getch 0.1.0 → 0.1.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 259461a4875fb46c062067c9663e211c206475aaaaa89d3066f85d1b3be2c19b
-  data.tar.gz: 3ab40d87e3f039ef840156cc81df8ee75e3f8f76c332ae4ba08335b04440625f
+  metadata.gz: 9291f8df276b462cd310f6dc759d6c0526a9d8fdc7c47116f4c22e53d1aec6e6
+  data.tar.gz: c7c325c4fbc228110630b98f9d52d110bdc7d5654566efb0a136bbcfedbe5331
 SHA512:
-  metadata.gz: eef130ea5b78dcde7f2897d16f3f74293c16da487ca029c0d47c905489d5cd4d9f32d5bffeba30fe06ab13694370f99a380aceaec6da053dece11598eb938ba4
-  data.tar.gz: f9f4584abb87c4287ba81e16bb0274c483627a712916728fbcc9a4667a2d91f03e09a092bdf09400bd1f92318c67ddabdf4c20217eff1eeb64f2d8d0c97a1a02
+  metadata.gz: f7634afba44f36e31c1ab56bc373afbf1b20cce50d97445410ffc496d4c803b3c5d978c98d1a0949dc41de725db25236185df5492a0c9115425a4dc08d1c73e8
+  data.tar.gz: d807dbcdf3fc769473c5c14200ad91c3e8c878f6f6627a0a242481601be05e57ffe58d623c1e0431b510546f896e7fdb0f0c98bd719298977cef15ad50a76c65

data/README.md

@@ -1,34 +1,53 @@
 # Getch
-A CLI tool to install Gentoo.
+A CLI tool to install Gentoo or Void Linux with default:
++ DNS over HTTPS (with [Quad9](https://www.quad9.net/)).
++ Vim | Nano installed.
++ Iptables installed (not configured).
++ Sudo installed (not configured).
++ [iwd](https://iwd.wiki.kernel.org/) installed if wifi is detected.
++ No GUI installed.
+
+Hardened System:
++ sysctl.conf with TCP/IP stack hardening and more [Arch](https://wiki.archlinux.org/title/Sysctl)
++ Kernel parameters enforced (dmesg restricted, kexec disabled, etc)
++ Kernel source (Gentoo) patched with [bask](https://github.com/szorfein/bask).
 
 ## Description
-Actually, Getch support only the [AMD64 handbook](https://wiki.gentoo.org/wiki/Handbook:AMD64) and only with the last `stage3-amd64-systemd`.  
-It also require a disk (only one for now) with a minimum of 20G.  
+Actually, Getch support only the `x86_64` architecture and only with the following archives:
++ **Gentoo**: `stage3-amd64-systemd` [Gentoo](https://www.gentoo.org/downloads/).
++ **Void**: `rootfs glibc` [Void](https://voidlinux.org/download/).
 
-BIOS system will use Grub2 and UEFI, systemd-boot. Filesystem supported by Getch are for now:
-+ ext4
-+ lvm
+Filesystem supported (with or without encryption)
++ Ext4
++ Lvm
++ ZFS
 
-Encryption is also supported.
+Boot Manager:
++ **Gentoo**: `BIOS` will use `Grub2` and `systemd-boot` for `UEFI`.
++ **Void**: use only Grub2, encryption for the root fs use luks1.
 
 The ISO images i was able to test and that works:
 + [Archlinux](https://www.archlinux.org/download/)
++ [Archaeidae](https://github.com/szorfein/archaeidae): Custom Archiso that includes ZFS support.
+
+## Dependencies
+Getch is build without external libs, so it only require `ruby >= 2.5`.
 
 ## Install
 Getch is cryptographically signed, so add my public key (if you haven’t already) as a trusted certificate.  
 With `gem` installed:
 
     $ gem cert --add <(curl -Ls https://raw.githubusercontent.com/szorfein/getch/master/certs/szorfein.pem)
-
     $ gem install getch -P HighSecurity
 
-When you boot from an `iso`, you can install `ruby`, `getch` and correct your `PATH=` directly with the `bin/setup.sh`:
+If you want to try the master branch (can be unstable):
 
-    # sh <(curl -L https://raw.githubusercontent.com/szorfein/getch/master/bin/setup.sh)
-    # source ~/.zshrc # or ~/.bashrc
+    # git clone https://github.com/szorfein/getch
+    # cd getch
+    # ruby -I lib bin/getch -h
 
 ## Usage
-Just ensure than the script is run with a root account, not just sudo.
+Just ensure than the script is run with a root account.
 
     # getch -h
 
@@ -39,28 +58,82 @@ For a french user:
 
     # getch --zoneinfo "Europe/Paris" --language fr_FR --keymap fr
 
-Install Gentoo on LVM:
+Install Gentoo on LVM and use a different root disk `/dev/sdc`
 
-    # getch --format lvm --disk sda
+    # getch --format lvm --disk sdc
 
 Encrypt your disk with LVM with a french keymap
 
     # getch --format lvm --encrypt --keymap fr
 
-Encrypt with ext4 and create a home directory /home/ninja
+Encrypt with ext4 and create a new user `ninja`:
 
     # getch --format ext4 --encrypt --username ninja
 
+With ZFS, if used with `--encrypt`, it use the native ZFS encryption:
+
+    # getch --format zfs
+
+With `Void Linux`:
+
+    # getch --os void --encrypt -k fr
+
 ## Troubleshooting
 
-#### LVM
-Unless your old LVM volume group is also named `vg0`, `getch` may fail to partition your disk. You have to clean up your device before proceed with `vgremove` and `pvremove`.
+#### Old VG for LVM
+If a old volume group exist, `getch` may fail to partition your disk. You have to clean up your device before proceed with `vgremove` and `pvremove`. An short example how doing this with a volume group named `vg0`:
+
+    # vgdisplay | grep vg0
+    # vgremove -f vg0
+    # pvremove -f /dev/sdb
 
 #### Encryption enable on BIOS with ext4
-To decrypt your disk on BIOS system, you have to enter your password two times. One time for Grub and another time for the initramfs (Genkernel). [post](https://wiki.archlinux.org/index.php/GRUB#Encrypted_/boot).  
+To decrypt your disk on BIOS system, you have to enter your password twice. One time for Grub and another time for Genkernel. [post](https://wiki.archlinux.org/index.php/GRUB#Encrypted_/boot).  
 Also with GRUB, only a `us` keymap is working.
 
-## Issues
-If need more support for your hardware (network, sound card, ...), you can submit a [new issue](https://github.com/szorfein/getch/issues/new) and post the output of the following command:
-+ lspci
-+ lsmod
+#### ZFS for Gentoo
+When Gentoo boot the first time, the pool may fail to start, it's happen when the pool has not been `export` to the ISO. So just `export` your pool from the genkernel shell:
+
+The zpool name should be visible (rpool-150ed here), so enter in the Genkernel shell:
+
+    > shell
+    zpool import -f -N -R /tmp rpool-150ed
+    zpool export -a
+
+Then, just reboot now, it's all.
+
+*INFO*: To create the zpool, getch use the 5 fist characters from the `partuuid`, just replace `sdX` by your real device:
+
+    # ls -l /dev/disk/by-partuuid/ | grep sdX4
+    -> 150ed969...
+
+The pool will be called `rpool-150ed`.
+
+#### ZFS for Void Linux - Enable the boot pool
+You have some extras step to do after booting to enable the boot pool, you need this pool when you update your system. It's used mainly by Grub and Dracut.
+By default, your /boot is empty because your boot pool is not imported...
+
+    # zpool import -N bpool150ed
+    # zfs mount bpool150ed/BOOT/void
+    # ls /boot
+
+You should see something in the boot (initramfs, vmlinuz).. Recreate the initramfs.
+
+    # xbps-reconfigure -fa
+
+Transform the boot pool in legacy mode and add this to the fstab:
+
+    # zfs set mountpoint=legacy bpool150ed/BOOT/void
+    # echo "bpool150ed/BOOT/void /boot zfs defaults 0 0" >> /etc/fstab
+    # mount /boot
+
+The /boot should not be empty again and then, reboot. `fstab` should do this automatically now.   
+
+#### ZFS Encrypted with Void
+Well, another weird issue, the first time you boot on your encrypted pool, nothing append. Dracut try to mount inexistent device. Just wait for enter in the shell:
+
+    # ls /lib/dracut/hooks/initqueue/finished/*
+    # rm /lib/dracut/hooks/initqueue/finished/dev*
+    # exit
+
+Dracut should finally start `mount-zfs.sh` and ask for your password. After you first login, follow instructions above for recompile the initramfs and mount the boot pool and your good.

data/assets/network-stack.conf

@@ -0,0 +1,63 @@
+# https://wiki.archlinux.org/title/Sysctl#TCP/IP_stack_hardening
+# https://github.com/trimstray/the-practical-linux-hardening-guide/wiki/Network-stack
+
+# TCP SYN cookie protection
+net.ipv4.tcp_syncookies = 1
+
+# TCP rfc1337
+net.ipv4.tcp_rfc1337 = 1
+
+# Reverse path filtering
+net.ipv4.conf.default.rp_filter = 1
+net.ipv4.conf.all.rp_filter = 1
+
+# Log martian packets
+net.ipv4.conf.default.log_martians = 1
+net.ipv4.conf.all.log_martians = 1
+
+# Disable ICMP redirects
+net.ipv6.conf.all.accept_redirects = 0
+net.ipv6.conf.default.accept_redirects = 0
+
+# Disable IP source routing
+net.ipv4.conf.default.accept_source_route = 0
+net.ipv4.conf.all.accept_source_route = 0
+
+# Ignore ICMP echo requests
+net.ipv4.icmp_echo_ignore_all = 1
+net.ipv6.icmp.echo_ignore_all = 1
+
+# Ignoring broadcasts request
+net.ipv4.icmp_echo_ignore_broadcasts = 1
+
+# An illicit router advertisement message could result in a man-in-the-middle attack.
+net.ipv6.conf.default.accept_ra = 0
+net.ipv6.conf.all.accept_ra = 0
+
+# Ignore bogus ICMP error responses
+net.ipv4.icmp_ignore_bogus_error_responses = 1
+
+# ICMP redirects
+net.ipv4.conf.default.accept_redirects = 0
+net.ipv4.conf.all.accept_redirects = 0
+
+# Accepting secure redirects
+net.ipv4.conf.default.secure_redirects = 0
+net.ipv4.conf.all.secure_redirects = 0
+
+# IP forwarding
+net.ipv4.ip_forward = 0
+
+# Sending ICMP redirects
+net.ipv4.conf.default.send_redirects = 0
+net.ipv4.conf.all.send_redirects = 0
+
+# Keep sockets in FIN-WAIT-2 state
+net.ipv4.tcp_fin_timeout = 30
+
+# Keepalive packets to keep an connection alive
+net.ipv4.tcp_keepalive_time = 180
+net.ipv4.tcp_keepalive_intvl = 10
+net.ipv4.tcp_keepalive_probes = 3
+
+

data/bin/getch

@@ -2,8 +2,16 @@
 
 require 'getch'
 
-def main(argv)
-  Getch::main(argv)
-end
+getch = Getch::Main.new(
+  :cli => Getch::Options.new(ARGV)
+)
 
-main(ARGV)
+getch.resume
+
+getch.partition
+getch.format
+getch.mount
+
+getch.install
+
+getch.configure

data/lib/getch.rb

@@ -1,22 +1,30 @@
 require_relative 'getch/options'
 require_relative 'getch/states'
 require_relative 'getch/gentoo'
+require_relative 'getch/void'
 require_relative 'getch/filesystem'
 require_relative 'getch/command'
 require_relative 'getch/helpers'
 require_relative 'getch/log'
+require_relative 'getch/config'
+require_relative 'getch/guard'
+require_relative 'getch/version'
 
 module Getch
 
-  DEFAULT_OPTIONS = {
-    language: 'en_US',
-    zoneinfo: 'US/Eastern',
-    keymap: 'us',
-    disk: 'sda',
-    fs: 'ext4',
-    username: nil,
-    encrypt: false,
-    verbose: false
+  OPTIONS = {
+    :language => 'en_US',
+    :zoneinfo => 'US/Eastern',
+    :keymap => 'us',
+    :disk => false,
+    :fs => 'ext4',
+    :username => false,
+    :os => 'gentoo',
+    :boot_disk => false,
+    :cache_disk => false,
+    :home_disk => false,
+    :encrypt => false,
+    :verbose => false
   }
 
   STATES = {
@@ -29,76 +37,118 @@ module Getch
     :gentoo_kernel => false
   }
 
-  MOUNTPOINT = "/mnt/gentoo".freeze
+  MOUNTPOINT = "/mnt/gentoo"
+
   DEFAULT_FS = {
     true => {
-      ext4: Getch::FileSystem::Ext4::Encrypt,
-      lvm: Getch::FileSystem::Lvm::Encrypt,
-      zfs: Getch::FileSystem::Zfs::Encrypt
+      ext4: FileSystem::Ext4::Encrypt,
+      lvm: FileSystem::Lvm::Encrypt,
+      zfs: FileSystem::Zfs::Encrypt
     },
     false => {
-      ext4: Getch::FileSystem::Ext4,
-      lvm: Getch::FileSystem::Lvm,
-      zfs: Getch::FileSystem::Zfs,
+      ext4: FileSystem::Ext4,
+      lvm: FileSystem::Lvm,
+      zfs: FileSystem::Zfs,
     }
   }.freeze
 
-  def self.class_fs
-    encrypt = DEFAULT_OPTIONS[:encrypt]
-    fs = DEFAULT_OPTIONS[:fs].to_sym
-    DEFAULT_FS[encrypt][fs]
+  def self.select_fs
+    encrypt = OPTIONS[:encrypt]
+    fs_sym = OPTIONS[:fs].to_sym
+    DEFAULT_FS[encrypt][fs_sym]
   end
 
-  def self.resume_options(opts)
-    puts "\nBuild Gentoo with the following args:\n"
-    puts "lang: #{DEFAULT_OPTIONS[:language]}"
-    puts "zoneinfo: #{DEFAULT_OPTIONS[:zoneinfo]}"
-    puts "keymap: #{DEFAULT_OPTIONS[:keymap]}"
-    puts "disk: #{DEFAULT_OPTIONS[:disk]}"
-    puts "fs: #{DEFAULT_OPTIONS[:fs]}"
-    puts "username: #{DEFAULT_OPTIONS[:username]}"
-    puts "encrypt: #{DEFAULT_OPTIONS[:encrypt]}"
-    puts
-    print "Continue? (n,y) "
-    case gets.chomp
-    when /^y|^Y/
-      return
-    else
-      exit 1
+  class Main
+    def initialize(argv)
+      argv[:cli]
+      @class_fs = Getch::select_fs
+      @log = Log.new
+      Getch::States.new # Update States
     end
-  end
 
-  def self.format(disk, fs, user)
-    return if STATES[:format] and STATES[:partition]
-    log = Log.new
-    puts
-    print "Partition and format disk #{disk}, this will erase all data, continue? (n,y) "
-    case gets.chomp
-    when /^y|^Y/
-      log.info("Partition start")
-      class_fs::Partition.new
-      class_fs::Format.new
-    else
-      exit 1
+    def resume
+      raise "No disk, use at least getch with -d DISK" if !OPTIONS[:disk]
+      puts "\nBuild " + OPTIONS[:os].capitalize + " Linux with the following args:\n"
+      puts
+      puts "\tLang: #{OPTIONS[:language]}"
+      puts "\tZoneinfo: #{OPTIONS[:zoneinfo]}"
+      puts "\tKeymap: #{OPTIONS[:keymap]}"
+      puts "\tDisk: #{OPTIONS[:disk]}"
+      puts "\tFilesystem: #{OPTIONS[:fs]}"
+      puts "\tUsername: #{OPTIONS[:username]}"
+      puts "\tEncrypt: #{OPTIONS[:encrypt]}"
+      puts
+      puts "\tseparate-boot disk: #{OPTIONS[:boot_disk]}"
+      puts "\tseparate-cache disk: #{OPTIONS[:cache_disk]}"
+      puts "\tseparate-home disk: #{OPTIONS[:home_disk]}"
+      puts
+      print "Continue? (y,N) "
+      case gets.chomp
+      when /^y|^Y/
+        return
+      else
+        exit
+      end
     end
-  end
 
-  def self.init_gentoo(options)
-    gentoo = Getch::Gentoo
-    gentoo.stage3
-    gentoo.config(options)
-    gentoo.chroot
-    gentoo.kernel
-    gentoo.boot(options)
-  end
+    def partition
+      return if STATES[:partition]
+      puts
+      print "Partition and format disk #{OPTIONS[:disk]}, this will erase all data, continue? (y,N) "
+      case gets.chomp
+      when /^y|^Y/
+        @log.info("Partition start")
+        @class_fs::Partition.new
+      else
+        exit
+      end
+    end
+
+    def format
+      return if STATES[:format]
+      @class_fs::Format.new
+    end
 
-  def self.main(argv)
-    options = Options.new(argv)
-    DEFAULT_OPTIONS.freeze
-    resume_options(options)
-    Getch::States.new # Update States
-    format(options.disk, options.fs, options.username)
-    class_fs::Mount.new.run
-    init_gentoo(options)
+    def mount
+      return if STATES[:mount]
+      @class_fs::Mount.new.run
+    end
+
+    def install
+      if OPTIONS[:os] == 'gentoo'
+        install_gentoo
+      elsif OPTIONS[:os] == 'void'
+        install_void
+      else
+        puts "Options #{OPTIONS[:os]} not supported...."
+        exit 1
+      end
+    end
+
+    def install_gentoo
+      gentoo = Getch::Gentoo::Main.new
+      gentoo.stage3
+      gentoo.config
+      gentoo.chroot
+      gentoo.kernel
+      gentoo.boot
+    end
+
+    def install_void
+      void = Getch::Void::Main.new
+      void.root_fs
+      void.config
+      void.chroot
+      void.boot
+    end
+    
+    def configure
+      config = Getch::Config::Main.new
+      config.ethernet
+      config.wifi
+      config.dns
+      config.sysctl
+      config.shell
+    end
   end
 end