diff options
Diffstat (limited to 'config.sh')
| -rwxr-xr-x | config.sh | 121 |
1 files changed, 121 insertions, 0 deletions
diff --git a/config.sh b/config.sh new file mode 100755 index 0000000..67c2cad --- /dev/null +++ b/config.sh @@ -0,0 +1,121 @@ +#!/bin/bash + +set -euxo pipefail + +#====================================== +# Functions... +#-------------------------------------- +test -f /.kconfig && . /.kconfig +test -f /.profile && . /.profile + +#====================================== +# Greeting... +#-------------------------------------- +echo "Configure image: [$kiwi_iname]-[$kiwi_profiles]..." + +#====================================== +# Set SELinux booleans +#-------------------------------------- +## Fixes KDE Plasma, see rhbz#2058657 +setsebool -P selinuxuser_execmod 1 + +#====================================== +# Clear machine specific configuration +#-------------------------------------- +## Clear machine-id on pre generated images +rm -f /etc/machine-id +echo 'uninitialized' > /etc/machine-id +## remove random seed, the newly installed instance should make its own +rm -f /var/lib/systemd/random-seed + +#====================================== +# Configure grub correctly +#-------------------------------------- +## Works around issues with grub-bls +## See: https://github.com/OSInside/kiwi/issues/2198 +echo "GRUB_DEFAULT=saved" >> /etc/default/grub +## Disable submenus to match Fedora +echo "GRUB_DISABLE_SUBMENU=true" >> /etc/default/grub +## Disable recovery entries to match Fedora +echo "GRUB_DISABLE_RECOVERY=true" >> /etc/default/grub + +#====================================== +# Delete & lock the root user password +#-------------------------------------- +if [[ "$kiwi_profiles" == *"Cloud"* ]] || [[ "$kiwi_profiles" == *"Live"* ]]; then + passwd -d root + passwd -l root +fi + +#====================================== +# Setup default services +#-------------------------------------- + +if [[ "$kiwi_profiles" == *"Live"* ]]; then + ## Configure livesys session + if [[ "$kiwi_profiles" == *"GNOME"* ]]; then + echo 'livesys_session="gnome"' > /etc/sysconfig/livesys + fi + if [[ "$kiwi_profiles" == *"KDE"* ]]; then + echo 'livesys_session="kde"' > /etc/sysconfig/livesys + fi +fi + +#====================================== +# Setup default target +#-------------------------------------- +if [[ "$kiwi_profiles" == *"GNOME"* ]] || [[ "$kiwi_profiles" == *"KDE"* ]]; then + systemctl set-default graphical.target +else + systemctl set-default multi-user.target +fi + +#====================================== +# Setup default customizations +#-------------------------------------- + +if [[ "$kiwi_profiles" == *"Azure"* ]]; then +cat > /etc/ssh/sshd_config.d/50-client-alive-interval.conf << EOF +ClientAliveInterval 120 +EOF + +cat >> /etc/chrony.conf << EOF +# Azure's virtual time source: +# https://docs.microsoft.com/en-us/azure/virtual-machines/linux/time-sync#check-for-ptp-clock-source +refclock PHC /dev/ptp_hyperv poll 3 dpoll -2 offset 0 +EOF +fi + +if [[ "$kiwi_profiles" == *"GCE"* ]]; then +cat <<EOF > /etc/NetworkManager/conf.d/gcp-mtu.conf +# In GCP it is recommended to use 1460 as the MTU. +# Set it to 1460 for all connections. +# https://cloud.google.com/network-connectivity/docs/vpn/concepts/mtu-considerations +[connection] +ethernet.mtu = 1460 +EOF +fi + +if [[ "$kiwi_profiles" == *"Vagrant"* ]]; then +sed -e 's/.*UseDNS.*/UseDNS no/' -i /etc/ssh/sshd_config +mkdir -m 0700 -p ~vagrant/.ssh +cat > ~vagrant/.ssh/authorized_keys << EOKEYS +ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6NF8iallvQVp22WDkTkyrtvp9eWW6A8YVr+kz4TjGYe7gHzIw+niNltGEFHzD8+v1I2YJ6oXevct1YeS0o9HZyN1Q9qgCgzUFtdOKLv6IedplqoPkcmF0aYet2PkEDo3MlTBckFXPITAMzF8dJSIFo9D8HfdOV0IAdx4O7PtixWKn5y2hMNG0zQPyUecp4pzC6kivAIhyfHilFR61RGL+GPXQ2MWZWFYbAGjyiYJnAmCP3NOTd0jMZEnDkbUvxhMmBYSdETk1rRgm+R4LOzFUGaHqHDLKLX+FIPKcF96hrucXzcWyLbIbEgE98OHlnVYCzRdK8jlqm8tehUc9c9WhQ== vagrant insecure public key +EOKEYS +chmod 600 ~vagrant/.ssh/authorized_keys +chown -R vagrant:vagrant ~vagrant/.ssh/ + +cat > /etc/ssh/sshd_config.d/10-vagrant-insecure-rsa-key.conf <<EOF +# For now the vagrant insecure key is an rsa key +# https://github.com/hashicorp/vagrant/issues/11783 +PubkeyAcceptedKeyTypes=+ssh-rsa +EOF + +# Further suggestion from @purpleidea (James Shubin) - extend key to root users as well +mkdir -m 0700 -p /root/.ssh +cp /home/vagrant/.ssh/authorized_keys /root/.ssh/authorized_keys +chmod 600 /root/.ssh/authorized_keys +chown -R root:root /root/.ssh +fi + +exit 0 |