mirror of
https://github.com/tommytran732/Arch-Setup-Script
synced 2024-09-19 15:14:43 -04:00
Compare commits
No commits in common. "98d4106ba74df6e860ffbd0a7463f23690008605" and "15a17738b327304fae42b7b99aacf38f8ad52386" have entirely different histories.
98d4106ba7
...
15a17738b3
@ -4,7 +4,7 @@
|
||||
|
||||
This is my installer for Arch Linux. It sets up a BTRFS system with encrypted `/boot` and full snapper support (both snapshotting and rollback work!). It also includes various system hardening configurations.
|
||||
|
||||
The script is based on [easy-arch](https://github.com/classy-giraffe/easy-arch). However, it diverges substantially from the original project does not follow its development.
|
||||
The script was originally based off [easy-arch](https://github.com/classy-giraffe/easy-arch). However, it diverges substantially from the original project does not follow its development.
|
||||
|
||||
Visit my Matrix group: https://invite.arcticfoxes.net/#/#tommy:arcticfoxes.net
|
||||
|
||||
|
||||
@ -1,36 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright (C) 2021-2024 Thien Tran
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
|
||||
# use this file except in compliance with the License. You may obtain a copy of
|
||||
# the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations under
|
||||
# the License.
|
||||
|
||||
# Make sure secureboot is in setup mode before running this
|
||||
|
||||
# Secure boot enrollment
|
||||
sudo sbctl enroll-keys
|
||||
sudo sbctl sign /boot/efi/EFI/GRUB/grubx64.efi
|
||||
|
||||
# Setup Flatpak
|
||||
sudo flatpak override --system --nosocket=x11 --nosocket=fallback-x11 --nosocket=pulseaudio --nosocket=session-bus --nosocket=system-bus --unshare=network --unshare=ipc --nofilesystem=host:reset --nodevice=input --nodevice=shm --nodevice=all --no-talk-name=org.freedesktop.Flatpak --no-talk-name=org.freedesktop.systemd1 --no-talk-name=ca.desrt.dconf --no-talk-name=org.gnome.Shell.Extensions
|
||||
flatpak override --user --nosocket=x11 --nosocket=fallback-x11 --nosocket=pulseaudio --nosocket=session-bus --nosocket=system-bus --unshare=network --unshare=ipc --nofilesystem=host:reset --nodevice=input --nodevice=shm --nodevice=all --no-talk-name=org.freedesktop.Flatpak --no-talk-name=org.freedesktop.systemd1 --no-talk-name=ca.desrt.dconf --no-talk-name=org.gnome.Shell.Extensions
|
||||
flatpak remote-add --if-not-exists --user flathub https://dl.flathub.org/repo/flathub.flatpakrepo
|
||||
flatpak --user install org.gnome.Extensions com.github.tchx84.Flatseal org.gnome.Loupe -y
|
||||
flatpak --user override com.github.tchx84.Flatseal --filesystem=/var/lib/flatpak/app:ro --filesystem=xdg-data/flatpak/app:ro --filesystem=xdg-data/flatpak/overrides:create
|
||||
flatpak --user override org.gnome.Extensions --talk-name=org.gnome.Shell.Extensions
|
||||
flatpak update -y
|
||||
|
||||
# Firewalld setup
|
||||
sudo firewall-cmd --set-default-zone=block
|
||||
sudo firewall-cmd --permanent --add-service=dhcpv6-client
|
||||
sudo firewall-cmd --reload
|
||||
sudo firewall-cmd --lockdown-on
|
||||
102
install.sh
102
install.sh
@ -38,6 +38,29 @@ install_mode_selector() {
|
||||
esac
|
||||
}
|
||||
|
||||
# Selecting the kernel flavor to install.
|
||||
kernel_selector () {
|
||||
output 'List of kernels:'
|
||||
output '1) Stable — Vanilla Linux kernel and modules, with a few patches applied.'
|
||||
output '2) Hardened — A security-focused Linux kernel.'
|
||||
output '3) Longterm — Long-term support (LTS) Linux kernel and modules.'
|
||||
output '4) Zen Kernel — Optimized for desktop usage.'
|
||||
output 'Insert the number of your selection:'
|
||||
read -r choice
|
||||
case $choice in
|
||||
1 ) kernel=linux
|
||||
;;
|
||||
2 ) kernel=linux-hardened
|
||||
;;
|
||||
3 ) kernel=linux-lts
|
||||
;;
|
||||
4 ) kernel=linux-zen
|
||||
;;
|
||||
* ) output 'You did not enter a valid selection.'
|
||||
kernel_selector
|
||||
esac
|
||||
}
|
||||
|
||||
luks_password_prompt () {
|
||||
output 'Enter your encryption password (the password will not be shown on the screen):'
|
||||
read -r -s luks_password
|
||||
@ -94,16 +117,12 @@ user_password_prompt () {
|
||||
}
|
||||
|
||||
hostname_prompt (){
|
||||
if [ "${install_mode}" = 'server' ]; then
|
||||
output 'Enter your hostname:'
|
||||
read -r hostname
|
||||
output 'Enter your hostname:'
|
||||
read -r hostname
|
||||
|
||||
if [ -z "${hostname}" ]; then
|
||||
output 'You need to enter a hostname.'
|
||||
hostname_prompt
|
||||
fi
|
||||
else
|
||||
hostname='localhost'
|
||||
if [ -z "${hostname}" ]; then
|
||||
output 'You need to enter a hostname.'
|
||||
hostname_prompt
|
||||
fi
|
||||
}
|
||||
|
||||
@ -116,6 +135,7 @@ clear
|
||||
|
||||
# Initial prompts
|
||||
install_mode_selector
|
||||
kernel_selector
|
||||
luks_password_prompt
|
||||
disk_prompt
|
||||
username_prompt
|
||||
@ -158,7 +178,7 @@ mkfs.fat -F 32 -s 2 "${ESP}" &>/dev/null
|
||||
|
||||
## Creating a LUKS Container for the root partition.
|
||||
output 'Creating LUKS Container for the root partition.'
|
||||
echo -n "${luks_password}" | cryptsetup luksFormat --pbkdf pbkdf2 ${cryptroot} -d - &>/dev/null
|
||||
echo -n "${luks_password}" | cryptsetup luksFormat --type luks1 ${cryptroot} -d - &>/dev/null
|
||||
echo -n "${luks_password}" | cryptsetup open ${cryptroot} cryptroot -d -
|
||||
BTRFS='/dev/mapper/cryptroot'
|
||||
|
||||
@ -264,16 +284,10 @@ fi
|
||||
|
||||
## Pacstrap
|
||||
output 'Installing the base system (it may take a while).'
|
||||
|
||||
output "You may see an error when mkinitcpio tries to generate a new initramfs."
|
||||
output "It is okay. The script will regenerate the initramfs later in the installation process."
|
||||
|
||||
pacstrap /mnt apparmor base chrony efibootmgr firewalld grub grub-btrfs inotify-tools linux-firmware linux-hardened linux-lts "${microcode}" nano networkmanager reflector sbctl snapper sudo zram-generator
|
||||
|
||||
if [ "${install_mode}" = 'desktop' ]; then
|
||||
pacstrap /mnt nautilus gdm gnome-console gnome-control-center flatpak pipewire-alsa pipewire-pulse pipewire-jack
|
||||
pacstrap /mnt base "${kernel}" "${microcode}" apparmor chrony efibootmgr firewalld grub grub-btrfs inotify-tools linux-firmware nano networkmanager reflector sbctl snapper sudo zram-generator nautilus gdm gnome-console gnome-control-center pipewire-alsa pipewire-pulse pipewire-jack
|
||||
elif [ "${install_mode}" = 'server' ]; then
|
||||
pacstrap /mnt openssh
|
||||
pacstrap /mnt base "${kernel}" "${microcode}" apparmor chrony efibootmgr firewalld grub grub-btrfs inotify-tools linux-firmware nano networkmanager reflector sbctl snapper sudo zram-generator openssh
|
||||
fi
|
||||
|
||||
if [ "${virtualization}" = 'none' ]; then
|
||||
@ -332,14 +346,14 @@ sed -i 's/rootflags=subvol=${rootsubvol}//g' /mnt/etc/grub.d/20_linux_xen
|
||||
|
||||
## Kernel hardening
|
||||
UUID=$(blkid -s UUID -o value "${cryptroot}")
|
||||
sed -i "s#quiet#rd.luks.name=${UUID}=cryptroot root=${BTRFS} lsm=landlock,lockdown,yama,integrity,apparmor,bpf mitigations=auto,nosmt spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on tsx=off kvm.nx_huge_pages=force nosmt=force l1d_flush=on spec_rstack_overflow=safe-ret gather_data_sampling=force reg_file_data_sampling=on random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=force_isolation efi=disable_early_pci_dma iommu=force iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none ia32_emulation=0 page_alloc.shuffle=1 randomize_kstack_offset=on debugfs=off lockdown=confidentiality module.sig_enforce=1#g" /mnt/etc/default/grub
|
||||
sed -i "s#quiet#rd.luks.name=${UUID}=cryptroot root=${BTRFS} mitigations=auto,nosmt spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on tsx=off kvm.nx_huge_pages=force nosmt=force l1d_flush=on spec_rstack_overflow=safe-ret gather_data_sampling=force reg_file_data_sampling=on random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=force_isolation efi=disable_early_pci_dma iommu=force iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none ia32_emulation=0 page_alloc.shuffle=1 randomize_kstack_offset=on debugfs=off lockdown=confidentiality module.sig_enforce=1#g" /mnt/etc/default/grub
|
||||
|
||||
## Add keyfile to the initramfs to avoid double password.
|
||||
dd bs=512 count=4 if=/dev/random of=/mnt/cryptkey/.root.key iflag=fullblock &>/dev/null
|
||||
chmod 000 /mnt/cryptkey/.root.key &>/dev/null
|
||||
echo -n "${luks_password}" | cryptsetup luksAddKey /dev/disk/by-partlabel/cryptroot /mnt/cryptkey/.root.key -d -
|
||||
sed -i 's#FILES=()#FILES=(/cryptkey/.root.key)#g' /mnt/etc/mkinitcpio.conf
|
||||
sed -i "s#module\.sig_enforce=1#module.sig_enforce=1 rd.luks.key=/cryptkey/.root.key#g" /mnt/etc/default/grub
|
||||
sed -i "s#module.sig_enforce=1#module.sig_enforce=1 rd.luks.key=/cryptkey/.root.key#g" /mnt/etc/default/grub
|
||||
|
||||
## Continue kernel hardening
|
||||
unpriv curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/modprobe.d/30_security-misc.conf | tee /mnt/etc/modprobe.d/30_security-misc.conf
|
||||
@ -363,31 +377,14 @@ sed -i 's/nullok//g' /mnt/etc/pam.d/system-auth
|
||||
## Disable coredump
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/security/limits.d/30-disable-coredump.conf | tee /mnt/etc/security/limits.d/30-disable-coredump.conf
|
||||
|
||||
# Disable XWayland
|
||||
sudo mkdir -p /mnt/etc/systemd/user/org.gnome.Shell@wayland.service.d
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/systemd/user/org.gnome.Shell%40wayland.service.d/override.conf | sudo tee /mnt/etc/systemd/user/org.gnome.Shell@wayland.service.d/override.conf
|
||||
|
||||
# Setup dconf
|
||||
mkdir -p /mnt/etc/dconf/db/local.d/locks
|
||||
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/locks/automount-disable | tee /mnt/etc/dconf/db/local.d/locks/automount-disable
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/locks/privacy | tee /mnt/etc/dconf/db/local.d/locks/privacy
|
||||
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/adw-gtk3-dark | tee /mnt/etc/dconf/db/local.d/adw-gtk3-dark
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/automount-disable | tee /mnt/etc/dconf/db/local.d/automount-disable
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/button-layout | tee /mnt/etc/dconf/db/local.d/button-layout
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/prefer-dark | tee /mnt/etc/dconf/db/local.d/prefer-dark
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/privacy | tee /mnt/etc/dconf/db/local.d/privacy
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/dconf/db/local.d/touchpad | tee /mnt/etc/dconf/db/local.d/touchpad
|
||||
|
||||
## ZRAM configuration
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/systemd/zram-generator.conf | tee /mnt/etc/systemd/zram-generator.conf
|
||||
|
||||
## Setup Networking
|
||||
|
||||
if [ "${install_mode}" = "desktop" ]; then
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/NetworkManager/conf.d/00-macrandomize.conf | tee /mnt/etc/NetworkManager/conf.d/00-macrandomize.conf
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/NetworkManager/conf.d/01-transient-hostname.conf | tee /mnt/etc/NetworkManager/conf.d/01-transient-hostname.conf
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/NetworkManager/conf.d/00-macrandomize.conf | tee /mnt/etc/NetworkManager/conf.d/00-macrandomize.conf
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/NetworkManager/conf.d/01-transient-hostname.conf | tee /mnt/etc/NetworkManager/conf.d/01-transient-hostname.conf
|
||||
fi
|
||||
|
||||
unpriv curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/NetworkManager.service.d/99-brace.conf | tee /mnt/etc/systemd/system/NetworkManager.service.d/99-brace.conf
|
||||
@ -403,36 +400,32 @@ arch-chroot /mnt /bin/bash -e <<EOF
|
||||
hwclock --systohc
|
||||
|
||||
# Generating locales.my keys aren't even on
|
||||
output "Generating locales."
|
||||
echo "Generating locales."
|
||||
locale-gen
|
||||
|
||||
# Create SecureBoot keys. This isn't strictly necessary, but certain things like linux-hardened preset expects it and mkinitcpio will fail without it, sooo...
|
||||
sbctl create-keys
|
||||
|
||||
# Generating a new initramfs.
|
||||
output "Creating a new initramfs."
|
||||
echo "Creating a new initramfs."
|
||||
chmod 600 /boot/initramfs-linux*
|
||||
mkinitcpio -P
|
||||
|
||||
# Installing GRUB.
|
||||
output "Installing GRUB on /boot."
|
||||
echo "Installing GRUB on /boot."
|
||||
grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=GRUB --modules="normal test efi_gop efi_uga search echo linux all_video gfxmenu gfxterm_background gfxterm_menu gfxterm loadenv configfile gzio part_gpt cryptodisk luks gcry_rijndael gcry_sha256 btrfs" --disable-shim-lock
|
||||
|
||||
# Creating grub config file.
|
||||
output "Creating GRUB config file."
|
||||
echo "Creating GRUB config file."
|
||||
grub-mkconfig -o /boot/grub/grub.cfg
|
||||
|
||||
# Adding user with sudo privilege
|
||||
if [ -n "$username" ]; then
|
||||
output "Adding $username with root privilege."
|
||||
echo "Adding $username with root privilege."
|
||||
useradd -m $username
|
||||
usermod -aG wheel $username
|
||||
fi
|
||||
|
||||
# Setting up dconf
|
||||
output "Setting up dconf."
|
||||
dconf update
|
||||
|
||||
# Snapper configuration
|
||||
umount /.snapshots
|
||||
rm -r /.snapshots
|
||||
@ -449,6 +442,11 @@ EOF
|
||||
## Give wheel user sudo access.
|
||||
sed -i 's/# \(%wheel ALL=(ALL\(:ALL\|\)) ALL\)/\1/g' /mnt/etc/sudoers
|
||||
|
||||
## Enabling openssh server
|
||||
if [ "${install_mode}" = 'server' ]; then
|
||||
systemctl enable sshd --root=/mnt
|
||||
fi
|
||||
|
||||
## Enable services
|
||||
systemctl enable apparmor --root=/mnt
|
||||
systemctl enable chronyd --root=/mnt
|
||||
@ -463,14 +461,6 @@ systemctl enable snapper-cleanup.timer --root=/mnt
|
||||
systemctl enable systemd-oomd --root=/mnt
|
||||
systemctl disable systemd-timesyncd --root=/mnt
|
||||
|
||||
if [ "${install_mode}" = 'desktop' ]; then
|
||||
systemctl enable gdm --root=/mnt
|
||||
fi
|
||||
|
||||
if [ "${install_mode}" = 'server' ]; then
|
||||
systemctl enable sshd --root=/mnt
|
||||
fi
|
||||
|
||||
## Set umask to 077.
|
||||
sudo sed -i 's/^UMASK.*/UMASK 077/g' /mnt/etc/login.defs
|
||||
sudo sed -i 's/^HOME_MODE/#HOME_MODE/g' /mnt/etc/login.defs
|
||||
|
||||
Loading…
Reference in New Issue
Block a user