Skip to main content

Debian Template Image Preparation and Cloning

ROUGH DRAFT

Fresh Install of VM

Fresh Debian Installation

To be documented

Post-install Ubuntu Configuration

  • Go to the Console tab and Power On the VM
  • Once it comes up, login to your VM
  • Get the VM IP:
    ip addr

  • SSH to the VM and login as your unprivileged user
  • su to root (enter the root password)
    su -
  • Edit sources.list
    deb http://deb.debian.org/debian bookworm main non-free-firmware
deb-src http://deb.debian.org/debian bookworm main non-free-firmware

deb http://security.debian.org/debian-security bookworm-security main non-free-firmware
deb-src http://security.debian.org/debian-security bookworm-security main non-free-firmware

deb http://deb.debian.org/debian bookworm-updates main non-free-firmware
deb-src http://deb.debian.org/debian bookworm-updates main non-free-firmware
  • Install sudo and add your user to sudo group
    apt-get install sudo
usermod -aG sudo johndoe
  • Logout and reconnect via SSH

  • Run any available upgrades and reboot

    sudo apt update && sudo apt upgrade -y && sudo reboot

  • Set up Chrony for time sync

    sudo apt install -y chrony && \
sudo systemctl restart chrony && \
chronyc tracking | grep --color=auto -e ^ -e "Last offset.*"
  • Add /usr/sbin to default PATH 
    sudo bash -c 'echo '\''PATH="/usr/sbin:$PATH"'\'' >> /etc/profile.d/usr_sbin_path.sh'

VIM Tweaks

  • Install VIM basic
    sudo apt install vim
  • Set VIM as the default editor
    sudo update-alternatives --config editor

Template Image Prep

Set up OpenSSH Key Reconfiguration

If you simply clone a Debian image without resetting the OpenSSH server host keys, an attacker can take those host keys and perform a MITM SSH attack on any system that was cloned from the same image. So we have to make sure those are reset before we make the image, and then automatically regenerated on the next boot.

  • Copy/Paste/Run this entire chunk of script into your terminal (creates process that checks for missing keys at boot, and regenerates them if missing):

    if [ `systemctl is-enabled openssh-reconfigure.service 2> /dev/null > /dev/null || true && false` ] ; then \
  echo "OpenSSH Key Reconfiguration Service already installed." ; \
else
  sudo bash -c 'cat << EOF > /usr/local/sbin/openssh-reconfigure
#!/bin/bash
test -f /etc/ssh/ssh_host_dsa_key || dpkg-reconfigure openssh-server
EOF'
sudo chmod 700 /usr/local/sbin/openssh-reconfigure
sudo bash -c 'cat << EOF > /etc/systemd/system/openssh-reconfigure.service
[Unit]
Description=OpenSSH Key Reconfiguration Service
Before=ssh.service
 
[Service]
Type=simple
ExecStart=/usr/local/sbin/openssh-reconfigure
 
[Install]
WantedBy=multi-user.target
EOF' ; \
  sudo chmod 644 /etc/systemd/system/openssh-reconfigure.service ; \
  sudo systemctl enable openssh-reconfigure.service ; \
fi
  • Delete the existing keys
    sudo /bin/rm -v /etc/ssh/ssh_host_*

Clear the Machine ID

  • Run this:

    sudo bash -c "truncate -s0 /etc/machine-id ; \
rm /var/lib/dbus/machine-id ; \
ln -s /etc/machine-id /var/lib/dbus/machine-id"

Genericize the interface config

  • Make these alterations to /etc/network/interfaces in the enX0 section. Leave the comments for the image/template user to understand what needs to happen to re-activate networking

    iface enX0 inet dhcp
#iface enX0 inet static
#       address 192.168.160.XXX
#       netmask 255.255.254.0
#       gateway 192.168.160.1
#       dns-nameservers 192.168.160.105

Clear the Bash, VIM, and other history

  • Run this:

    rm -rf ~/.viminfo ~/.Xauthority ~/.cache
sudo bash -c 'rm -rf ~/.viminfo ~/.Xauthority ~/.cache'
sudo bash -c 'echo -n "" > /var/log/wtmp'
sudo bash -c 'echo -n "" > /var/log/btmp'
sudo bash -c 'echo -n "" > /var/log/lastlog'
 
### These should always run last
sudo bash -c 'truncate -s0 ~/.bash_history ; history -c'
truncate -s0 ~/.bash_history ; history -c

Shutdown

  • Run this:

    sudo shutdown -h now

Back to top