{"id":14,"date":"2015-12-13T16:35:11","date_gmt":"2015-12-13T16:35:11","guid":{"rendered":"https:\/\/spacetux.org\/tommie\/?p=14"},"modified":"2017-02-04T17:35:43","modified_gmt":"2017-02-04T17:35:43","slug":"p14","status":"publish","type":"post","link":"https:\/\/spacetux.org\/tommie\/?p=14","title":{"rendered":"Gentoo Hardened on software RAID howto"},"content":{"rendered":"<p>Note: this note has been originally written end of 2015, but I updated it on 4 feb 2017 as some steps were not consistent anymore.<br \/>\n&nbsp;<\/p>\n<ul>\n<li><strong>Assumptions<\/strong><\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>This tutorial tries to stick to a step-by-step approach, but your chances to reach the end with a working system will be most likely higher if you already have previous experience installing Gentoo systems. If not, I would recommend getting some by following the <a href=\"https:\/\/wiki.gentoo.org\/wiki\/Handbook:Main_Page\" target=\"_blank\">Gentoo Handbook<\/a> on a virtual system like VMware Workstation\/Player. Once you get familiar following the handbook and installing a simple system, you&#8217;ll be able to move on to the slightly more complex setup described here.<\/p>\n<p>The main differences between the Gentoo Handbook and this tutorial are the emphasis on RAID and the use of Gentoo Hardened. I&#8217;ve actually put this tutorial together to remember how to install the OS on the <a href=\"https:\/\/www.soyoustart.com\/en\/offers\/e3-sat-3.xml\">rented server<\/a> this blog is running on, or if I have to do it again to install a new server. Once you get a working system under VMware Workstation\/Player, it should be rather straightforward to adapt this tutorial to any virtual or physical hardware.<\/p>\n<p>For this tutorial I assume a RAID1 setup on two physical (or virtual) 16GB+ hard drives. When using VMWare Workstation\/Player, create your two virtual hard drives on different physical hard drives if possible, to make it easier on your drives mechanics. If you have SSDs then it doesn&#8217;t really matter.<\/p>\n<p>The kernel config linked in this tutorial should work as-is if you use VMware Workstation\/Player, but it doesn&#8217;t have many features activated. You should customize it further according to your system and\/or the features you need. Network setup is assumed to be based on DHCP, localization is minimal.<\/p>\n<p>Note about RAID: RAID won&#8217;t protect you from silent data corruption, it&#8217;s really a basic tool to recover from the failure of a drive assuming that the data on the other drive(s) is reliable. Last generation filesystems such as ZFS or BTRFS should be preferred over software or hardware RAID when possible. At some point I should edit this post to describe a ZFS based install&#8230; oh well, if I have the time.<\/p>\n<p>Let&#8217;s start. Boot on your <a href=\"http:\/\/gentoo.mirrors.ovh.net\/gentoo-distfiles\/releases\/amd64\/autobuilds\/current-install-amd64-minimal\/\">minimal install .iso<\/a>, or <a href=\"http:\/\/help.ovh.com\/RescueMode\">system rescue<\/a>. Note: I&#8217;ve linked some info about OVH\/SoYouStart servers, but before you try this on one of their offers, or similar, <strong>be sure<\/strong> you <a href=\"http:\/\/help.ovh.com\/Firewall\">understand how to configure your firewall<\/a> so that your hosting company won&#8217;t dispatch maintenance because they are not able to monitor your server.<\/p>\n<p>&nbsp;<\/p>\n<ul>\n<li><strong>Prepare the drives<\/strong><\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>Wipe out disk A<br \/>\n<code>gdisk \/dev\/sda<\/code><\/p>\n<p>Type <code>x<\/code> (for expert), then <code>z<\/code> (for zap), answer <code>Y<\/code> (wipe out GPT) and again <code>Y<\/code> (blank out MBR)<\/p>\n<p>Then do the same for disk B<br \/>\n<code>gdisk \/dev\/sdb<\/code><\/p>\n<p>Repeat same steps (as for disk A): type <code>x<\/code> (for expert), then <code>z<\/code> (for zap), answer <code>Y<\/code> (wipe out GPT) and again <code>Y<\/code> (blank out MBR)<\/p>\n<p>Partition disk A<br \/>\n<code>gdisk \/dev\/sda<\/code><\/p>\n<p>Type <code>o<\/code> (create a new empty GUID partition table), answer <code>Y<\/code> (proceed)<\/p>\n<p>Type <code>n<\/code>, type enter to select the default partition number (partition 1), type enter to select the default first sector value 2048, type <code>+2M<\/code> for last sector to create a 2M BIOS partition, type <code>ef02<\/code> for hex code to set a BIOS partition type<\/p>\n<p>Type <code>n<\/code>, type enter to select the default partition number at this stage (partition 2), type enter to select the default first sector value, type <code>+128M<\/code> for last sector to create a 128M boot partition, type <code>fd00<\/code> for hex code to set a software raid partition type<\/p>\n<p>Type <code>n<\/code>, type enter to select the default partition number at this stage (partition 3), type enter to select the default first sector value, type <code>+2G<\/code> for last sector to create a 2GB swap partition, type <code>fd00<\/code> for hex code to set a software raid partition type<\/p>\n<p>Type <code>n<\/code>, type enter to select the default partition number at this stage (partition 4), type enter to select the default first sector value, type enter for last sector to create a root partition using the remaining space, type <code>fd00<\/code> for hex code to set a software raid partition type<\/p>\n<p>Type <code>w<\/code> to write your changes to disk a, answer <code>Y<\/code> (proceed)<\/p>\n<p>Now clone the partition layout of disk A to disk B<br \/>\n<code>sgdisk -R=\/dev\/sdb \/dev\/sda<\/code><\/p>\n<p>And create a new GUID for disk B<br \/>\n<code>sgdisk -G \/dev\/sdb<\/code><\/p>\n<p>&nbsp;<\/p>\n<ul>\n<li><strong>Activate your software raid partitions<\/strong><\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>Activate a software RAID1 to create the boot partition (where the &#8220;\/boot&#8221; directory will be located)<br \/>\n<code>mdadm --create --name=server:boot --verbose \/dev\/md\/boot --level=1 --raid-devices=2 \/dev\/sda2 \/dev\/sdb2<\/code><br \/>\nanswer <code>y<\/code><\/p>\n<p>Note: we are not using \/dev\/sda1 and \/dev\/sdb1 for the RAID1 boot partition because \/dev\/sda1 and \/dev\/sdb1 will be used by GRUB to host the bootloader<\/p>\n<p>Activate a software RAID1 to create the swap partition<br \/>\n<code>mdadm --create --name=server:swap --verbose \/dev\/md\/swap --level=1 --raid-devices=2 \/dev\/sda3 \/dev\/sdb3<\/code><br \/>\nanswer <code>y<\/code><\/p>\n<p>Activate a software RAID1 to create the root partition (where the &#8220;\/&#8221; directory will be located)<br \/>\n<code>mdadm --create --name=server:root --verbose \/dev\/md\/root --level=1 --raid-devices=2 \/dev\/sda4 \/dev\/sdb4<\/code><br \/>\nanswer <code>y<\/code><\/p>\n<p>Note: if you want RAID5 mode instead of RAID1, replace <code>--level=1 --raid-devices=2<\/code> by <code>--level=5 --raid-devices=&lt;n&gt;<\/code> with n being at least 3, and the right partition names. You&#8217;ll also need RAID5 activated in the kernel.<\/p>\n<p>The rest of this howto is now very similar to the standard Gentoo handbook, except that instead of {\/dev\/sda2, \/dev\/sda3, \/dev\/sda4} found in the handbook, our boot, swap, root partitions are respectively {\/dev\/md\/boot, \/dev\/md\/swap, \/dev\/md\/root}<\/p>\n<p>&nbsp;<\/p>\n<ul>\n<li><strong>Install Gentoo &#8220;almost&#8221; as usual<\/strong><\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>Create an ext2 filesystem on the boot partition<br \/>\n<code>mkfs.ext2 \/dev\/md\/boot<\/code><\/p>\n<p>Create a swap on the swap partition<br \/>\n<code>mkswap \/dev\/md\/swap<\/code><\/p>\n<p>Activate the swap<br \/>\n<code>swapon \/dev\/md\/swap<\/code><\/p>\n<p>Create an ext4 filesystem on the root partition<br \/>\n<code>mkfs.ext4 \/dev\/md\/root<\/code><\/p>\n<p>Get the latest portage tree snapshot (use your preferred mirror that you can select from <a href=\"https:\/\/www.gentoo.org\/downloads\/mirrors\/\" target=\"_blank\">the gentoo mirrors<\/a>)<br \/>\n<code>wget http:\/\/gentoo.mirrors.ovh.net\/gentoo-distfiles\/snapshots\/portage-latest.tar.xz<\/code><\/p>\n<p>Get the latest hardened stage3, for example at the time of writing (you need to dig in the autobuilds directory to get the latest, DO NOT pick the &#8220;nomultilib&#8221; version unless you know what you are doing)<br \/>\n<code>wget http:\/\/gentoo.mirrors.ovh.net\/gentoo-distfiles\/releases\/amd64\/autobuilds\/current-stage3-amd64-hardened\/stage3-amd64-hardened-20170202.tar.bz2<\/code><\/p>\n<p>Create the gentoo directory in \/mnt if it&#8217;s not already there<br \/>\n<code>mkdir -p \/mnt\/gentoo<\/code><\/p>\n<p>Mount the root partition in the directory you&#8217;ve just created<br \/>\n<code>mount \/dev\/md\/root \/mnt\/gentoo\/<\/code><\/p>\n<p>Create the boot directory<br \/>\n<code>mkdir \/mnt\/gentoo\/boot<\/code><\/p>\n<p>Mount the boot partition in the directory you&#8217;ve just created<br \/>\n<code>mount \/dev\/md\/boot \/mnt\/gentoo\/boot<\/code><\/p>\n<p>Extract the stage3 to the root of the target filesystem. Note: if you get an error message from the tar utility complaining about missing extended attributes support, it&#8217;s not a show stopper to install a hardened system, but you will need to re-emerge your full system after completing the install guide to get the correct extended attributes on your files. More on this later.<br \/>\n<code>tar xpf stage3* --xattrs -C \/mnt\/gentoo\/<\/code><\/p>\n<p>Extract the portage tree snapshot to \/usr in the target filesystem<br \/>\n<code>tar xf portage* -C \/mnt\/gentoo\/usr\/<\/code><\/p>\n<p>Link your \/etc\/resolv.conf file to the target root filesystem<br \/>\n<code>cp -L \/etc\/resolv.conf \/mnt\/gentoo\/etc\/<\/code><\/p>\n<p>Mount \/proc in the target root filesystem<br \/>\n<code>mount -t proc none \/mnt\/gentoo\/proc<\/code><\/p>\n<p>Bind \/sys in the target root filesystem<br \/>\n<code>mount --rbind \/sys \/mnt\/gentoo\/sys<\/code><\/p>\n<p>Bind \/dev in the target root filesystem<br \/>\n<code>mount --rbind \/dev \/mnt\/gentoo\/dev<\/code><\/p>\n<p>Now chroot yourself in the filesystem you just prepared<br \/>\n<code>chroot \/mnt\/gentoo \/bin\/bash<\/code><\/p>\n<p>Update your environment variables in the chroot<br \/>\n<code>source \/etc\/profile<\/code><\/p>\n<p>Change the prompt to remind us that we are in chroot<br \/>\n<code>export PS1=\"(chroot) $PS1\"<\/code><\/p>\n<p>Optional: if you have enough RAM (\u22658GB) you can save compile time (and the life or your SSDs if you use them as disk A and disk B) by mounting \/var\/tmp\/portage in RAM<br \/>\n<code>mkdir \/var\/tmp\/portage<\/code><br \/>\n<code>mount -t tmpfs tmpfs -o nr_inodes=1M \/var\/tmp\/portage<\/code><\/p>\n<p>Set your timezone. My timezone here is &#8220;Europe\/Berlin&#8221; but if yours is different pick one from <code>\/usr\/share\/zoneinfo\/<\/code><br \/>\n<code>echo \"Europe\/Berlin\" &gt; \/etc\/timezone<\/code><\/p>\n<p>Reconfigure the sys-libs\/timezone-data package<br \/>\n<code>emerge --config sys-libs\/timezone-data<\/code><\/p>\n<p>Select the locale, uncomment the entry <code>en_US.UTF-8 UTF-8<\/code> in <code>\/etc\/locale.gen<\/code><br \/>\n<code>nano \/etc\/locale.gen<\/code><\/p>\n<pre><code>#en_US ISO-8859-1<\/code>\r\n<code>en_US.UTF-8 UTF-8<\/code>\r\n<code>#ja_JP.EUC-JP EUC-JP<\/code>\r\n<code>#ja_JP.UTF-8 UTF-8<\/code>\r\n<code>#ja_JP EUC-JP<\/code>\r\n<code>#en_HK ISO-8859-1<\/code>\r\n<code>#en_PH ISO-8859-1<\/code>\r\n<code>#de_DE ISO-8859-1<\/code>\r\n<code>#de_DE@euro ISO-8859-15<\/code>\r\n<code>#es_MX ISO-8859-1<\/code>\r\n<code>#fa_IR UTF-8<\/code>\r\n<code>#fr_FR ISO-8859-1<\/code>\r\n<code>#fr_FR@euro ISO-8859-15<\/code>\r\n<code>#it_IT ISO-8859-1<\/code>\r\n<\/pre>\n<p>Generate the locale<br \/>\n<code>locale-gen<\/code><\/p>\n<p>Activate the locale, first look for the entry related to <code>en_US.utf8<\/code><br \/>\n<code>eselect locale list<\/code><\/p>\n<pre>Available targets for the LANG variable:\r\n\u00a0 [1]\u00a0\u00a0 C\r\n\u00a0 [2]\u00a0\u00a0 POSIX\r\n\u00a0 [3]\u00a0\u00a0 en_US.utf8\r\n\u00a0 [ ]\u00a0\u00a0 (free form)\r\n<\/pre>\n<p>Select the entry related to <code>en_US.utf8<\/code>, for me it&#8217;s the third but yours could be different<br \/>\n<code>eselect locale set 3<\/code><\/p>\n<p>reload your environment<br \/>\n<code>env-update &amp;&amp; source \/etc\/profile &amp;&amp; export PS1=\"(chroot) $PS1\"<\/code><\/p>\n<p>Now we need to edit \/etc\/fstab. Recent changes in udev require the use of UUID&#8217;s. To find them, issue<br \/>\n<code>lsblk -f<\/code><\/p>\n<p>And look for the UUID&#8217;s of the \/dev\/mdXXX devices. You&#8217;ll need them for the <code>\/etc\/fstab<\/code> file.<\/p>\n<p>Edit your fstab<br \/>\n<code>nano \/etc\/fstab<\/code><\/p>\n<p>Here is my <code>\/etc\/fstab<\/code> file, but you need to adjust yours according to the values of your UUID&#8217;s. Pay attention to the mount points to put the right UUIDs. Again, you can uncomment the last line if you have lots of RAM<\/p>\n<pre>#&lt;fs&gt;\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 &lt;mountpoint&gt;\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 &lt;type&gt;\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 &lt;opts&gt;\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 &lt;dump\/pass&gt;\r\nUUID=9ba69117-4896-41d4-bbac-c7ccb3fa0ced\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \/boot\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ext2\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 auto,noatime\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 1 2\r\nUUID=45c9cc7e-3967-4692-a523-6fe4112bb827\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \/\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ext4\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 noatime\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0 1\r\nUUID=377610a3-b921-4b4a-afa3-54b4f8cfb1bf\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 none\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 swap\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 sw\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0 0\r\n#tmpfs\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \/var\/tmp\/portage\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tmpfs\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 auto,nr_inodes=1M\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0 0\r\n<\/pre>\n<p>(optional) set your hostname, for the example we use &#8220;gentoo&#8221; here<br \/>\n<code>nano \/etc\/conf.d\/hostname<\/code><\/p>\n<pre><code>hostname=\"gentoo\"<\/code>\r\n<\/pre>\n<p>Configure your network with DHCP<br \/>\n<code>nano \/etc\/conf.d\/net<\/code><\/p>\n<pre><code>config_eth0=\"dhcp\"<\/code>\r\n<\/pre>\n<p>Alternatively, if you&#8217;re not on DHCP, set your IPv4 (and optionnally IPv6) and respective default gateways. Here in my example I have only IPv4, replace the x&#8217;s by your actual values.<br \/>\n<code>nano \/etc\/conf.d\/net<\/code><\/p>\n<pre><code>config_eth0=\"x.x.x.x\/x\"<\/code>\r\n<code>routes_eth0=\"default via x.x.x.x\"<\/code>\r\n<\/pre>\n<p>Also, if you&#8217;re not on DHCP, set your DNS server(s), replace the x&#8217;s by the IP of your DNS server(s)<br \/>\n<code>nano \/etc\/resolv.conf<\/code><\/p>\n<pre><code>nameserver x.x.x.x<\/code>\r\n<code>nameserver x.x.x.x<\/code>\r\n<\/pre>\n<p>If you&#8217;re not on DHCP and you have changed your hostname, update your hosts file with your IP addresse(s). Replace the x&#8217;s by your IP address set above, add your IPv6 address if you have one. If your host name has a FQDN, you should put it in.<br \/>\n<code>nano \/etc\/hosts<\/code><\/p>\n<pre><code>x.x.x.x gentoo<\/code>\r\n<\/pre>\n<p>If you&#8217;re on DHCP and you have changed your hostname, for <code>gentoo<\/code> for example, add your hostname to the localhost IPv4 and IPv6 aliases to avoid headaches with some software that bind to the hostname.<br \/>\n<code>nano \/etc\/hosts<\/code><\/p>\n<pre><code># IPv4 and IPv6 localhost aliases<\/code>\r\n<code>127.0.0.1       localhost gentoo<\/code>\r\n<code>::1             localhost gentoo<\/code><\/pre>\n<p>Now in any case (DHCP or static) set eth0 to be a standard service during startup<br \/>\n<code>cd \/etc\/init.d\/<\/code><br \/>\n<code>ln -s net.lo net.eth0<\/code><br \/>\n<code>cd<\/code><br \/>\n<code>rc-update add net.eth0 default<\/code><\/p>\n<p>Allow the test version of the gradm package<br \/>\n<code>nano \/etc\/portage\/package.keywords<\/code><\/p>\n<pre><code>sys-apps\/gradm<\/code>\r\n<\/pre>\n<p>Adjust your make.conf file according to your hardware and location. Your CPU_FLAGS_X86 variable can be found by emerging <code>app-portage\/cpuid2cpuflags<\/code> and running <code>cpuinfo2cpuflags-x86<\/code>. Below is my file.<br \/>\n<code>nano \/etc\/portage\/make.conf<\/code><\/p>\n<pre><code>CFLAGS=\"-O2 -pipe -march=native\"<\/code>\r\n<code>CXXFLAGS=\"${CFLAGS}\"<\/code>\r\n<code>CHOST=\"x86_64-pc-linux-gnu\"<\/code>\r\n<code>USE=\"unicode python lzma xattr\"<\/code>\r\n<code>CPU_FLAGS_X86=\"aes avx mmx mmxext popcnt sse sse2 sse3 sse4_1 sse4_2 ssse3\"<\/code>\r\n<code>EMERGE_DEFAULT_OPTS=\"--jobs=4 --load-average=4.0 --keep-going --with-bdeps y --complete-graph\"<\/code>\r\n<code>MAKEOPTS=\"-j4\"<\/code>\r\n<code>GENTOO_MIRRORS=\"http:\/\/gentoo.mirrors.ovh.net\/gentoo-distfiles\/\"<\/code>\r\n<code>PORTDIR=\"\/usr\/portage\"<\/code>\r\n<code>DISTDIR=\"${PORTDIR}\/distfiles\"<\/code>\r\n<code>PKGDIR=\"${PORTDIR}\/packages\"<\/code>\r\n<code>PORTAGE_NICENESS=10<\/code>\r\n<code>GRUB_PLATFORMS=\"pc\"<\/code>\r\n<code>KERNEL=\"linux\"<\/code>\r\n<code>PAX_MARKINGS=\"XT\"<\/code>\r\n<\/pre>\n<p>Create the repos.conf directory that is needed for syncing the portage tree<br \/>\n<code>mkdir \/etc\/portage\/repos.conf<\/code><\/p>\n<p>Create the gentoo.conf file<br \/>\n<code>nano \/etc\/portage\/repos.conf\/gentoo.conf<\/code><\/p>\n<p>Mine looks like this<\/p>\n<pre><code>[DEFAULT]<\/code>\r\n<code>main-repo = gentoo<\/code>\r\n\r\n<code>[gentoo]<\/code>\r\n<code>location = \/usr\/portage<\/code>\r\n<code>sync-type = rsync<\/code>\r\n<code>sync-uri = <\/code>rsync:\/\/rsync2.fr.gentoo.org\/gentoo-portage\/\r\n<code>auto-sync = yes<\/code>\r\n<\/pre>\n<p>Sync the portage tree<br \/>\n<code>emerge --sync<\/code><\/p>\n<p>Read the news. You&#8217;ll need to do this several times during this tutorial.<br \/>\n<code>eselect news read | more<\/code><\/p>\n<p>Install and update eix, it will be useful later. Remember here that this is Gentoo, everything is compiled from source, so installing packages takes time \ud83d\ude42<br \/>\n<code>emerge eix<\/code><br \/>\n<code>eix-update<\/code><\/p>\n<p>Install the kernel source and a few needed utils<br \/>\n<code>emerge hardened-sources &amp;&amp; emerge gradm mdadm genkernel<\/code><\/p>\n<p>If you read the news again here, you&#8217;ll see that unfortunately <a href=\"https:\/\/grsecurity.net\/\">grsecurity<\/a> only makes the test versions of their kernel patch available to the public. That&#8217;s infortunate for us small end users, but still better than nothing.<\/p>\n<p>Create the MDADM config file<br \/>\n<code>mdadm -Es &gt;&gt; \/etc\/mdadm.conf<\/code><\/p>\n<p>And start the MDADM service at boot<br \/>\n<code>rc-update add mdadm boot<\/code><\/p>\n<p>Edit some needed genkernel config tweaks, make sure the following options are uncommented \/ adjusted as follows. Note, in the genkernel config file I suggest to disable the CLEAN option because if you need to adjust your kernel config file and compile it again, you&#8217;ll save a lot of time.<br \/>\n<code>nano \/etc\/genkernel.conf<\/code><\/p>\n<pre><code>CLEAN=\"no\"<\/code>\r\n<code>MRPROPER=\"no\"<\/code>\r\n<code>MDADM=\"yes\"<\/code>\r\n<code>MDADM_CONFIG=\"\/etc\/mdadm.conf\"<\/code>\r\n<code>COMPRESS_INITRD_TYPE=\"xz\"<\/code>\r\n<\/pre>\n<p>Edit your kernel config, or grab my config which should work on VMWare Workstation\/Player (as long as you stay in the 4.8.x release, but you can always start from it with a &#8220;make oldconfig&#8221; on 4.9+). Note: the config file will also work on\u00a0the <a href=\"https:\/\/www.soyoustart.com\/en\/offers\/e3-sat-3.xml\">rented server<\/a> I run this blog on.<br \/>\n<code>wget https:\/\/spacetux.org\/tommie\/.config -O \/usr\/src\/linux\/.config<\/code><\/p>\n<p>Now compile and install your kernel. Go take a coffee, it usually takes a few minutes.<br \/>\n<code>genkernel all<\/code><\/p>\n<p>Install the bootloader<br \/>\n<code>emerge grub<\/code><\/p>\n<p>Edit a few grub tweaks<br \/>\n<code>nano \/etc\/default\/grub<\/code><\/p>\n<p>Uncomment and change the following line<\/p>\n<pre><code>GRUB_CMDLINE_LINUX_DEFAULT=\"domdadm rootfstype=ext4 net.ifnames=0\"<\/code>\r\n<\/pre>\n<p>Deactivate a few unneeded grub boot options, create a grub config file, and install the bootloader on \/dev\/sda and \/dev\/sdb<br \/>\n<code>cd \/etc\/grub.d\/<\/code><br \/>\n<code>chmod -x 20_linux_xen 30_os-prober 40_custom 41_custom<\/code><br \/>\n<code>mkdir \/boot\/grub<\/code><br \/>\n<code>cd<\/code><br \/>\n<code>grub-mkconfig -o \/boot\/grub\/grub.cfg<\/code><br \/>\n<code>grub-install \/dev\/sda<\/code><br \/>\n<code>grub-install \/dev\/sdb<\/code><\/p>\n<p>Install the system logger<br \/>\n<code>emerge syslog-ng<\/code><\/p>\n<p>Start the system logger automatically<br \/>\n<code>rc-update add syslog-ng default<\/code><\/p>\n<p>(optional) start the ssh daemon. This is obviously mandatory if you&#8217;re following the guide to install a remote server, but then you should also secure your sshd config a lot more. It&#8217;s not covered here.<br \/>\n<code>rc-update add sshd default<\/code><\/p>\n<p>Add a user (change the user&#8217;s name if you don&#8217;t like &#8220;user&#8221;)<br \/>\n<code>useradd -m -G wheel -s \/bin\/bash user<\/code><\/p>\n<p>Change the root password<br \/>\n<code>passwd<\/code><\/p>\n<p>Change the user&#8217;s password<br \/>\n<code>passwd user<\/code><\/p>\n<p>Uncomment a few openrc settings<br \/>\n<code>nano \/etc\/rc.conf<\/code><\/p>\n<pre><code>rc_logger=\"YES\"<\/code>\r\n<code>rc_sys=\"\"<\/code>\r\n<\/pre>\n<p>Remove the files portage left in its tmp directory<br \/>\n<code>rm -rf \/var\/tmp\/portage\/*<\/code><\/p>\n<p>Quit the chroot<br \/>\n<code>exit<\/code><\/p>\n<p>Unmount all our stuff<br \/>\n<code>umount -R \/mnt\/gentoo<\/code><\/p>\n<p>And&#8230;phew. We&#8217;re (almost) done, reboot !<br \/>\n<code>shutdown -r now<\/code><\/p>\n<p>If all went well the system should boot fine.<\/p>\n<p>&nbsp;<\/p>\n<ul>\n<li><strong>Post install<\/strong><\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>At the time of writing, init complains that udev doesn&#8217;t use the proper init script format, so let&#8217;s fix this<br \/>\n<code>perl -i -pe 's\/runscript\/openrc-run\/g' \/etc\/init.d\/udev<\/code><\/p>\n<p>(optional) create a trusted users group<br \/>\n<code>groupadd -g 101 trusted<\/code><\/p>\n<p>(optional) and add your user to it, or you won&#8217;t be able to run executable scripts created under this user<br \/>\n<code>gpasswd -a user trusted<\/code><\/p>\n<p>(optional) if the tar utility you used to extract the stage3 tarball doesn&#8217;t support extended attributes, it&#8217;s safer to recompile your whole system. This will take anywhere between half an hour and several hours depending on your hardware. At the time of writing, the tar version on the minimal Gentoo install .iso supports xattr, so this is not needed<br \/>\n<code>emerge -e @world<\/code><\/p>\n<p>(optional) if you recompiled your system in the step above, you can safely ignore all \/etc updates (choose the -7 option when running the etc-update utility), and then clean your <code>\/usr\/portage\/disfiles<\/code> directory as there will be a lot of source code there<br \/>\n<code>rm \/usr\/portage\/disfiles\/*<\/code><\/p>\n<p>(optional) when you&#8217;re done installing and happy with your kernel config, then clean the kernel source directory from all the pre-compiled objects<br \/>\n<code>cd \/usr\/src\/linux<\/code><br \/>\n<code>make clean<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Note: this note has been originally written end of 2015, but I updated it on 4 feb 2017 as some steps were not consistent anymore. &nbsp; Assumptions &nbsp; This tutorial tries to stick to a step-by-step approach, but your chances to reach the end with a working system will be most likely higher if you [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[3,4,6,7],"class_list":["post-14","post","type-post","status-publish","format-standard","hentry","category-gentoo","tag-gentoo","tag-hardened","tag-howto","tag-software-raid"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Gentoo Hardened on software RAID howto - Tom&#039;s Basement<\/title>\n<meta name=\"description\" content=\"Tutorial: install gentoo hardened on software raid\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/spacetux.org\/tommie\/?p=14\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Gentoo Hardened on software RAID howto - Tom&#039;s Basement\" \/>\n<meta property=\"og:description\" content=\"Tutorial: install gentoo hardened on software raid\" \/>\n<meta property=\"og:url\" content=\"https:\/\/spacetux.org\/tommie\/?p=14\" \/>\n<meta property=\"og:site_name\" content=\"Tom&#039;s Basement\" \/>\n<meta property=\"article:published_time\" content=\"2015-12-13T16:35:11+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2017-02-04T17:35:43+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"14 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/spacetux.org\\\/tommie\\\/?p=14#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/spacetux.org\\\/tommie\\\/?p=14\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\\\/\\\/spacetux.org\\\/tommie\\\/#\\\/schema\\\/person\\\/f5dd044de2e0bb1a187ed4d823c932ec\"},\"headline\":\"Gentoo Hardened on software RAID howto\",\"datePublished\":\"2015-12-13T16:35:11+00:00\",\"dateModified\":\"2017-02-04T17:35:43+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/spacetux.org\\\/tommie\\\/?p=14\"},\"wordCount\":2069,\"commentCount\":0,\"keywords\":[\"gentoo\",\"hardened\",\"howto\",\"software raid\"],\"articleSection\":[\"gentoo\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/spacetux.org\\\/tommie\\\/?p=14#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/spacetux.org\\\/tommie\\\/?p=14\",\"url\":\"https:\\\/\\\/spacetux.org\\\/tommie\\\/?p=14\",\"name\":\"Gentoo Hardened on software RAID howto - Tom&#039;s Basement\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/spacetux.org\\\/tommie\\\/#website\"},\"datePublished\":\"2015-12-13T16:35:11+00:00\",\"dateModified\":\"2017-02-04T17:35:43+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/spacetux.org\\\/tommie\\\/#\\\/schema\\\/person\\\/f5dd044de2e0bb1a187ed4d823c932ec\"},\"description\":\"Tutorial: install gentoo hardened on software raid\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/spacetux.org\\\/tommie\\\/?p=14#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/spacetux.org\\\/tommie\\\/?p=14\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/spacetux.org\\\/tommie\\\/?p=14#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/spacetux.org\\\/tommie\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Gentoo Hardened on software RAID howto\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/spacetux.org\\\/tommie\\\/#website\",\"url\":\"https:\\\/\\\/spacetux.org\\\/tommie\\\/\",\"name\":\"Tom&#039;s Basement\",\"description\":\"Random Geekery\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/spacetux.org\\\/tommie\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/spacetux.org\\\/tommie\\\/#\\\/schema\\\/person\\\/f5dd044de2e0bb1a187ed4d823c932ec\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2ac857972a06f62fd3a08a8cf76bfc57376820c7630511ef081c96e115663e20?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2ac857972a06f62fd3a08a8cf76bfc57376820c7630511ef081c96e115663e20?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2ac857972a06f62fd3a08a8cf76bfc57376820c7630511ef081c96e115663e20?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"url\":\"https:\\\/\\\/spacetux.org\\\/tommie\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Gentoo Hardened on software RAID howto - Tom&#039;s Basement","description":"Tutorial: install gentoo hardened on software raid","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/spacetux.org\/tommie\/?p=14","og_locale":"en_US","og_type":"article","og_title":"Gentoo Hardened on software RAID howto - Tom&#039;s Basement","og_description":"Tutorial: install gentoo hardened on software raid","og_url":"https:\/\/spacetux.org\/tommie\/?p=14","og_site_name":"Tom&#039;s Basement","article_published_time":"2015-12-13T16:35:11+00:00","article_modified_time":"2017-02-04T17:35:43+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"14 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/spacetux.org\/tommie\/?p=14#article","isPartOf":{"@id":"https:\/\/spacetux.org\/tommie\/?p=14"},"author":{"name":"admin","@id":"https:\/\/spacetux.org\/tommie\/#\/schema\/person\/f5dd044de2e0bb1a187ed4d823c932ec"},"headline":"Gentoo Hardened on software RAID howto","datePublished":"2015-12-13T16:35:11+00:00","dateModified":"2017-02-04T17:35:43+00:00","mainEntityOfPage":{"@id":"https:\/\/spacetux.org\/tommie\/?p=14"},"wordCount":2069,"commentCount":0,"keywords":["gentoo","hardened","howto","software raid"],"articleSection":["gentoo"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/spacetux.org\/tommie\/?p=14#respond"]}]},{"@type":"WebPage","@id":"https:\/\/spacetux.org\/tommie\/?p=14","url":"https:\/\/spacetux.org\/tommie\/?p=14","name":"Gentoo Hardened on software RAID howto - Tom&#039;s Basement","isPartOf":{"@id":"https:\/\/spacetux.org\/tommie\/#website"},"datePublished":"2015-12-13T16:35:11+00:00","dateModified":"2017-02-04T17:35:43+00:00","author":{"@id":"https:\/\/spacetux.org\/tommie\/#\/schema\/person\/f5dd044de2e0bb1a187ed4d823c932ec"},"description":"Tutorial: install gentoo hardened on software raid","breadcrumb":{"@id":"https:\/\/spacetux.org\/tommie\/?p=14#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/spacetux.org\/tommie\/?p=14"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/spacetux.org\/tommie\/?p=14#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/spacetux.org\/tommie"},{"@type":"ListItem","position":2,"name":"Gentoo Hardened on software RAID howto"}]},{"@type":"WebSite","@id":"https:\/\/spacetux.org\/tommie\/#website","url":"https:\/\/spacetux.org\/tommie\/","name":"Tom&#039;s Basement","description":"Random Geekery","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/spacetux.org\/tommie\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/spacetux.org\/tommie\/#\/schema\/person\/f5dd044de2e0bb1a187ed4d823c932ec","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/2ac857972a06f62fd3a08a8cf76bfc57376820c7630511ef081c96e115663e20?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/2ac857972a06f62fd3a08a8cf76bfc57376820c7630511ef081c96e115663e20?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2ac857972a06f62fd3a08a8cf76bfc57376820c7630511ef081c96e115663e20?s=96&d=mm&r=g","caption":"admin"},"url":"https:\/\/spacetux.org\/tommie\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/spacetux.org\/tommie\/index.php?rest_route=\/wp\/v2\/posts\/14","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/spacetux.org\/tommie\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/spacetux.org\/tommie\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/spacetux.org\/tommie\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/spacetux.org\/tommie\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=14"}],"version-history":[{"count":134,"href":"https:\/\/spacetux.org\/tommie\/index.php?rest_route=\/wp\/v2\/posts\/14\/revisions"}],"predecessor-version":[{"id":227,"href":"https:\/\/spacetux.org\/tommie\/index.php?rest_route=\/wp\/v2\/posts\/14\/revisions\/227"}],"wp:attachment":[{"href":"https:\/\/spacetux.org\/tommie\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/spacetux.org\/tommie\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/spacetux.org\/tommie\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}