37 lines
1.7 KiB
Markdown
37 lines
1.7 KiB
Markdown
# hetzner-dracut-sshd
|
|
|
|
🚧 **Work in progress** 🚧
|
|
|
|
Post-install script for Hetzner's `installimage` that installs `dracut-sshd` to enable remote LUKS
|
|
unlocking via SSH.
|
|
|
|
This is tested with Rocky Linux 10. It should also work with AlmaLinux 10 and possibly earlier
|
|
releases, but these have not been tested.
|
|
|
|
|
|
## Notes
|
|
|
|
- The script assumes a setup with LVM on LUKS on RAID1, but this is not a strict requirement. Other
|
|
setups may require small changes to the script.
|
|
- Configures the initramfs to enable networking (e.g. NetworkManager) in early boot
|
|
- `dracut-network`, NetworkManager in the initramfs and `rd.neednet=1` in the kernel cmdline
|
|
- Reuses the static IP configuration that `installimage` configures (via `dracut-network`)
|
|
- Enables EPEL (required for `dracut-sshd`)
|
|
- Installs `dracut-sshd`
|
|
- Uses the SSH keys in `/root/.ssh/authorized_keys`, as previously installed by `installimage`
|
|
- Always check `/root/postinstall_debug.txt` after `installimage` ran.
|
|
|
|
### After rebooting out of the rescue system
|
|
|
|
- The system reboots again after first boot due to SELinux autorelabeling. That means that you will
|
|
need to ssh into the initrd to unlock *twice* if it's the first time.
|
|
|
|
### Troubleshooting
|
|
|
|
- Always check `/root/postinstall_debug.txt` after `postinstall` ran.
|
|
- It's not specific to this postinstall script, but make sure you know how to mount an encrypted
|
|
system from the rescue disk using `mdadm`, `cryptsetup`, `lvscan` etc. Also remember to `touch
|
|
`/path-to/mounted-system/.autorelabel` after tinkering, to not break booting due to SELinux
|
|
choking on unlabeled files.
|
|
- Be sure to regenerate your initramfs if you changed anything substantial, e.g. NetworkManager
|
|
configuration.
|