mirror of
https://github.com/suiryc/archlinux-initrd-ssh-cryptsetup.git
synced 2026-07-27 20:27:00 +03:00
Refactor README
Add new option, and have install script mention README for details.
This commit is contained in:
27
README.md
27
README.md
@@ -4,26 +4,28 @@ The code was reworked from legacy dropbear_initrd_encrypt AUR package.
|
|||||||
|
|
||||||
## Installation
|
## Installation
|
||||||
After cloning the repo, installation is done as for an AUR package, e.g.:
|
After cloning the repo, installation is done as for an AUR package, e.g.:
|
||||||
|
```bash
|
||||||
makepkg -sri
|
makepkg -sri
|
||||||
|
```
|
||||||
|
|
||||||
## Dropbear
|
## Dropbear
|
||||||
SSH server key need to be generated for `dropbear`.
|
SSH server key need to be generated for `dropbear`.
|
||||||
Either a new key can be generated with `dropbearkey`, e.g.:
|
Either a new key can be generated with `dropbearkey`, e.g.:
|
||||||
|
```bash
|
||||||
dropbearkey -t ecdsa -f /etc/dropbear/dropbear_ecdsa_host_key
|
dropbearkey -t ecdsa -f /etc/dropbear/dropbear_ecdsa_host_key
|
||||||
|
```
|
||||||
Or an existing OpenSSH key can be converted with `dropbearconvert` (useful so that the server fingerprint is the same with both), e.g.:
|
Or an existing OpenSSH key can be converted with `dropbearconvert` (useful so that the server fingerprint is the same with both), e.g.:
|
||||||
|
```bash
|
||||||
dropbearconvert openssh dropbear /etc/ssh/ssh_host_ecdsa_key /etc/dropbear/dropbear_ecdsa_host_key
|
dropbearconvert openssh dropbear /etc/ssh/ssh_host_ecdsa_key /etc/dropbear/dropbear_ecdsa_host_key
|
||||||
|
```
|
||||||
Notes:
|
Notes:
|
||||||
* `rsa` and `ed25519` types are also handled
|
* `rsa` and `ed25519` types are also handled
|
||||||
* OpenSSH keys must be in `PEM` format for `dropbearconvert` to properly work
|
* OpenSSH keys must be in `PEM` format for `dropbearconvert` to properly work
|
||||||
|
|
||||||
If necessary an existing key file can be converted to `PEM` format using `ssh-keygen`:
|
If necessary an existing key file can be converted to `PEM` format using `ssh-keygen`:
|
||||||
|
```bash
|
||||||
ssh-keygen -A -p -m PEM -f /etc/ssh/ssh_host_ecdsa_key
|
ssh-keygen -A -p -m PEM -f /etc/ssh/ssh_host_ecdsa_key
|
||||||
|
```
|
||||||
|
|
||||||
## Configuration
|
## Configuration
|
||||||
As explained upon installation, the following things need to be done:
|
As explained upon installation, the following things need to be done:
|
||||||
@@ -38,13 +40,18 @@ The LUKS-encrypted devices to unlock are derived from `/etc/crypttab`.
|
|||||||
|
|
||||||
|
|
||||||
Some options can be set in `/etc/initcpio/sshcs_env` (file is sourced in initramfs shell):
|
Some options can be set in `/etc/initcpio/sshcs_env` (file is sourced in initramfs shell):
|
||||||
|
* `sshcs_opt_log_kmsg`: whether to log (debug, info, error) messages to kmsg too
|
||||||
|
- default: `1`
|
||||||
|
- many messages are only printed on console and are not concerned
|
||||||
|
- by default (debug disabled), only useful messages are concerned
|
||||||
|
- set `0` to disable
|
||||||
* `sshcs_opt_debug`: whether to be more verbose about ongoing actions
|
* `sshcs_opt_debug`: whether to be more verbose about ongoing actions
|
||||||
- default: `0`
|
- default: `0`
|
||||||
- any non-zero value to enable
|
- any non-zero value to enable
|
||||||
* `sshcs_opt_net_wol`: Wake-on-LAN option to set on network device
|
* `sshcs_opt_net_wol`: Wake-on-LAN option to set on network device
|
||||||
- default: `g` (MagicPacket™)
|
- default: `g` (MagicPacket™)
|
||||||
- usually WOL is disabled once in initramfs shell
|
- usually WoL is disabled once in initramfs shell
|
||||||
- set empty to not change network device WOL setting
|
- set empty to not change network device WoL setting
|
||||||
* `sshcs_opt_timeout_ipconfig`: time (in seconds) to configure IP
|
* `sshcs_opt_timeout_ipconfig`: time (in seconds) to configure IP
|
||||||
- default: `10`
|
- default: `10`
|
||||||
* `sshcs_opt_listen`: SSH listening port
|
* `sshcs_opt_listen`: SSH listening port
|
||||||
@@ -58,12 +65,12 @@ Some options can be set in `/etc/initcpio/sshcs_env` (file is sourced in initram
|
|||||||
- when disabled (the default), a script to unlock devices is executed instead
|
- when disabled (the default), a script to unlock devices is executed instead
|
||||||
|
|
||||||
For example:
|
For example:
|
||||||
|
```bash
|
||||||
sshcs_opt_timeout_ipconfig=30
|
sshcs_opt_timeout_ipconfig=30
|
||||||
sshcs_opt_listen=2222
|
sshcs_opt_listen=2222
|
||||||
sshcs_opt_timeout_poweroff=-1
|
sshcs_opt_timeout_poweroff=-1
|
||||||
sshcs_opt_use_shell=1
|
sshcs_opt_use_shell=1
|
||||||
|
```
|
||||||
|
|
||||||
## Building notes
|
## Building notes
|
||||||
1. Modify the sources (features in `src`, and/or package building files)
|
1. Modify the sources (features in `src`, and/or package building files)
|
||||||
|
|||||||
@@ -54,7 +54,7 @@ build() {
|
|||||||
|
|
||||||
# Note: parts of this script (modules/binaries/files added) are the same than
|
# Note: parts of this script (modules/binaries/files added) are the same than
|
||||||
# other install scripts (/usr/lib/initcpio/install/):
|
# other install scripts (/usr/lib/initcpio/install/):
|
||||||
# - 'encryp': nominal support of encrypted volumes at boot time
|
# - 'encrypt': nominal support of encrypted volumes at boot time
|
||||||
# - 'net': network tools
|
# - 'net': network tools
|
||||||
|
|
||||||
## Modules
|
## Modules
|
||||||
@@ -129,27 +129,8 @@ Network is configured with 'ip=' kernel parameter (see 'mkinitcpio-nfs-utils').
|
|||||||
Authorized SSH key(s) must be present in '/etc/dropbear/initrd.authorized_keys'.
|
Authorized SSH key(s) must be present in '/etc/dropbear/initrd.authorized_keys'.
|
||||||
LUKS encrypted devices to unlock are derived from '/etc/crypttab', which must
|
LUKS encrypted devices to unlock are derived from '/etc/crypttab', which must
|
||||||
be present.
|
be present.
|
||||||
Some options can be set in '/etc/initcpio/sshcs_env' (file is sourced in
|
Some options can be set in '/etc/initcpio/sshcs_env'.
|
||||||
initrd shell):
|
See the README for more details.
|
||||||
* 'sshcs_opt_debug': whether to be more verbose about ongoing actions
|
|
||||||
- default: '0'
|
|
||||||
- any non-zero value to enable
|
|
||||||
* 'sshcs_opt_net_wol': Wake-on-LAN option to set on network device
|
|
||||||
- default: 'g' (MagicPacket™)
|
|
||||||
- usually WOL is disabled once in initramfs shell
|
|
||||||
- set empty to not change network device WOL setting
|
|
||||||
* 'sshcs_opt_timeout_ipconfig': time (in seconds) to configure IP
|
|
||||||
- default: '10'
|
|
||||||
* 'sshcs_opt_listen': SSH listening port
|
|
||||||
- default: '22'
|
|
||||||
* 'sshcs_opt_timeout_poweroff': time (in seconds) to unlock devices before
|
|
||||||
automatic powering off
|
|
||||||
- default (and minimum value): '120' (2 minutes)
|
|
||||||
- negative value to deactivate
|
|
||||||
* 'sshcs_opt_use_shell': whether to start a full 'ash' shell
|
|
||||||
- default: '0'
|
|
||||||
- '1' to enable
|
|
||||||
- when disabled (the default), a script to unlock devices is executed instead
|
|
||||||
|
|
||||||
Each SSH server key ('dropbear_rsa_host_key', 'dropbear_ecdsa_host_key' and
|
Each SSH server key ('dropbear_rsa_host_key', 'dropbear_ecdsa_host_key' and
|
||||||
'dropbear_ed25519_host_key' in '/etc/dropbear' folder) is imported from OpenSSH
|
'dropbear_ed25519_host_key' in '/etc/dropbear' folder) is imported from OpenSSH
|
||||||
|
|||||||
Reference in New Issue
Block a user