1

I have exhausted Redhat's syntax guide, their advanced partitioning example, and a complex partitioning example on someone's blog. I have a fairly simple setup I want to achieve.

Here is my kickstart file:

#version=DEVEL
# System authorization information
auth --enableshadow --passalgo=sha512
# Use graphical install
graphical
# Use NFS installation media
nfs --server={MY PXE SERVER IP} --dir=/path/to/centos/7/
# Run the Setup Agent on first boot
firstboot --disable
ignoredisk --only-use=sda,sdb
eula --agreed

# Keyboard layouts
keyboard --vckeymap=us --xlayouts='us'
# System language
lang en_US.UTF-8

# Network information
network  --bootproto=dhcp --device=eno16777984 --ipv6=auto --activate
network  --hostname=myhostname.example.com

# Root password
rootpw --iscrypted {REDACTED}

# System services
services --enabled="chronyd"
# System timezone
timezone America/Denver --isUtc --ntpservers=MY_NTP1.example.com,MY_NTP2.example.com

# System bootloader configuration
bootloader --append=" crashkernel=auto" --location=mbr --boot-drive=sda

# Partition clearing information
clearpart --all --initlabel

# Primary drive partition
part sda1 --size=1024 --fstype=xfs --ondisk=sda
part /boot --size=1024 --onpart=sda1
part pv.sda2 --size=1 --grow --encrypted --fstype=xfs --ondisk=sda

# LVM for sda
volgroup vg_a pv.sda2
logvol / --vgname=vg_a --size=51200 --name=vg_a-root --fstype=xfs
logvol swap --vgname=vg_a --recommended --name=vg_a-swap
logvol /home --vgname=vg_a --size=1 --grow --name=vg_a-home --fstype=xfs

# Secondary drive partition
part pv.sdb1 --size=1 --grow --encrypted --fstype=xfs --ondisk=sdb

# LVM for sdb
volgroup vg_b pv.sdb1
logvol /storage --vgname=vg_b --size=1 --grow --name=vg_b-storage --fstype=xfs

repo --name=MyRepoName --baseurl=http://myhostname.example.com/path --install

%packages
@^compute-node-environment
@base
@core
@directory-client
@scientific
chrony
kexec-tools

%end

%addon com_redhat_kdump --enable --reserve-mb='auto'

%end

I have verified it is valid using ksvalidator.

For whatever reason, when the installation GUI comes up, it tells me I need to select my installation disks. So I go in, and none of my configurations from my file seem to be applied.

In fact, the partitions from my previous installation still exist. That is, I have to decrypt the drives with my old password. So the original partitions aren't even being cleared.

Once I unencrypt them, I have to manually set mount points, reformatting, encryption, device types, etc.

Is there something obvious I am missing?

As a minor secondary question, what does --asprimary do for part? I keep seeing it everywhere but haven't found a description.

I know my general configuration outside of partitioning is correct, as I have done an automated version using

autopart --type=lvm --encrypted

but I need a custom configuration because this groups my entire sdb drive with the logical volume for /home with sda.

EDIT:

Ok so I went ahead and manually configured everything in the installation GUI to how I wanted it, and then opened up /root/anaconda.cfg to see what lines were generated. (Also note, I am finding my config in /root/original.cfg so I know its loading properly)

This is what i found for the disk configuration (everything else was the same):

clearpart --all --initlabel --drives=sda,sdb

part /storage --fstype="xfs" --size=1 --grow --encrypted
part pv.2717 --fstype="lvmpv" --ondisk=sda  --size=284543
part /boot --fstype="xfs" --ondisk=sda  --size=1024

volgroup cl_newegg00 --pesize=4096 pv.2717

logvol swap --fstype="swap" --size=28532  --encrypted --name=swap --vgname=cl_newegg00
logvol /home --fstype="xfs" --size=204802  --encrypted --name=home --vgname=cl_newegg00
logvol root --fstype="xfs" --size=51202  --encrypted --name=root --vgname=cl_newegg00

So I thought if I just replaced my config with these lines, everything should work. But I am still experiencing the same behavior, i.e. having to unlock the drives, set there mount points, set encryption, set type, etc. Seems like this is completely defeating the purpose of a kickstart file.

EDIT:

So I've made some minor changes, and switched to text mode and I've discovered in my /tmp/*.log files a couple errors:

grep ERR /tmp/*.log
.. ERR: LUKS device sda has no key/passphrase
.. ERR: LUKS device sdb has no key/passphrase

I was under the impression it would ask me for a passphrase. I see tons of bug reports in google search but many of them are not recent. I get the same results in graphical mode. Seems like what I am trying to do is not possible.

1

I believe what I've been trying to achieve is not possible. I found reports of others experiencing the same issue. There is a way to get around this though with some post installation work:

cryptsetup luksChangeKey /dev/sdX

Additionally you can create a keyfile and set up mounting at boot:

dd if=/dev/urandom of=/root/keyfile bs=1024 count=4
cryptsetup luksAddKey /dev/sdX /root/keyfile

# /etc/crypttab
sdX_crypt      /dev/sdX  /root/keyfile  luks

# /etc/fstab
/dev/mapper/sdX_crypt  /media/sdX     ext3    defaults        0       2

Note: A keyfile can't be used if the partition it is on hasn't been decrypted. So you can create keys for every partition, but to unlock everything you need to enter a passphrase for a drive with the keys on it.


I have came up with a hack that works for me, using the %pre section and bash.

%pre
#!/bin/sh

TTY=`tty`
exec < $TTY > $TTY 2> $TTY


pswd1=a
pswd2=b
while [ ! $pswd1 == $pswd2 ]; do
    read -s -p "Enter encryption passphrase: " pswd1
    echo -e ""
    read -s -p "Enter passphrase again: " pswd2
    echo -e ""
    if [ ! $pswd1 == $pswd2 ]; then
        echo -e "Password does not match. Try again."
    fi
done

PASSPHRASE=$pswd1

cat << EOF > /tmp/part-include
    ...
    part .... --passphrase=${PASSPHRASE}
    part .... --passphrase=${PASSPHRASE}
    ...
EOF

%end

%include /tmp/part-include

Fill in your custom partitioning which gets written to a file, and included as a part of the kickstart installation after the %pre bash section has been evaluated.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.