Ich habe einen Hetzner-Server über die Serverbörse bestellt und meinen SSH-Schlüssel registriert.
Auf dem Rettungssystem kann ich mich damit anmelden:
12345678910111213141516171819202122232425262728
$ ssh root@8.145.3.2
The authenticity of host '8.145.3.2 (8.145.3.2)' can't be established.
ECDSA key fingerprint is ee:fd:95:77:cc:f4:9c:5d:3c:22:10:39:8a:8e:80:55.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '8.145.3.2' (ECDSA) to the list of known hosts.
-------------------------------------------------------------------
Welcome to the Hetzner Rescue System.
...
-------------------------------------------------------------------
Rescue System up since 2020-10-23 14:16 +02:00
Hardware data:
CPU1: AMD Ryzen 5 3600 6-Core Processor (Cores 12)
Memory: 64258 MB
Disk /dev/nvme0n1: 512 GB (=> 476 GiB) doesn't contain a valid partition table
Disk /dev/nvme1n1: 512 GB (=> 476 GiB) doesn't contain a valid partition table
Total capacity 953 GiB with 2 Disks
Network data:
eth0 LINK: yes
MAC: a8:XX:...
IP: 8.145.3.2
IPv6: 2a01:XXX:...:2/64
Intel(R) Gigabit Ethernet Network Driver
Installation Minimal-Ubuntu
Zuerst installieren wir ein Minimal-Ubuntu.
Das Minimal-Ubuntu läuft ohne Verschlüsselung und
wird später in die verschlüsselten Plattenbereiche
umkopiert.
Anmelden am Rettungssystem
12345678
desktop:~$ ssh root@8.145.3.2
-------------------------------------------------------------------
Welcome to the Hetzner Rescue System.
...
-------------------------------------------------------------------
...
rescue:/#
Grundinstallation
Die Grundinstallation sollte diese Anforderungen erfüllen:
möglichst kompakt
keine komplizierte Plattenaufteilung (nur ein Bereich)
Sie wird später umkopiert in die finale Installation. Dabei
kann dann auch eine anspruchsvolle Plattenaufteilung erfolgen,
bspw. separater /tmp-Bereich!
Interaktiv
1
rescue:/# installimage
Dann Fragen beantworten! Am Ende gibt es nach der Installation
eine Datei “installimage.conf”, die als “vorgefertigte Konfiguration”
verwendet werden kann – falls man die Grundinstallation wiederholen
möchte!
Vorgefertigte Konfiguration
Datei /autosetup
Inhalt:
12345678910111213141516171819202122
#
# Hetzner Online GmbH - installimage
#
# This file contains the configuration used to install this
# system via installimage script. Comments have been removed.
#
# More information about the installimage script and
# automatic installations can be found in our wiki:
#
# http://wiki.hetzner.de/index.php/Installimage
#
DRIVE1 /dev/nvme0n1
DRIVE2 /dev/nvme1n1
SWRAID 1
SWRAIDLEVEL 1
HOSTNAME hetzner-de-ryzen
PART /boot ext3 512M
PART lvm vg0 all
LV vg0 root / ext4 10G
LV vg0 swap swap swap 4G
IMAGE /root/.oldroot/nfs/install/../images/Ubuntu-2004-focal-64-minimal.tar.gz
Ablegen auf dem Hetzner-Server:
Obigen Inhalt “kopieren”
Im Rettungssystem: cat >/autosetup (bleibt “hängen”)
rescue:/# vgremove vg0
Do you really want to remove volume group "vg0" containing 2 logical volumes? [y/n]: y
Do you really want to remove active logical volume vg0/swap? [y/n]: y
Logical volume "swap" successfully removed
Do you really want to remove active logical volume vg0/root? [y/n]: y
Logical volume "root" successfully removed
Volume group "vg0" successfully removed
desktop:~$ ssh -o UserKnownHostsFile=/dev/null root@8.145.3.2
The authenticity of host '8.145.3.2 (8.145.3.2)' can't be established.
ECDSA key fingerprint is ee:fd:95:77:cc:f4:9c:5d:3c:22:10:39:8a:8e:80:55.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '8.145.3.2' (ECDSA) to the list of known hosts.
To unlock root partition, and maybe others like swap, run `cryptroot-unlock`
BusyBox v1.27.2 (Ubuntu 1:1.27.2-2ubuntu3.2) built-in shell (ash)
Enter 'help' for a list of built-in commands.
# cryptroot-unlock
Please unlock disk cryptroot (/dev/md1): {meinKennwort}
Error: Timeout reached while waiting for PID 388.
# exit
desktop:~$ ssh root@8.145.3.2
sb35:/# cryptsetup luksAddKey /dev/md1
Enter any existing passphrase: {keinKennwort}
Enter new passphrase for key slot: Porsche911_{geheimerZweiterTeil}
Verify passphrase: Porsche911_{geheimerZweiterTeil}
#!/bin/sh
#
#
# This is an example hook script. It will be run by 'mkinitramfs'
# when it creates the image. It's job is to decide which files to
# install, then install them into the staging area, where the
# initramfs is being created. This happens when a new 'linux-image'
# package is installed, or when the administrator runs 'mkinitramfs'
# by hand to update an initramfs image.
#
# CONFDIR -- usually /etc/initramfs-tools, can be set on mkinitramfs
# command line.
#
# DESTDIR -- The staging directory where we are building the image.
#
# see initramfs-tools(8)
#
# List the soft prerequisites here. This is a space separated list of
# names, of scripts that are in the same directory as this one, that
# must be run before this one can be.
#
PREREQ=""
prereqs()
{
echo "$PREREQ"
}
case $1 in
# get pre-requisites
prereqs)
prereqs
exit 0
;;
esac
# You can do anything you need to from here on.
#
# Source the optional 'hook-functions' scriptlet, if you need the
# functions defined within it. Read it to see what is available to
# you. It contains functions for copying dynamically linked program
# binaries, and kernel modules into the DESTDIR.
#
. /usr/share/initramfs-tools/hook-functions
copy_file binary "${CONFDIR}/unlock-disks.sh" "/bin"
exit 0
desktop:~$ ssh root@8.145.3.2
final:/# reboot
Connection to 8.145.3.2 closed by remote host.
Connection to 8.145.3.2 closed.
desktop:~$ echo "Porsche911"|ssh -o UserKnownHostsFile=knownHosts-boot root@8.145.3.2 /bin/unlock-disks.sh
The authenticity of host '8.145.3.2 (8.145.3.2)' can't be established.
ECDSA key fingerprint is 68:...
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '8.145.3.2' (ECDSA) to the list of known hosts.
Please unlock disk cryptroot (/dev/md1)
Error: Timeout reached while waiting for PID 394.
desktop:~$ ssh root@8.145.3.2
Welcome to Ubuntu 20.04.1 LTS (GNU/Linux 5.4.0-52-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
...
final:/#
Weitere SSH-Schlüssel für den Boot-Vorgang freischalten
Datei “etc/dropbear-initramfs/authorized_keys” erweitern um den PubKey:
Während der Installation und eine ganze Weile danach habe
ich den Eindruck, dass der Server sehr langsam ist. Insbesondere
wenn Datenbereiche kopiert werden, dauert das ewig.
Sichtung von “/proc/mdstat” zeigt, dass der Resync des von mir
verwendeten Raid1 noch im Gange ist:
