diff options
Diffstat (limited to 'docs/gnulinux')
| -rw-r--r-- | docs/gnulinux/configuring_parabola.md | 18 | ||||
| -rw-r--r-- | docs/gnulinux/encrypted_parabola.md | 27 | ||||
| -rw-r--r-- | docs/gnulinux/grub_cbfs.md | 3 |
3 files changed, 48 insertions, 0 deletions
diff --git a/docs/gnulinux/configuring_parabola.md b/docs/gnulinux/configuring_parabola.md index e70204e1..7fc9d688 100644 --- a/docs/gnulinux/configuring_parabola.md +++ b/docs/gnulinux/configuring_parabola.md @@ -56,8 +56,10 @@ careful about this when reading anything on the Arch wiki. Some of these steps require internet access. I'll go into networking later but for now, I just connected my system to a switch and did: # systemctl start dhcpcd.service + You can stop it later by running: # systemctl stop dhcpcd.service\ + For most people this should be enough, but if you don't have DHCP on your network then you should setup your network connection first:\ [Setup network connection in Parabola](#network) @@ -83,6 +85,7 @@ In the end, I didn't change my configuration for pacman. When you are updating, resync with the latest package names/versions: # pacman -Syy + (according to the wiki, -Syy is better than Sy because it refreshes the package list even if it appears to be up to date, which can be useful when switching to another mirror).\ @@ -159,6 +162,7 @@ The wiki also mentions this method for removing everything from the cache, including currently installed packages that are cached: # pacman -Scc + This is inadvisable, since it means re-downloading the package again if you wanted to quickly re-install it. This should only be used when disk space is at a premium. @@ -196,6 +200,7 @@ Read the entire document linked to above, and then continue. Add your user: # useradd -m -G wheel -s /bin/bash *yourusername* + Set a password: # passwd *yourusername* @@ -223,6 +228,7 @@ supplier) to use systemd. The manpage should also help: # man systemd + The section on 'unit types' is especially useful. According to the wiki, systemd 'journal' keeps logs of a size up to @@ -256,9 +262,11 @@ Finally, the wiki mentions 'temporary' files and the utility for managing them. # man systemd-tmpfiles + The command for 'clean' is: # systemd-tmpfiles --clean + According to the manpage, this *"cleans all files and directories with an age parameter"*. According to the Arch wiki, this reads information in /etc/tmpfiles.d/ and /usr/lib/tmpfiles.d/ to know what actions to @@ -270,6 +278,7 @@ However, /usr/lib/tmpfiles.d/ contained some files. The first one was etc.conf, containing information and a reference to this manpage: # man tmpfiles.d + Read that manpage, and then continue studying all the files. The systemd developers tell me that it isn't usually necessary to touch @@ -312,6 +321,7 @@ when installing Parabola. You can also do it with systemd (do so now, if you like): # hostnamectl set-hostname *yourhostname* + This writes the specified hostname to /etc/hostname. More information can be found in these manpages: @@ -399,6 +409,7 @@ non-free firmware inside, but it's transparent to you but the smart data comes from it. Therefore, don't rely on it too much): # pacman -S smartmontools + Read <https://wiki.archlinux.org/index.php/S.M.A.R.T.> to learn how to use it. @@ -418,6 +429,7 @@ Based on <https://wiki.archlinux.org/index.php/Xorg>. Firstly, install it! # pacman -S xorg-server + I also recommend installing this (contains lots of useful tools, including *xrandr*): @@ -427,9 +439,11 @@ Install the driver. For me this was *xf86-video-intel* on the ThinkPad X60. T60 and macbook11/21 should be the same. # pacman -S xf86-video-intel + For other systems you can try: # pacman -Ss xf86-video- | less + Combined with looking at your *lspci* output, you can determine which driver is needed. By default, Xorg will revert to xf86-video-vesa which is a generic driver and doesn't provide true hardware acceleration. @@ -535,6 +549,7 @@ I also like to install these: Enable LXDM (the default display manager, providing a graphical login): # systemctl enable lxdm.service + It will start when you boot up the system. To start it now, do: # systemctl start lxdm.service @@ -615,6 +630,7 @@ Install Network Manager: You will also want the graphical applet: # pacman -S network-manager-applet + Arch wiki says that an autostart rule will be written at */etc/xdg/autostart/nm-applet.desktop* @@ -629,6 +645,7 @@ LXDE uses openbox, so I refer to:\ It tells me for the applet I need: # pacman -S xfce4-notifyd gnome-icon-theme + Also, for storing authentication details (wifi) I need: # pacman -S gnome-keyring @@ -637,6 +654,7 @@ I wanted to quickly enable networkmanager: # systemctl stop dhcpcd # systemctl start NetworkManager + Enable NetworkManager at boot time: # systemctl enable NetworkManager diff --git a/docs/gnulinux/encrypted_parabola.md b/docs/gnulinux/encrypted_parabola.md index 5f0b796b..e1f6a9d7 100644 --- a/docs/gnulinux/encrypted_parabola.md +++ b/docs/gnulinux/encrypted_parabola.md @@ -82,6 +82,7 @@ guide is recommending putting zero there. I'm going to use urandom. Do this: # head -c 3145728 /dev/urandom > /dev/sda; sync + (Wiping the LUKS header is important, since it has hashed passphrases and so on. It's 'secure', but 'potentially' a risk). @@ -93,6 +94,7 @@ list the available keymaps and use yours: # localectl list-keymaps # loadkeys LAYOUT + For me, LAYOUT would have been dvorak-uk. Establish an internet connection @@ -166,6 +168,7 @@ is the best option. I am initializing LUKS with the following: # cryptsetup -v --cipher serpent-xts-plain64 --key-size 512 --hash + whirlpool --iter-time 500 --use-random --verify-passphrase luksFormat /dev/sda1 @@ -313,6 +316,7 @@ and wpa\_supplicant/dialog/iw/wpa\_actiond are needed for wireless after the install: # pacstrap /mnt base base-devel wpa\_supplicant dialog iw + wpa\_actiond Configure the system @@ -323,9 +327,11 @@ Generate an fstab - UUIDs are used because they have certain advantages prefer labels instead, replace the -U option with -L): # genfstab -U -p /mnt >> /mnt/etc/fstab + Check the created file: # cat /mnt/etc/fstab + (If there are any errors, edit the file. Do **NOT** run the genfstab command again!) @@ -354,6 +360,7 @@ Parabola does not have wget. This is sinister. Install it: Locale: # vi /etc/locale.gen + Uncomment your needed localisations. For example en\_GB.UTF-8 (UTF-8 is highly recommended over other options). @@ -364,6 +371,7 @@ highly recommended over other options). Console font and keymap: # vi /etc/vconsole.conf + In my case: KEYMAP=dvorak-uk @@ -372,6 +380,7 @@ In my case: Time zone: # ln -s /usr/share/zoneinfo/Europe/London /etc/localtime + (Replace Zone and Subzone to your liking. See /usr/share/zoneinfo) Hardware clock: @@ -382,6 +391,7 @@ Hostname: Write your hostname to /etc/hostname. For example, if your hostname is parabola: # echo parabola > /etc/hostname + Add the same hostname to /etc/hosts: # vi /etc/hosts @@ -400,6 +410,7 @@ Mkinitcpio: Configure /etc/mkinitcpio.conf as needed (see information about each hook.) Specifically, for this use case: # vi /etc/mkinitcpio.conf + Then modify the file like so: - MODULES="i915" @@ -426,9 +437,11 @@ with (this is different from Arch, specifying linux-libre instead of linux): # mkinitcpio -p linux-libre + Also do it for linux-libre-lts: # mkinitcpio -p linux-libre-lts + Also do it for linux-libre-grsec: # mkinitcpio -p linux-libre-grsec @@ -438,9 +451,11 @@ default for its password hashing. I referred to <https://wiki.archlinux.org/index.php/SHA_password_hashes>. # vi /etc/pam.d/passwd + Add rounds=65536 at the end of the uncommented 'password' line. # passwd root + Make sure to set a secure password! Also, it must never be the same as your LUKS password. @@ -466,6 +481,7 @@ To unlock a user manually (if a password attempt is failed 3 times), do: # pam\_tally --user *theusername* --reset What the above + configuration does is lock the user out for 10 minutes, if they make 3 failed login attempts. @@ -495,6 +511,7 @@ Lock the encrypted partition (close it): # cryptsetup luksClose lvm # shutdown -h now + Remove the installation media, then boot up again. Booting from GRUB @@ -546,6 +563,7 @@ current firmware - where *libreboot.rom* is an example: make sure to adapt: # flashrom -p internal -r libreboot.rom + If flashrom complains about multiple flash chips detected, add a *-c* option at the end, with the name of your chosen chip is quotes.\ You can check if everything is in there (*grub.cfg* and *grubtest.cfg* @@ -594,17 +612,20 @@ from the ROM image: and insert the modified grubtest.cfg: # ./cbfstool libreboot.rom add -n grubtest.cfg -f grubtest.cfg -t + raw Now refer to [../install/#flashrom](../install/#flashrom). Cd (up) to the libreboot\_util directory and update the flash chip contents: # ./flash update libreboot.rom + Ocassionally, coreboot changes the name of a given board. If flashrom complains about a board mismatch, but you are sure that you chose the correct ROM image, then run this alternative command: # ./flash forceupdate libreboot.rom + You should see "Verifying flash\... VERIFIED." written at the end of the flashrom output. @@ -633,6 +654,7 @@ Inside libreboot\_util/cbfstool/{armv7l i686 x86\_64}, we can do this with the following command: # sed -e 's:(cbfsdisk)/grub.cfg:(cbfsdisk)/grubtest.cfg:g' -e + 's:Switch to grub.cfg:Switch to grubtest.cfg:g' < grubtest.cfg > grub.cfg @@ -649,6 +671,7 @@ Now you have a modified ROM. Once more, refer to directory and update the flash chip contents: # ./flash update libreboot.rom + And wait for the "Verifying flash\... VERIFIED." Once you have done that, shut down and then boot up with your new configuration. @@ -676,20 +699,24 @@ putting a keyfile inside initramfs would be a bad idea).\ Boot up and login as root or your user. Then generate the key file: # dd bs=512 count=4 if=/dev/urandom of=/etc/mykeyfile + iflag=fullblock Insert it into the luks volume: # cryptsetup luksAddKey /dev/sdX /etc/mykeyfile + and enter your LUKS passphrase when prompted. Add the keyfile to the initramfs by adding it to FILES in /etc/mkinitcpio.conf. For example: # FILES="/etc/mykeyfile" + Create the initramfs image from scratch: # mkinitcpio -p linux-libre # mkinitcpio -p linux-libre-lts # mkinitcpio -p linux-libre-grsec + Add the following to your grub.cfg - you are now able to do that, see above! -, or add it in the kernel command line for GRUB: diff --git a/docs/gnulinux/grub_cbfs.md b/docs/gnulinux/grub_cbfs.md index 8d10c478..09e2c288 100644 --- a/docs/gnulinux/grub_cbfs.md +++ b/docs/gnulinux/grub_cbfs.md @@ -109,6 +109,7 @@ your current firmware, using flashrom: $ sudo flashrom -p internal -r libreboot.rom # flashrom -p internal -r libreboot.rom + If you are told to specify the chip, add the option **-c {your chip}** to the command, for example: @@ -158,6 +159,7 @@ Ocassionally, coreboot changes the name of a given board. If flashrom complains about a board mismatch, but you are sure that you chose the correct ROM image, then run this alternative command: # ./flash forceupdate libreboot.rom + You should see **"Verifying flash\... VERIFIED."** written at the end of the flashrom output. Once you have done that, shut down and then boot up with your new test configuration.** @@ -183,6 +185,7 @@ case you ever want to follow this guide again in the future (modifying the already modified config). From /libreboot\_util/cbfstool, do: # sed -e 's:(cbfsdisk)/grub.cfg:(cbfsdisk)/grubtest.cfg:g' -e + 's:Switch to grub.cfg:Switch to grubtest.cfg:g' < grubtest.cfg > grub.cfg |