getch 0.1.5 → 0.1.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cb3fc628a7308969d14505c6f56623c11c5adda014841e162b264f189b5ad54c
-  data.tar.gz: ea50a6890b8c0c718ec38876809144fab98442daeddad2db85bc591a77996948
+  metadata.gz: 9291f8df276b462cd310f6dc759d6c0526a9d8fdc7c47116f4c22e53d1aec6e6
+  data.tar.gz: c7c325c4fbc228110630b98f9d52d110bdc7d5654566efb0a136bbcfedbe5331
 SHA512:
-  metadata.gz: 2395983c7fc521cc7867cdd54550177a2ed3f5eccdcd070f36eec256e73d06b8bfe961dc3f922fa9c5afac30d28e898625b32655ee89d45bc8e1da79dbf54d15
-  data.tar.gz: 1e8eeda1ff45f0d633820ced177fb6ae97645d5aa2e7f02e69279f0b9e611035269c23707f6677820886c92122a27e92d3906401a873fc60a1e1e9064c8de3bf
+  metadata.gz: f7634afba44f36e31c1ab56bc373afbf1b20cce50d97445410ffc496d4c803b3c5d978c98d1a0949dc41de725db25236185df5492a0c9115425a4dc08d1c73e8
+  data.tar.gz: d807dbcdf3fc769473c5c14200ad91c3e8c878f6f6627a0a242481601be05e57ffe58d623c1e0431b510546f896e7fdb0f0c98bd719298977cef15ad50a76c65

data/README.md

@@ -1,34 +1,46 @@
 # Getch
-A CLI tool to install Gentoo.
+A CLI tool to install Gentoo or Void Linux with default:
++ DNS over HTTPS (with [Quad9](https://www.quad9.net/)).
++ Vim | Nano installed.
++ Iptables installed (not configured).
++ Sudo installed (not configured).
++ [iwd](https://iwd.wiki.kernel.org/) installed if wifi is detected.
++ No GUI installed.
+
+Hardened System:
++ sysctl.conf with TCP/IP stack hardening and more [Arch](https://wiki.archlinux.org/title/Sysctl)
++ Kernel parameters enforced (dmesg restricted, kexec disabled, etc)
++ Kernel source (Gentoo) patched with [bask](https://github.com/szorfein/bask).
 
 ## Description
-Actually, Getch support only the [AMD64 handbook](https://wiki.gentoo.org/wiki/Handbook:AMD64) and only with the last `stage3-amd64-systemd`.  
+Actually, Getch support only the `x86_64` architecture and only with the following archives:
++ **Gentoo**: `stage3-amd64-systemd` [Gentoo](https://www.gentoo.org/downloads/).
++ **Void**: `rootfs glibc` [Void](https://voidlinux.org/download/).
 
-BIOS system will use `Grub2` and `systemd-boot` for UEFI. Filesystem supported by Getch are for now:
+Filesystem supported (with or without encryption)
 + Ext4
-+ LVM
++ Lvm
 + ZFS
 
-Encryption is also supported.
+Boot Manager:
++ **Gentoo**: `BIOS` will use `Grub2` and `systemd-boot` for `UEFI`.
++ **Void**: use only Grub2, encryption for the root fs use luks1.
 
 The ISO images i was able to test and that works:
 + [Archlinux](https://www.archlinux.org/download/)
 + [Archaeidae](https://github.com/szorfein/archaeidae): Custom Archiso that includes ZFS support.
 
+## Dependencies
+Getch is build without external libs, so it only require `ruby >= 2.5`.
+
 ## Install
 Getch is cryptographically signed, so add my public key (if you haven’t already) as a trusted certificate.  
 With `gem` installed:
 
     $ gem cert --add <(curl -Ls https://raw.githubusercontent.com/szorfein/getch/master/certs/szorfein.pem)
-
     $ gem install getch -P HighSecurity
 
-When you boot from an `iso`, you can install `ruby`, `getch` and correct your `PATH=` directly with the `bin/setup.sh`:
-
-    # sh <(curl -L https://raw.githubusercontent.com/szorfein/getch/master/bin/setup.sh)
-    # source ~/.zshrc # or ~/.bashrc
-
-If you want to try the master branch:
+If you want to try the master branch (can be unstable):
 
     # git clone https://github.com/szorfein/getch
     # cd getch
@@ -46,26 +58,30 @@ For a french user:
 
     # getch --zoneinfo "Europe/Paris" --language fr_FR --keymap fr
 
-Install Gentoo on LVM:
+Install Gentoo on LVM and use a different root disk `/dev/sdc`
 
-    # getch --format lvm --disk sda
+    # getch --format lvm --disk sdc
 
 Encrypt your disk with LVM with a french keymap
 
     # getch --format lvm --encrypt --keymap fr
 
-Encrypt with ext4 and create a home directory /home/ninja
+Encrypt with ext4 and create a new user `ninja`:
 
     # getch --format ext4 --encrypt --username ninja
 
-With ZFS:
+With ZFS, if used with `--encrypt`, it use the native ZFS encryption:
 
     # getch --format zfs
 
+With `Void Linux`:
+
+    # getch --os void --encrypt -k fr
+
 ## Troubleshooting
 
-#### LVM
-Unless your old LVM volume group is also named `vg0`, `getch` may fail to partition your disk. You have to clean up your device before proceed with `vgremove` and `pvremove`. An short example how doing this with a volume group named `vg0`:
+#### Old VG for LVM
+If a old volume group exist, `getch` may fail to partition your disk. You have to clean up your device before proceed with `vgremove` and `pvremove`. An short example how doing this with a volume group named `vg0`:
 
     # vgdisplay | grep vg0
     # vgremove -f vg0
@@ -75,13 +91,13 @@ Unless your old LVM volume group is also named `vg0`, `getch` may fail to partit
 To decrypt your disk on BIOS system, you have to enter your password twice. One time for Grub and another time for Genkernel. [post](https://wiki.archlinux.org/index.php/GRUB#Encrypted_/boot).  
 Also with GRUB, only a `us` keymap is working.
 
-#### ZFS
+#### ZFS for Gentoo
 When Gentoo boot the first time, the pool may fail to start, it's happen when the pool has not been `export` to the ISO. So just `export` your pool from the genkernel shell:
 
 The zpool name should be visible (rpool-150ed here), so enter in the Genkernel shell:
 
     > shell
-    zpool import -f -N -R /mnt rpool-150ed
+    zpool import -f -N -R /tmp rpool-150ed
     zpool export -a
 
 Then, just reboot now, it's all.
@@ -93,7 +109,31 @@ Then, just reboot now, it's all.
 
 The pool will be called `rpool-150ed`.
 
-## Issues
-If need more support for your hardware (network, sound card, ...), you can submit a [new issue](https://github.com/szorfein/getch/issues/new) and post the output of the following command:
-+ lspci
-+ cat /proc/modules
+#### ZFS for Void Linux - Enable the boot pool
+You have some extras step to do after booting to enable the boot pool, you need this pool when you update your system. It's used mainly by Grub and Dracut.
+By default, your /boot is empty because your boot pool is not imported...
+
+    # zpool import -N bpool150ed
+    # zfs mount bpool150ed/BOOT/void
+    # ls /boot
+
+You should see something in the boot (initramfs, vmlinuz).. Recreate the initramfs.
+
+    # xbps-reconfigure -fa
+
+Transform the boot pool in legacy mode and add this to the fstab:
+
+    # zfs set mountpoint=legacy bpool150ed/BOOT/void
+    # echo "bpool150ed/BOOT/void /boot zfs defaults 0 0" >> /etc/fstab
+    # mount /boot
+
+The /boot should not be empty again and then, reboot. `fstab` should do this automatically now.   
+
+#### ZFS Encrypted with Void
+Well, another weird issue, the first time you boot on your encrypted pool, nothing append. Dracut try to mount inexistent device. Just wait for enter in the shell:
+
+    # ls /lib/dracut/hooks/initqueue/finished/*
+    # rm /lib/dracut/hooks/initqueue/finished/dev*
+    # exit
+
+Dracut should finally start `mount-zfs.sh` and ask for your password. After you first login, follow instructions above for recompile the initramfs and mount the boot pool and your good.

data/assets/network-stack.conf

@@ -0,0 +1,63 @@
+# https://wiki.archlinux.org/title/Sysctl#TCP/IP_stack_hardening
+# https://github.com/trimstray/the-practical-linux-hardening-guide/wiki/Network-stack
+
+# TCP SYN cookie protection
+net.ipv4.tcp_syncookies = 1
+
+# TCP rfc1337
+net.ipv4.tcp_rfc1337 = 1
+
+# Reverse path filtering
+net.ipv4.conf.default.rp_filter = 1
+net.ipv4.conf.all.rp_filter = 1
+
+# Log martian packets
+net.ipv4.conf.default.log_martians = 1
+net.ipv4.conf.all.log_martians = 1
+
+# Disable ICMP redirects
+net.ipv6.conf.all.accept_redirects = 0
+net.ipv6.conf.default.accept_redirects = 0
+
+# Disable IP source routing
+net.ipv4.conf.default.accept_source_route = 0
+net.ipv4.conf.all.accept_source_route = 0
+
+# Ignore ICMP echo requests
+net.ipv4.icmp_echo_ignore_all = 1
+net.ipv6.icmp.echo_ignore_all = 1
+
+# Ignoring broadcasts request
+net.ipv4.icmp_echo_ignore_broadcasts = 1
+
+# An illicit router advertisement message could result in a man-in-the-middle attack.
+net.ipv6.conf.default.accept_ra = 0
+net.ipv6.conf.all.accept_ra = 0
+
+# Ignore bogus ICMP error responses
+net.ipv4.icmp_ignore_bogus_error_responses = 1
+
+# ICMP redirects
+net.ipv4.conf.default.accept_redirects = 0
+net.ipv4.conf.all.accept_redirects = 0
+
+# Accepting secure redirects
+net.ipv4.conf.default.secure_redirects = 0
+net.ipv4.conf.all.secure_redirects = 0
+
+# IP forwarding
+net.ipv4.ip_forward = 0
+
+# Sending ICMP redirects
+net.ipv4.conf.default.send_redirects = 0
+net.ipv4.conf.all.send_redirects = 0
+
+# Keep sockets in FIN-WAIT-2 state
+net.ipv4.tcp_fin_timeout = 30
+
+# Keepalive packets to keep an connection alive
+net.ipv4.tcp_keepalive_time = 180
+net.ipv4.tcp_keepalive_intvl = 10
+net.ipv4.tcp_keepalive_probes = 3
+
+

data/bin/getch

@@ -2,8 +2,16 @@
 
 require 'getch'
 
-def main(argv)
-  Getch::main(argv)
-end
+getch = Getch::Main.new(
+  :cli => Getch::Options.new(ARGV)
+)
 
-main(ARGV)
+getch.resume
+
+getch.partition
+getch.format
+getch.mount
+
+getch.install
+
+getch.configure

data/lib/getch.rb

@@ -1,27 +1,30 @@
 require_relative 'getch/options'
 require_relative 'getch/states'
 require_relative 'getch/gentoo'
+require_relative 'getch/void'
 require_relative 'getch/filesystem'
 require_relative 'getch/command'
 require_relative 'getch/helpers'
 require_relative 'getch/log'
 require_relative 'getch/config'
 require_relative 'getch/guard'
+require_relative 'getch/version'
 
 module Getch
 
-  DEFAULT_OPTIONS = {
-    language: 'en_US',
-    zoneinfo: 'US/Eastern',
-    keymap: 'us',
-    disk: 'sda',
-    fs: 'ext4',
-    username: nil,
-    boot_disk: nil,
-    cache_disk: nil,
-    home_disk: nil,
-    encrypt: false,
-    verbose: false
+  OPTIONS = {
+    :language => 'en_US',
+    :zoneinfo => 'US/Eastern',
+    :keymap => 'us',
+    :disk => false,
+    :fs => 'ext4',
+    :username => false,
+    :os => 'gentoo',
+    :boot_disk => false,
+    :cache_disk => false,
+    :home_disk => false,
+    :encrypt => false,
+    :verbose => false
   }
 
   STATES = {
@@ -34,86 +37,118 @@ module Getch
     :gentoo_kernel => false
   }
 
-  MOUNTPOINT = "/mnt/gentoo".freeze
+  MOUNTPOINT = "/mnt/gentoo"
+
   DEFAULT_FS = {
     true => {
-      ext4: Getch::FileSystem::Ext4::Encrypt,
-      lvm: Getch::FileSystem::Lvm::Encrypt,
-      zfs: Getch::FileSystem::Zfs::Encrypt
+      ext4: FileSystem::Ext4::Encrypt,
+      lvm: FileSystem::Lvm::Encrypt,
+      zfs: FileSystem::Zfs::Encrypt
     },
     false => {
-      ext4: Getch::FileSystem::Ext4,
-      lvm: Getch::FileSystem::Lvm,
-      zfs: Getch::FileSystem::Zfs,
+      ext4: FileSystem::Ext4,
+      lvm: FileSystem::Lvm,
+      zfs: FileSystem::Zfs,
     }
   }.freeze
 
-  def self.class_fs
-    encrypt = DEFAULT_OPTIONS[:encrypt]
-    fs = DEFAULT_OPTIONS[:fs].to_sym
-    DEFAULT_FS[encrypt][fs]
+  def self.select_fs
+    encrypt = OPTIONS[:encrypt]
+    fs_sym = OPTIONS[:fs].to_sym
+    DEFAULT_FS[encrypt][fs_sym]
   end
 
-  def self.resume_options(opts)
-    puts "\nBuild Gentoo with the following args:\n"
-    puts "Lang: #{DEFAULT_OPTIONS[:language]}"
-    puts "Zoneinfo: #{DEFAULT_OPTIONS[:zoneinfo]}"
-    puts "Keymap: #{DEFAULT_OPTIONS[:keymap]}"
-    puts "Disk: #{DEFAULT_OPTIONS[:disk]}"
-    puts "Filesystem: #{DEFAULT_OPTIONS[:fs]}"
-    puts "Username: #{DEFAULT_OPTIONS[:username]}"
-    puts "Encrypt: #{DEFAULT_OPTIONS[:encrypt]}"
-    puts
-    puts "separate-boot disk: #{DEFAULT_OPTIONS[:boot_disk]}"
-    puts "separate-cache disk: #{DEFAULT_OPTIONS[:cache_disk]}"
-    puts "separate-home disk: #{DEFAULT_OPTIONS[:home_disk]}"
-    puts
-    print "Continue? (n,y) "
-    case gets.chomp
-    when /^y|^Y/
-      return
-    else
-      exit 1
+  class Main
+    def initialize(argv)
+      argv[:cli]
+      @class_fs = Getch::select_fs
+      @log = Log.new
+      Getch::States.new # Update States
     end
-  end
 
-  def self.format(disk, fs, user)
-    return if STATES[:format] and STATES[:partition]
-    log = Log.new
-    puts
-    print "Partition and format disk #{disk}, this will erase all data, continue? (n,y) "
-    case gets.chomp
-    when /^y|^Y/
-      log.info("Partition start")
-      class_fs::Partition.new
-      class_fs::Format.new
-    else
-      exit 1
+    def resume
+      raise "No disk, use at least getch with -d DISK" if !OPTIONS[:disk]
+      puts "\nBuild " + OPTIONS[:os].capitalize + " Linux with the following args:\n"
+      puts
+      puts "\tLang: #{OPTIONS[:language]}"
+      puts "\tZoneinfo: #{OPTIONS[:zoneinfo]}"
+      puts "\tKeymap: #{OPTIONS[:keymap]}"
+      puts "\tDisk: #{OPTIONS[:disk]}"
+      puts "\tFilesystem: #{OPTIONS[:fs]}"
+      puts "\tUsername: #{OPTIONS[:username]}"
+      puts "\tEncrypt: #{OPTIONS[:encrypt]}"
+      puts
+      puts "\tseparate-boot disk: #{OPTIONS[:boot_disk]}"
+      puts "\tseparate-cache disk: #{OPTIONS[:cache_disk]}"
+      puts "\tseparate-home disk: #{OPTIONS[:home_disk]}"
+      puts
+      print "Continue? (y,N) "
+      case gets.chomp
+      when /^y|^Y/
+        return
+      else
+        exit
+      end
     end
-  end
 
-  def self.init_gentoo(options)
-    gentoo = Getch::Gentoo
-    gentoo.stage3
-    gentoo.config(options)
-    gentoo.chroot(options)
-    gentoo.kernel
-    gentoo.boot(options)
-  end
+    def partition
+      return if STATES[:partition]
+      puts
+      print "Partition and format disk #{OPTIONS[:disk]}, this will erase all data, continue? (y,N) "
+      case gets.chomp
+      when /^y|^Y/
+        @log.info("Partition start")
+        @class_fs::Partition.new
+      else
+        exit
+      end
+    end
 
-  def self.configure(options)
-    config = Getch::Config.new
-    config.network
-  end
+    def format
+      return if STATES[:format]
+      @class_fs::Format.new
+    end
 
-  def self.main(argv)
-    options = Options.new(argv)
-    DEFAULT_OPTIONS.freeze
-    resume_options(options)
-    Getch::States.new # Update States
-    format(options.disk, options.fs, options.username)
-    class_fs::Mount.new.run
-    init_gentoo(options)
-    configure(options)
+    def mount
+      return if STATES[:mount]
+      @class_fs::Mount.new.run
+    end
+
+    def install
+      if OPTIONS[:os] == 'gentoo'
+        install_gentoo
+      elsif OPTIONS[:os] == 'void'
+        install_void
+      else
+        puts "Options #{OPTIONS[:os]} not supported...."
+        exit 1
+      end
+    end
+
+    def install_gentoo
+      gentoo = Getch::Gentoo::Main.new
+      gentoo.stage3
+      gentoo.config
+      gentoo.chroot
+      gentoo.kernel
+      gentoo.boot
+    end
+
+    def install_void
+      void = Getch::Void::Main.new
+      void.root_fs
+      void.config
+      void.chroot
+      void.boot
+    end
+    
+    def configure
+      config = Getch::Config::Main.new
+      config.ethernet
+      config.wifi
+      config.dns
+      config.sysctl
+      config.shell
+    end
   end
 end