J276F

                esto es importante herr comandante.


# DEBIAN 9 (STRETCH) VIA PXE NETWORK BOOT SERVER
------------------------------------------------

Based on [1]. Assume working Gateway as in paper: 

  Spring_2019::Simple_Debian_9_GateWay
  
Login as

  user:     kasutaja       user: root
  password: as on hosts    password: as on hosts

Machine behind Gateway -- Ubuntu Desktop LTS 18.04 unattended install [2].

------
# LINKS

  [1] Install-debian-9-stretch-via-pxe-network-boot-server

      https://www.howtoforge.com/tutorial
        /install-debian-9-stretch-via-pxe-network-boot-server/
        
  [2] Script to create unattended Ubuntu ISO 

      https://github.com/netson/ubuntu-unattended
------

Step 1. NIC's configuration:

  $ cat /etc/network/interfaces
  # This file describes the network interfaces available on your system
  # and how to activate them. For more information, see interfaces(5).

  source /etc/network/interfaces.d/*

  # The loopback network interface
  auto lo
  iface lo inet loopback

  allow-hotplug enp0s3
  iface enp0s3 inet dhcp

  allow-hotplug enp0s8
  iface enp0s8 inet static
          address 10.0.10.1
          netmask 255.255.255.0
          gateway 10.0.10.1
          dns-search google.com
          dns-nameservers 10.0.10.1


Step 2. Install and configure ISC-DHCP Server

  # apt-get install isc-dhcp-server
  # mv /etc/dhcp/dhcpd.conf /etc/dhcp/dhcpd.conf.backup

To perform TFTP boot, it is not enough of DNSMASQ DHCP functionalty. Just comment out the dhcp-related lines in your dnsmasq.conf file and then restart dnsmasq.

  # cat /etc/dhcp/dhcpd.conf
  
File dhcpd.conf

  ddns-update-style none;
  authoritative;
  log-facility local7;
  # required for if option arch.. clause
  option arch code 93 = unsigned integer 16;

  subnet 10.0.10.0 netmask 255.255.255.0 {
    range 10.0.10.20 10.0.10.25;
    option routers 10.0.10.1;
    option broadcast-address 10.0.10.255;
    option subnet-mask 255.255.255.0;

    option domain-name-servers 10.0.10.1;
          allow booting;
          allow bootp;

    if option arch = 00:07 or option arch = 00:09 {
          filename "bootnetx64.efi";
    } else {
          filename "pxelinux.0";
    }
          next-server 10.0.10.1;

    default-lease-time 14400;
    max-lease-time 28800;
  }

EOF

Step 3. In file /etc/default/isc-dhcp-server

  INTERFACESv4="enp0s8"

remove line for INTERFACESv6.

Step 4. Install TFTP Server

  apt-get install tftpd-hpa
  cat /etc/default/tftpd-hpa

  TFTP_USERNAME="tftp"
  TFTP_DIRECTORY="/srv/tftp"
  TFTP_ADDRESS="0.0.0.0:69"
  TFTP_OPTIONS="--secure --create"
  
Now activate start and check the service with:
  
  # systemctl enable tftpd-hpa

  # systemctl start tftpd-hpa

  # systemctl status tftpd-hpa
  
Step 5. iptables

apt-get install iptables-persistent

  # iptables -A INPUT -p udp --dport 67 -j ACCEPT
  # iptables -A INPUT -p udp --dport 69 -j ACCEPT

  # service netfilter-persistent save
  # service netfilter-persistent reload
  
Step 6. syslinux

  # apt-get install syslinux
  # cp /usr/lib/syslinux/memdisk /srv/tftp/
  
Step 7. Deploy Debian 9 Netboot Files

  # wget http://ftp.ee.debian.org/debian/dists/stretch/main/installer-amd64/current/images/netboot/netboot.tar.gz
  
  # tar xfz netboot.tar.gz -C /srv/tftp/
  
  # ln -s /srv/tftp/debian-installer/amd64/bootnetx64.efi /srv/tftp/

Step 8. nano /srv/tftp/debian-installer/amd64/boot-screens/txt.cfg

  label auto
  menu label ^Automated install
  kernel debian-installer/amd64/linux
  append auto=true priority=critical vga=788 initrd=debian-installer/amd64/initrd.gz --- quiet 

Step 9. Run dhcp server permanent

  # systemctl enable isc-dhcp-server.service
  # systemctl start  isc-dhcp-server.service
  # systemctl status isc-dhcp-server.service
   
Machines behind gateway should have following boot order:

  [v] Hard Disk
  [v] Network (PXE)
  [ ] ..
  
This brings us to following philosophy. Initially we have parent computer "Gateway" able to export knowledge (OS), and one to six (10.0.10.20..25) child computers "UFO1..6" able to receive and auto-install (unattended) OS provided by Gateway. At the end of install procedure Gateway emits "reboot". Now child is able to boot from it's own HDD, and is interested in Gateway only as in network provider: DHCP, DnsMasq access restrictions. It's up to "Gateway" computer how to organize further "education" for "UFO":

  1. curious child, no censure
  ..
  2. sshpass slave computer, repositories on gateway

As child becomes more and more educated, less network traffic is needed to achieve complex goals. For example, to show new one hour anime episode, computer receives only 1MB scenario file. Everything else: actors, mimics, environments,.. is already cached to local persistent memory. 

TODO: figure out how to replace Debian automated install option (step 7) with unattended install script like [2].

===========================

# Annex A. Using sshpass on childs with OS already installed

  apt-get install sshpass
  sshpass -p 'virtu' ssh virtu@10.0.10.21 DISPLAY=":0.0" firefox &
  wget -c \
  https://www.planwallpaper.com/static/images/1712173free-wallpaper.jpg
  DISPLAY=":0.0" pcmanfm \
  --set-wallpaper="/home/virtu/1712173free-wallpaper.jpg"

Where is initial wallpaper?

  $ sudo find / -name '1804*'
  /usr/share/lubuntu/wallpapers/1804-lubuntu-default-wallpaper.png

=======================================

# ANNEX B. How to fix system by removing accidentally installed packages (X-Desktop may contain dangerous widgets, NetworkManager, control over resolv.conf lost*, etc)

------
*) How to take back control of /etc/resolv.conf on Linux

  https://www.ctrl.blog/entry/resolvconf-tutorial

There are quite a few different tools that fight to control a Linux system’s DNS resolution configuration file /etc/resolv.conf including netconfig, NetworkManager, resolvconf, rdnssd, and systemd-resolved.
------

Solution: List packages in a "reference" and "broken" system. Generate script to remove complement packages, SQL seems to be reasonable tool. Alternative is using loops in AWK, C, BASH.

Q: How to select the relative complement of a table B in a table A (A\B) in an SQL-Query?

  https://stackoverflow.com/questions/4968570
  /how-to-select-the-relative-complement-of-a-table-b-
  in-a-table-a-a-b-in-an-sq

I've got two tables:

    subjects: [id, ...]
    categories: [subject.id, ...]

I want to select all subjects from table #1 without the entries in #2 (categories).

A1:

  select 
    * 
  from 
    subjects 
  where 
    id not in (select subject.id from categories )

A2: (faster)

  SELECT
    subjects.*
  FROM
    subjects
  LEFT OUTER JOIN
    categories
  ON
    subjects.id = categories.subject_id
  WHERE
    categories.subject_id IS NULL

File packages.sql

  CREATE DATABASE IF NOT EXISTS packages;
  USE packages;

  DROP TABLE IF EXISTS desired;

  CREATE TABLE desired (
    id INTEGER AUTO_INCREMENT NOT NULL PRIMARY KEY,
    name varchar(50) NOT NULL
  );

  DROP TABLE IF EXISTS actual;

  CREATE TABLE actual (
    id INTEGER AUTO_INCREMENT NOT NULL PRIMARY KEY,
    name varchar(50) NOT NULL
  );

  INSERT INTO desired ( name) VALUES
  ("D"),
  ("E"),
  ("F");

  INSERT INTO actual ( name) VALUES
  ("A"),
  ("B"),
  ("C"),
  ("D"),
  ("E"),
  ("F"),
  ("G"),
  ("H"),
  ("I"),
  ("J"),
  ("K"),
  ("L");

EOF

Query 1:

   SELECT * FROM actual WHERE name NOT IN (SELECT name FROM desired);


# ANNEX C. REMOVE PACKAGES USING DIFF

Paste desired packages from another file via putty copy-paste

  ed desi
  cat desi | awk '{ print $2; }' > desired
  cat desired | wc -l
  cat actual | wc -l

  apt remove `diff desired actual | grep '^>' | awk '{ print $2; }'`

========================
  
Used links:

1. https://www.howtoforge.com/tutorial
     /install-debian-9-stretch-via-pxe-network-boot-server/

2. https://stackoverflow.com/questions/30818931
    /debian-8-iptables-persistent

3. https://community.ivanti.com/thread/16541
