 4096M -n LUKSusr vg00
			lvcreate -v -L 4096M -n LUKSvar vg00
			lvcreate -v -L 4096M -n LUKShome vg00

Adj: /* Procedure */

2012-02-21T23:11:32Z

Procedure

← Older revision		Revision as of 23:11, 21 February 2012
Line 135:		Line 135:
	sudo dd if=/dev/urandom of=/dev/sda4 bs=1M		sudo dd if=/dev/urandom of=/dev/sda4 bs=1M
	sudo dd if=/dev/urandom of=/dev/sdb4 bs=1M		sudo dd if=/dev/urandom of=/dev/sdb4 bs=1M

			/dev/urandom can be pretty slow (about 4Mbytes/sec on this machine). Assuming there are 4Mibytes of free space in /tmp, here's a much faster method:

			dd if=/dev/urandom bs=1024 count=4096 of=/tmp/randfile
			(while true; do cat /tmp/randfile; done) \| sudo dd bs=1M of=/dev/sda4
			(while true; do cat /tmp/randfile; done) \| sudo dd bs=1M of=/dev/sdb4

	* Generate keys for these devices:		* Generate keys for these devices:
	# 64 bytes of random data, printed in hex is 128 characters and 512 bits, which should be a decent sized passphrase.		# 64 bytes of random data, printed in hex is 128 characters and 512 bits, which should be a decent sized passphrase.

Adj: /* non-Free firmware for Ethernet cards */

2012-02-19T17:22:43Z

non-Free firmware for Ethernet cards

← Older revision		Revision as of 17:22, 19 February 2012
Line 33:		Line 33:
	PowerEdge 1950 machines have 2 on-board Broadcom Corporation NetXtreme II BCM5708 Gigabit Ethernet adapters. Firmware for these adapters is non-free and must be loaded to perform the Debian installation.		PowerEdge 1950 machines have 2 on-board Broadcom Corporation NetXtreme II BCM5708 Gigabit Ethernet adapters. Firmware for these adapters is non-free and must be loaded to perform the Debian installation.

	An ISO image is available at http://cdimage.debian.org/cdimage/unofficial/non-free/cd-including-firmware/~~6.0.3~~/amd64/iso-cd/ which should include the bits necessary to use these adapters during the OS installation. This is the Netinst ISO but it includes the non-free firmware. Saves on getting the non-free firmware installed using USB keys, floppies, or other media.		An ISO image is available at http://cdimage.debian.org/cdimage/unofficial/non-free/cd-including-firmware/current/amd64/iso-cd/ which should include the bits necessary to use these adapters during the OS installation. This is the Netinst ISO but it includes the non-free firmware. Saves on getting the non-free firmware installed using USB keys, floppies, or other media.

	http://wiki.debian.org/Firmware has a discussion of issues surrounding the non-free firmware needed by these systems and its use in Debian.		http://wiki.debian.org/Firmware has a discussion of issues surrounding the non-free firmware needed by these systems and its use in Debian.

Adj: /* Procedure */

2012-02-14T00:47:30Z

Procedure

← Older revision		Revision as of 00:47, 14 February 2012
Line 165:		Line 165:
	/dev/mapper/gulik_softraid_vg00_pv_member_0 missing		/dev/mapper/gulik_softraid_vg00_pv_member_0 missing
	# (We'll add another physical disk, LUKS format it, and add it to the MD array at some later time.)		# (We'll add another physical disk, LUKS format it, and add it to the MD array at some later time.)
			* Put a LUKS volume on top of the software RAID device like so:
			sudo cryptsetup -c twofish-xts-plain64:wp512 -h WHIRLPOOL -y -s 512 --iter-time 10000 luksFormat /dev/md/gulik_mdraid_luks_vg00_pv_0
			* Open the new LUKS volume so we can start putting LVM structures on it:
			sudo cryptsetup luksOpen /dev/md/gulik_mdraid_luks_vg00_pv_0 gulik_vg00_pv_0
			* Add appropriate entry to /etc/crypttab:
			gulik_vg00_pv_0 /dev/md/gulik_mdraid_luks_vg00_pv_0 none luks
			* Run pvcreate:
			sudo pvcreate --metadatatype 2 --pvmetadatacopies 2 -v -Z y /dev/mapper/gulik_vg00_pv_0
			* Add two more modules to /etc/initramfs-tools/modules:
			twofish_x86_64
			wp512
			* Rebuild initramfs:
			sudo update-initramfs -v -v -u

Adj: /* IPMI */

2012-02-13T22:24:14Z

IPMI

← Older revision		Revision as of 22:24, 13 February 2012
Line 20:		Line 20:
	will turn it off.		will turn it off.
	ipmitool -H 172.16.0.241 -U Admin sol activate		ipmitool -H 172.16.0.241 -U Admin sol activate
	will conect to a serial console where you can interact with GRUB and the Linux kernel console, and log in ~~vial~~ a serial connection on /dev/ttyS1.		will conect to a serial console where you can interact with GRUB and the Linux kernel console, and log in via a serial connection on /dev/ttyS1.

	There are a bunch of other possibilities, too.		There are a bunch of other possibilities, too.