randy/debian11-on-vbox.md

Installing a Debian 11 Bullseye Guest on Virtual Box

For this example, I will use the vm/host name deb11.rg.net. Modify to suit your needs.

Before I start the install, I put the new host in the DNS so that it has time to propagate.

Create the VM and do the Debian install

Do the Debian install over the VBox GUI. I use the graphical install. The options I choose are:

• US English and US keyboard. This means I am not offered the UTC timezone option and have to set manually later. But it sets the /etc/apt/sources.list to the US servers.

• DHCP.

• Use the entire disk.

• Install the SSH server as well as the standard system utilities. Do not install any of the desktop stuff or the print server.

• Install the GRUB boot loader so that you can make serial console work. You may have to specify /dev/vda.

Reboot the VM

The installation completes, and reboots. I log in and get the IP address via ip add.

As soon as possible, I ssh into the new system as the new user.

First Configuration

The first thing is set the password to something nasty. And remember to also set the user password.

I also have to get the network configured properly. In my example

cat > /etc/network/interfaces << EOF
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto enp0s3
iface enp0s3 inet dhcp

auto enp0s8
iface enp0s8 inet dhcp
EOF
/etc/init.d/networking restart

If the restart does not work, reboot. If one has made an error, it is good that the VGA console is still open :)

Customize VM

If it does not run Emacs, it is not a computer. And install unbound so we have a local nameserver, and ntpd so we have a local chime. We will do detailed configuration of unbound and chrony later.

cat > /etc/apt/apt.conf.d/01norecommend << EOF
APT::Install-Recommends "0";
APT::Install-Suggests "0";
EOF

apt install emacs-nox chrony rsync sudo screen debian-goodies

Hack /etc/sudoers to make it passwordless for members of the sudo group.

%sudo   ALL=(ALL) NOPASSWD: SETENV: ALL

Add the initial user to /etc/group in group sudo

/usr/sbin/usermod -a -G sudo randy

I want to disable ssh passwording as soon as reasonable, so I install root's ssh credentials.

cd /root
mkdir .ssh
chmod 700 .ssh
cat > .ssh/authorized_keys << EOF
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID9DzOVboz/9daQwQRPkxD/D4PZ4ZVNgMLqd+zc79Gl+ randy@ryuu.psg.com
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAww1WTCBezBK1snfUKi1LAwIIvQEQuhgV63toCMnTrYZfkp9/jyI1WVmKf4FIiodJWWeUtjCkt2E7t0oPZ7BxNbP8bn6HTso8qTexng8kM23UCgdzorp0ofatO0esdIdbuXd8qu9uJRlJn1TwVYeY7qY10eF60CbSZawuwSsM0iq0EbKTJQkHBtytd1zC7a7geGfieR4D3sHB9b33YhUgP9b1EO+CYtS8Qbb8xbMboD1eIB0UH0jcSUVZvb2DRtnsyIVQioW6zaAbIbFz7x+5zJBsFjkDvjR/80atOvNYJTyYZRD71D3kBu2peYup2XrsTPvrsKh5hJCVlJFCuFQaNQ== randy@psg.com
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC8yvE/UBwHdLVDk708/U81ZQdtDLF9Y7grMkVBfUoclF4BGFCcH1bIv6y0p1I/2PATSRnK/B5ndvWP/SrQ6y0DqnQugHKoFMR3idkzVagjjXOhcZkpitcp5hRCdjn/y/88QEiIKItEM66q48nW0OtCgcq7ENXQuYUVt0e6kh6UKRDfrPP3i2D7m8o3/W+xYt8QkYZ0iFanCfhxHAP7w3SOezmThu+p7V6yxVcy+G0WTvPHrs2JlgSaI+4SoJ2btPgqIrmKu1ILfyoAr9/RjSVHr74LijsdUKec7OXnKnV2v1VfMRglBXFgXVaWyX/adA2tMuh9nMk3Y3a3+xDqPIz6RnzQAupqUmPZ/1qbFIrVSNmhygWTC9jgemaNNC/B1nFG7em6m+fmxKjauuWoIdpybaofWiJElUDBBT4bHU+L8NF7zbNROt1GtaDnbL4W9/asqzPu+aJy7L6uJQHtkc/eoXsheajztFC9I5qxW/29ja+FcQsVoDJpe96XmBtJ7elOGXaq3YtDRURwrdu9fGUBDWqwP1IFECVkeVh/NrXbQRHtgp4v533D+0MubA+hDhVTsUk6G93WLyX3usUprU1cJjyhrVzZ9U23eCPOj8J18Ixw4sJFuNeUhSCaN6j+rmOyGor3PYYysKTp1VfLNAYdcc/AYC0jDy9mYjjfCDwKfQ== randy@ryuu.psg.com
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP2qXA3uRFGv7Q0yolQtC5bcF7kVW94c/aOhf0xbU3i8 randy@kappa.local
EOF
chmod 600 .ssh/authorized_keys

Copy the ssh authority to the user account

rsync -vlpPStgoHxr .ssh ~randy
chown -R randy:randy ~randy

Disallow plaintext password logins by editing /etc/ssh/sshd_config as root

# Change to no to disable tunnelled clear text passwords
#PasswordAuthentication yes
PasswordAuthentication no
#UsePAM yes
UsePAM no

Take the new sshd config

systemctl restart ssh

I want my standard dot files, so I go to a recently customized Debian system and rsync them over.

rsync -vlpPStgoHx .bashrc .emacs .exrc .forward .inputrc randy@deb11.rg.net:
ssh randy@deb11.rg.net chown -R randy:randy .

And a bit of decoration from the other system

rsync -vlpPStgoHx /usr/bin/xtitle root@deb11.rg.net:/usr/bin/xtitle

Last Cosmetics Before Reboot

Check that /etc/hostname has the full FQDN.

Set the timezone. All my servers are in UTC

dpkg-reconfigure tzdata

You may need to tell it that the VM's hardware clock is UTC and then whack the BIOS clock.

deb11.rg.net:/home/randy# hwclock -l
2021-12-28 00:14:46.766988+00:00
deb11.rg.net:/home/randy# hwclock -s
deb11.rg.net:/home/randy# date
Tue Dec 28 00:15:51 UTC 2021

As I still have the VGA console open, it ia a good time to reboot and watch for problems.

Use Ansible to Install and Configure a Bunch of Things

Now the barrage of ansible, which for me is based on my Mac laptop.

ansible-playbook -l deb11.rg.net no-depends.yml unattended-upgrades.yml chrony.yml rsyslog.yml

Disable IPv6 as VBox Does Not Support

cat >> /etc/sysctl.conf << EOF
net.ipv6.conf.all.disable_ipv6 = 1
EOF
sudo sysctl -p

---

2021.12.27