From: Matt Birkholz Date: Mon, 15 Jun 2026 17:16:15 +0000 (-0600) Subject: Update from a fresh install of Debian 13. X-Git-Url: https://birchwood-abbey.net/git?a=commitdiff_plain;h=831f0bd3b3b58833839bdfbd45f36234dcecec56;p=Institute Update from a fresh install of Debian 13. Move Gate (and Core) to the private Ethernet immediately after download (installing) additional packages, before exchanging public keys, using their private IP addresses. Punted the example of a textual Debian install setting the initial user's password. A graphical install is the default. Added instructions for creating a WireGuard™ key pair and registering the public key. And gave the appropriate answers (the defaults) to the Postfix installation questions. --- diff --git a/README.org b/README.org index 586e6a6..291d7b9 100644 --- a/README.org +++ b/README.org @@ -1053,22 +1053,38 @@ that were pre-loaded via cable modem (to test a frontier deployment). : $ sudo apt install nagios4 monitoring-plugins-basic lm-sensors \ : _ nagios-nrpe-plugin -Next, the administrator concatenated a personal public ssh key and the -key found in [[file:Secret/ssh_admin/][=Secret/ssh_admin/=]] (created by [[*The CA Command][The CA Command]]) into an -=admin_keys= file, copied it to Core, and installed it as the -=authorized_keys= for ~sysadm~. +Now Core no longer needed the Internets so it was disconnected from +the cable modem and connected to the campus Ethernet switch. Its +primary Ethernet interface was manually configured with its private IP +address and a default route, using commands similar to the examples +below. In the example commands, the address ~192.168.56.1~ is the +example value of ~core_addr~ set in [[*Subnets][Subnets]]. The second address, +~192.168.56.2~, is likewise the example value of ~gate_addr~. + +: sysadm@core$ sudo ip address add 192.168.56.1 dev enp82s0 +: sysadm@core$ sudo ip route add default via 192.168.56.2 dev enp82s0 + +Next, the administrator connected their notebook to the campus +Ethernet and adopted an unused IP address, e.g. ~192.168.56.100~. + +: notebook$ sudo ip address add 192.168.56.100 dev eth0 + +On their notebook, the administrator concatenated their personal +public SSH key with Ansible's (found in [[file:Secret/ssh_admin/][=Secret/ssh_admin/=]], created +by [[*The CA Command][The CA Command]]) into an =admin_keys= file, copied the file to Core, +and installed it as the =authorized_keys= for ~sysadm~. : notebook$ cat ~/.ssh/id_ed25519.pub \ : notebook_ Secret/ssh_admin/id_ed25519.pub \ : notebook_ > admin_keys -: notebook$ scp admin_keys sysadm@core.lan: -: The authenticity of host 'core.lan' can't be established. +: notebook$ scp admin_keys sysadm@192.168.56.1: +: The authenticity of host '192.168.56.1' can't be established. : .... : Are you sure you want to continue connecting (...)? yes : ... -: sysadm@core.lan's password: oingstramextedil -: notebook$ ssh sysadm@core.lan -: sysadm@core.lan's password: oingstramextedil +: sysadm@192.168.56.1's password: oingstramextedil +: notebook$ ssh sysadm@192.168.56.1 +: sysadm@192.168.56.1's password: oingstramextedil : sysadm@core$ ( umask 077; mkdir .ssh; \ : sysadm@core_ cp admin_keys .ssh/authorized_keys ) : sysadm@core$ rm admin_keys @@ -1076,25 +1092,6 @@ key found in [[file:Secret/ssh_admin/][=Secret/ssh_admin/=]] (created by [[*The : notebook$ rm admin_keys : notebook$ -Note that the name ~core.lan~ should be known to the cable modem's DNS -service. An IP address might be used instead, discovered with an ~ip --4 a~ command on Core. - -Now Core no longer needed the Internets so it was disconnected from -the cable modem and connected to the campus Ethernet switch. Its -primary Ethernet interface was temporarily (manually) configured with -a new, private IP address and a default route. - -In the example command lines below, the address ~10.227.248.1~ was -generated by the random subnet address picking procedure described in -[[*Subnets][Subnets]], and is named ~core_addr~ in the Ansible code. The second -address, ~10.227.248.2~, is the corresponding address for Gate's -Ethernet interface, and is named ~gate_addr~ in the Ansible -code. - -: sysadm@core$ sudo ip address add 10.227.248.1 dev enp82s0 -: sysadm@core$ sudo ip route add default via 10.227.248.2 dev enp82s0 - At this point Core was prepared for provisioning with Ansible. ** The Gate Machine @@ -1160,23 +1157,16 @@ The Ansible code in this document is somewhat dependent on the physical network shown in the [[*Overview][Overview]] wherein Gate has three network interfaces. -The following example prepared a new gate on a PC with Debian 11 +The following example prepared a new gate on a PC with Debian 13 freshly installed. During installation, the machine was named ~gate~, -no desktop or server software was installed, no root password was set, -and a privileged account named ~sysadm~ was created (per the policy in -[[*The Administration Accounts][The Administration Accounts]]). - -: New password: icismassssadestm -: Retype new password: icismassssadestm -: ... -: Full Name []: System Administrator -: ... -: Is the information correct? [Y/n] +no desktop nor server software was installed, no root password was +set, and a privileged account named ~sysadm~ was created (per the +policy in [[*The Administration Accounts][The Administration Accounts]]). -The password was generated by ~gpw~, saved in the administrator's -password keep, and later added to [[file:Secret/become.yml][=Secret/become.yml=]] as shown below. -(Producing a working Ansible configuration with [[file:Secret/become.yml][=Secret/become.yml=]] -file is described in [[*The Ansible Configuration][The Ansible Configuration]].) +The password for ~sysadm~ was generated by ~gpw~, saved in the +administrator's password keep, and later added to [[file:Secret/become.yml][=Secret/become.yml=]] +as shown below. (Producing a working Ansible configuration with +[[file:Secret/become.yml][=Secret/become.yml=]] file is described in [[*The Ansible Configuration][The Ansible Configuration]].) : notebook$ gpw 1 16 : icismassssadestm @@ -1195,56 +1185,74 @@ cable modem and installed them as shown below. : _ ufw postfix wireguard lm-sensors \ : _ nagios-nrpe-server munin-node emacs -The host then needed to be rebooted to get its name service working -again after ~systemd-resolved~ was installed. (Any help with this will -be welcome!) After rebooting and re-logging in, the administrator was -ready to proceed. +Manual installation of Postfix prompted for configuration type and +mail name. The answers given are listed here. -Next, the administrator concatenated a personal public ssh key and the -key found in [[file:Secret/ssh_admin/][=Secret/ssh_admin/=]] (created by [[*The CA Command][The CA Command]]) into an -=admin_keys= file, copied it to Gate, and installed it as the -=authorized_keys= for ~sysadm~. +- General type of mail configuration: Internet Site +- System mail name: gate.small.private + +Now Gate no longer needed the Internets, and needed to be rebooted to +get its name service working again after installing +~systemd-resolved~. (Any help with this will be welcome!) It was +shutdown and disconnected from the cable modem, then connected to the +campus Ethernet switch and restarted. Logged in on the console, the +administrator configured the primary Ethernet interface with Gate's +private IP address using a command similar to the example below. In +the example command, the address ~192.168.56.2~ is the example value +of ~gate_addr~, set in [[*Subnets][Subnets]]. + +: sysadm@gate$ sudo ip address add 192.168.56.2 dev eth0 + +Next, the administrator connected their notebook to the campus +Ethernet and adopted an unused IP address, e.g. ~192.168.56.100~. + +: notebook$ sudo ip address add 192.168.56.100 dev eth0 + +On their notebook, the administrator concatenated their personal +public SSH key with Ansible's (found in [[file:Secret/ssh_admin/][=Secret/ssh_admin/=]], created +by [[*The CA Command][The CA Command]]) into an =admin_keys= file, copied the file to Gate, +and installed it as the =authorized_keys= for ~sysadm~. : notebook$ cat ~/.ssh/id_ed25519.pub \ : notebook_ Secret/ssh_admin/id_ed25519.pub \ : notebook_ > admin_keys -: notebook$ scp admin_keys sysadm@gate.lan: -: The authenticity of host 'gate.lan' can't be established. +: notebook$ scp admin_keys sysadm@192.168.56.2: +: The authenticity of host '192.168.56.2' can't be established. : .... : Are you sure you want to continue connecting (...)? yes : ... -: sysadm@gate.lan's password: icismassssadestm -: notebook$ ssh sysadm@gate.lan -: sysadm@gate.lan's password: icismassssadestm +: sysadm@192.168.56.2's password: icismassssadestm +: notebook$ ssh sysadm@192.168.56.2 +: sysadm@192.168.56.2's password: icismassssadestm : sysadm@gate$ ( umask 077; mkdir .ssh; \ : sysadm@gate_ cp admin_keys .ssh/authorized_keys ) -: sysadm@core$ rm admin_keys -: sysadm@core$ logout +: sysadm@gate$ rm admin_keys +: sysadm@gate$ logout : notebook$ rm admin_keys : notebook$ -Note that the name ~gate.lan~ should be known to the cable modem's DNS -service. An IP address might be used instead, discovered with an ~ip -a~ command on Gate. - -Now Gate no longer needed the Internets so it was disconnected from -the cable modem and connected to the campus Ethernet switch. Its -primary Ethernet interface was temporarily (manually) configured with -a new, private IP address. - -In the example command lines below, the address ~10.227.248.2~ was -generated by the random subnet address picking procedure described in -[[*Subnets][Subnets]], and is named ~gate_addr~ in the Ansible code. - -: $ sudo ip address add 10.227.248.2 dev eth0 - Gate was also connected to the USB Ethernet dongles cabled to the -campus Wi-Fi access point and the campus ISP and the values of three +campus Wi-Fi access point and the campus ISP, and the values of three variables (~gate_lan_mac~, ~gate_wild_mac~, and ~gate_isp_mac~ in -[[file:private/vars.yml][=private/vars.yml=]]) match the actual hardware MAC addresses of the +[[file:private/vars.yml][=private/vars.yml=]]) were set to the hardware MAC addresses of the dongles. (For more information, see the tasks in the [[Configure Gate NetworkD]] section.) +Finally, a new WireGuard™ private key was generated. The following +commands generated the key without revealing it, and displayed the +corresponding public key. + +: sysadm@small$ umask 077 +: susadm@small$ wg genkey \ +: sysadm@small_ | sudo tee /etc/wireguard/private-key \ +: sysadm@small_ | wg pubkey +: S+6HaTnOwwhWgUGXjSBcPAvifKw+j8BDTRfq534gNW4= +: sysadm@small$ logout +: notebook$ + +The public key is copied and pasted into [[file:private/vars.yml][=private/vars.yml=]] as the +value of ~front_wg_pubkey~ (as in the example [[pubkeys][here]]). + At this point Gate was prepared for provisioning with Ansible.