Defcon Kaklkaklkekl (Wiki)

====== Differences ====== This shows you the differences between two versions of the page.

--- testing:readonly-lenny [2009/03/18 12:28]
fishy More documentation.. "the why and the where".
+++ testing:readonly-lenny [2009/03/18 14:29] (current)
fishy New section...
@@ Line 16: / Line 16: @@
   * Partitioning: Manual, one partition, no swap
   * Tasksel Install: Base system only.
+  * Non-root user: kitteh
 Post install:
@@ Line 142: / Line 143: @@
 ln -s /var/local/data/network_run /etc/network/run
 rmdir /var/local/data/network_run
+</code>
+Debian uses udev and hotplug since, well, a long time now. It is set up to assign each ethernet adaper a separate device name, based on the MAC-address and/or the kernel-driver used. We do not want to save any persistent ethernet device data, and we want to use eth0 as the networking device. So, we have to remove the udev-definitions of “persistent devicenames”. The definition for persistent net device names are located in /etc/udev/rules.d/70-persistent-net.rules. Edit this file by hand, or use the following sed line:
+<code>
+ sed -e '/^SUBSYSTEM=="net".*eth/D' -e '/^$/D' \
+     -e '/^# PCI device/D' \
+     -e '/^$/D' \
+     -i /etc/udev/rules.d/70-persistent-net.rules
 </code>
@@ Line 176: / Line 186: @@
 ===== Transferring back =====
+Transferring the image back is simply a task of unmounting the loopmount, and dumping the resulting image back onto the CF card.
+Unmounting first...
 <code>
 exit
@@ Line 183: / Line 197: @@
 sudo umount /mnt/
 </code>
+And dumping the image back. Yes, I am using 'cat'. I should have used 'dd'. But both tools do the same job, so, why bother with complexity when you can have simplicity...
 <code>
@@ Line 191: / Line 207: @@
 ===== Booting up, verifying =====
-Somewhat of a failure. I need to correct some stuffz, and update the above :)
+After tanking up the CF image, the card is moved back to the eBOX, and the eBOX is booted up. While the system is booting, check closely for stuff that fails, and verify that all essential systems start up OK.
-<code>
+In the first iteration, I had a whole lot of errors. I went though them and corrected all the critical ones, and updated this document to reflect the corrections. The corrections that I was not able to fix by cleanly modifying existing startup scripts, or doing bind-mounts or tempfs mounts, are fixed in the rosystem-fix startup script. So, if you follow this walkthrough, and have errors, the likely places to put your fixes will be in /etc/fstab and /etc/init.d/rosystem-fix.
-Mounting local filesystems ...failed          wtf?
-Setting up networking.../etc/rcS.d/S39ifupdown: line 85: /etc/network/run/ifstate: Read-only file system
-Failure initializing /etc/network/run/ifstate failed!
- failed!
-Configuring network interfaces...ifup: failed to open statefile: /etc/network/run/ifstate: Read-only file system
- failed!
-chown: failed to get attributes of '/var/log/dmesg' : No such file or directory
-chown: failed to get attributes of '/var/log/dmesg' : No such file or directory
-rm: cannot remove '/var/lib/urandom/random-seed': Read-only file system
-Plus syslogd complaining that /var/log/news/* does in fact not exist....
+After booting up, the next task is to make this a kind of Kiosk; i.e. starting a web browser in full screen...
-</code>
 ===== X Server installation =====
+I decided to try to keep the X Server installation small, but not super-small ;) By using apt, a bunch of dependencies that are not really needed are pulled in, but at least it is not as bloated as it would be, had I pulled in a complete desktop meta-package.
+First: set the filesystem writable....
+<code>
+rw
+</code>
 <code>
@@ Line 215: / Line 229: @@
                 xserver-xorg-video-vesa xserver-xorg-video-vga xinit cpp cpp-4.3 xserver-xorg \
                 xserver-xorg-core xfs xfonts-100dpi xfonts-75dpi xfonts-scalable ttf-dejavu \
-                ttf-freefont gtk2-engines xterm blackbox iceweasel
+                ttf-freefont gtk2-engines xterm blackbox iceweasel unclutter
+</code>
+We need some additional fonts for our setup. Note that we add the "contrib" package of Microsoft Core fonts. No religious views here, we allow non-free stuff in... Klavika is a font that is used extensively in the GUC visual profile.
+<code>
+echo "deb http://ftp.no.debian.org/debian/ lenny contrib" >> /etc/apt/sources.list
+echo "deb http://ftp.no.debian.org/debian/ lenny non-free" >> /etc/apt/sources.list
+apt-get update
+apt-get install msttcorefonts
+cd /tmp
+wget http://dilbert.hig.no/jonl/klavika.tar.bz2
+cd /usr/share/fonts
+tar jxvf /tmp/klavika.tar.bz2
+fc-cache -f -v
+fc-list | grep Kl # to confirm the install
+</code>
+The Xorg configuration will need to be tweaked to the display the Kiosk is to run with.
+Finally, the filesystem is set read-only again.
+<code>
+ro
+</code>
+===== Setting up the Kiosk function... =====
+With X up and running, and the filesystem back in read-only mode, make sure the non-root user crated during install is available for use, by setting up the home directory:
+<code>
+mkdir /home/kitteh
+chown kitteh.kittteh /home/kitteh
+</code>
+Now, either switch to a different VT, or log out root. Log in as the non-root user created during install, create a simple ~/.xinitrc:
+<code>
+# File: /home/kitteh/.xinitrc
+xterm &
+blackbox
+</code>
+Start up X:
+<code>
+startx
+</code>
+Now, start up iceweasel (yeah, firefox is not called firefox, but iceweasel on Debian, due to licensing issues). Install the Autohide extension from http://www.krickelkrackel.de/autohide/, and configure it for the local user. By enabling this extension, and exiting iceweasel while it is displayed fullscreen, iceweasel will "always" start in full-screen mode.
+After setting iceweasel up, update the .xinitrc:
+<code>
+# File: /home/kitteh/.xinitrc
+xsetroot -solid white &
+xset -dpms s off &
+unclutter &
+xterm -iconic &
+iceweasel http://the.url.of.the.kiosk.example.com &
+blackbox
+</code>
+After this, exit X11, test that it works OK, and exit the non-root login completely.
+Now, we need to retain the settings made from boot to boot. /home is mounted as a tmpfs, so we need to clone the kitteh
+home directory somewhere else on the file system, and push it back in place on boot. Log in as root..
+<code>
+rw
+cp -pRv /home/kitteh /usr/local/kitteh
+</code>
+Add  the following to /etc/rc.local to clone the saved homedir content on boot:
+<code>
+cp -R /usr/local/kitteh /home/kitteh
+chown -R kitteh.kitteh /home/kitteh
+</code>
+I have opted to force X to start on boot by running it from /etc/rc.local as well, by adding this line
+just above "exit 0":
+<code>
+su -c "startx" kitteh
+</code>
+Now, X will normally not start unless the user starting it is also controlling the console. As I am starting X from an rc-script, that is not the case. So, to allow rc.local starting X as the user "kitteh", put the following content in
+/etc/X11/Xwrapper.config
+<code>
+# Keeping the old setting as a comment, for clarity...
+# allowed_users=console
+#
+# This is not really seen as "safe", but in our case, it is needed..
+allowed_users=anybody
+#
+# Niceness value? Nah....
+nice_value=0
+</code>
+That should really be enough for starters. Close everything up, set the file system as read only again, and reboot.
+<code>
+ro
+reboot
 </code>

Defcon Kaklkaklkekl (Wiki)

Page Actions

Wiki Actions

User Actions