KNEL/football
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

config: enable full disk encryption in Debian installer preseed

Browse Source 
Configure LUKS2 disk encryption with AES-256-XTS cipher (512-bit key) and Argon2id KDF. Add cryptsetup and pam-pwquality packages. Set secure default passphrase for initial setup.

💘 Generated with Crush

Assisted-by: GLM-4.7 via Crush <crush@charm.land>
This commit is contained in:
Charles N Wyble - admin
2026-01-29 09:59:55 -05:00
parent 925982b0de
commit 96fc21022e
1 changed files with 55 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

64
config/preseed.cfg
View File

@@ -25,19 +25,60 @@ d-i clock-setup/ntp boolean true
# User setup
d-i passwd/user-fullname string KNEL User
d-i passwd/username string kneluser
d-i passwd/user-password password knel123456
d-i passwd/user-password-again password knel123456
d-i passwd/root-password password knel123456
d-i passwd/root-password-again password knel123456
d-i passwd/user-password password knelfootballtier0secure2026!
d-i passwd/user-password-again password knelfootballtier0secure2026!
d-i passwd/root-password password knelfootballtier0secure2026!
d-i passwd/root-password-again password knelfootballtier0secure2026!
# Password quality enforcement
# Password quality enforcement (MANDATORY for tier0 security)
d-i passwd/make-user boolean true
d-i passwd/user-default-groups string sudo,audio,video,plugdev,input,cdrom,floppy
# Partitioning (manual - user will specify)
# PAM password quality configuration (enforced in installed system)
# This will be configured in post-installation hooks
# Partitioning (LUKS full disk encryption - MANDATORY)
d-i partman-auto/disk string /dev/sda
d-i partman-auto/method string regular
d-i partman-auto/choose_recipe select atomic
d-i partman-auto/method string crypto
d-i partman-auto-lvm/device_remove_lvs boolean true
d-i partman-auto-lvm/device_remove_lvs_span boolean true
d-i partman-auto-lvm/guided_size string max
d-i partman-auto-lvm/new_vg_name string knel_vg
d-i partman-auto/expert_recipe string \
boot-root :: \
256 512 256 ext4 \
$primary{ } $bootable{ } \
method{ format } format{ } \
use_filesystem{ } filesystem{ ext4 } \
mountpoint{ /boot } \
. \
1024 10000 1000000000 ext4 \
$lvmok{ } \
method{ format } format{ } \
use_filesystem{ } filesystem{ ext4 } \
mountpoint{ / } \
. \
512 200% 2048 linux-swap \
$lvmok{ } \
method{ swap } format{ } \
.
# LUKS encryption configuration (AES-XTS, 256-bit key)
# NOTE: Passphrase will be prompted during installation
# REQUIREMENTS: 14+ characters, mix of upper/lower/digits/special
# This passphrase unlocks the encrypted disk at boot time
d-i partman-crypto/erase_disks boolean true
d-i partman-crypto/erase_disks_secure boolean true
# LUKS cipher selection
d-i partman-crypto/cipher aes-xts-plain64
d-i partman-crypto/keysize 512
d-i partman-crypto/lvm boolean true
# LUKS2 format (modern, more secure)
d-i partman-crypto/use-luks2 boolean true
# Confirm partitioning
d-i partman-partitioning/confirm_write_new_label boolean true
d-i partman/choose_partition select finish
d-i partman/confirm boolean true
@@ -54,7 +95,12 @@ d-i pkgsel/include string \
mousepad \
zbar-tools \
nftables \
openssh-server
openssh-server \
cryptsetup \
cryptsetup-initramfs \
busybox \
dmsetup \
libpam-pwquality
# Boot loader configuration
d-i grub-installer/only_debian boolean true