From 831f0bd3b3b58833839bdfbd45f36234dcecec56 Mon Sep 17 00:00:00 2001 From: Matt Birkholz Date: Mon, 15 Jun 2026 11:16:15 -0600 Subject: [PATCH] Update from a fresh install of Debian 13. MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Move Gate (and Core) to the private Ethernet immediately after download (installing) additional packages, before exchanging public keys, using their private IP addresses. Punted the example of a textual Debian install setting the initial user's password. A graphical install is the default. Added instructions for creating a WireGuard™ key pair and registering the public key. And gave the appropriate answers (the defaults) to the Postfix installation questions. --- README.org | 158 ++++++++++++++++++++++++++++------------------------- 1 file changed, 83 insertions(+), 75 deletions(-) diff --git a/README.org b/README.org index 586e6a6..291d7b9 100644 --- a/README.org +++ b/README.org @@ -1053,22 +1053,38 @@ that were pre-loaded via cable modem (to test a frontier deployment). : $ sudo apt install nagios4 monitoring-plugins-basic lm-sensors \ : _ nagios-nrpe-plugin -Next, the administrator concatenated a personal public ssh key and the -key found in [[file:Secret/ssh_admin/][=Secret/ssh_admin/=]] (created by [[*The CA Command][The CA Command]]) into an -=admin_keys= file, copied it to Core, and installed it as the -=authorized_keys= for ~sysadm~. +Now Core no longer needed the Internets so it was disconnected from +the cable modem and connected to the campus Ethernet switch. Its +primary Ethernet interface was manually configured with its private IP +address and a default route, using commands similar to the examples +below. In the example commands, the address ~192.168.56.1~ is the +example value of ~core_addr~ set in [[*Subnets][Subnets]]. The second address, +~192.168.56.2~, is likewise the example value of ~gate_addr~. + +: sysadm@core$ sudo ip address add 192.168.56.1 dev enp82s0 +: sysadm@core$ sudo ip route add default via 192.168.56.2 dev enp82s0 + +Next, the administrator connected their notebook to the campus +Ethernet and adopted an unused IP address, e.g. ~192.168.56.100~. + +: notebook$ sudo ip address add 192.168.56.100 dev eth0 + +On their notebook, the administrator concatenated their personal +public SSH key with Ansible's (found in [[file:Secret/ssh_admin/][=Secret/ssh_admin/=]], created +by [[*The CA Command][The CA Command]]) into an =admin_keys= file, copied the file to Core, +and installed it as the =authorized_keys= for ~sysadm~. : notebook$ cat ~/.ssh/id_ed25519.pub \ : notebook_ Secret/ssh_admin/id_ed25519.pub \ : notebook_ > admin_keys -: notebook$ scp admin_keys sysadm@core.lan: -: The authenticity of host 'core.lan' can't be established. +: notebook$ scp admin_keys sysadm@192.168.56.1: +: The authenticity of host '192.168.56.1' can't be established. : .... : Are you sure you want to continue connecting (...)? yes : ... -: sysadm@core.lan's password: oingstramextedil -: notebook$ ssh sysadm@core.lan -: sysadm@core.lan's password: oingstramextedil +: sysadm@192.168.56.1's password: oingstramextedil +: notebook$ ssh sysadm@192.168.56.1 +: sysadm@192.168.56.1's password: oingstramextedil : sysadm@core$ ( umask 077; mkdir .ssh; \ : sysadm@core_ cp admin_keys .ssh/authorized_keys ) : sysadm@core$ rm admin_keys @@ -1076,25 +1092,6 @@ key found in [[file:Secret/ssh_admin/][=Secret/ssh_admin/=]] (created by [[*The : notebook$ rm admin_keys : notebook$ -Note that the name ~core.lan~ should be known to the cable modem's DNS -service. An IP address might be used instead, discovered with an ~ip --4 a~ command on Core. - -Now Core no longer needed the Internets so it was disconnected from -the cable modem and connected to the campus Ethernet switch. Its -primary Ethernet interface was temporarily (manually) configured with -a new, private IP address and a default route. - -In the example command lines below, the address ~10.227.248.1~ was -generated by the random subnet address picking procedure described in -[[*Subnets][Subnets]], and is named ~core_addr~ in the Ansible code. The second -address, ~10.227.248.2~, is the corresponding address for Gate's -Ethernet interface, and is named ~gate_addr~ in the Ansible -code. - -: sysadm@core$ sudo ip address add 10.227.248.1 dev enp82s0 -: sysadm@core$ sudo ip route add default via 10.227.248.2 dev enp82s0 - At this point Core was prepared for provisioning with Ansible. ** The Gate Machine @@ -1160,23 +1157,16 @@ The Ansible code in this document is somewhat dependent on the physical network shown in the [[*Overview][Overview]] wherein Gate has three network interfaces. -The following example prepared a new gate on a PC with Debian 11 +The following example prepared a new gate on a PC with Debian 13 freshly installed. During installation, the machine was named ~gate~, -no desktop or server software was installed, no root password was set, -and a privileged account named ~sysadm~ was created (per the policy in -[[*The Administration Accounts][The Administration Accounts]]). - -: New password: icismassssadestm -: Retype new password: icismassssadestm -: ... -: Full Name []: System Administrator -: ... -: Is the information correct? [Y/n] +no desktop nor server software was installed, no root password was +set, and a privileged account named ~sysadm~ was created (per the +policy in [[*The Administration Accounts][The Administration Accounts]]). -The password was generated by ~gpw~, saved in the administrator's -password keep, and later added to [[file:Secret/become.yml][=Secret/become.yml=]] as shown below. -(Producing a working Ansible configuration with [[file:Secret/become.yml][=Secret/become.yml=]] -file is described in [[*The Ansible Configuration][The Ansible Configuration]].) +The password for ~sysadm~ was generated by ~gpw~, saved in the +administrator's password keep, and later added to [[file:Secret/become.yml][=Secret/become.yml=]] +as shown below. (Producing a working Ansible configuration with +[[file:Secret/become.yml][=Secret/become.yml=]] file is described in [[*The Ansible Configuration][The Ansible Configuration]].) : notebook$ gpw 1 16 : icismassssadestm @@ -1195,56 +1185,74 @@ cable modem and installed them as shown below. : _ ufw postfix wireguard lm-sensors \ : _ nagios-nrpe-server munin-node emacs -The host then needed to be rebooted to get its name service working -again after ~systemd-resolved~ was installed. (Any help with this will -be welcome!) After rebooting and re-logging in, the administrator was -ready to proceed. +Manual installation of Postfix prompted for configuration type and +mail name. The answers given are listed here. -Next, the administrator concatenated a personal public ssh key and the -key found in [[file:Secret/ssh_admin/][=Secret/ssh_admin/=]] (created by [[*The CA Command][The CA Command]]) into an -=admin_keys= file, copied it to Gate, and installed it as the -=authorized_keys= for ~sysadm~. +- General type of mail configuration: Internet Site +- System mail name: gate.small.private + +Now Gate no longer needed the Internets, and needed to be rebooted to +get its name service working again after installing +~systemd-resolved~. (Any help with this will be welcome!) It was +shutdown and disconnected from the cable modem, then connected to the +campus Ethernet switch and restarted. Logged in on the console, the +administrator configured the primary Ethernet interface with Gate's +private IP address using a command similar to the example below. In +the example command, the address ~192.168.56.2~ is the example value +of ~gate_addr~, set in [[*Subnets][Subnets]]. + +: sysadm@gate$ sudo ip address add 192.168.56.2 dev eth0 + +Next, the administrator connected their notebook to the campus +Ethernet and adopted an unused IP address, e.g. ~192.168.56.100~. + +: notebook$ sudo ip address add 192.168.56.100 dev eth0 + +On their notebook, the administrator concatenated their personal +public SSH key with Ansible's (found in [[file:Secret/ssh_admin/][=Secret/ssh_admin/=]], created +by [[*The CA Command][The CA Command]]) into an =admin_keys= file, copied the file to Gate, +and installed it as the =authorized_keys= for ~sysadm~. : notebook$ cat ~/.ssh/id_ed25519.pub \ : notebook_ Secret/ssh_admin/id_ed25519.pub \ : notebook_ > admin_keys -: notebook$ scp admin_keys sysadm@gate.lan: -: The authenticity of host 'gate.lan' can't be established. +: notebook$ scp admin_keys sysadm@192.168.56.2: +: The authenticity of host '192.168.56.2' can't be established. : .... : Are you sure you want to continue connecting (...)? yes : ... -: sysadm@gate.lan's password: icismassssadestm -: notebook$ ssh sysadm@gate.lan -: sysadm@gate.lan's password: icismassssadestm +: sysadm@192.168.56.2's password: icismassssadestm +: notebook$ ssh sysadm@192.168.56.2 +: sysadm@192.168.56.2's password: icismassssadestm : sysadm@gate$ ( umask 077; mkdir .ssh; \ : sysadm@gate_ cp admin_keys .ssh/authorized_keys ) -: sysadm@core$ rm admin_keys -: sysadm@core$ logout +: sysadm@gate$ rm admin_keys +: sysadm@gate$ logout : notebook$ rm admin_keys : notebook$ -Note that the name ~gate.lan~ should be known to the cable modem's DNS -service. An IP address might be used instead, discovered with an ~ip -a~ command on Gate. - -Now Gate no longer needed the Internets so it was disconnected from -the cable modem and connected to the campus Ethernet switch. Its -primary Ethernet interface was temporarily (manually) configured with -a new, private IP address. - -In the example command lines below, the address ~10.227.248.2~ was -generated by the random subnet address picking procedure described in -[[*Subnets][Subnets]], and is named ~gate_addr~ in the Ansible code. - -: $ sudo ip address add 10.227.248.2 dev eth0 - Gate was also connected to the USB Ethernet dongles cabled to the -campus Wi-Fi access point and the campus ISP and the values of three +campus Wi-Fi access point and the campus ISP, and the values of three variables (~gate_lan_mac~, ~gate_wild_mac~, and ~gate_isp_mac~ in -[[file:private/vars.yml][=private/vars.yml=]]) match the actual hardware MAC addresses of the +[[file:private/vars.yml][=private/vars.yml=]]) were set to the hardware MAC addresses of the dongles. (For more information, see the tasks in the [[Configure Gate NetworkD]] section.) +Finally, a new WireGuard™ private key was generated. The following +commands generated the key without revealing it, and displayed the +corresponding public key. + +: sysadm@small$ umask 077 +: susadm@small$ wg genkey \ +: sysadm@small_ | sudo tee /etc/wireguard/private-key \ +: sysadm@small_ | wg pubkey +: S+6HaTnOwwhWgUGXjSBcPAvifKw+j8BDTRfq534gNW4= +: sysadm@small$ logout +: notebook$ + +The public key is copied and pasted into [[file:private/vars.yml][=private/vars.yml=]] as the +value of ~front_wg_pubkey~ (as in the example [[pubkeys][here]]). + At this point Gate was prepared for provisioning with Ansible. -- 2.47.3