Difference between revisions of "Install/Finishing"

From Funtoo
Jump to navigation Jump to search
(before improving entropy user should aware what is it and be sure if it's really needed)
(Marked this version for translation)
 
(8 intermediate revisions by 4 users not shown)
Line 36: Line 36:
{{2Col|{{c|wheel}}|Allows your user account to '{{c|su}}' to root. Recommended on your primary user account for easy maintenance. Also used with {{c|sudo}}.}}
{{2Col|{{c|wheel}}|Allows your user account to '{{c|su}}' to root. Recommended on your primary user account for easy maintenance. Also used with {{c|sudo}}.}}
{{2Col|{{c|audio}}|Allows your user account to directly access audio devices. Required if using ALSA; otherwise optional.}}
{{2Col|{{c|audio}}|Allows your user account to directly access audio devices. Required if using ALSA; otherwise optional.}}
{{2Col|{{c|video}}|Allows your user account to directly access video devices. Required for certain video drivers and webcams.}}
{{2Col|{{c|plugdev}}|Allows your user account work with various removable devices. Allows adding of a WiFi network in GNOME without providing root password. Recommended for desktop users.}}
{{2Col|{{c|plugdev}}|Allows your user account work with various removable devices. Allows adding of a WiFi network in GNOME without providing root password. Recommended for desktop users.}}
{{2Col|{{c|portage}}|Allows extended use of Portage as regular user. Recommended.}}
{{2Col|{{c|portage}}|Allows extended use of Portage as regular user. Recommended.}}
Line 45: Line 46:
<!--T:15-->
<!--T:15-->
{{console|body=
{{console|body=
%chroot% ##i##usermod -G wheel,audio,plugdev,portage drobbins
%chroot% ##i##usermod -G wheel,audio,video,plugdev,portage drobbins
}}
}}


Line 59: Line 60:
}}
}}


===Secure SSH server === <!--T:23-->
===Install an Entropy Generator === <!--T:18-->
 
<!--T:24-->
{{c|sshd}} is a member of [[OpenRC_(Funtoo)|OpenRC]]'s default runlevel. It means that after reboot it will be possible to connect to your host via SSH (with valid credentials). You should think about securing your SSH server or even consider if it's really needed (e.g. for desktops).
 
Common practice is to disable root login and enable public key authentication. You can read more about securing SSH service in [https://wiki.gentoo.org/wiki/Security_Handbook/Securing_services#SSH Gentoo Security Handbook] or in our [[Package:OpenSSH|wiki page about OpenSSH]].
 
If you don't need to connect to your new Funtoo host run this:
{{console|body=
%chroot% ##i##rc-update del sshd default
}}
 
===Install an Entropy Generator (if really needed) === <!--T:25-->


<!--T:19-->
<!--T:19-->
The Linux kernel uses various sources such as user input to generate entropy, which is in turn used for generating random numbers. Encrypted communications can use a lot of entropy, and often the amount of entropy generated by your system will not be sufficient. This is commonly an issue on headless server systems, which can also include ARM systems such as Raspberry Pi, and can result in slower than normal ssh connections among other issues.
The Linux kernel uses various sources such as user input to generate entropy, which is in turn used for generating random numbers. Encrypted communications can use a lot of entropy, and often the amount of entropy generated by your system will not be sufficient. This is commonly an issue on headless server systems, which can also include ARM systems such as Raspberry Pi, and can result in slower than normal ssh connections among other issues.
<!--T:26-->
{{console|body=
%chroot% ##i##cat /proc/sys/kernel/random/entropy_avail
}}
This read-only file gives the available entropy (in bits). If it is [https://developers.redhat.com/blog/2017/10/05/entropy-rhel-based-cloud-instances/ below 1000] you can think about improving entropy.
<!--T:27-->
In order to check how your machine deals with [https://en.wikipedia.org/wiki/FIPS_140-2 FIPS 140-2 standard] {{c|rng-tools}} can be used
{{console|body=
%chroot% ##i##emerge rng-tools
%chroot% ##i##rngtest -c 1000 < /dev/random
}}
<!--T:28-->
To identify the different sources of entropy available in the system, use
{{console|body=
%chroot% ##i##rngd -l
}}


<!--T:20-->
<!--T:20-->
To compensate for low entropy it is possible to use a hardware random number generator, use [https://www.schneier.com/academic/fortuna/ a secure pseudorandom number generator] or enable a user-space entropy generator at boot time. We will use {{c|haveged}} in this example, although others are available, such as mentioned before {{c|rng-tools}}.
To compensate for this, a user-space entropy generator can be emerged and enabled at boot time. We will use {{c|haveged}} in this example, although others are available, such as {{c|rng-tools}}.


<!--T:21-->
<!--T:21-->
Line 110: Line 80:


<!--T:4-->
<!--T:4-->
Now is the time to leave chroot, to unmount Funtoo Linux partitions and files and to restart your computer. When you restart, the GRUB boot loader will start, load the Linux kernel and initramfs, and your system will begin booting.
Now is the time to leave fchroot, to unmount Funtoo Linux partitions and files and to restart your computer. When you restart, the GRUB boot loader will start, load the Linux kernel and initramfs, and your system will begin booting.


<!--T:5-->
<!--T:5-->
Leave the chroot, change directory to /mnt, unmount your Funtoo partitions, and reboot.
To leave the fchroot, simply type {{c|exit}} and you will be returned back to your LiveCD shell.
 
<!--T:23-->
If you used manual chroot steps, you can use the following sequence of commands prepare to restart:
{{console|body=
{{console|body=
%chroot% ##i##exit
%chroot% ##i##exit
# ##i##cd /mnt
# ##i##cd /mnt
# ##i##umount -lR funtoo
# ##i##umount -lR funtoo
}}
<!--T:24-->
Now, you are ready to reboot into Funtoo:
{{console|body=
# ##i##reboot
# ##i##reboot
}}
}}
<!--T:6-->
{{note|The Funtoo LiveCD will gracefully unmount your new Funtoo filesystems as part of its normal shutdown sequence.}}


<!--T:7-->
<!--T:7-->

Latest revision as of 04:57, June 23, 2022

Other languages:

Install Guide: Finishing Up

Install Guide, Chapter 16 < Prev Next >

Set your root password

It's imperative that you set your root password before rebooting so that you can log in.

chroot # passwd
New password: **********
Retype new password: **********
passwd: password updated successfully

Create a Regular User

It's also a good idea to create a regular user for daily use. If you're using GNOME, this is a requirement as you cannot log in to GDM (The GNOME Display Manager) as root. This can be accomplished as follows:

chroot # useradd -m drobbins

You will also likely want to add your primary user to one or more supplemental groups. Here is a list of important groups and their effect:

GroupDescription
wheelAllows your user account to 'su' to root. Recommended on your primary user account for easy maintenance. Also used with sudo.
audioAllows your user account to directly access audio devices. Required if using ALSA; otherwise optional.
videoAllows your user account to directly access video devices. Required for certain video drivers and webcams.
plugdevAllows your user account work with various removable devices. Allows adding of a WiFi network in GNOME without providing root password. Recommended for desktop users.
portageAllows extended use of Portage as regular user. Recommended.

To add your user to multiple groups, use the usermod command, specifying a complete group list:

chroot # usermod -G wheel,audio,video,plugdev,portage drobbins

As with your root account, don't forget to set a password:

chroot # passwd drobbins
New password: **********
Retype new password: **********
passwd: password updated successfully

Install an Entropy Generator

The Linux kernel uses various sources such as user input to generate entropy, which is in turn used for generating random numbers. Encrypted communications can use a lot of entropy, and often the amount of entropy generated by your system will not be sufficient. This is commonly an issue on headless server systems, which can also include ARM systems such as Raspberry Pi, and can result in slower than normal ssh connections among other issues.

To compensate for this, a user-space entropy generator can be emerged and enabled at boot time. We will use haveged in this example, although others are available, such as rng-tools.

chroot # emerge haveged
chroot # rc-update add haveged default

Haveged will now start at boot and will augment the Linux kernel's entropy pool.

Restart your system

Now is the time to leave fchroot, to unmount Funtoo Linux partitions and files and to restart your computer. When you restart, the GRUB boot loader will start, load the Linux kernel and initramfs, and your system will begin booting.

To leave the fchroot, simply type exit and you will be returned back to your LiveCD shell.

If you used manual chroot steps, you can use the following sequence of commands prepare to restart:

chroot # exit
root # cd /mnt
root # umount -lR funtoo

Now, you are ready to reboot into Funtoo:

root # reboot

You should now see your system reboot, the GRUB boot loader appear for a few seconds, and then see the Linux kernel and initramfs loading. After this, you should see Funtoo Linux itself start to boot, and you should be greeted with a login: prompt. Funtoo Linux has been successfully installed!

Install Guide, Chapter 16 < Prev Next >