Ich habe einen Hetzner-Server über die Serverbörse bestellt und meinen SSH-Schlüssel registriert.
Auf dem Rettungssystem kann ich mich damit anmelden:
12345678910111213141516171819202122232425262728
$ ssh root@8.145.3.2
The authenticity of host '8.145.3.2 (8.145.3.2)' can't be established.
ECDSA key fingerprint is ee:fd:95:77:cc:f4:9c:5d:3c:22:10:39:8a:8e:80:55.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '8.145.3.2' (ECDSA) to the list of known hosts.
-------------------------------------------------------------------
Welcome to the Hetzner Rescue System.
...
-------------------------------------------------------------------
Rescue System up since 2019-10-15 08:11 +02:00
Hardware data:
CPU1: Intel(R) Core(TM) i7-3770 CPU @ 3.40GHz (Cores 8)
Memory: 32086 MB
Disk /dev/sda: 3000 GB (=> 2794 GiB) doesn't contain a valid partition table
Disk /dev/sdb: 3000 GB (=> 2794 GiB) doesn't contain a valid partition table
Total capacity 5589 GiB with 2 Disks
Network data:
eth0 LINK: yes
MAC: d8:80:11:22:33:44
IP: 8.145.3.2
IPv6: 2e01:5e3:111:2222::2/64
RealTek RTL-8169 Gigabit Ethernet driver
Server ist sehr langsam
Während der Installation und eine ganze Weile danach habe
ich den Eindruck, dass der Server sehr langsam ist. Insbesondere
wenn Datenbereiche kopiert werden, dauert das ewig.
Sichtung von “/proc/mdstat” zeigt, dass der Resync des von mir
verwendeten Raid1 noch im Gange ist:
Nachdem der Resync fertig ist, sollte der Rechner dauerhaft mit der üblichen Geschwindigkeit funktionieren!
Installation Minimal-Ubuntu
Zuerst installieren wir ein Minimal-Ubuntu.
Das Minimal-Ubuntu läuft ohne Verschlüsselung und
wird später in die verschlüsselten Plattenbereiche
umkopiert.
Anmelden am Rettungssystem
12345678
desktop:~$ ssh root@8.145.3.2
-------------------------------------------------------------------
Welcome to the Hetzner Rescue System.
...
-------------------------------------------------------------------
...
rescue:/#
rescue:/# vgremove vg0
Do you really want to remove volume group "vg0" containing 2 logical volumes? [y/n]: y
Do you really want to remove active logical volume vg0/swap? [y/n]: y
Logical volume "swap" successfully removed
Do you really want to remove active logical volume vg0/root? [y/n]: y
Logical volume "root" successfully removed
Volume group "vg0" successfully removed
final:/# update-grub
Sourcing file `/etc/default/grub'
Generating grub configuration file ...
WARNING: Failed to connect to lvmetad. Falling back to device scanning.
WARNING: Failed to connect to lvmetad. Falling back to device scanning.
WARNING: Failed to connect to lvmetad. Falling back to device scanning.
WARNING: Failed to connect to lvmetad. Falling back to device scanning.
WARNING: Failed to connect to lvmetad. Falling back to device scanning.
WARNING: Failed to connect to lvmetad. Falling back to device scanning.
WARNING: Failed to connect to lvmetad. Falling back to device scanning.
WARNING: Failed to connect to lvmetad. Falling back to device scanning.
WARNING: Failed to connect to lvmetad. Falling back to device scanning.
WARNING: Failed to connect to lvmetad. Falling back to device scanning.
Found linux image: /boot/vmlinuz-4.15.0-65-generic
Found initrd image: /boot/initrd.img-4.15.0-65-generic
WARNING: Failed to connect to lvmetad. Falling back to device scanning.
WARNING: Failed to connect to lvmetad. Falling back to device scanning.
done
final:/# grub-install /dev/sda
Installing for i386-pc platform.
Installation finished. No error reported.
final:/# grub-install /dev/sdb
Installing for i386-pc platform.
Installation finished. No error reported.
desktop:~$ ssh -o UserKnownHostsFile=/dev/null root@8.145.3.2
The authenticity of host '8.145.3.2 (8.145.3.2)' can't be established.
ECDSA key fingerprint is ee:fd:95:77:cc:f4:9c:5d:3c:22:10:39:8a:8e:80:55.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '8.145.3.2' (ECDSA) to the list of known hosts.
To unlock root partition, and maybe others like swap, run `cryptroot-unlock`
BusyBox v1.27.2 (Ubuntu 1:1.27.2-2ubuntu3.2) built-in shell (ash)
Enter 'help' for a list of built-in commands.
# cryptroot-unlock
Please unlock disk cryptroot (/dev/md1): {meinKennwort}
Error: Timeout reached while waiting for PID 388.
# exit
desktop:~$ ssh root@8.145.3.2
sb35:/# cryptsetup luksAddKey /dev/md1
Enter any existing passphrase: {keinKennwort}
Enter new passphrase for key slot: Porsche911_{geheimerZweiterTeil}
Verify passphrase: Porsche911_{geheimerZweiterTeil}
#!/bin/sh
#
#
# This is an example hook script. It will be run by 'mkinitramfs'
# when it creates the image. It's job is to decide which files to
# install, then install them into the staging area, where the
# initramfs is being created. This happens when a new 'linux-image'
# package is installed, or when the administrator runs 'mkinitramfs'
# by hand to update an initramfs image.
#
# CONFDIR -- usually /etc/initramfs-tools, can be set on mkinitramfs
# command line.
#
# DESTDIR -- The staging directory where we are building the image.
#
# see initramfs-tools(8)
#
# List the soft prerequisites here. This is a space separated list of
# names, of scripts that are in the same directory as this one, that
# must be run before this one can be.
#
PREREQ=""
prereqs()
{
echo "$PREREQ"
}
case $1 in
# get pre-requisites
prereqs)
prereqs
exit 0
;;
esac
# You can do anything you need to from here on.
#
# Source the optional 'hook-functions' scriptlet, if you need the
# functions defined within it. Read it to see what is available to
# you. It contains functions for copying dynamically linked program
# binaries, and kernel modules into the DESTDIR.
#
. /usr/share/initramfs-tools/hook-functions
copy_file binary "${CONFDIR}/unlock-disks.sh" "/bin"
exit 0
desktop:~$ ssh root@8.145.3.2
sb35:/# reboot
Connection to 8.145.3.2 closed by remote host.
Connection to 8.145.3.2 closed.
desktop:~$ echo "Porsche911"|ssh -o UserKnownHostsFile=knownHosts-boot root@8.145.3.2 /bin/unlock-disks.sh
The authenticity of host '8.145.3.2 (8.145.3.2)' can't be established.
ECDSA key fingerprint is 68:...
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '8.145.3.2' (ECDSA) to the list of known hosts.
Please unlock disk cryptroot (/dev/md1)
Error: Timeout reached while waiting for PID 394.
desktop:~$ ssh root@8.145.3.2
Welcome to Ubuntu 18.04.3 LTS (GNU/Linux 4.15.0-65-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
...
sb35:/#
Weitere SSH-Schlüssel für den Boot-Vorgang freischalten
Datei “etc/dropbear-initramfs/authorized_keys” erweitern um den PubKey:
