Debian on a USB stick - Revision history

Martin: /* Modern live boot usb stick */

2024-04-29T20:32:38Z

Modern live boot usb stick

← Older revision		Revision as of 20:32, 29 April 2024
Line 1:		Line 1:
	= ~~Modern~~ live boot usb stick =		= debian 12 live boot usb stick =

	* 1st Partiton: Size: 200 MB - Use As: EFI Partition (no other options will be available once this is chosen, it will be set to FAT32 and mounted at /boot/efi)		* 1st Partiton: Size: 200 MB - Use As: EFI Partition (no other options will be available once this is chosen, it will be set to FAT32 and mounted at /boot/efi)
Line 44:		Line 44:
	tmpfs /var/log/gdm3 tmpfs nosuid,nodev 0 0		tmpfs /var/log/gdm3 tmpfs nosuid,nodev 0 0
	</pre>		</pre>




	= old =		= old =

Martin at 20:22, 29 April 2024

2024-04-29T20:22:50Z

← Older revision		Revision as of 20:22, 29 April 2024
Line 1:		Line 1:
			= Modern live boot usb stick =

			* 1st Partiton: Size: 200 MB - Use As: EFI Partition (no other options will be available once this is chosen, it will be set to FAT32 and mounted at /boot/efi)
			* 2nd Partition: Size: 1 GB - Use As: Ext4 - Mount point: "/boot" (static files)
			* 3rd Partition: Size: remaining free space - Use As: Physical Volume for Encryption

			(done)

			* Scroll up to "configure encrypted volumes" > write changes, then "create encrypted volumes."
			** Select "partition" > "finish"
			** Create your encryption password

			* Scroll to "encrypted volume" and select the partition listed beneath to edit it.
			** Set mount point to "/" (root) > done setting up partition
			** Finish partitioning and write changes to disk (finally! But wait, there's more!!)
			** The installer will ask if you want to return to create a swap partition. Select "no"

			* Write changes. This will commence the actual installation.

			== install EFI ==
			<pre>
			cryptsetup luksOpen /dev/sda3 mnt
			mount /dev/mapper/mnt /mnt && mount /dev/sda2 /mnt/boot && mount /dev/sda1 /mnt/boot/efi
			mount --bind /dev /mnt/dev && mount --bind /dev/pts /mnt/dev/pts && mount --bind /proc /mnt/proc && mount --bind /sys /mnt/sys
			chroot /mnt

			grub-install --target=x86_64-efi /dev/sda
			grub-install --recheck /dev/sda

			exit

			umount /mnt/sys && umount /mnt/proc && umount /mnt/dev/pts && umount /mnt/dev && umount /mnt
			</pre>

			== try and reduce writes to root ==

			add the following lines to /etc/fstab

			<pre>
			tmpfs /tmp tmpfs nosuid,nodev 0 0
			tmpfs /var/log tmpfs nosuid,nodev 0 0
			tmpfs /var/tmp tmpfs nosuid,nodev 0 0
			tmpfs /var/log/journal tmpfs nosuid,nodev 0 0
			tmpfs /var/log/gdm3 tmpfs nosuid,nodev 0 0
			</pre>




			= old =

	The same principles can be used to create a minimal debian install without encryption.		The same principles can be used to create a minimal debian install without encryption.


	This is similar in size yet more up to date than [http://www.damnsmalllinux.org DSL].		This is similar in size yet more up to date than [http://www.damnsmalllinux.org DSL].

Martin: Created page with "The same principles can be used to create a minimal debian install without encryption. This is similar in size yet more up to date than [http://www.damnsmalllinux.org DSL]...."

2021-09-14T20:54:03Z

Created page with "The same principles can be used to create a minimal debian install without encryption. This is similar in size yet more up to date than [http://www.damnsmalllinux.org DSL]...."

New page

The same principles can be used to create a minimal debian install without encryption.

This is similar in size yet more up to date than [http://www.damnsmalllinux.org DSL].

http://feraga.com/project/deb2flash

note use --help for options - has single partition unencrypted, two partitions, one encrypted...

== historic info - useful if feraga is down ==

Content from [http://feraga.com/node/94 Feraga] with some minor tweeks for testing - lenny

<pre>
apt-get install cryptsetup dmsetup parted debootstrap grub

sda1 unencrypted boot partion sda2 root filesystem

mkfs.ext2 /dev/sda1
tune2fs -c0 -i0 /dev/sda1 # optionally turn off filesystem checks

cryptsetup luksFormat /dev/sda2 Note YES in captials
cryptsetup luksOpen /dev/sda2 rootfs

mkfs.ext2 /dev/mapper/rootfs
tune2fs -c0 -i0 /dev/mapper/rootfs # optionally turn off filesystem checks

mkdir /mnt/buildroot
mount -t ext2 /dev/mapper/rootfs /mnt/buildroot

mkdir /mnt/buildroot/boot
mount /dev/sda1 /mnt/buildroot/boot

debootstrap --arch i386 lenny /mnt/buildroot

mount -o bind /dev/ /mnt/buildroot/dev
mount -o bind /dev/pts /mnt/buildroot/dev/pts
mount -o bind /sys /mnt/buildroot/sys

/lib/udev/vol_id -u /dev/sda1
/lib/udev/vol_id -u /dev/sda2

chroot /mnt/buildroot /bin/su -l
</pre>

Create /etc/fstab with the below:

<pre>
#/etc/fstab: static file system information.
#
/dev/mapper/rootfs / ext2 defaults,errors=remount-ro,noatime 0 1
UUID=<uuid for sda1> /boot ext2 defaults,noatime,ro 0 1
none /proc proc defaults 0 0
tmpfs /tmp tmpfs defaults,noatime 0 0
tmpfs /var/lock tmpfs defaults,noatime 0 0
tmpfs /var/log tmpfs defaults,noatime 0 0
tmpfs /var/run tmpfs defaults,noatime 0 0
</pre>

/etc/apt/apt.conf.d/30remount_readwrite

<pre>
DPkg
{
Pre-Invoke {
"mount -o remount,rw /boot;" }
Post-Invoke {
"mount -o remount,ro /boot;" }
}
</pre>

mount -a

Change flash to your hostname:

/etc/hosts

127.0.0.1 localhost.localdoman localhost flash

/etc/hostname

flash

/etc/apt/sources.list

deb http://ftp.debian.org/debian sid main non-free contrib

create script for log directory structure:

/etc/rcS.d/S37feraga-init.sh.

<pre>
#!/bin/sh

case "$1" in
start)
echo
echo "Feraga"
echo "-Recreating required subdirectories on /var/log (tmpfs)"

# /var/log subdirectories.
mkdir -p /var/log/fsck
mkdir -p /var/log/ksymoops
mkdir -p /var/log/news

# Example for the mixmaster anonymous remailer
if [ -f /usr/bin/mixmaster ] ; then
mkdir -p /var/log/mixmaster
fi

# Example for the Tor proxy
if [ -f /usr/sbin/tor ] ; then
mkdir -p /var/log/tor
fi

# Example for Privoxy
if [ -f /usr/sbin/privoxy ] ; then
mkdir -p /var/log/privoxy
fi

# Apt archive subdirectories.
mkdir -p /var/cache/apt/archives/partial

echo "-done."
echo
;;
stop)
echo "Feraga shutting down."
# Add anything that needs to happen at shutdown here.
echo
;;
*)
echo "Usage: cryptdisks {start|stop}"
exit 1
;;
esac
</pre>

<pre>
apt-get update

apt-get install initramfs-tools
<pre>
usbcore
ehci-hcd
ohci-hcd
uhci-hcd
usbhid
ide-core
scsi_mod
usb-storage
mbcache
ext2
ide-cd
ide-disk
ide-generic
sd_mod
</pre>

Configure /etc/initramfs-tools/initramfs.conf
<pre>
# initramfs.conf
# Configuration file for mkinitramfs(8). See initramfs.conf(5).
MODULES=most
BUSYBOX=y
BOOT=local
DEVICE=eth0
NFSROOT=auto
</pre>

<pre>
apt-get install cryptsetup dmsetup hashalot
cp /usr/share/initramfs-tools/hooks/cryptroot /etc/initramfs-tools/hooks/
cp /usr/share/initramfs-tools/scripts/local-top/cryptroot /etc/initramfs-tools/scripts/local-top/
</pre>

/etc/crypttab:
replace the <uuid for sda2> with your uuid
<pre>
# <target name> <source device> <key file> <options>
rootfs /dev/disk/by-uuid/<uuid for sda2> none luks
</pre>

edit /etc/initramfs-tools/scripts/local-top/cryptroot to allow for USB detection.

<pre>
modprobe -q dm_crypt ## After this line add the following.

# Add delay
message "Sleeping for 5 seconds to allow USB detection."
sleep 5
message "Awake, attempting to mount encrypted partitions."
</pre>

in chroot shell
<pre>
mount -o remount,rw /boot
apt-get install grub
</pre>

Next from outside the chroot:
<pre>
grub-install --recheck --root-directory=/mnt/buildroot /dev/sda
</pre>

/boot/grub/menu.lst and add this simplified configuration:
<pre>
# default num
default 0

# timeout sec
timeout 5

# pretty colours
color green/black black/green

### BEGIN AUTOMAGIC KERNELS LIST

## ## Start Default Options ##

# kopt=root=/dev/mapper/rootfs ro\n")
# groot=(hd0,0)
# alternative=true
# lockalternative=false
# defoptions=
# lockold=false
# howmany=all
# memtest86=true
# updatedefaultentry=false

## ## End Default Options ##

### END DEBIAN AUTOMAGIC KERNELS LIST
</pre>

<pre>
grub
root (hd1,0)
setup (hd1)
quit

rm -f /boot/grub/device.map
</pre>

/etc/kernel-img.conf

<pre>
do_symlinks = yes
relative_links = yes
do_bootloader = no
do_bootfloppy = no
do_initrd = yes ## <--- Verify this line
link_in_boot = yes
postinst_hook = /sbin/update-grub
postrm_hook = /sbin/update-grub
</pre>

apt-get install linux-image-686

apt-get remove linux-image-686

apt-get clean

passwd

umount -a

to update the scripts in initramfs:

update-initramfs -u