Remote disk unlocking: Difference between revisions
m →Setup |
Add setup for systemd based initrd |
||
| Line 3: | Line 3: | ||
== Setup == | == Setup == | ||
Generate host key for the SSH daemon | 1. The network card may not work in initrd without its kernel being manually loaded by {{nixos:option|boot.initrd.availableKernelModules}}. Find out the kernel module required by checking "Kernel modules" section in the output of <code>lspci -v | grep -iA8 'network\|ethernet'</code> (<code>lspci</code> is available in {{nixos:package|pciutils}}), and add it to {{nixos:option|boot.initrd.availableKernelModules}} (not to confuse with {{nixos:option|boot.availableKernelModules}}, which is for stage 2). | ||
{{file|/etc/nixos/configuration.nix|nix|<nowiki> | |||
boot.initrd.availableKernelModules = [ ... ]; | |||
</nowiki>}} | |||
2. Generate host key for the SSH daemon in <code>/etc/secrets/initrd/ssh_host_ed25519_key</code> which is required. | |||
<syntaxhighlight lang="console"> | <syntaxhighlight lang="console"> | ||
| Line 9: | Line 15: | ||
# ssh-keygen -t ed25519 -N "" -f /etc/secrets/initrd/ssh_host_ed25519_key | # ssh-keygen -t ed25519 -N "" -f /etc/secrets/initrd/ssh_host_ed25519_key | ||
</syntaxhighlight> | </syntaxhighlight> | ||
3. Configure {{nixos:option|boot.initrd.network.ssh}}. Add the generated host key to {{nixos:option|boot.initrd.network.ssh.hostKeys}} and your public key to {{nixos:option|boot.initrd.network.ssh.authorizedKeys}}. | |||
{{file|/etc/nixos/configuration.nix|nix|<nowiki> | |||
boot.initrd.network = { | |||
enable = true; | |||
ssh = { | |||
enable = true; | |||
hostKeys = [ | |||
"/etc/secrets/initrd/ssh_host_ed25519_key" | |||
]; | |||
authorizedKeys = [ | |||
"ssh-rsa AAAAyourpublic-key-here..."; | |||
]; | |||
}; | |||
}; | |||
</nowiki>}} | |||
Now proceed to one of [[#Setup with Systemd]] or [[#Setup without Systemd]]. | |||
== Setup with Systemd == | |||
1. Enable debug shell. Although it is not required, enabling the debug shell allows you to enter the debug shell by press <code>Ctrl+Alt+F9</code> during Stage 1. | |||
{{file|/etc/nixos/configuration.nix|nix|<nowiki> | |||
boot.kernelParams = [ "rd.systemd.debug_shell=1" ]; | |||
</nowiki>}} | |||
The network and SSH status can be checked from within the debug shell: | |||
<syntaxhighlight lang="console"> | |||
# networkctl status: show systemd-networkd status | |||
# journalctl -u sshd | |||
# cat /etc/ssh/sshd_config | |||
</syntaxhighlight> | |||
2. Configure [[Systemd/networkd]]. {{nixos:option|boot.initrd.systemd.network}} has a syntax similar to {{nixos:option|systemd.network}}. For details, see [[Systemd/networkd]]. | |||
First find the interface name(s) (<code>eth0</code> in this example): | |||
<syntaxhighlight lang="console"> | |||
# ip addr | |||
lo ... | |||
eth0 ... | |||
</syntaxhighlight> | |||
To configure DHCP: | |||
{{file|/etc/nixos/configuration.nix|nix|3=boot.initrd.systemd.network = { | |||
enable = true; | |||
networks."10-eth0" = { | |||
matchConfig.Name = "eth0"; | |||
networkConfig.DHCP = "ipv4"; | |||
# Wait until network interfaces have a routable address | |||
# https://wiki.archlinux.org/title/Systemd-networkd | |||
linkConfig.RequiredForOnline = "routable"; | |||
}; | |||
};|name=/etc/nixos/configuration.nix|lang=nix}} | |||
To configure static IP: | |||
{{file|/etc/nixos/configuration.nix|nix|<nowiki>boot.initrd.systemd.network = { | |||
enable = true; | |||
networks."10-eth0" = { | |||
# Run `ip addr` to find the interface name to specify, e.g. enp5s0 | |||
matchConfig.Name = "enp5s0"; | |||
address = [ | |||
"192.168.1.123/24" | |||
"2001:db8:1234:5678::1/64" | |||
]; | |||
routes = [ | |||
{ Gateway = "192.168.1.1"; } | |||
{ Gateway = "fe80::1"; } | |||
]; | |||
# Wait until network interfaces have a routable address | |||
# https://wiki.archlinux.org/title/Systemd-networkd | |||
linkConfig.RequiredForOnline = "routable"; | |||
}; | |||
}; | |||
3. To automatically be prompted for a password when logging in via SSH, add <code>command="systemctl default"</code> to {{nixos:option|boot.initrd.network.ssh.authorizedKeys}}. | |||
{{file|/etc/nixos/configuration.nix|diff|<nowiki> | |||
boot.initrd.network = { | |||
enable = true; | |||
ssh = { | |||
enable = true; | |||
hostKeys = [ | |||
"/etc/secrets/initrd/ssh_host_ed25519_key" | |||
]; | |||
authorizedKeys = [ | |||
- "ssh-rsa AAAAyourpublic-key-here..."; | |||
+ ''command="systemctl default" ssh-rsa AAAAyourpublic-key-here...'' | |||
]; | |||
}; | |||
}; | |||
</nowiki>}} | |||
== Setup without Systemd == | |||
Enable SSH daemon in initrd | Enable SSH daemon in initrd | ||
| Line 14: | Line 119: | ||
{{file|/etc/nixos/configuration.nix|nix|<nowiki> | {{file|/etc/nixos/configuration.nix|nix|<nowiki> | ||
boot.initrd = { | boot.initrd = { | ||
systemd.enable = false; | |||
availableKernelModules = [ "r8169" ]; | availableKernelModules = [ "r8169" ]; | ||
network = { | network = { | ||
| Line 52: | Line 158: | ||
If you omit it, you will get dropped into <code>/bin/ash</code>, and you will have to manually run <code>cryptsetup-askpass</code> to enter the password. Alternatively, the <code>boot.initrd.systemd.users.root.shell</code> option can be set to <code>/bin/conspy</code> for passwords which expect stdin. This binary included by default, and provided by busybox. | If you omit it, you will get dropped into <code>/bin/ash</code>, and you will have to manually run <code>cryptsetup-askpass</code> to enter the password. Alternatively, the <code>boot.initrd.systemd.users.root.shell</code> option can be set to <code>/bin/conspy</code> for passwords which expect stdin. This binary included by default, and provided by busybox. | ||
== Usage == | == Usage == | ||