Sibirocobombus Setup
I’m paying the systemd tax, twice. I had a Debian Wheezy (7) machine that I wanted to upgrade to Debian Jessie (8). It ran in an OpenVZ environment, ie. the kernel is shared between instances. Sadly, Jessie uses systemd which means I need a new kernel. OpenVZ prevents me from installing a new kernel. I tried it and ended with a machine that was offline. I could connect via serial console and nothing else. But like an idiot, I once again used OpenVZ. And now as I am about to upgrade to Debin Stretch (9) I am faced with the same prospect. This time, however, it is going to be a KVM.
I tried it
So now I’m setting up a new machine. I’m copying stuff over, step by step. Needless to say, I’m not happy.
From the web site:
- reinstall operating system
- change root password
Connect as root via ssh:
- `cat /etc/debian_version` # check that we have the correct version
- `apt update`
- `apt install dialog`
- `apt upgrade -y`
- `dpkg-reconfigure locales` was not necessary because I liked the default of `en_GB.UTF-8`
- `dpkg-reconfigure tzdata` and pick Europe/Zurich
- `adduser alex`
- `usermod -a -G sudo alex`
On the old machine, I installed `apt-clone` and ran `apt-clone clone sibirocobombus` which game me the file `sibirocobombus.apt-clone.tar.gz`. When I tried to restore this on the new machine, I was unable to run the `restore-new-distro` command because there seemed to be no appropriate destination distro shortcut. When I used `restore` it seemed to take forever and I aborted it. Now I have a broken setup and I’m angry.
Don’t do this:
- `scp -P 882 alex@192.71.233.105:sibirocobombus.apt-clone.tar.gz .`
- `apt install apt-clone`
- `apt-clone restore sibirocobombus.apt-clone.tar.gz`
To undo the damage:
- `mv /etc/apt/sources.list.apt-clone /etc/apt/sources.list`
The manual alternative also doesn’t work. On the old system, you can export a list of packages:
- `dpkg --get-selections > packages.list`
- `apt-mark showauto > package.states.auto.list`
- `apt-mark showhold > package.states.hold.list`
- `apt-mark showmanual > package.states.manual.list`
Copy them to the new system and try to import them:
- `scp -P 882 alex@192.71.233.105:*.list .`
- `dpkg --set-selections < packages.list`
I’m getting an error for practically every single package. So now I’m trying to do it the old way.
- `apt-get install -y emacs rsync sudo less ssh w3m git apache2 munin monit make telnet checksecurity lockfile-progs bsd-mailx mutt cron-apt fail2ban strace bzip2 unzip dialog makepatch man info subversion git python-pygments colordiff diffutils curl gcc libgd-dev hunspell-an hunspell-ar hunspell-be hunspell-br hunspell-ko hunspell-en-us hunspell-fr hunspell-fr-modern hunspell-gl-es hunspell-kk hunspell-ml hunspell-ru hunspell-se hunspell-sv-se hunspell-de-at hunspell-de-ch hunspell-de-de hunspell-da hunspell-en-ca hunspell-hu hunspell-ne hunspell-ro hunspell-sr hunspell-vi hunspell-uz hunspell-eu-es espeak lame libwww-perl spf-tools-perl sasl2-bin spamassassin swaks libnet-ssleay-perl exim4-daemon-heavy procmail libdb-dev python3-pip` # don’t bother creating keys for tripwire, we will be deinstalling it
- `apt-get remove -y tripwire logcheck` # because this one is annoying
- `apt-get autoremove -y`
- `rsync --rsh="ssh -p 882" --archive --compress --verbose 192.71.233.105:/etc/monit/conf.d/ /etc/monit/conf.d` # no changes to `/etc/monit/monitrc`
- `rsync --rsh="ssh -p 882" --archive --compress --verbose 192.71.233.105:/etc/ssl/localcerts/ /etc/ssl/localcerts` # required for monit.pem
- `rsync --rsh="ssh -p 882" --archive --compress --verbose 192.71.233.105:/etc/munin/plugin-conf.d/ /etc/munin/plugin-conf.d`
- `rsync --rsh="ssh -p 882" --archive --compress --verbose 192.71.233.105:/etc/munin/plugins/ /etc/munin/plugins`
- `rsync --rsh="ssh -p 882" --archive --compress --verbose 192.71.233.105:/etc/munin/munin-htpasswd /etc/munin/`
- `rm /etc/munin/plugins/if_* /etc/munin/plugins/http_loadtime`
- `rsync --rsh="ssh -p 882" --archive --compress --verbose 192.71.233.105:/etc/rsyncd.conf /etc/`
- `rsync --rsh="ssh -p 882" --archive --compress --verbose 192.71.233.105:/etc/logrotate.d/alex-websites /etc/logrotate.d`
- `echo 178.209.50.237 sibirocobombus communitywiki.org emacswiki.org www.emacswiki.org campaignwiki.org rpg.alexschroeder.ch korero.org arabisch-lernen.org alexschroeder.ch oddmuse.org >> /etc/hosts`
- `for f in hardening.conf letsencrypt.conf security.conf max-uri.conf perl5.conf servername.conf log.conf; do rsync --rsh="ssh -p 882" --archive --compress --verbose 192.71.233.105:/etc/apache2/conf-available/$f /etc/apache2/conf-available; done`
- `for f in hardening.conf letsencrypt.conf security.conf max-uri.conf perl5.conf servername.conf log.conf; do a2enconf $f; done`
- `for f in other-vhosts-access-log.conf serve-cgi-bin.conf localized-error-pages.conf charset.conf; do a2disconf $d; done`
Here’s the essential info: `for f in hardening.conf letsencrypt.conf security.conf max-uri.conf perl5.conf servername.conf log.conf; do echo $f; printf %s "$f"|tr -c '-' '[-*]'; echo; grep -v '^#' $f | grep -v '^