User Tools

Site Tools


pi:raspbian

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision
Previous revision
pi:raspbian [2020-05-18 14:02] – general network configuration gabrielpi:raspbian [2020-05-19 09:39] (current) – [Raspbian] updating overview gabriel
Line 1: Line 1:
 ====== Raspbian ====== ====== Raspbian ======
  
-This page documents my local Raspberry Pi config for a Raspberry Pi 3 running Raspbian.  This is config is based on Raspian Buster Lite released on 2020-02-13 by the Raspberry Pi Foundation which can be found [[https://www.raspberrypi.org/downloads/raspbian/|here]].+Documentation for my local Raspberry Pi 3 B+ config.  These notes are based on Raspian Buster Lite released on 2020-02-13 by the Raspberry Pi Foundationwhich can be found [[https://www.raspberrypi.org/downloads/raspbian/|here]].
  
-  * Disable auto resizing of root partition on boot +===== Before first boot =====
-  * Disable quiet boot +
-  * Configure static IP address +
-  * Modify OpenSSH configuration +
-  * Add user+
  
-===== Disable automatic resizing of root partition =====+By default Raspbian attempts to grow the root partition of your system on first boot to fill your entire SD card. To disable this option do the following on the SD card image before first boot.
  
-By default Raspbian attempts to grow the root partition of your system on first boot to fill your entire SD card. +  * Remove custom init script and quiet from ''/boot/cmdline.txt'' before first power on. 
-To disable this option do the following. +  * Remove ''/etc/init.d/resize2fs_once'' script.
- +
-  * Remove custom init script and quiet from /boot/cmdline.txt before first power on. +
-  * Remove /etc/init.d/resize script.+
  
 ===== After first boot ===== ===== After first boot =====
Line 26: Line 19:
 apt install vim apt install vim
 update-alternatives --set editor /usr/bin/vim.basic update-alternatives --set editor /usr/bin/vim.basic
-</code> 
- 
-==== Disable Wi-Fi and Bluetooth ==== 
- 
-Add the following to /boot/cmdline.txt 
- 
-<code> 
-dtoverlay=disable-wifi,disable-bt 
-</code> 
- 
-Disable modem service per [[https://github.com/raspberrypi/firmware/blob/master/boot/overlays/README|boot overlays doc]]. 
- 
-<code> 
-systemctl disable hciuart 
 </code> </code>
  
 ==== Disble IPv6 ==== ==== Disble IPv6 ====
  
-Add the following to /etc/sysctl.d/local.conf:+Add the following to ''/etc/sysctl.d/local.conf'':
  
 <code> <code>
Line 53: Line 32:
 ==== Configure static IP address ==== ==== Configure static IP address ====
  
-Edit /etc/dhcpcd.conf and add the following:+Edit ''/etc/dhcpcd.conf'' and add the following:
  
 <code> <code>
Line 61: Line 40:
 static routers=10.77.3.1 static routers=10.77.3.1
 static domain_name_servers=10.77.3.4 10.77.3.5 static domain_name_servers=10.77.3.4 10.77.3.5
 +</code>
 +
 +Add our local domain to the default search path configured by ''resolvconf''.
 +
 +<code>
 +echo "search in.quay.net" >> /etc/resolv.conf.tail
 </code> </code>
  
Line 74: Line 59:
 ==== User configuration ==== ==== User configuration ====
  
-Add local user+The following user modifications are made. 
 + 
 +=== local user === 
 + 
 +Add local user:
  
 <code> <code>
Line 82: Line 71:
 </code> </code>
  
-Disable pi user+=== pi === 
 + 
 +Disable pi user:
  
 <code> <code>
Line 88: Line 79:
 </code> </code>
  
-Set root password+=== root === 
 + 
 +Now set root password
 + 
 +=== ansible === 
 + 
 +Add ansible user: 
 + 
 +<code> 
 +groupadd -g 1111 ansible 
 +useradd -u 1111 -c "Ansible control user" -g 1111 -m ansible 
 +usermod -p '*' ansible 
 +</code> 
 + 
 +Configure the following sudo rule for ansible: 
 + 
 +<code> 
 +# Ansible control user 
 +ansible ALL=(ALL) NOPASSWD:ALL 
 +</code> 
 + 
 +Copy SSH keys for Ansible user.
  
 ==== Sudoers config ==== ==== Sudoers config ====
  
-Set timestamp_timeout=NN to more useful timeout value.+Set ''timestamp_timeout=NN'' to more useful timeout value.
  
 ==== Grow root partition ==== ==== Grow root partition ====
  
-Use parted and resize2fs to manually set root filesystem size.+Use ''parted'' and ''resize2fs'' to manually set root filesystem size.
  
 <code> <code>
Line 111: Line 123:
 ==== raspi-config ==== ==== raspi-config ====
  
-Run the raspi-config tool and set the following options.+Run the ''raspi-config'' tool and set the following options:
  
   * **2 Network Options** -> Hostname -> Set hostname   * **2 Network Options** -> Hostname -> Set hostname
Line 125: Line 137:
     * **A3 Memory Split** -> 16     * **A3 Memory Split** -> 16
  
-==== Configure OpenSSH server ====+==== Additional hardware configuration via config.txt ====
  
-Disable all keys except ed25519.+These settings involve manual configuration of ''/boot/config.txt'' to disable certain drivers.  See [[https://github.com/raspberrypi/firmware/blob/master/boot/overlays/README|boot overlays README]] for more information. 
 + 
 +=== Disable unneeded networking ===
  
 <code> <code>
-cat "HostKey /etc/ssh/ssh_host_ed25519_key" >> /etc/ssh/sshd_config +# disable WiFi 
-cd /etc/ssh/ ** rm -f *key* +dtoverlay=disable-wifi 
-dpkg-reconfigure openssh-server+ 
 +# disable Bluetooth 
 +dtoverlay=disable-bt
 </code> </code>
  
- +Disable modem service per boot overlays doc:
- +
- +
-===== Old: Raspian Jessie Lite instructions ===== +
- +
-  * Add OpenSSH authorized_keys for root user +
-  * Remove all key types except rsa and ed25519 from sshd_config +
-  * Remove all default keys and regenerate +
-    * ''rm *key*'' +
-    * ''ssh-keygen -q -N "" -t rsa -b 8192 -f /etc/ssh/ssh_host_rsa_key'' +
-    * ''ssh-keygen -q -N "" -t ed25519 -f /etc/ssh/ssh_host_ed25519_key'' +
-    * ''service ssh restart'' +
-    * Make ''vi'' the default editor: ''update-alternatives --set editor /usr/bin/vim.tiny'' +
-    * Set static IP address for host by editing ''/etc/dhcpcd.conf'':+
  
 <code> <code>
-# See dhcpcd.conf(5) for details. +systemctl disable hciuart
-interface eth0 +
-static ip_address=$IP/$MASK +
-static routers=$ROUTER+
 </code> </code>
  
-  * Set ''resolvconf'' for a static configuration by editing /etc/resolvconf.conf: +=== Disable audio driver ===
- +
-<code> +
-# Configuration for resolvconf(8) +
-# See resolvconf.conf(5) for details+
  
-resolv_conf=/etc/resolv.conf +Comment out the audio driver:
-# If you run a local name server, you should uncomment the below line and +
-# configure your subscribers configuration files below. +
-search_domains=in.quay.net +
-# BUG WORKAROUNDspace separated lists of DNS servers are not currently working +
-name_servers=$NS1 +
-name_servers_append=$NS2+
  
-Mirror the Debian package defaults for the below resolvers +<code> 
-so that resolvconf integrates seemlessly. +Enable audio (loads snd_bcm2835) 
-dnsmasq_resolv=/var/run/dnsmasq/resolv.conf +#dtparam=audio=on
-pdnsd_conf=/etc/pdnsd.conf +
-unbound_conf=/var/cache/unbound/resolvconf_resolvers.conf+
 </code> </code>
  
-  * Remove pi default user +==== Configure OpenSSH server ====
-  * Remove pi group +
-  * Add new default user and group +
-    * Add sudoers entry for user +
-    * Set password +
-  * Update ntp config; ''apt-get install ntpdate'' and sync time +
-    * ''time.chu.nrc.ca'' +
-    * ''ntp1.torix.ca'' +
-    * ''tick.umanitoba.ca'' +
-    * ''time.nrc.ca'' +
-    * ''ntp2.torix.ca'' +
-    * ''tock.utoronto.ca'' +
-    * ''ntp3.torix.ca'' +
-    * ''tick.usask.ca'' +
-    * ''time.nist.gov'' +
-  * Set timezone to Toronto: ''sudo ln -fs /usr/share/zoneinfo/America/Toronto /etc/localtime'' +
-  * Remove MOTD text ''> /etc/motd'' +
-  * Install git and needrestart+
  
-Raspbian appears to have issues with managing network dependencies during boot.  This script ensures that BIND, dhcpd, and NTP start up correctly after the network interface is properly set up.  It is run via ''/etc/rc.local'' as a background process and depends on fping.+Disable all keys except ed25519.
  
 <code> <code>
-#!/bin/bash+cat "HostKey /etc/ssh/ssh_host_ed25519_key" >> /etc/ssh/sshd_config 
 +rm -fv /etc/ssh/*key* 
 +dpkg-reconfigure openssh-server 
 +</code>
  
-until fping -qc 3 8.8.8.8 > /dev/null 2>&1; do +==== Packages ====
-  echo "Waiting for network..." +
-done+
  
-for daemon in isc-dhcp-server bind9; do +<code> 
-  echo "Forcing restart of $daemon" +vim 
-  service $daemon restart +ntp 
-done +isc-dhcp-server 
- +bind9 
-echo "Forcing restart of ntp" +dnsutils 
-service ntp stop +whois 
-ntpdate -s 0.ca.pool.ntp.org +fping 
-service ntp start+git 
 +tmux 
 +mksh 
 +zsh
 </code> </code>
  
-====== Service management under systemd ====== 
  
-  * Add service to systemd init process: ''systemctl enable $SERVICE'' +==== Services ====
-  * List all services: ''service --status-all''+
  
-====== Disable WiFi completely ====== +Service modification
- +
-Blacklist the driver by creating a file in ''/etc/modprobe.d'' called ''wlan-blacklist.conf'' with the following contents:+
  
 <code> <code>
-blacklist brcmfmac +systemctl disable apt-daily-upgrade.timer 
-blacklist brcmutil+systemctl disable apt-daily.timer
 </code> </code>
 +
 +===== See also =====
 +
 +  * [[quay:dns|Local DNS configuration]]
 +  * [[quay:ntp|Local time service]]
 +  * [[quay:dhcp|Local DHCP service]]
pi/raspbian.1589824946.txt.gz · Last modified: 2020-05-18 14:02 by gabriel