aboutsummaryrefslogtreecommitdiff
path: root/docs/gnulinux
diff options
context:
space:
mode:
authorAlyssa Rosenzweig <alyssa@rosenzweig.io>2017-03-20 20:26:48 -0700
committerAlyssa Rosenzweig <alyssa@rosenzweig.io>2017-03-20 20:26:48 -0700
commita62fe03d3e84150e6186f57f53029d5a9abe3d7b (patch)
tree1a1276b32fcc5388165bd42b685c0d9e83380a7b /docs/gnulinux
parent07da8fb0c7d513bc73470b69be99f1add0cb95e5 (diff)
downloadlibrebootfr-a62fe03d3e84150e6186f57f53029d5a9abe3d7b.tar.gz
librebootfr-a62fe03d3e84150e6186f57f53029d5a9abe3d7b.zip
undo breakages
Diffstat (limited to 'docs/gnulinux')
-rw-r--r--docs/gnulinux/configuring_parabola.md415
-rw-r--r--docs/gnulinux/encrypted_debian.md83
-rw-r--r--docs/gnulinux/encrypted_parabola.md525
-rw-r--r--docs/gnulinux/grub_boot_installer.md147
-rw-r--r--docs/gnulinux/grub_cbfs.md109
-rw-r--r--docs/gnulinux/grub_hardening.md25
-rw-r--r--docs/gnulinux/index.md9
7 files changed, 635 insertions, 678 deletions
diff --git a/docs/gnulinux/configuring_parabola.md b/docs/gnulinux/configuring_parabola.md
index 918e98aa..0162aa0c 100644
--- a/docs/gnulinux/configuring_parabola.md
+++ b/docs/gnulinux/configuring_parabola.md
@@ -1,4 +1,6 @@
-% Configuring Parabola (post-install)
+
+Configuring Parabola (post-install)
+===================================
Post-installation configuration steps for Parabola GNU+Linux-libre.
Parabola is extremely flexible; this is just an example. This example
@@ -7,6 +9,8 @@ uses LXDE because it's lightweight, but we recommend the *MATE* desktop
[Back to previous index](./)
+
+
Table of Contents
=================
@@ -38,6 +42,8 @@ Table of Contents
- [LXDE - battery monitor](#lxde_battery)
- [LXDE - network manager](#lxde_network)
+
+
While not strictly related to the libreboot project, this guide is
intended to be useful for those interested in installing Parabola on
their libreboot system.
@@ -53,6 +59,8 @@ will be made to maintain it.
to be made at the present date, please get in touch with the libreboot
project!**
+
+
You do not necessarily have to follow this guide word-for-word;
*parabola* is extremely flexible. The aim here is to provide a common
setup that most users will be happy with. While Parabola can seem
@@ -65,6 +73,8 @@ Paradoxically, as you get more advanced Parabola can actually become
compared to what most distributions provide. You will find over time
that other distributions tend to *get in your way*.
+
+
**This guide assumes that you already have Parabola installed. If you
have not yet installed Parabola, then [this
guide](encrypted_parabola.html) is highly recommended!**
@@ -83,18 +93,19 @@ system Linux, using the term open-source (or closed-source), and it will
sometimes recommend the use of proprietary software. You need to be
careful about this when reading anything on the Arch wiki.
-Some of these steps require internet access. I'll go into networking
-later but for now, I just connected my system to a switch and did:
- # systemctl start dhcpcd.service
-You can stop it later by running:
- # systemctl stop dhcpcd.service
+Some of these steps require internet access. I'll go into networking
+later but for now, I just connected my system to a switch and did:\
+\# **systemctl start dhcpcd.service**\
+You can stop it later by running:\
+\# **systemctl stop dhcpcd.service**\
For most people this should be enough, but if you don't have DHCP on
-your network then you should setup your network connection first:
-
+your network then you should setup your network connection first:\
[Setup network connection in Parabola](#network)
+
+
Configure pacman {#pacman_configure}
----------------
@@ -111,20 +122,19 @@ sure to read and understand this, it's very important) and
[Back to top of page.](#pagetop)
+
+
Updating Parabola {#pacman_update}
-----------------
In the end, I didn't change my configuration for pacman. When you are
-updating, resync with the latest package names/versions:
-
- # pacman -Syy
+updating, resync with the latest package names/versions:\
+\# **pacman -Syy**\
(according to the wiki, -Syy is better than Sy because it refreshes the
package list even if it appears to be up to date, which can be useful
-when switching to another mirror).
-
-Then, update the system:
-
-# **pacman -Syu**
+when switching to another mirror).\
+Then, update the system:\
+\# **pacman -Syu**
**Before installing packages with 'pacman -S', always update first,
using the notes above.**
@@ -146,7 +156,7 @@ work.
The Arch forum can also be useful, if others have the same issue as you
(if you encounter issues, that is). The *Parabola* IRC channel
-(#parabola on freenode) can also help you.
+(\#parabola on freenode) can also help you.
Due to this and the volatile nature of Parabola/Arch, you should only
update when you have at least a couple hours of spare time in case of
@@ -164,6 +174,8 @@ event that they do occur.
[Back to top of page.](#pagetop)
+
+
Maintaining Parabola {#pacman_maintain}
--------------------
@@ -179,17 +191,15 @@ re-install it or install the distro on another computer, for example).
### Cleaning the package cache {#pacman_cacheclean}
**The following is very important as you continue to use, update and
-maintain your Parabola system:
-
+maintain your Parabola system:\
<https://wiki.archlinux.org/index.php/Pacman#Cleaning_the_package_cache>.
Essentially, this guide talks about a directory that has to be cleaned
once in a while, to prevent it from growing too big (it's a cache of
old package information, updated automatically when you do anything in
pacman).**
-To clean out all old packages that are cached:
-
-# **pacman -Sc**
+To clean out all old packages that are cached:\
+\# **pacman -Sc**
The wiki cautions that this should be used with care. For example, since
older packages are deleted from the repo, if you encounter issues and
@@ -197,9 +207,8 @@ want to revert back to an older package then it's useful to have the
caches available. Only do this if you are sure that you won't need it.
The wiki also mentions this method for removing everything from the
-cache, including currently installed packages that are cached:
-
- # pacman -Scc
+cache, including currently installed packages that are cached:\
+\# **pacman -Scc**\
This is inadvisable, since it means re-downloading the package again if
you wanted to quickly re-install it. This should only be used when disk
space is at a premium.
@@ -209,12 +218,13 @@ space is at a premium.
### pacman command equivalents {#pacman_commandequiv}
The following table lists other distro package manager commands, and
-their equivalent in pacman:
-
+their equivalent in pacman:\
<https://wiki.archlinux.org/index.php/Pacman_Rosetta>
[Back to top of page.](#pagetop)
+
+
your-freedom {#yourfreedom}
------------
@@ -229,6 +239,8 @@ continue installing *your-freedom*.
[Back to top of page.](#pagetop)
+
+
Add a user {#useradd}
----------
@@ -241,16 +253,18 @@ access to the entire operating system.
Read the entire document linked to above, and then continue.
-Add your user:
-
- # useradd -m -G wheel -s /bin/bash *yourusername*
-Set a password:
-
-# **passwd *yourusername***
+Add your user:\
+\# **useradd -m -G wheel -s /bin/bash *yourusername***\
+Set a password:\
+\# **passwd *yourusername***
Use of the *diceware method* is recommended, for generating secure
passphrases (instead of passwords).
+[Back to top of page](#pagetop)
+
+
+
systemd
-------
@@ -268,9 +282,8 @@ sshd (openssh), dhcp, etc. There are countless others.
the background behind the decision by Arch (Parabola's upstream
supplier) to use systemd.
-The manpage should also help:
-
- # man systemd
+The manpage should also help:\
+\# **man systemd**\
The section on 'unit types' is especially useful.
According to the wiki, systemd 'journal' keeps logs of a size up to
@@ -280,36 +293,30 @@ implications later when the log gets too big. Based on instructions from
the wiki, I will reduce the total size of the journal to 50MiB (the wiki
recommends 50MiB).
-Open /etc/systemd/journald.conf and find the line that says:
-
-*#SystemMaxUse=*
-
-Change it to say:
-
+Open /etc/systemd/journald.conf and find the line that says:\
+*\#SystemMaxUse=*\
+Change it to say:\
*SystemMaxUse=50M*
The wiki also recommended a method for forwarding journal output to TTY
12 (accessible by pressing ctrl+alt+f12, and you use ctrl+alt+\[F1-F12\]
to switch between terminals). I decided not to enable it.
-Restart journald:
-
-# **systemctl restart systemd-journald**
+Restart journald:\
+\# **systemctl restart systemd-journald**
The wiki recommends that if the journal gets too large, you can also
-simply delete (rm -Rf) everything inside /var/log/journald/* but
+simply delete (rm -Rf) everything inside /var/log/journald/\* but
recommends backing it up. This shouldn't be necessary, since you
already set the size limit above and systemd will automatically start to
delete older records when the journal size reaches it's limit
(according to systemd developers).
Finally, the wiki mentions 'temporary' files and the utility for
-managing them.
-
- # man systemd-tmpfiles
-The command for 'clean' is:
-
- # systemd-tmpfiles \--clean
+managing them.\
+\# **man systemd-tmpfiles**\
+The command for 'clean' is:\
+\# **systemd-tmpfiles \--clean**\
According to the manpage, this *"cleans all files and directories with
an age parameter"*. According to the Arch wiki, this reads information
in /etc/tmpfiles.d/ and /usr/lib/tmpfiles.d/ to know what actions to
@@ -318,14 +325,17 @@ locations to get a better understanding.
I looked in /etc/tmpfiles.d/ and found that it was empty on my system.
However, /usr/lib/tmpfiles.d/ contained some files. The first one was
-etc.conf, containing information and a reference to this manpage:
-
- # man tmpfiles.d
+etc.conf, containing information and a reference to this manpage:\
+\# **man tmpfiles.d**\
Read that manpage, and then continue studying all the files.
The systemd developers tell me that it isn't usually necessary to touch
the systemd-tmpfiles utility manually at all.
+[Back to top of page](#pagetop)
+
+
+
Interesting repositories {#interesting_repos}
------------------------
@@ -336,25 +346,23 @@ default base. It might be worth looking into what is available there,
depending on your use case.
I enabled it on my system, to see what was in it. Edit /etc/pacman.conf
-and below the 'extra' section add:
-
-*\[kernels\]
-
+and below the 'extra' section add:\
+*\[kernels\]\
Include = /etc/pacman.d/mirrorlist*
-Now sync with the repository:
+Now sync with the repository:\
+\# **pacman -Syy**
-# **pacman -Syy**
-
-List all available packages in this repository:
-
-# **pacman -Sl kernels**
+List all available packages in this repository:\
+\# **pacman -Sl kernels**
In the end, I decided not to install anything from it but I kept the
repository enabled regardless.
[Back to top of page.](#pagetop)
+
+
Setup a network connection in Parabola {#network}
--------------------------------------
@@ -366,20 +374,16 @@ Read <https://wiki.archlinux.org/index.php/Configuring_Network>.
This should be the same as the hostname that you set in /etc/hostname
when installing Parabola. You can also do it with systemd (do so now, if
-you like):
-
- # hostnamectl set-hostname *yourhostname*
+you like):\
+\# **hostnamectl set-hostname *yourhostname***\
This writes the specified hostname to /etc/hostname. More information
-can be found in these manpages:
-
- # man hostname
- # info hostname
-# **man hostnamectl**
-
-Add the same hostname to /etc/hosts, on each line. Example:
-
-*127.0.0.1 localhost.localdomain localhost myhostname
+can be found in these manpages:\
+\# **man hostname**\
+\# **info hostname**\
+\# **man hostnamectl**
+Add the same hostname to /etc/hosts, on each line. Example:\
+*127.0.0.1 localhost.localdomain localhost myhostname\
::1 localhost.localdomain localhost myhostname*
You'll note that I set both lines; the 2nd line is for IPv6. More and
@@ -397,21 +401,17 @@ According to the Arch wiki,
[udev](https://wiki.archlinux.org/index.php/Udev) should already detect
the ethernet chipset and load the driver for it automatically at boot
time. You can check this in the *"Ethernet controller"* section when
-running this command:
-
-# **lspci -v**
+running this command:\
+\# **lspci -v**
Look at the remaining sections *'Kernel driver in use'* and *'Kernel
-modules'*. In my case it was as follows:
-
-*Kernel driver in use: e1000e
-
+modules'*. In my case it was as follows:\
+*Kernel driver in use: e1000e\
Kernel modules: e1000e*
Check that the driver was loaded by issuing *dmesg | grep module\_name*.
-In my case, I did:
-
-# **dmesg | grep e1000e**
+In my case, I did:\
+\# **dmesg | grep e1000e**
### Network device names {#network_devicenames}
@@ -432,12 +432,10 @@ instructions in [grub\_cbfs.html](grub_cbfs.html)).
For background information, read [Predictable Network Interface
Names](http://www.freedesktop.org/wiki/Software/systemd/PredictableNetworkInterfaceNames/)
-Show device names:
-
-# **ls /sys/class/net**
-
-Changing the device names is possible (I chose not to do it):
+Show device names:\
+\# **ls /sys/class/net**
+Changing the device names is possible (I chose not to do it):\
<https://wiki.archlinux.org/index.php/Configuring_Network#Change_device_name>
[Back to top of page.](#pagetop)
@@ -446,8 +444,7 @@ Changing the device names is possible (I chose not to do it):
I actually chose to ignore most of Networking section on the wiki.
Instead, I plan to set up LXDE desktop with the graphical
-network-manager client. Here is a list of network managers:
-
+network-manager client. Here is a list of network managers:\
<https://wiki.archlinux.org/index.php/List_of_applications/Internet#Network_managers>.
If you need to, set a static IP address (temporarily) using the
networking guide and the Arch wiki, or start the dhcpcd service in
@@ -455,6 +452,8 @@ systemd. NetworkManager will be setup later, after installing LXDE.
[Back to top of page.](#pagetop)
+
+
System Maintenance {#system_maintain}
------------------
@@ -465,14 +464,15 @@ is important, so make sure to read them!**
Install smartmontools (it can be used to check smart data. HDDs use
non-free firmware inside, but it's transparent to you but the smart
-data comes from it. Therefore, don't rely on it too much):
-
- # pacman -S smartmontools
+data comes from it. Therefore, don't rely on it too much):\
+\# **pacman -S smartmontools**\
Read <https://wiki.archlinux.org/index.php/S.M.A.R.T.> to learn how to
use it.
[Back to top of page.](#pagetop)
+
+
Configuring the desktop {#desktop}
-----------------------
@@ -484,57 +484,49 @@ provide LXDE by default.
[Back to top of page.](#pagetop)
+
### Installing Xorg {#desktop_xorg}
Based on <https://wiki.archlinux.org/index.php/Xorg>.
-Firstly, install it!
-
- # pacman -S xorg-server
+Firstly, install it!\
+\# **pacman -S xorg-server**\
I also recommend installing this (contains lots of useful tools,
-including *xrandr*):
-
-# **pacman -S xorg-server-utils**
+including *xrandr*):\
+\# **pacman -S xorg-server-utils**
Install the driver. For me this was *xf86-video-intel* on the ThinkPad
-X60. T60 and macbook11/21 should be the same.
-
- # pacman -S xf86-video-intel
-For other systems you can try:
-
- # pacman -Ss xf86-video- | less
+X60. T60 and macbook11/21 should be the same.\
+\# **pacman -S xf86-video-intel**\
+For other systems you can try:\
+\# **pacman -Ss xf86-video- | less**\
Combined with looking at your *lspci* output, you can determine which
driver is needed. By default, Xorg will revert to xf86-video-vesa which
is a generic driver and doesn't provide true hardware acceleration.
Other drivers (not just video) can be found by looking at the
-*xorg-drivers* group:
-
- # pacman -Sg xorg-drivers
+*xorg-drivers* group:\
+\# **pacman -Sg xorg-drivers**\
Mostly you will rely on a display manager, but in case you ever want to
-start X without one:
-
-# **pacman -S xorg-xinit**
-
-<optional>
-
-   Arch wiki recommends installing these, for testing that X works:
-
-    # pacman -S xorg-twm xorg-xclock xterm
-   Refer to <https://wiki.archlinux.org/index.php/Xinitrc>. and test X:
-
-    # startx
+start X without one:\
+\# **pacman -S xorg-xinit**
+
+<optional>\
+   Arch wiki recommends installing these, for testing that X works:\
+   \# **pacman -S xorg-twm xorg-xclock xterm**\
+   Refer to <https://wiki.archlinux.org/index.php/Xinitrc>. and test X:\
+   \# **startx**\
   When you are satisfied, type ***exit*** in xterm, inside the X
-session.
-
-   Uninstall them (clutter. eww): # **pacman -S xorg-xinit xorg-twm
-xorg-xclock xterm**
-
+session.\
+   Uninstall them (clutter. eww): \# **pacman -S xorg-xinit xorg-twm
+xorg-xclock xterm**\
</optional>
[Back to top of page.](#pagetop)
+
+
### Xorg keyboard layout {#desktop_kblayout}
Refer to
@@ -545,9 +537,8 @@ will notice that the layout you set in /etc/vconsole.conf earlier might
not actually be the same in X.
To see what layout you currently use, try this on a terminal emulator in
-X:
-
-# **setxkbmap -print -verbose 10**
+X:\
+\# **setxkbmap -print -verbose 10**
In my case, I wanted to use the Dvorak (UK) keyboard which is quite
different from Xorg's default Qwerty (US) layout.
@@ -560,30 +551,20 @@ X60, with a 105-key UK keyboard). If you use an American keyboard
*dvorak*.
The Arch wiki recommends two different methods for setting the keyboard
-layout:
-
+layout:\
<https://wiki.archlinux.org/index.php/Keyboard_configuration_in_Xorg#Using_X_configuration_files>
-and
-
+and\
<https://wiki.archlinux.org/index.php/Keyboard_configuration_in_Xorg#Using_localectl>.
-In my case, I chose to use the *configuration file* method:
-
+In my case, I chose to use the *configuration file* method:\
Create the file /etc/X11/xorg.conf.d/10-keyboard.conf and put this
-inside:
-
-*Section "InputClass"
-
-        Identifier "system-keyboard"
-
-        MatchIsKeyboard "on"
-
-        Option "XkbLayout" "gb"
-
-        Option "XkbModel" "pc105"
-
-        Option "XkbVariant" "dvorak"
-
+inside:\
+*Section "InputClass"\
+        Identifier "system-keyboard"\
+        MatchIsKeyboard "on"\
+        Option "XkbLayout" "gb"\
+        Option "XkbModel" "pc105"\
+        Option "XkbVariant" "dvorak"\
EndSection*
For you, the steps above may differ if you have a different layout. If
@@ -592,6 +573,8 @@ you use a US Qwerty keyboard, then you don't even need to do anything
[Back to top of page.](#pagetop)
+
+
### Install LXDE {#desktop_lxde}
Desktop choice isn't that important to me, so for simplicity I decided
@@ -601,65 +584,52 @@ would like to try something different, refer to
Refer to <https://wiki.archlinux.org/index.php/LXDE>.
-Install it, choosing 'all' when asked for the default package list:
-
-# **pacman -S lxde obconf**
-
-I didn't want the following, so I removed them:
-
-# **pacman -R lxmusic lxtask**
+Install it, choosing 'all' when asked for the default package list:\
+\# **pacman -S lxde obconf**
-I also lazily installed all fonts:
+I didn't want the following, so I removed them:\
+\# **pacman -R lxmusic lxtask**
-# **pacman -S \$(pacman -Ssq ttf-)**
+I also lazily installed all fonts:\
+\# **pacman -S \$(pacman -Ssq ttf-)**
-And a mail client:
-
-# **pacman -S icedove**
+And a mail client:\
+\# **pacman -S icedove**
In IceCat, go to *Preferences :: Advanced* and disable *GNU IceCat
Health Report*.
-I also like to install these:
-
-# **pacman -S xsensors stress htop**
-
-Enable LXDM (the default display manager, providing a graphical login):
-
- # systemctl enable lxdm.service
-It will start when you boot up the system. To start it now, do:
+I also like to install these:\
+\# **pacman -S xsensors stress htop**
-# **systemctl start lxdm.service**
+Enable LXDM (the default display manager, providing a graphical login):\
+\# **systemctl enable lxdm.service**\
+It will start when you boot up the system. To start it now, do:\
+\# **systemctl start lxdm.service**
Log in with your standard (non-root) user that you created earlier. It
is advisable to also create an xinitrc rule in case you ever want to
start lxde without lxdm. Read
<https://wiki.archlinux.org/index.php/Xinitrc>.
-Open LXterminal:
-
- $ cp /etc/skel/.xinitrc \~
+Open LXterminal:\
+\$ **cp /etc/skel/.xinitrc \~**\
Open .xinitrc and add the following plus a line break at the bottom of
-the file.
-
-*# Probably not needed. The same locale info that we set before
-
-# Based on advice from the LXDE wiki export LC\_ALL=en\_GB.UTF-8
-
-export LANGUAGE=en\_GB.UTF-8
-
-export LANG=en\_GB.UTF-8
-
-# Start lxde desktop
-
-exec startlxde
-
-* Now make sure that it is executable:
-
+the file.\
+*\# Probably not needed. The same locale info that we set before\
+\# Based on advice from the LXDE wiki export LC\_ALL=en\_GB.UTF-8\
+export LANGUAGE=en\_GB.UTF-8\
+export LANG=en\_GB.UTF-8\
+\
+\# Start lxde desktop\
+exec startlxde\
+* Now make sure that it is executable:\
\$ **chmod +x .xinitrc**
[Back to top of page.](#pagetop)
+
+
### LXDE - clock {#lxde_clock}
In **Digital Clock Settings** (right click the clock) I set the Clock
@@ -667,17 +637,20 @@ Format to *%Y/%m/%d %H:%M:%S*
[Back to top of page.](#pagetop)
+
+
### LXDE - font {#lxde_font}
NOTE TO SELF: come back to this later.
[Back to top of page.](#pagetop)
-### LXDE - screenlock {#lxde_screenlock}
-Arch wiki recommends to use *xscreensaver*:
-# **pacman -S xscreensaver**
+### LXDE - screenlock {#lxde_screenlock}
+
+Arch wiki recommends to use *xscreensaver*:\
+\# **pacman -S xscreensaver**
Under *Preferences :: Screensaver* in the LXDE menu, I chose *Mode:
Blank Screen Only*, setting *Blank After*, *Cycle After* and *Lock
@@ -688,6 +661,8 @@ menu.
[Back to top of page.](#pagetop)
+
+
### LXDE - automounting {#lxde_automount}
Refer to
@@ -697,6 +672,8 @@ I chose to ignore this for now. NOTE TO SELF: come back to this later.
[Back to top of page.](#pagetop)
+
+
### LXDE - disable suspend {#lxde_suspend}
When closing the laptop lid, the system suspends. This is annoying at
@@ -704,6 +681,8 @@ least to me. NOTE TO SELF: disable it, then document the steps here.
[Back to top of page.](#pagetop)
+
+
### LXDE - battery monitor {#lxde_battery}
Right click lxde panel and *Add/Remove Panel Items*. Click *Add* and
@@ -714,44 +693,38 @@ cursor over it, it'll show information about the battery.
[Back to top of page.](#pagetop)
+
+
### LXDE - Network Manager {#lxde_network}
Refer to <https://wiki.archlinux.org/index.php/LXDE#Network_Management>.
Then I read: <https://wiki.archlinux.org/index.php/NetworkManager>.
-Install Network Manager:
-
-# **pacman -S networkmanager**
-
-You will also want the graphical applet:
+Install Network Manager:\
+\# **pacman -S networkmanager**
- # pacman -S network-manager-applet
+You will also want the graphical applet:\
+\# **pacman -S network-manager-applet**\
Arch wiki says that an autostart rule will be written at
*/etc/xdg/autostart/nm-applet.desktop*
I want to be able to use a VPN at some point, so the wiki tells me to
-do:
-
-# **pacman -S networkmanager-openvpn**
-
-LXDE uses openbox, so I refer to:
+do:\
+\# **pacman -S networkmanager-openvpn**
+LXDE uses openbox, so I refer to:\
<https://wiki.archlinux.org/index.php/NetworkManager#Openbox>.
-It tells me for the applet I need:
-
- # pacman -S xfce4-notifyd gnome-icon-theme
-Also, for storing authentication details (wifi) I need:
-
-# **pacman -S gnome-keyring**
+It tells me for the applet I need:\
+\# **pacman -S xfce4-notifyd gnome-icon-theme**\
+Also, for storing authentication details (wifi) I need:\
+\# **pacman -S gnome-keyring**
-I wanted to quickly enable networkmanager:
-
- # systemctl stop dhcpcd
- # systemctl start NetworkManager
-Enable NetworkManager at boot time:
-
-# **systemctl enable NetworkManager**
+I wanted to quickly enable networkmanager:\
+\# **systemctl stop dhcpcd**\
+\# **systemctl start NetworkManager**\
+Enable NetworkManager at boot time:\
+\# **systemctl enable NetworkManager**
Restart LXDE (log out, and then log back in).
@@ -761,8 +734,10 @@ theme, in *lxappearance*.
[Back to top of page.](#pagetop)
-Copyright © 2014, 2015 Leah Rowe <info@minifree.org>
+
+
+Copyright © 2014, 2015 Leah Rowe <info@minifree.org>\
Permission is granted to copy, distribute and/or modify this document
under the terms of the Creative Commons Attribution-ShareAlike 4.0
International license or any later version published by Creative
diff --git a/docs/gnulinux/encrypted_debian.md b/docs/gnulinux/encrypted_debian.md
index b74af313..499f4fbd 100644
--- a/docs/gnulinux/encrypted_debian.md
+++ b/docs/gnulinux/encrypted_debian.md
@@ -1,4 +1,6 @@
-% Installing Debian or Devuan GNU+Linux with full disk encryption (including /boot)
+
+Installing Debian or Devuan GNU+Linux with full disk encryption (including /boot)
+=================================================================================
This guide is written for the Debian distribution, but it should also
work for Devuan with the net installer.
@@ -20,30 +22,21 @@ tampering by someone with physical access to the system.
This guide is written for Debian net installer. You can download the ISO
from the homepage on [debian.org](https://www.debian.org/). Use this on
-the GRUB terminal to boot it from USB (for 64-bit Intel or AMD):
-
-**set root='usb0'
-
-linux /install.amd/vmlinuz
-
-initrd /install.amd/initrd.gz
-
-boot
-
-** If you are on a 32-bit system (e.g. X60):
-
-**set root='usb0'
-
-linux /install.386/vmlinuz
-
-initrd /install.386/initrd.gz
-
+the GRUB terminal to boot it from USB (for 64-bit Intel or AMD):\
+**set root='usb0'\
+linux /install.amd/vmlinuz\
+initrd /install.amd/initrd.gz\
+boot\
+** If you are on a 32-bit system (e.g. X60):\
+**set root='usb0'\
+linux /install.386/vmlinuz\
+initrd /install.386/initrd.gz\
boot**
[This guide](grub_boot_installer.html) shows how to create a boot USB
drive with the Debian ISO image.
-**This guide is *only* for the GRUB payload. If you use the
+**This guide is \*only\* for the GRUB payload. If you use the
depthcharge payload, ignore this section entirely.**
Note: on some thinkpads, a faulty DVD drive can cause the cryptomount -a
@@ -52,6 +45,8 @@ drive.
[Back to previous index](./)
+
+
Set a strong user password (lots of lowercase/uppercase, numbers and
symbols).
@@ -68,6 +63,8 @@ therefore optional, and not recommended. Choose 'no'.**
you will set later on. Your LUKS password should, like the user
password, be secure.**
+
+
Partitioning
============
@@ -107,6 +104,8 @@ Choose 'Manual' partitioning:
- name: **swap** (user this exact name)
- size: press enter
+
+
Further partitioning
====================
@@ -122,12 +121,16 @@ mountpoints and filesystems to use.
- done setting up partition
- Now you select 'Finished partitioning and write changes to disk'.
+
+
Kernel
======
Installation will ask what kernel you want to use. linux-generic is
fine.
+
+
Tasksel
=======
@@ -148,12 +151,16 @@ instead, which contains the most up to date versions of the Linux
kernel. These kernels are also deblobbed, like Debian's kernels, so you
can be sure that no binary blobs are present.
+
+
Postfix configuration
=====================
If asked, choose *"No Configuration"* here (or maybe you want to
select something else. It's up to you.)
+
+
Install the GRUB boot loader to the master boot record
======================================================
@@ -164,35 +171,38 @@ Choice is irrelevant here.
*You do not need to install GRUB at all, since in libreboot you are
using the GRUB payload (for libreboot) to boot your system directly.*
+
+
Clock UTC
=========
Just say 'Yes'.
+
+
Booting your system
===================
At this point, you will have finished the installation. At your GRUB
payload, press C to get to the command line.
-Do that:
-
-grub> cryptomount -a
-grub> set root='lvm/matrix-rootvol'
+Do that:\
+grub> **cryptomount -a**\
+grub> **set root='lvm/matrix-rootvol'**\
grub> **linux /vmlinuz root=/dev/mapper/matrix-rootvol
-cryptdevice=/dev/mapper/matrix-rootvol:root**
-
-grub> initrd /initrd.img
+cryptdevice=/dev/mapper/matrix-rootvol:root**\
+grub> **initrd /initrd.img**\
grub> **boot**
+
+
ecryptfs
========
If you didn't encrypt your home directory, then you can safely ignore
this section.
-Immediately after logging in, do that:
-
+Immediately after logging in, do that:\
\$ **sudo ecryptfs-unwrap-passphrase**
This will be needed in the future if you ever need to recover your home
@@ -200,6 +210,8 @@ directory from another system, so write it down and keep the note
somewhere secret. Ideally, you should memorize it and then burn the note
(or not even write it down, and memorize it still)>
+
+
Modify grub.cfg (CBFS)
======================
@@ -210,11 +222,10 @@ Modify your grub.cfg (in the firmware) [using this
tutorial](grub_cbfs.html); just change the default menu entry 'Load
Operating System' to say this inside:
- cryptomount -a
- set root='lvm/matrix-rootvol'
+**cryptomount -a**\
+**set root='lvm/matrix-rootvol'**\
**linux /vmlinuz root=/dev/mapper/matrix-rootvol
-cryptdevice=/dev/mapper/matrix-rootvol:root**
-
+cryptdevice=/dev/mapper/matrix-rootvol:root**\
**initrd /initrd.img**
Without specifying a device, the *-a* parameter tries to unlock all
@@ -225,6 +236,8 @@ hardening your GRUB configuration, for security purposes.
Flash the modified ROM using [this tutorial](../install/#flashrom).
+
+
Troubleshooting
===============
@@ -236,6 +249,7 @@ station.
Further investigation revealed that it was the DVD drive causing
problems. Removing that worked around the issue.
+
"sudo wodim -prcap" shows information about the drive:
Device was not specified. Trying to find an appropriate drive...
Detected CD-R drive: /dev/sr0
@@ -312,8 +326,9 @@ problems. Removing that worked around the issue.
Does write ultra high speed CD-RW media
Does not write ultra high speed+ CD-RW media
-Copyright © 2014, 2015, 2016 Leah Rowe <info@minifree.org>
+
+Copyright © 2014, 2015, 2016 Leah Rowe <info@minifree.org>\
Permission is granted to copy, distribute and/or modify this document
under the terms of the Creative Commons Attribution-ShareAlike 4.0
International license or any later version published by Creative
diff --git a/docs/gnulinux/encrypted_parabola.md b/docs/gnulinux/encrypted_parabola.md
index 20b7e02e..99be254a 100644
--- a/docs/gnulinux/encrypted_parabola.md
+++ b/docs/gnulinux/encrypted_parabola.md
@@ -1,4 +1,6 @@
-% Installing Parabola or Arch GNU+Linux with full disk encryption (including /boot)
+
+Installing Parabola or Arch GNU+Linux with full disk encryption (including /boot)
+=================================================================================
Libreboot on x86 uses the GRUB
[payload](http://www.coreboot.org/Payloads#GRUB_2) by default, which
@@ -15,7 +17,7 @@ volume. Not so with libreboot! Since GRUB is already included directly
as a payload, even /boot can be encrypted. This protects /boot from
tampering by someone with physical access to the system.
-**This guide is *only* for the GRUB payload. If you use the
+**This guide is \*only\* for the GRUB payload. If you use the
depthcharge payload, ignore this section entirely.**
This guide is intended for the Parabola distribution, but it should also
@@ -32,6 +34,8 @@ drive.
[Back to previous index](./)
+
+
Boot Parabola's install environment. [How to boot a GNU+Linux
installer](grub_boot_installer.html).
@@ -47,6 +51,8 @@ to the Parabola wiki at a later date. For up to date Parabola install
guide, go to the Parabola wiki. This guide essentially cherry picks the
useful information (valid at the time of writing: 2015-08-25).
+
+
This section deals with wiping the storage device on which you plan to
install Parabola GNU+Linux. Follow these steps, but if you use an SSD,
also:
@@ -64,15 +70,13 @@ article](https://wiki.archlinux.org/index.php/Solid_State_Drives). Edit
/etc/fstab later on when chrooted into your install. Also, read the
whole article and keep all points in mind, adapting them for this guide.
-Securely wipe the drive:
-
- # dd if=/dev/urandom of=/dev/sda; sync
+Securely wipe the drive:\
+\# **dd if=/dev/urandom of=/dev/sda; sync**\
NOTE: If you have an SSD, only do this the first time. If it was already
LUKS-encrypted before, use the info below to wipe the LUKS header. Also,
check online for your SSD what the recommended erase block size is. For
-example if it was 2MiB:
-
-# **dd if=/dev/urandom of=/dev/sda bs=2M; sync**
+example if it was 2MiB:\
+\# **dd if=/dev/urandom of=/dev/sda bs=2M; sync**
If your drive was already LUKS encrypted (maybe you are re-installing
your distro) then it is already 'wiped'. You should just wipe the LUKS
@@ -80,22 +84,24 @@ header.
<https://www.lisenet.com/2013/luks-add-keys-backup-and-restore-volume-header/>
showed me how to do this. It recommends doing the first 3MiB. Now, that
guide is recommending putting zero there. I'm going to use urandom. Do
-this:
-
- # head -c 3145728 /dev/urandom > /dev/sda; sync
+this:\
+\# **head -c 3145728 /dev/urandom > /dev/sda; sync**\
(Wiping the LUKS header is important, since it has hashed passphrases
and so on. It's 'secure', but 'potentially' a risk).
+
+
Change keyboard layout
----------------------
Parabola live shell assumes US Qwerty. If you have something different,
-list the available keymaps and use yours:
-
- # localectl list-keymaps
- # loadkeys LAYOUT
+list the available keymaps and use yours:\
+\# **localectl list-keymaps**\
+\# **loadkeys LAYOUT**\
For me, LAYOUT would have been dvorak-uk.
+
+
Establish an internet connection
--------------------------------
@@ -103,6 +109,8 @@ Refer to [this
guide](https://wiki.parabola.nu/Beginners%27_guide#Establish_an_internet_connection).
Wired is recommended, but wireless is also explained there.
+
+
Getting started
---------------
@@ -110,13 +118,14 @@ The beginning is based on
<https://wiki.parabolagnulinux.org/Installation_Guide>. Then I referred
to <https://wiki.archlinux.org/index.php/Partitioning> at first.
+
+
dm-mod
------
device-mapper will be used - a lot. Make sure that the kernel module is
-loaded:
-
-# **modprobe dm-mod**
+loaded:\
+\# **modprobe dm-mod**
Create LUKS partition
---------------------
@@ -129,35 +138,29 @@ prepared cryptsetup command below. Note that the iteration time is for
security purposes (mitigates brute force attacks), so anything lower
than 5 seconds is probably not ok.
-I am using MBR partitioning, so I use cfdisk:
-
-# **cfdisk /dev/sda**
+I am using MBR partitioning, so I use cfdisk:\
+\# **cfdisk /dev/sda**
I create a single large sda1 filling the whole drive, leaving it as the
default type 'Linux' (83).
Now I refer to
-<https://wiki.archlinux.org/index.php/Dm-crypt/Drive_preparation#Partitioning>:
-
+<https://wiki.archlinux.org/index.php/Dm-crypt/Drive_preparation#Partitioning>:\
I am then directed to
<https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption>.
Parabola forces you to RTFM. Do that.
-It tells me to run:
-
-# **cryptsetup benchmark** (for making sure the list below is
-populated)
-
-Then:
-
- # cat /proc/crypto
+It tells me to run:\
+\# **cryptsetup benchmark** (for making sure the list below is
+populated)\
+Then:\
+\# **cat /proc/crypto**\
This gives me crypto options that I can use. It also provides a
representation of the best way to set up LUKS (in this case, security is
a priority; speed, a distant second). To gain a better understanding, I
-am also reading:
-
-# **man cryptsetup**
+am also reading:\
+\# **man cryptsetup**
Following that page, based on my requirements, I do the following based
on
@@ -165,9 +168,8 @@ on
Reading through, it seems like Serpent (encryption) and Whirlpool (hash)
is the best option.
-I am initializing LUKS with the following:
-
-# **cryptsetup -v \--cipher serpent-xts-plain64 \--key-size 512 \--hash
+I am initializing LUKS with the following:\
+\# **cryptsetup -v \--cipher serpent-xts-plain64 \--key-size 512 \--hash
whirlpool \--iter-time 500 \--use-random \--verify-passphrase luksFormat
/dev/sda1** Choose a **secure** passphrase here. Ideally lots of
lowercase/uppercase numbers, letters, symbols etc all in a random
@@ -177,45 +179,38 @@ without writing it down or storing it anywhere.
Use of the *diceware method* is recommended, for generating secure
passphrases (instead of passwords).
+
+
Create LVM
----------
Now I refer to <https://wiki.archlinux.org/index.php/LVM>.
-Open the LUKS partition:
-
- # cryptsetup luksOpen /dev/sda1 lvm
+Open the LUKS partition:\
+\# **cryptsetup luksOpen /dev/sda1 lvm**\
(it will be available at /dev/mapper/lvm)
-Create LVM partition:
-
- # pvcreate /dev/mapper/lvm
-Show that you just created it:
-
-# **pvdisplay**
+Create LVM partition:\
+\# **pvcreate /dev/mapper/lvm**\
+Show that you just created it:\
+\# **pvdisplay**
Now I create the volume group, inside of which the logical volumes will
-be created:
-
- # vgcreate matrix /dev/mapper/lvm
+be created:\
+\# **vgcreate matrix /dev/mapper/lvm**\
(volume group name is 'matrix' - choose your own name, if you like)
-Show that you created it:
-
-# **vgdisplay**
-
-Now create the logical volumes:
-
-# **lvcreate -L 2G matrix -n swapvol** (2G swap partition, named
-swapvol)
+Show that you created it:\
+\# **vgdisplay**
+Now create the logical volumes:\
+\# **lvcreate -L 2G matrix -n swapvol** (2G swap partition, named
+swapvol)\
Again, choose your own name if you like. Also, make sure to choose a
swap size of your own needs. It basically depends on how much RAM you
have installed. I refer to
-<http://www.linux.com/news/software/applications/8208-all-about-linux-swap-space>.
-
-# **lvcreate -l +100%FREE matrix -n root** (single large partition in
-the rest of the space, named root)
-
+<http://www.linux.com/news/software/applications/8208-all-about-linux-swap-space>.\
+\# **lvcreate -l +100%FREE matrix -n root** (single large partition in
+the rest of the space, named root)\
You can also be flexible here, for example you can specify a /boot, a /,
a /home, a /var, a /usr, etc. For example, if you will be running a
web/mail server then you want /var in its own partition (so that if it
@@ -223,27 +218,26 @@ fills up with logs, it won't crash your system). For a home/laptop
system (typical use case), a root and a swap will do (really).
Verify that the logical volumes were created, using the following
-command:
+command:\
+\# **lvdisplay**
+
-# **lvdisplay**
Create / and swap partitions, and mount
---------------------------------------
-For the swapvol LV I use:
+For the swapvol LV I use:\
+\# **mkswap /dev/mapper/matrix-swapvol**\
+Activate swap:\
+\# **swapon /dev/matrix/swapvol**
- # mkswap /dev/mapper/matrix-swapvol
-Activate swap:
+For the root LV I use:\
+\# **mkfs.btrfs /dev/mapper/matrix-root**
-# **swapon /dev/matrix/swapvol**
+Mount the root (/) partition:\
+\# **mount /dev/matrix/root /mnt**
-For the root LV I use:
-# **mkfs.btrfs /dev/mapper/matrix-root**
-
-Mount the root (/) partition:
-
-# **mount /dev/matrix/root /mnt**
Continue with Parabola installation
-----------------------------------
@@ -255,150 +249,121 @@ Now I am following the rest of
<https://wiki.parabolagnulinux.org/Installation_Guide>. I also cross
referenced <https://wiki.archlinux.org/index.php/Installation_guide>.
-Create /home and /boot on root mountpoint:
-
- # mkdir -p /mnt/home
-# **mkdir -p /mnt/boot**
+Create /home and /boot on root mountpoint:\
+\# **mkdir -p /mnt/home**\
+\# **mkdir -p /mnt/boot**
Once all the remaining partitions, if any, have been mounted, the
devices are ready to install Parabola.
In **/etc/pacman.d/mirrorlist**, comment out all lines except the Server
line closest to where you are (I chose the UK Parabola server (main
-server)) and then did:
-
- # pacman -Syy
- # pacman -Syu
-# **pacman -Sy pacman** (and then I did the other 2 steps above,
-again)
-
+server)) and then did:\
+\# **pacman -Syy**\
+\# **pacman -Syu**\
+\# **pacman -Sy pacman** (and then I did the other 2 steps above,
+again)\
In my case I did the steps in the next paragraph, and followed the steps
in this paragraph again.
-<troubleshooting>
-
+<troubleshooting>\
   The following is based on 'Verification of package signatures' in
-the Parabola install guide.
-
-   Check there first to see if steps differ by now.
-
+the Parabola install guide.\
+   Check there first to see if steps differ by now.\
   Now you have to update the default Parabola keyring. This is used for
-signing and verifying packages:
-
-    # pacman -Sy parabola-keyring
+signing and verifying packages:\
+   \# **pacman -Sy parabola-keyring**\
   It says that if you get GPG errors, then it's probably an expired
-key and, therefore, you should do:
-
-    # pacman-key \--populate parabola
-    # pacman-key \--refresh-keys
-    # pacman -Sy parabola-keyring
+key and, therefore, you should do:\
+   \# **pacman-key \--populate parabola**\
+   \# **pacman-key \--refresh-keys**\
+   \# **pacman -Sy parabola-keyring**\
   To be honest, you should do the above anyway. Parabola has a lot of
-maintainers, and a lot of keys. Really!
-
-   If you get an error mentioning dirmngr, do:
-
-    # dirmngr </dev/null
+maintainers, and a lot of keys. Really!\
+   If you get an error mentioning dirmngr, do:\
+   \# **dirmngr </dev/null**\
   Also, it says that if the clock is set incorrectly then you have to
-manually set the correct time
-
-   (if keys are listed as expired because of it):
-
-    # date MMDDhhmm\[\[CC\]YY\]\[.ss\]
-   I also had to install:
-
-    # pacman -S archlinux-keyring
-    # pacman-key \--populate archlinux
+manually set the correct time\
+   (if keys are listed as expired because of it):\
+   \# **date MMDDhhmm\[\[CC\]YY\]\[.ss\]**\
+   I also had to install:\
+   \# **pacman -S archlinux-keyring**\
+   \# **pacman-key \--populate archlinux**\
   In my case I saw some conflicting files reported in pacman, stopping
-me from using it.
-
+me from using it.\
   I deleted the files that it mentioned and then it worked.
-Specifically, I had this error:
-
-   *licenses: /usr/share/licenses/common/MPS exists in filesystem*
-
+Specifically, I had this error:\
+   *licenses: /usr/share/licenses/common/MPS exists in filesystem*\
   I rm -Rf'd the file and then pacman worked. I'm told that the
-following would have also made it work:
-
-    # pacman -Sf licenses
-</troubleshooting>
+following would have also made it work:\
+   \# **pacman -Sf licenses**\
+</troubleshooting>\
I also like to install other packages (base-devel, compilers and so on)
and wpa\_supplicant/dialog/iw/wpa\_actiond are needed for wireless after
-the install:
-
-# **pacstrap /mnt base base-devel wpa\_supplicant dialog iw
+the install:\
+\# **pacstrap /mnt base base-devel wpa\_supplicant dialog iw
wpa\_actiond**
+
+
Configure the system
--------------------
Generate an fstab - UUIDs are used because they have certain advantages
(see <https://wiki.parabola.nu/Fstab#Identifying_filesystems>. If you
-prefer labels instead, replace the -U option with -L):
-
- # genfstab -U -p /mnt >> /mnt/etc/fstab
-Check the created file:
-
- # cat /mnt/etc/fstab
+prefer labels instead, replace the -U option with -L):\
+\# **genfstab -U -p /mnt >> /mnt/etc/fstab**\
+Check the created file:\
+\# **cat /mnt/etc/fstab**\
(If there are any errors, edit the file. Do **NOT** run the genfstab
command again!)
-Chroot into new system:
+Chroot into new system:\
+\# **arch-chroot /mnt /bin/bash**
-# **arch-chroot /mnt /bin/bash**
-
-It's a good idea to have this installed:
-
-# **pacman -S linux-libre-lts**
+It's a good idea to have this installed:\
+\# **pacman -S linux-libre-lts**
It was also suggested that you should install this kernel (read up on
-what GRSEC is):
-
-# **pacman -S linux-libre-grsec**
+what GRSEC is):\
+\# **pacman -S linux-libre-grsec**
This is another kernel that sits inside /boot, which you can use. LTS
means 'long-term support'. These are so-called 'stable' kernels that
can be used as a fallback during updates, if a bad kernel causes issues
for you.
-Parabola does not have wget. This is sinister. Install it:
-
-# **pacman -S wget**
+Parabola does not have wget. This is sinister. Install it:\
+\# **pacman -S wget**
-Locale:
-
- # vi /etc/locale.gen
+Locale:\
+\# **vi /etc/locale.gen**\
Uncomment your needed localisations. For example en\_GB.UTF-8 (UTF-8 is
-highly recommended over other options).
-
- # locale-gen
- # echo LANG=en\_GB.UTF-8 > /etc/locale.conf
-# **export LANG=en\_GB.UTF-8**
+highly recommended over other options).\
+\# **locale-gen**\
+\# **echo LANG=en\_GB.UTF-8 > /etc/locale.conf**\
+\# **export LANG=en\_GB.UTF-8**
-Console font and keymap:
-
- # vi /etc/vconsole.conf
+Console font and keymap:\
+\# **vi /etc/vconsole.conf**\
In my case:
KEYMAP=dvorak-uk
FONT=lat9w-16
-Time zone:
-
- # ln -s /usr/share/zoneinfo/Europe/London /etc/localtime
+Time zone:\
+\# **ln -s /usr/share/zoneinfo/Europe/London /etc/localtime**\
(Replace Zone and Subzone to your liking. See /usr/share/zoneinfo)
-Hardware clock:
-
-# **hwclock \--systohc \--utc**
+Hardware clock:\
+\# **hwclock \--systohc \--utc**
Hostname: Write your hostname to /etc/hostname. For example, if your
-hostname is parabola:
-
- # echo parabola > /etc/hostname
-Add the same hostname to /etc/hosts:
-
- # vi /etc/hosts
+hostname is parabola:\
+\# **echo parabola > /etc/hostname**\
+Add the same hostname to /etc/hosts:\
+\# **vi /etc/hosts**\
#<ip-address> <hostname.domain.org> <hostname>
127.0.0.1 localhost.localdomain localhost parabola
@@ -410,10 +375,9 @@ Configure the network: Refer to
Mkinitcpio: Configure /etc/mkinitcpio.conf as needed (see
<https://wiki.parabola.nu/Mkinitcpio>). Runtime modules can be found in
/usr/lib/initcpio/hooks, and build hooks can be found in
-/usr/lib/initcpio/install. (# **mkinitcpio -H hookname** gives
-information about each hook.) Specifically, for this use case:
-
- # vi /etc/mkinitcpio.conf
+/usr/lib/initcpio/install. (\# **mkinitcpio -H hookname** gives
+information about each hook.) Specifically, for this use case:\
+\# **vi /etc/mkinitcpio.conf**\
Then modify the file like so:
- MODULES="i915"
@@ -437,54 +401,44 @@ Then modify the file like so:
Now using mkinitcpio, you can create the kernel and ramdisk for booting
with (this is different from Arch, specifying linux-libre instead of
-linux):
-
- # mkinitcpio -p linux-libre
-Also do it for linux-libre-lts:
-
- # mkinitcpio -p linux-libre-lts
-Also do it for linux-libre-grsec:
-
-# **mkinitcpio -p linux-libre-grsec**
+linux):\
+\# **mkinitcpio -p linux-libre**\
+Also do it for linux-libre-lts:\
+\# **mkinitcpio -p linux-libre-lts**\
+Also do it for linux-libre-grsec:\
+\# **mkinitcpio -p linux-libre-grsec**
Set the root password: At the time of writing, Parabola used SHA512 by
default for its password hashing. I referred to
-<https://wiki.archlinux.org/index.php/SHA_password_hashes>.
-
- # vi /etc/pam.d/passwd
-Add rounds=65536 at the end of the uncommented 'password' line.
-
- # passwd root
+<https://wiki.archlinux.org/index.php/SHA_password_hashes>.\
+\# **vi /etc/pam.d/passwd**\
+Add rounds=65536 at the end of the uncommented 'password' line.\
+\# **passwd root**\
Make sure to set a secure password! Also, it must never be the same as
your LUKS password.
Use of the *diceware method* is recommended, for generating secure
passphrases (instead of passwords).
+
+
Extra security tweaks
---------------------
Based on <https://wiki.archlinux.org/index.php/Security>.
-Restrict access to important directories:
-
-# **chmod 700 /boot /etc/{iptables,arptables}**
-
-Lockout user after three failed login attempts:
-
-Edit the file /etc/pam.d/system-login and comment out that line:
-
-*# auth required pam\_tally.so onerr=succeed file=/var/log/faillog*
-
-Or just delete it. Above it, put:
+Restrict access to important directories:\
+\# **chmod 700 /boot /etc/{iptables,arptables}**
+Lockout user after three failed login attempts:\
+Edit the file /etc/pam.d/system-login and comment out that line:\
+*\# auth required pam\_tally.so onerr=succeed file=/var/log/faillog*\
+Or just delete it. Above it, put:\
*auth required pam\_tally.so deny=2 unlock\_time=600 onerr=succeed
-file=/var/log/faillog*
-
+file=/var/log/faillog*\
To unlock a user manually (if a password attempt is failed 3 times),
-do:
-
-# **pam\_tally \--user *theusername* \--reset** What the above
+do:\
+\# **pam\_tally \--user *theusername* \--reset** What the above
configuration does is lock the user out for 10 minutes, if they make 3
failed login attempts.
@@ -492,29 +446,29 @@ Configure sudo - not covered here. Will be covered post-installation in
another tutorial, at a later date. If this is a single-user system, you
don't really need sudo.
-Unmount, reboot!
-----------------
-Exit from chroot:
-# **exit**
+Unmount, reboot!
+----------------
-unmount:
+Exit from chroot:\
+\# **exit**
- # umount -R /mnt
-# **swapoff -a**
+unmount:\
+\# **umount -R /mnt**\
+\# **swapoff -a**
-deactivate the lvm lv's:
+deactivate the lvm lv's:\
+\# **lvchange -an /dev/matrix/root**\
+\# **lvchange -an /dev/matrix/swapvol**\
- # lvchange -an /dev/matrix/root
- # lvchange -an /dev/matrix/swapvol
+Lock the encrypted partition (close it):\
+\# **cryptsetup luksClose lvm**
-Lock the encrypted partition (close it):
+\# **shutdown -h now**\
+Remove the installation media, then boot up again.
-# **cryptsetup luksClose lvm**
- # shutdown -h now
-Remove the installation media, then boot up again.
Booting from GRUB
-----------------
@@ -523,17 +477,18 @@ Initially you will have to boot manually. Press C to get to the GRUB
command line. The underlined parts are optional (using those 2
underlines will boot lts kernel instead of normal).
-grub> cryptomount -a
-grub> set root='lvm/matrix-root'
+grub> **cryptomount -a**\
+grub> **set root='lvm/matrix-root'**\
grub> **linux /boot/vmlinuz-linux-libre-lts root=/dev/matrix/root
-cryptdevice=/dev/sda1:root**
-
-grub> initrd /boot/initramfs-linux-libre-lts.img
-grub> boot
+cryptdevice=/dev/sda1:root**\
+grub> **initrd /boot/initramfs-linux-libre-lts.img**\
+grub> **boot**\
You could also make it load /boot/vmlinuz-linux-libre-grsec and
/boot/initramfs-linux-libre-grsec.img
+
+
Follow-up tutorial: configuring Parabola
----------------------------------------
@@ -549,6 +504,8 @@ means that you are in control. For more information, read [The Arch
Way](https://wiki.archlinux.org/index.php/The_Arch_Way) (Parabola also
follows it).
+
+
Modify grub.cfg inside the ROM
------------------------------
@@ -563,21 +520,16 @@ possibility of bricking your device!
I will go for the re-flash option here. Firstly, cd to the
libreboot\_util/cbfstool/{armv7l i686 x86\_64} directory. Dump the
current firmware - where *libreboot.rom* is an example: make sure to
-adapt:
-
- # flashrom -p internal -r libreboot.rom
+adapt:\
+\# **flashrom -p internal -r libreboot.rom**\
If flashrom complains about multiple flash chips detected, add a *-c*
-option at the end, with the name of your chosen chip is quotes.
-
+option at the end, with the name of your chosen chip is quotes.\
You can check if everything is in there (*grub.cfg* and *grubtest.cfg*
-would be really nice):
-
- $ ./cbfstool libreboot.rom print
-Extract grubtest.cfg:
-
- $ ./cbfstool libreboot.rom extract -n grubtest.cfg -f grubtest.cfg
-And modify:
-
+would be really nice):\
+\$ **./cbfstool libreboot.rom print**\
+Extract grubtest.cfg:\
+\$ **./cbfstool libreboot.rom extract -n grubtest.cfg -f grubtest.cfg**\
+And modify:\
\$ **vi grubtest.cfg**
In grubtest.cfg, inside the 'Load Operating System' menu entry, change
@@ -606,24 +558,20 @@ detected LUKS volumes. You can also specify -u UUID or -a (device).
hardening your GRUB configuration, for security purposes.
Save your changes in grubtest.cfg, then delete the unmodified config
-from the ROM image:
-
- $ ./cbfstool libreboot.rom remove -n grubtest.cfg
-and insert the modified grubtest.cfg:
-
+from the ROM image:\
+\$ **./cbfstool libreboot.rom remove -n grubtest.cfg**\
+and insert the modified grubtest.cfg:\
\$ **./cbfstool libreboot.rom add -n grubtest.cfg -f grubtest.cfg -t
-raw**
+raw**\
Now refer to <http://libreboot.org/docs/install/#flashrom>. Cd (up) to
-the libreboot\_util directory and update the flash chip contents:
-
- # ./flash update libreboot.rom
+the libreboot\_util directory and update the flash chip contents:\
+\# **./flash update libreboot.rom**\
Ocassionally, coreboot changes the name of a given board. If flashrom
complains about a board mismatch, but you are sure that you chose the
-correct ROM image, then run this alternative command:
-
- # ./flash forceupdate libreboot.rom
-You should see "Verifying flash... VERIFIED." written at the end of
+correct ROM image, then run this alternative command:\
+\# **./flash forceupdate libreboot.rom**\
+You should see "Verifying flash\... VERIFIED." written at the end of
the flashrom output.
With this new configuration, Parabola can boot automatically and you
@@ -636,7 +584,7 @@ LUKS passphrase and login as root/your user. All went well? Great!
If it does not work like you want it to, if you are unsure or sceptical
in any way, don't despair: you have been wise and did not brick your
device! Reboot and login the default way, and then modify your
-grubtest.cfg until you get it right! **Do *not* proceed past this
+grubtest.cfg until you get it right! **Do \*not\* proceed past this
point unless you are 100% sure that your new configuration is safe (or
desirable) to use.**
@@ -648,37 +596,35 @@ the main config still links (in the menu) to grubtest.cfg, so that you
don't have to manually switch to it, in case you ever want to follow
this guide again in the future (modifying the already modified config).
Inside libreboot\_util/cbfstool/{armv7l i686 x86\_64}, we can do this
-with the following command:
-
+with the following command:\
\$ **sed -e 's:(cbfsdisk)/grub.cfg:(cbfsdisk)/grubtest.cfg:g' -e
's:Switch to grub.cfg:Switch to grubtest.cfg:g' < grubtest.cfg >
-grub.cfg**
-
-Delete the grub.cfg that remained inside the ROM:
-
- $ ./cbfstool libreboot.rom remove -n grub.cfg
-Add the modified version that you just made:
-
- $ ./cbfstool libreboot.rom add -n grub.cfg -f grub.cfg -t raw
+grub.cfg**\
+Delete the grub.cfg that remained inside the ROM:\
+\$ **./cbfstool libreboot.rom remove -n grub.cfg**\
+Add the modified version that you just made:\
+\$ **./cbfstool libreboot.rom add -n grub.cfg -f grub.cfg -t raw**\
Now you have a modified ROM. Once more, refer to
<http://libreboot.org/docs/install/#flashrom>. Cd to the libreboot\_util
-directory and update the flash chip contents:
-
- # ./flash update libreboot.rom
-And wait for the "Verifying flash... VERIFIED." Once you have done
+directory and update the flash chip contents:\
+\# **./flash update libreboot.rom**\
+And wait for the "Verifying flash\... VERIFIED." Once you have done
that, shut down and then boot up with your new configuration.
When done, delete GRUB (remember, we only needed it for the
*grub-mkpasswd-pbkdf2* utility; GRUB is already part of libreboot,
-flashed alongside it as a *payload*):
+flashed alongside it as a *payload*):\
+\# **pacman -R grub**
+
-# **pacman -R grub**
If you followed all that correctly, you should now have a fully
encrypted Parabola installation. Refer to the wiki for how to do the
rest.
+
+
Bonus: Using a key file to unlock /boot/
----------------------------------------
@@ -689,40 +635,36 @@ fact that it is being loaded from an encrypted volume. Therefore, you
will be asked to enter your passphrase a second time. A workaround is to
put a keyfile inside initramfs, with instructions for the kernel to use
it when booting. This is safe, because /boot/ is encrypted (otherwise,
-putting a keyfile inside initramfs would be a bad idea).
-
-Boot up and login as root or your user. Then generate the key file:
-
-# **dd bs=512 count=4 if=/dev/urandom of=/etc/mykeyfile
-iflag=fullblock**
-
-Insert it into the luks volume:
-
- # cryptsetup luksAddKey /dev/sdX /etc/mykeyfile
+putting a keyfile inside initramfs would be a bad idea).\
+Boot up and login as root or your user. Then generate the key file:\
+\# **dd bs=512 count=4 if=/dev/urandom of=/etc/mykeyfile
+iflag=fullblock**\
+Insert it into the luks volume:\
+\# **cryptsetup luksAddKey /dev/sdX /etc/mykeyfile**\
and enter your LUKS passphrase when prompted. Add the keyfile to the
-initramfs by adding it to FILES in /etc/mkinitcpio.conf. For example:
-
- # FILES="/etc/mykeyfile"
-Create the initramfs image from scratch:
-
- # mkinitcpio -p linux-libre
- # mkinitcpio -p linux-libre-lts
- # mkinitcpio -p linux-libre-grsec
+initramfs by adding it to FILES in /etc/mkinitcpio.conf. For example:\
+\# **FILES="/etc/mykeyfile"**\
+Create the initramfs image from scratch:\
+\# **mkinitcpio -p linux-libre**\
+\# **mkinitcpio -p linux-libre-lts**\
+\# **mkinitcpio -p linux-libre-grsec**\
Add the following to your grub.cfg - you are now able to do that, see
-above! -, or add it in the kernel command line for GRUB:
-
- # cryptkey=rootfs:/etc/mykeyfile
-
+above! -, or add it in the kernel command line for GRUB:\
+\# **cryptkey=rootfs:/etc/mykeyfile**\
+\
You can also place this inside the grub.cfg that exists in CBFS:
[grub\_cbfs.html](grub_cbfs.html).
+
+
Further security tips
---------------------
-<https://wiki.archlinux.org/index.php/Security>.
-
+<https://wiki.archlinux.org/index.php/Security>.\
<https://wiki.parabolagnulinux.org/User:GNUtoo/laptop>
+
+
Troubleshooting
===============
@@ -734,6 +676,7 @@ station.
Further investigation revealed that it was the DVD drive causing
problems. Removing that worked around the issue.
+
"sudo wodim -prcap" shows information about the drive:
Device was not specified. Trying to find an appropriate drive...
Detected CD-R drive: /dev/sr0
@@ -810,10 +753,10 @@ problems. Removing that worked around the issue.
Does write ultra high speed CD-RW media
Does not write ultra high speed+ CD-RW media
-Copyright © 2014, 2015, 2016 Leah Rowe <info@minifree.org>
-Copyright © 2015 Jeroen Quint <jezza@diplomail.ch>
+Copyright © 2014, 2015, 2016 Leah Rowe <info@minifree.org>\
+Copyright © 2015 Jeroen Quint <jezza@diplomail.ch>\
Permission is granted to copy, distribute and/or modify this document
under the terms of the Creative Commons Attribution-ShareAlike 4.0
International license or any later version published by Creative
diff --git a/docs/gnulinux/grub_boot_installer.md b/docs/gnulinux/grub_boot_installer.md
index 8821f1ef..5f34a6ab 100644
--- a/docs/gnulinux/grub_boot_installer.md
+++ b/docs/gnulinux/grub_boot_installer.md
@@ -1,4 +1,6 @@
-% How to install GNU+Linux on a libreboot system
+
+How to install GNU+Linux on a libreboot system
+==============================================
This section relates to preparing, booting and installing a GNU+Linux
distribution on your libreboot system, using nothing more than a USB
@@ -14,38 +16,40 @@ flash drive (and *dd*).
[Back to previous index](./)
+
+
**This section is only for the GRUB payload. For depthcharge (used on
CrOS devices in libreboot), instructions have yet to be written in the
libreboot documentation.**
+
+
Prepare the USB drive (in GNU+Linux)
------------------------------------
If you downloaded your ISO on an existing GNU+Linux system, here is how
to create the bootable GNU+Linux USB drive:
-Connect the USB drive. Check dmesg:
-
- $ dmesg
-Check lsblk to confirm which drive it is:
-
- $ lsblk
+Connect the USB drive. Check dmesg:\
+**\$ dmesg**\
+Check lsblk to confirm which drive it is:\
+**\$ lsblk**
Check that it wasn't automatically mounted. If it was, unmount it. For
-example:
-
- $ sudo umount /dev/sdX*
- # umount /dev/sdX*
+example:\
+**\$ sudo umount /dev/sdX\***\
+**\# umount /dev/sdX\***
dmesg told you what device it is. Overwrite the drive, writing your
-distro ISO to it with dd. For example:
-
- $ sudo dd if=gnulinux.iso of=/dev/sdX bs=8M; sync
- # dd if=gnulinux.iso of=/dev/sdX bs=8M; sync
+distro ISO to it with dd. For example:\
+**\$ sudo dd if=gnulinux.iso of=/dev/sdX bs=8M; sync**\
+**\# dd if=gnulinux.iso of=/dev/sdX bs=8M; sync**
You should now be able to boot the installer from your USB drive.
Continue reading, for information about how to do that.
+[Back to top of page](#pagetop).
+
Prepare the USB drive (in NetBSD)
---------------------------------
@@ -69,26 +73,26 @@ Prepare the USB drive (in LibertyBSD or OpenBSD)
If you downloaded your ISO on a LibertyBSD or OpenBSD system, here is
how to create the bootable GNU+Linux USB drive:
-Connect the USB drive. Check dmesg:
-
- $ dmesg | tail
-Check to confirm which drive it is, for example, if you think its sd3:
-
- $ disklabel sd3
+Connect the USB drive. Check dmesg:\
+**\$ dmesg | tail**\
+Check to confirm which drive it is, for example, if you think its sd3:\
+**\$ disklabel sd3**
Check that it wasn't automatically mounted. If it was, unmount it. For
-example:
-
- $ doas umount /dev/sd3i
+example:\
+**\$ doas umount /dev/sd3i**\
dmesg told you what device it is. Overwrite the drive, writing the
-OpenBSD installer to it with dd. For example:
-
- $ doas dd if=gnulinux.iso of=/dev/rsdXc bs=1M; sync
+OpenBSD installer to it with dd. For example:\
+**\$ doas dd if=gnulinux.iso of=/dev/rsdXc bs=1M; sync**\
You should now be able to boot the installer from your USB drive.
Continue reading, for information about how to do that.
+[Back to top of page](#pagetop).
+
+
+
Installing GNU+Linux with full disk encryption
----------------------------------------------
@@ -97,33 +101,31 @@ Installing GNU+Linux with full disk encryption
- [Installing Parabola GNU+Linux with full disk encryption (including
/boot)](encrypted_parabola.html)
+[Back to top of page](#pagetop).
+
+
+
Debian or Devuan net install?
-----------------------------
Download the Debian or Devuan net installer. You can download the ISO
from the homepage on [debian.org](https://www.debian.org/), or [the
Devuan homepage](https://www.devuan.org/) for Devuan. Use this on the
-GRUB terminal to boot it from USB (for 64-bit Intel or AMD):
-
-**set root='usb0'
-
-linux /install.amd/vmlinuz
-
-initrd /install.amd/initrd.gz
-
-boot
-
-** If you are on a 32-bit system (e.g. X60):
-
-**set root='usb0'
-
-linux /install.386/vmlinuz
+GRUB terminal to boot it from USB (for 64-bit Intel or AMD):\
+**set root='usb0'\
+linux /install.amd/vmlinuz\
+initrd /install.amd/initrd.gz\
+boot\
+** If you are on a 32-bit system (e.g. X60):\
+**set root='usb0'\
+linux /install.386/vmlinuz\
+initrd /install.386/initrd.gz\
+boot**\
+We recommend using the *MATE* desktop.
-initrd /install.386/initrd.gz
+[Back to top of page](#pagetop).
-boot**
-We recommend using the *MATE* desktop.
Booting ISOLINUX images (automatic method)
------------------------------------------
@@ -133,6 +135,10 @@ menu should appear in GRUB, showing the boot options for that distro;
this is a GRUB menu, converted from the usual ISOLINUX menu provided by
that distro.
+[Back to top of page](#pagetop).
+
+
+
Booting ISOLINUX images (manual method)
---------------------------------------
@@ -141,18 +147,14 @@ distribution. You must adapt them appropriately, for whatever GNU+Linux
distribution it is that you are trying to install.*
If the ISOLINUX parser or *Search for GRUB configuration* options won't
-work, then press C in GRUB to access the command line.
-
-grub> ls
-Get the device from above output, eg (usb0). Example:
-
-grub> cat (usb0)/isolinux/isolinux.cfg
+work, then press C in GRUB to access the command line.\
+grub> **ls**\
+Get the device from above output, eg (usb0). Example:\
+grub> **cat (usb0)/isolinux/isolinux.cfg**\
Either this will show the ISOLINUX menuentries for that ISO, or link to
-other .cfg files, for example /isolinux/foo.cfg.
-
-If it did that, then you do:
-
-grub> cat (usb0)/isolinux/foo.cfg
+other .cfg files, for example /isolinux/foo.cfg.\
+If it did that, then you do:\
+grub> **cat (usb0)/isolinux/foo.cfg**\
And so on, until you find the correct menuentries for ISOLINUX. **The
file */isolinux/foo.cfg* is a fictional example. Do not actually use
this example, unless you actually have that file, if it is
@@ -168,24 +170,24 @@ options in txt.cfg. This is important if you want 64-bit booting on your
system. Devuan versions based on Debian 8.x may also have the same
issue.
-Now look at the ISOLINUX menuentry. It'll look like:
-
-**kernel /path/to/kernel
-
-append PARAMETERS initrd=/path/to/initrd MAYBE\_MORE\_PARAMETERS
-
+Now look at the ISOLINUX menuentry. It'll look like:\
+**kernel /path/to/kernel\
+append PARAMETERS initrd=/path/to/initrd MAYBE\_MORE\_PARAMETERS\
** GRUB works the same way, but in it's own way. Example GRUB
-commands:
-
-grub> set root='usb0'
-grub> linux /path/to/kernel PARAMETERS MAYBE\_MORE\_PARAMETERS
-grub> initrd /path/to/initrd
-grub> boot
+commands:\
+grub> **set root='usb0'**\
+grub> **linux /path/to/kernel PARAMETERS MAYBE\_MORE\_PARAMETERS**\
+grub> **initrd /path/to/initrd**\
+grub> **boot**\
Note: *usb0* may be incorrect. Check the output of the *ls* command in
GRUB, to see a list of USB devices/partitions. Of course this will vary
from distro to distro. If you did all of that correctly, then it should
now be booting your USB drive in the way that you specified.
+[Back to top of page](#pagetop).
+
+
+
Troubleshooting
===============
@@ -211,8 +213,7 @@ When using the ROM images that use coreboot's "text mode" instead of
the coreboot framebuffer, booting the Debian or Devuan net installer
results in graphical corruption because it is trying to switch to a
framebuffer which doesn't exist. Use that kernel parameter on the
-'linux' line when booting it:
-
+'linux' line when booting it:\
**vga=normal fb=false**
This forces debian-installer to start in text-mode, instead of trying to
@@ -227,10 +228,12 @@ This workaround was found on the page:
also work for Debian, Devuan and any other apt-get distro that provides
debian-installer (text mode) net install method.
-Copyright © 2014, 2015, 2016 Leah Rowe <info@minifree.org>
+[Back to top of page](#pagetop).
+
-Copyright © 2016 Scott Bonds <scott@ggr.com>
+Copyright © 2014, 2015, 2016 Leah Rowe <info@minifree.org>\
+Copyright © 2016 Scott Bonds <scott@ggr.com>\
Permission is granted to copy, distribute and/or modify this document
under the terms of the Creative Commons Attribution-ShareAlike 4.0
International license or any later version published by Creative
diff --git a/docs/gnulinux/grub_cbfs.md b/docs/gnulinux/grub_cbfs.md
index e51912f0..43857984 100644
--- a/docs/gnulinux/grub_cbfs.md
+++ b/docs/gnulinux/grub_cbfs.md
@@ -1,4 +1,6 @@
-% How to replace the default GRUB configuration file on a libreboot system
+
+How to replace the default GRUB configuration file on a libreboot system
+========================================================================
Libreboot on x86 uses the GRUB
[payload](http://www.coreboot.org/Payloads#GRUB_2) by default, which
@@ -22,11 +24,13 @@ the libreboot GRUB payload will automatically search for.
Here is an excellent writeup about CBFS (coreboot filesystem):
<http://lennartb.home.xs4all.nl/coreboot/col5.html>.
-**This guide is *only* for the GRUB payload. If you use the
+**This guide is \*only\* for the GRUB payload. If you use the
depthcharge payload, ignore this section entirely.**
[Back to previous index](./)
+
+
Table of Contents
=================
@@ -41,13 +45,14 @@ Table of Contents
- [Testing](#testing)
- [Final steps](#final_steps)
+
+
Introduction
------------
-Download the latest release from <http://libreboot.org/>
-
+Download the latest release from <http://libreboot.org/>\
**If you downloaded from git, refer to
-[../git/#build\_meta](../git/#build_meta) before continuing.**
+[../git/\#build\_meta](../git/#build_meta) before continuing.**
[Back to top of page.](#pagetop)
@@ -61,6 +66,8 @@ If you aren't up to that then don't worry; it is possible to use a
custom GRUB menu without flashing a new image, by loading a GRUB
configuration from a partition on the main storage instead.
+
+
1st option: don't re-flash {#option1_dont_reflash}
---------------------------
@@ -87,8 +94,8 @@ coreboot payload) that is located in a partition on the main storage.
If you want to adapt a copy of the existing *libreboot* GRUB
configuration and use that for the libreboot\_grub.cfg file, then follow
-[#tools](#tools), [\#rom](#rom) and
-[#extract\_testconfig](#extract_testconfig) to get the
+[\#tools](#tools), [\#rom](#rom) and
+[\#extract\_testconfig](#extract_testconfig) to get the
***grubtest.cfg***. Rename ***grubtest.cfg*** to
***libreboot\_grub.cfg*** and save it to ***/boot/grub/*** on the
running system where it is intended to be used. Modify the file at that
@@ -99,6 +106,8 @@ for libreboot\_grub.cfg otherwise it will loop.**.
[Back to top of page.](#pagetop)
+
+
2nd option: re-flash {#option2_reflash}
--------------------
@@ -107,18 +116,21 @@ on to find out how.
[Back to top of page.](#pagetop)
+
+
Acquire the necessary utilities {#tools}
-------------------------------
Use ***cbfstool*** and ***flashrom***. There are available in the
*libreboot\_util* release archive, or they can be compiled (see
-[../git/#build\_flashrom](../git/#build_flashrom)). Flashrom is also
-available from the repositories:
-
-# **pacman -S flashrom**
+[../git/\#build\_flashrom](../git/#build_flashrom)). Flashrom is also
+available from the repositories:\
+\# **pacman -S flashrom**
[Back to top of page.](#pagetop)
+
+
Acquiring the correct ROM image {#rom}
-------------------------------
@@ -128,23 +140,22 @@ flashed. For the purpose of this tutorial it is assumed that your ROM
image file is named *libreboot.rom*, so please make sure to adapt.
ROM images are included pre-compiled in libreboot. You can also dump
-your current firmware, using flashrom:
-
- $ sudo flashrom -p internal -r libreboot.rom
- # flashrom -p internal -r libreboot.rom
+your current firmware, using flashrom:\
+\$ **sudo flashrom -p internal -r libreboot.rom**\
+\# **flashrom -p internal -r libreboot.rom**\
If you are told to specify the chip, add the option **-c {your chip}**
-to the command, for example:
-
-# **flashrom -c MX25L6405 -p internal -r libreboot.rom**
+to the command, for example:\
+\# **flashrom -c MX25L6405 -p internal -r libreboot.rom**
[Back to top of page.](#pagetop)
+
+
Extract grubtest.cfg from the ROM image {#extract_testconfig}
---------------------------------------
-You can check the contents of the ROM image, inside CBFS:
-
- $ cd .../libreboot\_util/cbfstool** \$ ./cbfstool libreboot.rom
+You can check the contents of the ROM image, inside CBFS:\
+**\$ cd \.../libreboot\_util/cbfstool** **\$ ./cbfstool libreboot.rom
print**
The files *grub.cfg* and *grubtest.cfg* should be present. grub.cfg is
@@ -152,43 +163,42 @@ loaded by default, with a menuentry for switching to grubtest.cfg. In
this tutorial, you will first modify and test *grubtest.cfg*. This is to
reduce the possibility of bricking your device, so DO NOT SKIP THIS!
-Extract grubtest.cfg from the ROM image:
-
- $ ./cbfstool libreboot.rom extract -n grubtest.cfg -f grubtest.cfg
+Extract grubtest.cfg from the ROM image:\
+**\$ ./cbfstool libreboot.rom extract -n grubtest.cfg -f grubtest.cfg**
Modify the grubtest.cfg accordingly.
[Back to top of page.](#pagetop)
+
+
Re-insert the modified grubtest.cfg into the ROM image {#reinsert_modified_testconfig}
------------------------------------------------------
Once your grubtest.cfg is modified and saved, delete the unmodified
-config from the ROM image:
-
- $ ./cbfstool libreboot.rom remove -n grubtest.cfg
-
-Next, insert the modified version:
+config from the ROM image:\
+**\$ ./cbfstool libreboot.rom remove -n grubtest.cfg**
+Next, insert the modified version:\
**\$ ./cbfstool libreboot.rom add -n grubtest.cfg -f grubtest.cfg -t
raw**
[Back to top of page.](#pagetop)
+
+
Testing
-------
**Now you have a modified ROM. Refer back to
-[../install/#flashrom](../install/#flashrom) for information on how to
-flash it.
-
- $ cd /libreboot\_util** # **./flash update libreboot.rom
+[../install/\#flashrom](../install/#flashrom) for information on how to
+flash it.\
+\$ **cd /libreboot\_util** \# **./flash update libreboot.rom**\
Ocassionally, coreboot changes the name of a given board. If flashrom
complains about a board mismatch, but you are sure that you chose the
-correct ROM image, then run this alternative command:
-
- # ./flash forceupdate libreboot.rom
-You should see **"Verifying flash... VERIFIED."** written at the end
+correct ROM image, then run this alternative command:\
+\# **./flash forceupdate libreboot.rom**\
+You should see **"Verifying flash\... VERIFIED."** written at the end
of the flashrom output. Once you have done that, shut down and then boot
up with your new test configuration.**
@@ -197,11 +207,13 @@ works, then your config is safe and you can continue below.
**If it does not work like you want it to, if you are unsure or
sceptical in any way, then re-do the steps above until you get it right!
-Do *not* proceed past this point unless you are 100% sure that your
+Do \*not\* proceed past this point unless you are 100% sure that your
new configuration is safe (or desirable) to use.**
[Back to top of page.](#pagetop)
+
+
Final steps {#final_steps}
-----------
@@ -212,31 +224,28 @@ difference: the menuentry 'Switch to grub.cfg' will be changed to
grubtest.cfg. This is so that the main config still links (in the menu)
to grubtest.cfg, so that you don't have to manually switch to it, in
case you ever want to follow this guide again in the future (modifying
-the already modified config). From /libreboot\_util/cbfstool, do:
-
+the already modified config). From /libreboot\_util/cbfstool, do:\
\$ **sed -e 's:(cbfsdisk)/grub.cfg:(cbfsdisk)/grubtest.cfg:g' -e
's:Switch to grub.cfg:Switch to grubtest.cfg:g' < grubtest.cfg >
-grub.cfg**
-
-Delete the grub.cfg that remained inside the ROM:
-
- $ ./cbfstool libreboot.rom remove -n grub.cfg
+grub.cfg**\
-Add the modified version that you just made:
+Delete the grub.cfg that remained inside the ROM:\
+**\$ ./cbfstool libreboot.rom remove -n grub.cfg**
- $ ./cbfstool libreboot.rom add -n grub.cfg -f grub.cfg -t raw
+Add the modified version that you just made:\
+**\$ ./cbfstool libreboot.rom add -n grub.cfg -f grub.cfg -t raw**
**Now you have a modified ROM. Again, refer back to
-[../install/#flashrom](../install/#flashrom) for information on how to
+[../install/\#flashrom](../install/#flashrom) for information on how to
flash it. It's the same method as you used before. Shut down and then
boot up with your new configuration.**
[Back to top of page.](#pagetop)
-Copyright © 2014, 2015 Leah Rowe <info@minifree.org>
-Copyright © 2015 Jeroen Quint <jezza@diplomail.ch>
+Copyright © 2014, 2015 Leah Rowe <info@minifree.org>\
+Copyright © 2015 Jeroen Quint <jezza@diplomail.ch>\
Permission is granted to copy, distribute and/or modify this document
under the terms of the Creative Commons Attribution-ShareAlike 4.0
International license or any later version published by Creative
diff --git a/docs/gnulinux/grub_hardening.md b/docs/gnulinux/grub_hardening.md
index f135b349..26de1399 100644
--- a/docs/gnulinux/grub_hardening.md
+++ b/docs/gnulinux/grub_hardening.md
@@ -1,4 +1,6 @@
-% GRUB hardening
+
+GRUB hardening
+==============
This guide deals with various ways in which you can harden your GRUB
configuration, for security purposes. These steps are optional, but
@@ -6,6 +8,8 @@ highly recommended by the Libreboot project.
[Back to previous index](./)
+
+
GRUB secure boot with GPG
=========================
@@ -32,7 +36,7 @@ image:
Helpful links:
- [GRUB manual
- #security](https://www.gnu.org/software/grub/manual/html_node/Security.html#Security)
+ \#security](https://www.gnu.org/software/grub/manual/html_node/Security.html#Security)
- [GRUB info
pages](http://git.savannah.gnu.org/cgit/grub.git/tree/docs/grub.texi)
- [SATA connected storage considered dangerous until proven
@@ -40,6 +44,8 @@ Helpful links:
- [Coreboot GRUB security
howto](https://www.coreboot.org/GRUB2#Security)
+
+
GRUB Password
=============
@@ -111,12 +117,12 @@ configurations, is to remove (or comment out) **unset superusers** in
function try\_user\_config:
function try_user_config {
- set root="\${1}"
+ set root="${1}"
for dir in boot grub grub2 boot/grub boot/grub2; do
for name in '' autoboot_ libreboot_ coreboot_; do
- if [ -f /"\${dir}"/"\${name}"grub.cfg ]; then
+ if [ -f /"${dir}"/"${name}"grub.cfg ]; then
#unset superusers
- configfile /"\${dir}"/"\${name}"grub.cfg
+ configfile /"${dir}"/"${name}"grub.cfg
fi
done
done
@@ -131,6 +137,8 @@ an attacker wants is then just a few GRUB commands away.
As far as basic password setup is concerned we are done and we can now
move on to signing.
+
+
GPG keys
========
@@ -138,7 +146,7 @@ First generate a GPG keypair to use for signing. Option RSA (sign only)
is ok.
**Warning:** GRUB does not read ASCII armored keys. When attempting to
-trust ... a key filename it will print error: bad signature
+trust \... a key filename it will print error: bad signature
mkdir --mode 0700 keys
gpg --homedir keys --gen-key
@@ -176,10 +184,11 @@ What remains now is to include the modifications into the image (rom):
cbfstool my.rom add -n grubtest.cfg -f my.grubtest.cfg -t raw
cbfstool my.rom add -n grubtest.cfg.sig -f my.grubtest.cfg.sig -t raw
-... and flashing it.
+\... and flashing it.
+
-Copyright © 2017 Fedja Beader <fedja@protonmail.ch>
+Copyright © 2017 Fedja Beader <fedja@protonmail.ch>\
Permission is granted to copy, distribute and/or modify this document
under the terms of the Creative Commons Attribution-ShareAlike 4.0
International license or any later version published by Creative
diff --git a/docs/gnulinux/index.md b/docs/gnulinux/index.md
index 84cf4b23..b423bfbb 100644
--- a/docs/gnulinux/index.md
+++ b/docs/gnulinux/index.md
@@ -1,9 +1,11 @@
-% GNU+Linux distributions
+
+GNU+Linux distributions
+=======================
This section relates to dealing with GNU+Linux distributions: preparing
bootable USB drives, changing the default GRUB menu and so on.
-**This section is only for the *GRUB* payload. For depthcharge,
+**This section is only for the \*GRUB\* payload. For depthcharge,
instructions have yet to be written.**
[Back to previous index](../).
@@ -21,8 +23,9 @@ instructions have yet to be written.**
- [How to harden your GRUB configuration, for
security](grub_hardening.html)
-Copyright © 2014, 2015 Leah Rowe <info@minifree.org>
+
+Copyright © 2014, 2015 Leah Rowe <info@minifree.org>\
Permission is granted to copy, distribute and/or modify this document
under the terms of the Creative Commons Attribution-ShareAlike 4.0
International license or any later version published by Creative