From 3441b392e0c0745d342234d036a751a074bb77a1 Mon Sep 17 00:00:00 2001 From: Anish L Date: Mon, 30 May 2022 00:36:02 +1000 Subject: [PATCH] move around install scripts --- install-encrypted.sh | 121 ++++++++++++++++++++++++++++++ install-yubikey.sh | 172 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 293 insertions(+) create mode 100755 install-encrypted.sh create mode 100755 install-yubikey.sh diff --git a/install-encrypted.sh b/install-encrypted.sh new file mode 100755 index 00000000..e044cd56 --- /dev/null +++ b/install-encrypted.sh @@ -0,0 +1,121 @@ +# Setup +# Presumes pre-formatted harddrives +BOOT=/dev/sda1 +DISK=/dev/sda2 + +dd if=/dev/urandom of=./keyfile0.bin bs=1024 count=4 +dd if=/dev/urandom of=./keyfile1.bin bs=1024 count=4 + +echo "Creating LUKS partitions..." +# Enter the passphrase which is used to unlock disk. You will enter this in grub on every boot +cryptsetup luksFormat --type luks1 -c aes-xts-plain64 -s 256 -h sha512 $DISK +# Add a second key which will be used by nixos. You will need to enter the pasphrase from previous step +cryptsetup luksAddKey $DISK keyfile0.bin +cryptsetup luksOpen $DISK crypted-nixos -d keyfile0.bin + +# Create the LVM +echo "Creating LVM partitions..." +pvcreate /dev/mapper/crypted-nixos +vgcreate vg /dev/mapper/crypted-nixos +lvcreate -L 4G -n swap vg +lvcreate -l '100%FREE' -n root vg + +# Format the disks +echo "Formatting disks..." +mkfs.fat -F 32 $BOOT +mkswap -L swap /dev/vg/swap +mkfs.ext4 -L root /dev/vg/root +# mkfs.ext4 -L data /dev/mapper/crypted-data + +echo "Mounting drives..." +mount /dev/vg/root /mnt +mkdir -p /mnt/boot/efi +mount $BOOT /mnt/boot/efi +swapon /dev/vg/swap + +# Copy the keys + +mkdir -p /mnt/etc/secrets/initrd/ +cp keyfile0.bin keyfile1.bin /mnt/etc/secrets/initrd +chmod 000 /mnt/etc/secrets/initrd/keyfile*.bin + +# Generate and edit configuration + +echo "Generating NixOS config..." +nixos-generate-config --root /mnt + +# TODO: neds to get the uuid of each of the disks +# UUID=$(blkid) +echo "Extending NixOS config..." +cat >> /mnt/etc/nixos/configuration.nix <<'endmsg' + boot.loader.efi.canTouchEfiVariables = true; + boot.loader.efi.efiSysMountPoint = "/boot/efi"; + boot.loader.grub = { + enable = true; + device = "nodev"; + version = 2; + efiSupport = true; + enableCryptodisk = true; + }; + + boot.initrd = { + luks.devices."root" = { + # UPDATE ME + device = "/dev/disk/by-uuid/a8b302cf-5296-4a2e-a7ba-707e6fa75123"; # UUID for /dev/nvme01np2 + preLVM = true; + keyFile = "/keyfile0.bin"; + allowDiscards = true; + }; + secrets = { + # Create /mnt/etc/secrets/initrd directory and copy keys to it + "keyfile0.bin" = "/etc/secrets/initrd/keyfile0.bin"; + "keyfile1.bin" = "/etc/secrets/initrd/keyfile1.bin"; + }; + }; + + # Data mount + # This is all wrong for box for now + # fileSystems."/data" = { + # device = "/dev/disk/by-uuid/79630267-5766-4c7d-85a5-1d5f1dcd58ad"; # UUID for /dev/mapper/crypted-data + # encrypted = { + # enable = true; + # label = "crypted-data"; + # blkDev = "/dev/disk/by-uuid/3476cb09-b3c4-4301-9ec9-84f60f32828a"; # UUID for /dev/sda1 + # keyFile = "/keyfile1.bin"; + # }; + # }; + + time.timeZone = "Australia/Brisbane"; + + networking.useDHCP = false; + + nix = { + package = pkgs.nixUnstable; + extraOptions = '' + experimental-features = nix-command flakes + ''; + }; + + users.users.anish = { + isNormalUser = true; + hashedPassword = "MVHHpy9gbe3ow"; + extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user. + openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDM0Zvei46x/yZl/IeBCq6+IYQQ0avulzVyBysF9cPigZMCybWRV7IEU+E3k9t6JrbdbdGfJkcZIWmsWDdKS8W8mBnZpVoT0ffLynu8JQ/TKdGm4Qv6bgUeKNrGsNv0ZPs2CDaGSLj0oJfRF7Ko10tcLP0vW+yujrh+y6TH/vVzJioaV4TGvtCUpn+wEQah9ROwPQLUUofsSWdnRsDJ/gp37zXWs4l5wyjSKtP3O9RZUP7kBekbSqEgSXiTk0oUQSVqIWl9NDiP6onk/gSOjXsR/JPqsSN/XI/c/yj6gyY0f51Ru2D7iBxuMJIJcWV+rU6coIj+ULcQWLzt/7TI8jq5AOOzI/ll4zbL24Eo84Rz+TP9tvMMhDZ0VaMN22AJ8qQEjc5P09tWKsX7Jg39XelyV1jHXncE4yvIE9F4RSCHzWCeKeXakizQNuzSaxTxIExRFYHjNW5bR6+3MTGwVrEIXU+qML+0yFTR86MT+tdY5AreAJQLwbog79O1NupeXJE= anish@curve" ]; + }; + security.sudo.wheelNeedsPassword = false; # needed for deploy-rs + + services.openssh.enable = true; + + # This value determines the NixOS release from which the default + # settings for stateful data, like file locations and database versions + # on your system were taken. It‘s perfectly fine and recommended to leave + # this value at the release version of the first install of this system. + # Before changing this value read the documentation for this option + # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). + system.stateVersion = "21.05"; # Did you read the comment? +} + +endmsg + + +# sudo nixos-install diff --git a/install-yubikey.sh b/install-yubikey.sh new file mode 100755 index 00000000..2ddac5b9 --- /dev/null +++ b/install-yubikey.sh @@ -0,0 +1,172 @@ +rbtohex() { + ( od -An -vtx1 | tr -d ' \n' ) +} + +hextorb() { + ( tr '[:lower:]' '[:upper:]' | sed -e 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/gI'| xargs printf ) +} + +# Setup +# nix-env -i gcc-wrapper +# nix-env -i yubikey-personalization +# nix-env -i openssl +# Use nix-shell https://github.com/sgillespie/nixos-yubikey-luks/archive/master.tar.gz + +# Compile correct version of OpenSSL key derivation +cc -O3 -I$(nix-build "" --no-build-output -A openssl.dev)/include -L$(nix-build "" --no-build-output -A openssl.out)/lib $(nix eval "(with import {}; pkgs.path)")/nixos/modules/system/boot/pbkdf2-sha512.c -o ./pbkdf2-sha512 -lcrypto + +# Yubikey Setup +SLOT=2 +ykpersonalize -"$SLOT" -ochal-resp -ochal-hmac +SALT_LENGTH=16 +salt="$(dd if=/dev/random bs=1 count=$SALT_LENGTH 2>/dev/null | rbtohex)" +k_user=PASSWORDCHANGEMEPLAEASES +challenge="$(echo -n $salt | openssl dgst -binary -sha512 | rbtohex)" +response="$(ykchalresp -2 -x $challenge 2>/dev/null)" + +# Setup LUKS device +KEY_LENGTH=512 +ITERATIONS=1000000 +k_luks="$(echo -n $k_user | ./pbkdf2-sha512 $(($KEY_LENGTH / 8)) $ITERATIONS $response | rbtohex)" + +EFI_PART=/dev/sda1 +LUKS_PART=/dev/sda2 +EFI_MNT=/boot/ +mkdir -p "$EFI_MNT" +mkfs.fat -F 32 -n boot "$EFI_PART" +mount "$EFI_PART" "$EFI_MNT" +STORAGE=/crypt-storage/default +mkdir -p "$(dirname $EFI_MNT$STORAGE)" +echo -ne "$salt\n$ITERATIONS" > $EFI_MNT$STORAGE +CIPHER=aes-xts-plain64 +HASH=sha512 +echo -n "$k_luks" | hextorb | cryptsetup luksFormat --cipher="$CIPHER" --key-size="$KEY_LENGTH" --hash="$HASH" --key-file=- "$LUKS_PART" +umount "$EFI_MNT" + +# LVM Setup +LUKSROOT=crypthome +echo -n "$k_luks" | hextorb | cryptsetup luksOpen $LUKS_PART $LUKSROOT --key-file=- +pvcreate "/dev/mapper/$LUKSROOT" +VGNAME=partitions +vgcreate "$VGNAME" "/dev/mapper/$LUKSROOT" +lvcreate -L 2G -n swap "$VGNAME" +FSROOT=fsroot +lvcreate -l 100%FREE -n "$FSROOT" "$VGNAME" + +vgchange -ay +mkswap -L swap /dev/partitions/swap + +# BTRFS Setup +mkfs.btrfs -L "$FSROOT" "/dev/partitions/$FSROOT" + +# incase the above breaks +#mkdir /mnt-root +#touch /mnt-root/nix-store.squashfs + +mount "/dev/partitions/$FSROOT" /mnt +cd /mnt +btrfs subvolume create root +btrfs subvolume create home +cd +umount /mnt +mount -o subvol=root "/dev/partitions/$FSROOT" /mnt +mkdir /mnt/home +mount -o subvol=home "/dev/partitions/$FSROOT" /mnt/home +mkdir /mnt/boot +mount "$EFI_PART" /mnt/boot + +swapon /dev/partitions/swap + +# Install NixOS +nixos-generate-config --root /mnt + +# Change the config +cat > /mnt/etc/nixos/configuration.nix <<'endmsg' +{ config, pkgs, ... }: + +{ + imports = + [ # Include the results of the hardware scan. + ./hardware-configuration.nix + ]; + + boot.loader.grub.enable = true; + boot.loader.grub.version = 2; + # Define on which hard drive you want to install Grub. + boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only + + # Minimal list of modules to use the EFI system partition and the YubiKey + boot.initrd.kernelModules = [ "vfat" "nls_cp437" "nls_iso8859-1" "usbhid" ]; + + # Enable support for the YubiKey PBA + boot.initrd.luks.yubikeySupport = true; + + # Configuration to use your Luks device + boot.initrd.luks.devices = { + "crypthome" = { + device = "/dev/sda2"; + preLVM = true; # You may want to set this to false if you need to start a network service first + yubikey = { + slot = 2; + twoFactor = true; # Set to false if you did not set up a user password. + storage = { + device = "/dev/sda1"; + }; + }; + }; + }; + + # Enable Flakes + nix = { + package = pkgs.nixUnstable; + extraOptions = '' + experimental-features = nix-command flakes + ''; + }; + + networking.hostName = "curve"; # Define your hostname. + networking.wireless.enable = true; # Enables wireless support via wpa_supplicant. + + time.timeZone = "Australia/Brisbane"; + + networking.useDHCP = false; + networking.interfaces.enp0s31f6.useDHCP = true; + networking.interfaces.wlp3s0.useDHCP = true; + + # Select internationalisation properties. + i18n.defaultLocale = "en_US.UTF-8"; + # console = { + # font = "Lat2-Terminus16"; + # keyMap = "us"; + # }; + + services.xserver.layout = "us,dvorak"; + + sound.enable = true; + hardware.pulseaudio.enable = true; + + services.xserver.libinput.enable = true; + + # Hmmm maybe somewhere else? + users.users.anish = { + isNormalUser = true; + extraGroups = [ "wheel" ]; + }; + + # Enable the OpenSSH daemon. + # services.openssh.enable = true; + + # This value determines the NixOS release from which the default + # settings for stateful data, like file locations and database versions + # on your system were taken. It‘s perfectly fine and recommended to leave + # this value at the release version of the first install of this system. + # Before changing this value read the documentation for this option + # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). + system.stateVersion = "21.05"; # Did you read the comment? +} + +endmsg + +cd /mnt +nixos-install --root /mnt +passwd