Difference between revisions of "Bering-uClibc 7.x - User Guide - Installing the Disk Image"

From bering-uClibc
Jump to: navigation, search
(Choosing An Image File to Download)
(SSH session setup)
 
(93 intermediate revisions by the same user not shown)
Line 11: Line 11:
 
==Choosing An Image File to Download==
 
==Choosing An Image File to Download==
 
For [[Bering-uClibc 7.x]] there are several different disk image files available for download. These offer a choice of tailored variants of the same basic distribution and you should only need to download one of them - the one that best matches your requirements.
 
For [[Bering-uClibc 7.x]] there are several different disk image files available for download. These offer a choice of tailored variants of the same basic distribution and you should only need to download one of them - the one that best matches your requirements.
 +
 +
<b>All of LEAF's tarballs and .img distributions, from version 7.0.0 and up, now come up with a pre-configured web browser access to eth1 at https://192.168.1.254 </b>. The main purpose was to make the '''VGA''' or '''Serial''' console optional, but it turns out it also allows '''someone with no previous knowledge of Linux''' to easily setup the target firewall from a web page (Webconf). If it's your case make sure to establish this connection. It will all be explained later [[Bering-uClibc_7.x_-_User_Guide_-_Basic_Configuration_-_Booting_for_the_First_Time#Connecting_to_your_target_system|here]], but continue reading the rest of this page.
 +
 +
<b>For users familiar with Windows only, and with no previous knowledge of Linux, it is possible to make a bootable flash image of a distribution using Windows 10 (pro)</b>. We can do that with <code class="filename">'''7-Zip'''</code>, to unzip and untar the archive , and <code class="filename">'''syslinux'''</code> for Windows, to make the USB key bootable. For the inpatients, look here.
 +
 
The different variables are:
 
The different variables are:
 
* The Linux kernel optimisations:
 
* The Linux kernel optimisations:
Line 28: Line 33:
 
** [https://sourceforge.net/projects/leaf/files/Bering-uClibc/7.0.0 '''Bering-uClibc_x86_vga.img''']
 
** [https://sourceforge.net/projects/leaf/files/Bering-uClibc/7.0.0 '''Bering-uClibc_x86_vga.img''']
 
** [https://sourceforge.net/projects/leaf/files/Bering-uClibc/7.0.0 '''Bering-uClibc_x86_ser.img''']
 
** [https://sourceforge.net/projects/leaf/files/Bering-uClibc/7.0.0 '''Bering-uClibc_x86_ser.img''']
**  
+
** If your hardware allows booting from USB, as most modern systems do, we suggest to download and install one of the trying-out <code class="filename">.img</code> files to a USB key using '''<tt>dd</tt>''' on Linux or the '''<tt>Raspberry PI Imager</tt>''' on Linux, Windows and Macs. This will quickly familiarize you with the LEAF firewall inner workings and provide you with a fully functionnal firewall, even if it is a 7.0.0 version.
 
+
** If you don't have a separate PC running a Linux OS, you can use the 7.0.0 firewall itself as a Linux PC to download more recent version of LEAF and prepare a new bootable USB key. You will have to use command lines, but a full recipe [https://bering-uclibc.zetam.org/wiki/Bering-uClibc_7.x_-_User_Guide_-_Installing_the_Disk_Image#Copying_a_syslinux_Image_to_a_Flash_Media_using_the_firewall_itself.2C_which_is_running_a_7.0.0_USB_image is given here] for the impatients and it is easy to follow for new Linux users.
If your hardware allows booting from USB, as most modern systems do, we suggest to download and install one of the trying-out <code class="filename">.img</code> files to a USB key using '''<tt>dd</tt>''' on Linux or the '''<tt>Raspberry PI Imager</tt>''' on Linux, Windows and Macs. This will quickly familiarizes you with the LEAF firewall working and provides you with a working firewall, even if it is a 7.0.0 version.
+
  
 
If no USB boot is possible, and if in doubt, then start with the first (most standard) option in each case - in other words the combination '''<tt>i486_syslinux_vga</tt>'''.
 
If no USB boot is possible, and if in doubt, then start with the first (most standard) option in each case - in other words the combination '''<tt>i486_syslinux_vga</tt>'''.
Line 36: Line 40:
 
===A special case: the Raspberry Pi(s)===
 
===A special case: the Raspberry Pi(s)===
  
There are also tarballs and (comming up ?) bootable <code class="filename">.img</code> files available for the family of Raspberry PIs, which are the Zero and 1,2,3, and 4. Installing these is a lot simpler than for other architectures/platforms like Intels or AMDs, which usually require preparing the boot media with a boot sector and some form of boot loader like  '''syslinux'''. All PIs, in their pristine configuration, will boot from an SD card, that must simply contain some specific files, have a look [https://i.stack.imgur.com/xEB4q.png here].  
+
There are also tarballs and (comming up ?) bootable <code class="filename">.img</code> files available for the family of Raspberry PIs, which are the Zero and 1,2,3, and 4. Installing these is a lot simpler than for other architectures/platforms like Intels or AMDs, which usually require preparing the boot media with a boot sector and some form of boot loader like  '''syslinux'''. All PIs, in their pristine configuration, will boot from an SD card, that must simply contain some specific files.  
  
So for LEAF, we will simply unzip the corresponding PIn's (n=2,3,4) tarballs like <code class=filename">Bering-uClibc_7.0.x_raspberry-rpi(n).tar.gz</code> to a FAT32 formatted single partition '''SD card''', <u>nothing else</u>, as the right files are all there. For the PI Zero and PI Zero W, use the '''rpi2''' tarball. The last '''PI1''' tarball is to be found in LEAF 6.2.7. simply as <code class="filename">'''...rpi...'''</code>. The bootable <code class="filename">.img</code> files, when available, should also be copied to an '''SD card''' but using '''dd''' or the '''Raspberry PI Imager'''.
+
So for LEAF, we will simply unzip the corresponding PI(n) (n=0,1,2,3,4) tarballs like <code class=filename">Bering-uClibc_7.0.x_raspberry-rpi(n).tar.gz</code> to a FAT32 formatted single partition '''SD card''', <u>nothing else</u>, as the right files are all there. For the PI Zero and PI Zero W, use the '''rpi2''' tarball. The last '''PI1''' tarball is to be found in LEAF 6.2.7. simply as <code class="filename">'''...rpi...'''</code>.
  
 
The PIs were designed to be accessed with a HDMI monitor or TV and a USB keyboard. The LEAF tarballs are built to be used that way too. The PI Zero will need a [https://www.adafruit.com/products/2819 mini to standard HDMI adapter] and a [https://www.adafruit.com/products/1099 USB OTG micro B to A cable]. Just insert the previously prepared SD card in the PI and power it up. You will get a display on your HDMI monitor just like on a VGA display and the keyboard will act like the Linux '''tty1''' standard input device.  
 
The PIs were designed to be accessed with a HDMI monitor or TV and a USB keyboard. The LEAF tarballs are built to be used that way too. The PI Zero will need a [https://www.adafruit.com/products/2819 mini to standard HDMI adapter] and a [https://www.adafruit.com/products/1099 USB OTG micro B to A cable]. Just insert the previously prepared SD card in the PI and power it up. You will get a display on your HDMI monitor just like on a VGA display and the keyboard will act like the Linux '''tty1''' standard input device.  
  
LEAF has been basically designed to use hardware platforms that have a minimum of 2 network interface controllers (NIC) in order to act as a router/firewall, a bridge or an access point. You should be somewhat familiar with LEAF before you try setting up a PI which basically possesses only one NIC. For this reason the detailed PIs's setups have been moved to the [[Bering-uClibc_7.x_-_User_Guide_-_Advanced_Topics_-_Setting_Up_a_Raspberry_PI| Advanced Topics: Setting up a Raspberry PI]].
+
LEAF has been basically designed to use hardware platforms that have a minimum of 2 network interface controllers (NIC) in order to act as a router/firewall, a bridge or an access point. You should be somewhat familiar with LEAF before you try setting up a PI which basically has only one NIC. For this reason the detailed PIs's setups have been moved to the [[Bering-uClibc_7.x_-_User_Guide_-_Advanced_Topics_-_Setting_Up_a_Raspberry_PI| Advanced Topics: Setting up a Raspberry PI]].
  
 
==Download Location==
 
==Download Location==
Line 60: Line 64:
  
 
* On Linux:
 
* On Linux:
#Download an image file, for instance [https://sourceforge.net/projects/leaf/files/Bering-uClibc/7.0.1/Bering-uClibc_x86_ser.img/download '''Bering-uClibc_x86_ser.img''']
+
#Download an image file, for instance [https://sourceforge.net/projects/leaf/files/Bering-uClibc/7.0.0 '''Bering-uClibc_x86_ser.img''']
 
#insert your USB key and check with ''''dmesg'''', or ''''fdisk -l'''' which device your PC assigned it to... let's assume we get: ''''/dev/sdb''''
 
#insert your USB key and check with ''''dmesg'''', or ''''fdisk -l'''' which device your PC assigned it to... let's assume we get: ''''/dev/sdb''''
 
     cd <code class="filename">~/Downloads</code>
 
     cd <code class="filename">~/Downloads</code>
Line 80: Line 84:
 
These are the different ways LEAF is installed.
 
These are the different ways LEAF is installed.
  
<b>All of LEAF's tarballs and .img distributions, from version 7.0.1 and up, now come up with a pre-configured web browser access to eth1 at https://192.168.1.254 </b> . It's all explained [[Bering-uClibc_7.x_-_User_Guide_-_Basic_Configuration_-_Booting_for_the_First_Time#Connecting_to_your_target_system|here]].
+
====Copying a '''syslinux''' Image to a Flash Media from a Windows PC====
 +
 
 +
 
 +
The following steps assumes that the flash media will be prepared on a separate '''Windows 10 PC''' system using <del>a USB interface such as a 'Compact Flash-to-USB' or an 'SD-to-USB' adapter, and of course</del> a straight USB key. You can't use the target system yet which will be running [[Bering-uClibc 7.x]], as there is no way to boot it yet...... well ... unless you do [https://bering-uclibc.zetam.org/wiki/Bering-uClibc_7.x_-_User_Guide_-_Installing_the_Disk_Image#Copying_a_syslinux_Image_to_a_Flash_Media_using_the_firewall_itself.2C_which_is_running_a_7.0.0_USB_image this] ...
 +
 +
=====Preparing the Flash Media=====
 +
 
 +
 
 +
For a standard [[Bering-uClibc 7.x]] installation, the flash media must:
 +
* Be at least 130MB in size for a full installation.
 +
** By removing some of the large Packages this can be reduced significantly. 8MB is probably the absolute bare minimum.
 +
* Have a single disk partition, which is flagged as bootable.
 +
* Have a FAT32 file system on the boot partition.
 +
 
 +
=====Partition and format your media=====
 +
 
 +
''(Note: I used '''Windows 10 pro''' to do this, I don't have other Windows versions.)''
 +
 
 +
You need the right tools to do that in Windows, so let's download them:
 +
*First: go to this site [https://www.7-zip.org/ 7-Zip], (I picked it because it is popular and easy to use and '''free''').
 +
**and download a version that suits you, I picked https://www.7-zip.org/a/7z2501-x64.exe
 +
*Second: You will have to download a Windows compatible version of syslinux, a click on that link [https://www.kernel.org/pub/linux/utils/boot/syslinux/syslinux-6.03.zip syslinux-6.03] will download it.
 +
*Once downloaded, use File Explorer to go to your <code class="filename">Downloads</code> folder,
 +
**just click, the <code class="filename">7z2501-x64.exe</code> installer in the <code class="filename">Downloads</code> folder , Windows will install it in <code class="filename">C:\Program Files\7-Zip\</code> folder .
 +
**For Syslinux-6.0.3, in your <code class="filename">Downloads</code> folder, double click <code class="filename">syslinux-6.0.3.zip</code>. Click '''Extract all''' in the '''Extract folder tool''' in the Windows File Explorer pink outlined tab. Now, accept the <code class="filename">C:\Users\''username''\Downloads\syslinux-6.0.3</code> that File Explorer proposes and click <code class="filename">Extract</code>, Note: ''username'' will show your Windows '''username'''.
 +
 
 +
 
 +
Insert a USB key, and note which device it is assign to: D: , E: ... etc ... I will assume it is D: for what follows.
 +
 
 +
*Format the USB key:
 +
**in File Explorer, right click <code class="filename">USB Drive (D:)</code>, and chose <code class="filename">Format...</code>. Make sure the File system is <code class="filename">FAT32 (Default)</code> and click <code class="filename">Start</code>
 +
 
 +
*Open up a terminal window in '''administrator mode''':
 +
**Search for <code class="filename">cmd</code> in Windows search bar, and choose in the black window <code class="filename">Command Prompt System >>> Run as administrator</code>. Say YES to the allow question ...
 +
 
 +
*Make the key '''Bootable with Syslinux''':
 +
**In the, just opened, terminal window entitled: "Administrator Command Prompt", type what follows, one line at the time (the Bold part only):
 +
***C:\Windows\system32>'''cd C:\Users\'''''username'''''\Downloads\syslinux-6.03\bios\win32''', don't forget to replace ''username'' with your Windows 'username' and press ''enter''
 +
***C:\Users\''username''\Downloads\syslinux-6.03\bios\win32>'''syslinux.exe -a -m -i -s D:''', press ''enter''
 +
***Ok, maybe you want to know what this mumbu-jumbo is all about ?, well type <code class="filename">syslinux.exe</code> and find out.
 +
 
 +
*You can breathe now, there will be no more command lines ... :-)
 +
 
 +
=====Installing a distribution on the USB key=====
 +
 
 +
 
 +
Ok let's get a distribution archive from the [https://sourceforge.net/projects/leaf/files/Bering-uClibc/ Bering-uClibc] site:
 +
*in any browser on your Windows PC, enter:
 +
https://sourceforge.net/projects/leaf/files/Bering-uClibc/ in the URL or simply '''right click''' on the link
 +
 
 +
*Pick up a version, preferably the latest. For this tutorial, I picked up [https://sourceforge.net/projects/leaf/files/Bering-uClibc/7.5.1/Bering-uClibc_7.5.1_x86_64_syslinux_vga.tar.gz/download 7.5.1 x86_64 VGA]:
 +
https://sourceforge.net/projects/leaf/files/Bering-uClibc/7.5.1/Bering-uClibc_7.5.1_x86_64_syslinux_vga.tar.gz/download
 +
 
 +
*Right click on the link to start downloading the tar.gz archive. Windows will put it in your <code class="filename">Downloads</code> directory (C:\Users\''username''\Downloads\)
 +
 
 +
*Time for 7-Zip: ''(Note: 7-Zip will unpack the archive in two steps, first it unzip to tar, second untar to files)''
 +
**With Windows File Explorer, get to your <code class="filename">Downloads</code> folder, and right click <code class="filename">Bering-uClibc_7.5.1_x86_64_syslinux_vga.tar.gz</code>, and choose '''open width 7-Zip''' and choose '''Open archive'''. This will open a 7-Zip window.
 +
**In the newly opened 7-Zip window, click the blue extract bar... and accept the <code class="filename">Copy to: C:\Users\''username''\Downloads\Bering-uClibc/7.5.1/Bering-uClibc_7.5.1_x86_64_syslinux_vga.tar</code>, '''click OK'''. ''(Note the ..._vga.tar at the end of the line.)''
 +
**Still in 7-Zip window, look for the bar containing: <code class="filename">C:\Users\''username''\Downloads\Bering-uClibc/7.5.1/Bering-uClibc_7.5.1_x86_64_syslinux_vga.tar.gz\</code>, just underneath the colored icons, and '''delete the .gz\''' at the end of the line, to get to the tar archive, '''type enter'''.
 +
**Now click the blue extract bar again but this time change the destination to the USB key with: <code class="filename">Copy to: '''D:\'''</code>, '''click OK'''. 7-Zip will untar the archive to the USB key. You can also click on the '''...''' in the '''Copy to:''' window to choose the destination. 
 +
 
 +
*and we are done
 +
 
 +
* Remove the flash media from your Windows PC and proceed to the [[Bering-uClibc 7.x - User Guide - Basic Configuration|next Chapter]].
  
 
====Copying a '''syslinux''' Image to a Flash Media from a working Linux PC====
 
====Copying a '''syslinux''' Image to a Flash Media from a working Linux PC====
Line 101: Line 168:
  
  
'''The following steps assumes that the flash media will be prepared on a separate Linux PC system using a USB interface such as a 'Compact Flash-to-USB' or an 'SD-to-USB' adapter, and of course a straight USB key. You can't use the target system yet which will be running [[Bering-uClibc 7.x]], has there is no way to boot it.'''
+
'''The following steps assumes that the flash media will be prepared on a separate Linux PC system using a USB interface such as a 'Compact Flash-to-USB' or an 'SD-to-USB' adapter, and of course a straight USB key. You can't use the target system yet which will be running [[Bering-uClibc 7.x]], as there is no way to boot it yet...'''... well ... unless you do [https://bering-uclibc.zetam.org/wiki/Bering-uClibc_7.x_-_User_Guide_-_Installing_the_Disk_Image#Copying_a_syslinux_Image_to_a_Flash_Media_using_the_firewall_itself.2C_which_is_running_a_7.0.0_USB_image this]
  
 
=====Preparing the Flash Media=====
 
=====Preparing the Flash Media=====
Line 125: Line 192:
 
  sudo fdisk /dev/sdb
 
  sudo fdisk /dev/sdb
 
The safest approach is to delete any existing partition on the media.
 
The safest approach is to delete any existing partition on the media.
To delete a partition type "'''d'''", to create a new partition type "'''n'''", choose "'''p'''" for a new primary partition, "'''1'''" for the partition number, accept the default values for First and Last Sector. To change the partition system id to W95 FAT32, choose "'''t'''" and "'''b'''". Lastly make the partition bootable, type "'''a'''" and "'''1'''" to make the first partition bootable.
+
To delete a partition type "'''d'''", to create a new partition type "'''n'''", choose "'''p'''" for a new primary partition, "'''1'''" for the partition number, accept the default values for First and Last Sector. To change the partition system id to W95 FAT32, type "'''t'''" and "'''b'''". Lastly make the partition bootable, type "'''a'''" and "'''1'''" to make the first partition bootable.
  
 
You may have a look before writing the changes to your media with the command "'''p'''". It should show something like this:
 
You may have a look before writing the changes to your media with the command "'''p'''". It should show something like this:
Line 142: Line 209:
 
  sudo syslinux -i /dev/sdb1
 
  sudo syslinux -i /dev/sdb1
  
 
+
Install the MBR code on the flash media:
Install the MBR code on the flash media:  
+
Please note the '''/dev/sdb''', not sdb1, this will write the Syslinux mbr code (mbr.bin) into the master boot record of the media.
 
  dd bs=440 count=1 if=/usr/lib/syslinux/mbr/mbr.bin of=/dev/sdb
 
  dd bs=440 count=1 if=/usr/lib/syslinux/mbr/mbr.bin of=/dev/sdb
 
Please note '''/dev/sdb''', this will write the Syslinux mbr code (mbr.bin) into the master boot record of the media.
 
  
 
Running <code class="filename">syslinux -i</code> results in file <code class="filename">ldlinux.sys</code> being created in the root of the FAT32 file system. Do not attempt to edit or move this file since that will break the SYSLINUX operation.
 
Running <code class="filename">syslinux -i</code> results in file <code class="filename">ldlinux.sys</code> being created in the root of the FAT32 file system. Do not attempt to edit or move this file since that will break the SYSLINUX operation.
Line 174: Line 239:
  
 
  cd /
 
  cd /
 
 
  sudo find . | grep /syslinux/modules/bios
 
  sudo find . | grep /syslinux/modules/bios
  
Line 182: Line 246:
 
'''A very important reminder here''', before un-mounting your media: you should check that the variables <code class="filename">PKGPATH=/dev/sda1:vfat</code> in <code class="filename">/mnt/leaf.cfg</code>  and <code class="filename">LEAFCFG=/dev/sda1:vfat</code> in <code class="filename">/mnt/syslinux/syslinux.cfg</code> will point to the correct device once inserted on your target platform. For most platform <code class="filename">/dev/sda1</code> will be fine if it is the first and only media installed, but if you are using an SD card slot on your target, you might have to change <code class="filename">sda1</code> to <code class="filename">mmclbk0p1</code>.  
 
'''A very important reminder here''', before un-mounting your media: you should check that the variables <code class="filename">PKGPATH=/dev/sda1:vfat</code> in <code class="filename">/mnt/leaf.cfg</code>  and <code class="filename">LEAFCFG=/dev/sda1:vfat</code> in <code class="filename">/mnt/syslinux/syslinux.cfg</code> will point to the correct device once inserted on your target platform. For most platform <code class="filename">/dev/sda1</code> will be fine if it is the first and only media installed, but if you are using an SD card slot on your target, you might have to change <code class="filename">sda1</code> to <code class="filename">mmclbk0p1</code>.  
  
This all becomes irrelevant if you use '''leafinstall''' script to generate a new LEAF installation since UUIDs will be used to identify the medias. ( check 7.0.1 ??? I know 7.0.2 does it.)
+
This all becomes irrelevant if you use '''leafinstall''' script to generate a new LEAF installation since UUIDs will be used to identify the medias.  
  
 
Finally:
 
Finally:
Line 190: Line 254:
  
 
Remove the flash media from the Linux PC and proceed to the [[Bering-uClibc 7.x - User Guide - Basic Configuration|next Chapter]].
 
Remove the flash media from the Linux PC and proceed to the [[Bering-uClibc 7.x - User Guide - Basic Configuration|next Chapter]].
 +
 +
====Copying a syslinux Image to a Flash Media using the firewall itself, which is running a 7.0.0 USB image====
 +
 +
 +
In case you don't have an external PC running Linux, we can use the firewall PC itself if it is booted with one of the 7.0.0 USB images ([https://sourceforge.net/projects/leaf/files/Bering-uClibc/7.0.0 '''Bering-uClibc_x86_ser.img'''] or [https://sourceforge.net/projects/leaf/files/Bering-uClibc/7.0.0 '''Bering-uClibc_x86_vga.img'''] [https://bering-uclibc.zetam.org/wiki/Bering-uClibc_7.x_-_User_Guide_-_Installing_the_Disk_Image#Simple_copy_for_USB_booting , see this.]). It then becomes a suitable Linux PC since it contains all the software and files to generate a new flash media. You will have to use command lines either from a '''vga''' or '''serial''' console or from an '''ssh session''' from a browser on a Windows or Mac PC. This last '''ssh session''' might be easier to use as it will allow you to copy a large line of text when we come to the <code class="filename">wget</code> command.
 +
 +
If not already done boot your firewall PC with one of the 7.0.0 USB image.
 +
 +
If you have a '''vga''' or '''serial''' console you can skip the '''SSH session''' setup.
 +
Just log-in by typing <code class="filename">root</code> and set a strong password, then exit the <code class="filename">LEAF configuration menu</code> with <code class="filename">q</code> and proceed to [https://bering-uclibc.zetam.org/wiki/Bering-uClibc_7.x_-_User_Guide_-_Installing_the_Disk_Image#Preparing_the_Flash_Media_2 Preparing the Flash Media].
 +
 +
=====SSH session setup=====
 +
 +
As a safety precaution, for the first time you will connect to to your firewall, make sure there are no Ethernet connections between your firewall and your LAN, or your ISP hardware (modem cable). Then connect a network cable between the "external PC network port" and the "firewall internal interface port", in our case eth1, the one pre-configured with static IP address 192.168.1.254.
 +
 +
Manually set the IP address of your Linux, Windows or Mac's external PC, to a fixed address like 192.168.1.2 and a network masq of 255.255.255.0 .
 +
 +
*Open a browser on your external PC and type <code class="filename">'''http://192.168.1.254'''</code> in the '''URL''' and type <code class="filename">enter</code>
 +
 +
 +
*If you don't get a browser response, try to connect the network cable to the other(s) network port of the firewall, until you get a browser response, it will be '''eth1''' if you didn't know.
 +
 +
 +
*You will be greeted with a single active webpage, the <code class="filename">Webconf Password</code> page, asking for a user name and a password. '''You will be stuck in this page up until you do set a Username and a Password and click Apply.''' Once done, and even if the webpage does not appear to have changed, you will have total access to all of the items in the left hand Configuration column; they will be outlined in blue as you pass your mouse over them.
 +
 +
 +
*We will now configure an '''SSH''' access to your firewall. This will give you a '''CLI''' (command line interface) console equivalent to the vga or serial console that you don't have, but that we need for what follows...
 +
#Under the <code class="filename">'''Interface Style'''</code> line at the bottom of the left column,  click <code class="filename">switch to expert</code>, click <code class="filename">dropbear</code> and <code class="filename">/etc/default/dropbear</code>. At the end of the file add: <code class="filename">DB_OPTIONS=" -B "</code>, click save and restart dropbear. ''This will allow us a <u>first</u> blank password login.''
 +
#From you external PC, in a terminal window, open up an '''SSH''' session by typing:
 +
    ssh root@192.168.1.254
 +
#Login as user "root", no password is required at this point, as you will be asked to set a password for the root account, '''set a strong password'''. You will then be presented with the LEAF configuration menu, have a look at [https://bering-uclibc.zetam.org/wiki/Bering-uClibc_7.x_-_User_Guide_-_Basic_Configuration_-_Booting_for_the_First_Time#Successful_First_Boot_for_Consoles_vga_or_serial|link this paragraphe] to see what it looks like. On Windows use Putty of course but, recently, "they finally saw the light", as ssh(d) is now available in Windows 10 Pro. 
 +
#Just to be on the safe side and totally paranoid, now that the root password is set, add the comment # symbol at the beginning of the line DB_OPTIONS=" -B " you previously added in <code class="filename">/etc/default/dropbear</code>. If in doubts about what -B does, type <code class="filename">dropbear -h</code> on your new console access.
 +
 +
 +
*When done, if you want to preserve all of these changes, on the console in the '''LEAF configuration menu''' hit '''s) Save configuration''', if not there run <code class="filename">lrcfg</code>. Or use '''Webconf''' > '''Save To Disk''' > '''Backup Packages'''. Saving like that is a habit you will have to develop, it is the price to pay for having everything running in rams, but you'll learn it rather quickly after some failed configuration changes :-) .
 +
 +
 +
*Ok using the '''ssh session''' console we can proceed to the next paragraph '''Preparing the Flash Media'''
 +
 +
=====Preparing the Flash Media=====
 +
 +
 +
For a standard [[Bering-uClibc 7.x]] installation, the flash media must:
 +
* Be at least 130MB in size for a full installation.
 +
** By removing some of the large Packages this can be reduced significantly. 8MB is probably the absolute bare minimum.
 +
* Have a single disk partition, which is flagged as bootable.
 +
* Have a FAT32 file system on the boot partition. It is advised to format the disk with "-r 1024" to have enough root directory entries to install the Packages.
 +
 +
=====partition and format your media=====
 +
 +
 +
On your firewall PC running LEAF 7.0.0 Linux, insert an other flash media (USB key) on a spare USB port ... :-), and run:
 +
dmesg
 +
or
 +
fdisk -l
 +
 +
these will show which device your media was assigned to, it should be detected as: '''/dev/sdb'''... the still plugged-in 7.0.0 key is /dev/sda
 +
 +
in which case, start the fdisk utility to partition your media.
 +
fdisk /dev/sdb
 +
The safest approach is to delete any existing partition on the media.
 +
To delete a partition type "'''d'''", to create a new partition type "'''n'''", choose "'''p'''" for a new primary partition, "'''1'''" for the partition number, accept the default values for First and Last Sector. To change the partition system id to W95 FAT32, type "'''t'''" and "'''b'''". Lastly make the partition bootable, type "'''a'''" and "'''1'''" to make the first partition bootable.
 +
 +
You may have a look before writing the changes to your media with the command "'''p'''". It should show something like this:
 +
 +
Device      Boot      Start        End          Blocks      Id        System
 +
/dev/sdb1    *        2048        524287        261120        b        W95 FAT32
 +
 +
Save your changes with the command "'''w'''" and leave the fdisk utility with "'''q'''".
 +
 +
 +
Format the flash media:
 +
mkfs.vfat -r 1024 /dev/sdb1
 +
 +
Next you need to install the [http://syslinux.zytor.com/wiki/index.php/SYSLINUX SYSLINUX] bootloader onto the boot partition.
 +
Simply run:
 +
 +
syslinux -i /dev/sdb1
 +
 +
 +
Install the MBR code on the flash media:
 +
Please note '''/dev/sdb''', not sdb1, this will write the Syslinux mbr code (mbr.bin) into the master boot record of the media.
 +
cd /usr/share/syslinux
 +
dd bs=440 count=1 if=mbr.bin of=/dev/sdb
 +
 +
 +
Running <code class="filename">syslinux -i</code> results in file <code class="filename">ldlinux.sys</code> being created in the root of the FAT32 file system. Do not attempt to edit or move this file since that will break the SYSLINUX operation.
 +
 +
For [[Bering-uClibc 5.x]] the Linux kernel and the SYSLINUX configuration files have been relocated to the <code class="filename">syslinux/</code> directory of the boot disk. However, file <code class="filename">ldlinux.sys</code> should remain in the root directory.
 +
 +
 +
Mount the media:
 +
mount /dev/sdb1 /mnt
 +
cd /mnt
 +
 +
Now it is time to connect the firewall PC to the internet, with a network cable between eth0 of the firewall to the cable modem.
 +
 +
Check if eth0 was configured with a proper IP address from your ISP DHCP server
 +
ip addr
 +
 +
If everything went well, you should get a response like:
 +
3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
 +
    link/ether 00:0c:b7:53:89:10 brd ff:ff:ff:ff:ff:ff
 +
    inet 104.121.123.10/24 brd 255.255.255.255 scope global dynamic noprefixroute eth0
 +
 +
With your Windows or Mac PC, go to the LEAF download page https://sourceforge.net/projects/leaf/files/Bering-uClibc/ and pick the version you want to download and copy it's link. Here I have chosen 7.5.1 x86_64_syslinux_vga.tar.gz
 +
 +
https://sourceforge.net/projects/leaf/files/Bering-uClibc/7.5.1/Bering-uClibc_7.5.1_x86_64_syslinux_vga.tar.gz/download
 +
 +
'''notice:''' do not include the '''/download''' at the end of the line. Copying that line in '''wget''' is easier from the Windows or Mac Pc using the SSH session. On a '''vga''' or '''serial''' console you will have to type the whole line by hand.
 +
 +
run the command:
 +
wget https://sourceforge.net/projects/leaf/files/Bering-uClibc/7.5.1/Bering-uClibc_7.5.1_x86_64_syslinux_vga.tar.gz -O /mnt/distrib
 +
 +
Once done, Extract your tarball, run:
 +
 +
tar -xvzf distrib
 +
 +
Ok done, now remove the 7.0.0 USB key from your firewall, and;
 +
reboot
 +
 +
If everything went well you should have 7.5.1 running on the firewall .
  
 
====Copying an '''isolinux''' Image to CD-ROM====
 
====Copying an '''isolinux''' Image to CD-ROM====

Latest revision as of 18:39, 10 December 2025

Installing the Disk Image
Prev Bering-uClibc 7.x - User Guide Next


Contents

Choosing An Image File to Download

For Bering-uClibc 7.x there are several different disk image files available for download. These offer a choice of tailored variants of the same basic distribution and you should only need to download one of them - the one that best matches your requirements.

All of LEAF's tarballs and .img distributions, from version 7.0.0 and up, now come up with a pre-configured web browser access to eth1 at https://192.168.1.254 . The main purpose was to make the VGA or Serial console optional, but it turns out it also allows someone with no previous knowledge of Linux to easily setup the target firewall from a web page (Webconf). If it's your case make sure to establish this connection. It will all be explained later here, but continue reading the rest of this page.
For users familiar with Windows only, and with no previous knowledge of Linux, it is possible to make a bootable flash image of a distribution using Windows 10 (pro). We can do that with 7-Zip, to unzip and untar the archive , and syslinux for Windows, to make the USB key bootable. For the inpatients, look here.

The different variables are:

  • The Linux kernel optimisations:
    • i486 is the most basic and most widely compatible kernel variant, suitable for Intel 486 CPUs (or better).
    • i686 is a variant which is optimised for Intel Pentium Pro CPUs (or better) and supports multiple CPUs / CPU cores.
    • geode is a variant which is optimised for AMD Geode CPUs such as are used in e.g. the PC Engines ALIX boards.
    • wrap is a variant which is optimised for WRAP boxes based on AMD SC1100 CPU e.g. PC Engines WRAP or Soekris boxes.
    • x86_64 is a variant optimised for 64bit systems e.g. PC Engines APUs, AMDs , Intels.
  • The boot media type:
    • syslinux for flash drive or hard drive devices such as a USB or Compact Flash drive or a standard hard disk.
    • isolinux for CD-ROM devices (optionally in conjunction with a floppy disk SD card or USB key, for storing configuration changes).
    • pxelinux for PXE network booting.
  • The console type:
    • vga for a standard VGA console.
    • ser for an RS-232 Serial console.
  • The bootable trying-out images for USB: these images are version 7.0.0
    • Bering-uClibc_x86_vga.img
    • Bering-uClibc_x86_ser.img
    • If your hardware allows booting from USB, as most modern systems do, we suggest to download and install one of the trying-out .img files to a USB key using dd on Linux or the Raspberry PI Imager on Linux, Windows and Macs. This will quickly familiarize you with the LEAF firewall inner workings and provide you with a fully functionnal firewall, even if it is a 7.0.0 version.
    • If you don't have a separate PC running a Linux OS, you can use the 7.0.0 firewall itself as a Linux PC to download more recent version of LEAF and prepare a new bootable USB key. You will have to use command lines, but a full recipe is given here for the impatients and it is easy to follow for new Linux users.

If no USB boot is possible, and if in doubt, then start with the first (most standard) option in each case - in other words the combination i486_syslinux_vga.

A special case: the Raspberry Pi(s)

There are also tarballs and (comming up ?) bootable .img files available for the family of Raspberry PIs, which are the Zero and 1,2,3, and 4. Installing these is a lot simpler than for other architectures/platforms like Intels or AMDs, which usually require preparing the boot media with a boot sector and some form of boot loader like syslinux. All PIs, in their pristine configuration, will boot from an SD card, that must simply contain some specific files.

So for LEAF, we will simply unzip the corresponding PI(n) (n=0,1,2,3,4) tarballs like Bering-uClibc_7.0.x_raspberry-rpi(n).tar.gz to a FAT32 formatted single partition SD card, nothing else, as the right files are all there. For the PI Zero and PI Zero W, use the rpi2 tarball. The last PI1 tarball is to be found in LEAF 6.2.7. simply as ...rpi....

The PIs were designed to be accessed with a HDMI monitor or TV and a USB keyboard. The LEAF tarballs are built to be used that way too. The PI Zero will need a mini to standard HDMI adapter and a USB OTG micro B to A cable. Just insert the previously prepared SD card in the PI and power it up. You will get a display on your HDMI monitor just like on a VGA display and the keyboard will act like the Linux tty1 standard input device.

LEAF has been basically designed to use hardware platforms that have a minimum of 2 network interface controllers (NIC) in order to act as a router/firewall, a bridge or an access point. You should be somewhat familiar with LEAF before you try setting up a PI which basically has only one NIC. For this reason the detailed PIs's setups have been moved to the Advanced Topics: Setting up a Raspberry PI.

Download Location

Image file(s) should be downloaded from the LEAF files area on SourceForge: https://sourceforge.net/projects/leaf/files/Bering-uClibc/

For the quickest installation, look for the USB image files.

For the most basic standard Image variant, look for files named like Bering-uClibc_7.x.x_i486_isolinux_vga.tar.gz (ISO image to boot from CD-ROM) or Bering-uClibc_7.x.x_i486_syslinux_vga.tar.gz (Image to boot from USB-/Flash-/HD-drives).

It is advised to choose the latest available Bering-uClibc_7.x version.

Copying to the Installation Media

Simple copy for USB booting

The USB Images are delivered as .img files which must be copied to a USB key media using 'dd' on Linux or the 'Raspberry Pi Imager' on Windows and Macs.

These images contain a small system that is guaranty to boot from USB. This system is built with the minimum number of pre-configured packages to make it work as a "cable modem firewall". The goal here is to simplify the installation as much as possible mostly for new users but also for seasoned users who might not be fully aware of recent changes. It can then be used to evaluate/learn how LEAF works and eventually leads to the building of a more suitable/customized system by adding or removing specifics packages. To help the user even more, a built-in specialized script 'leafinstall' will allow the generation of a modern LEAF installation on popular medias like SD cards or USB keys. (check for hard disks on PCs or SSD on APU2s...)

  • On Linux:
  1. Download an image file, for instance Bering-uClibc_x86_ser.img
  2. insert your USB key and check with 'dmesg', or 'fdisk -l' which device your PC assigned it to... let's assume we get: '/dev/sdb'
    cd ~/Downloads
    dd if=Bering-uClibc_x86_ser.img of=/dev/sdb bs=1M


  • On Windows or Macs
  1. Download the 'Raspberry Pi Imager'
  2. Download the image file, again something like Bering-uClibc_x86_ser.img
  3. Insert you USB key and start 'Raspberry Pi Imager'
    Click CHOOSE OS > Use custom > find /Downloads/Bering-uClibc_x86_ser.img > Open
    Click CHOOSE SD CARD > SanDisk Cruze U Media - 15.6 GB > WRITE

  • Remove the flash media from the PC and proceed to the next Chapter.

Classical and still working other copy methods

These are the different ways LEAF is installed.

Copying a syslinux Image to a Flash Media from a Windows PC

The following steps assumes that the flash media will be prepared on a separate Windows 10 PC system using a USB interface such as a 'Compact Flash-to-USB' or an 'SD-to-USB' adapter, and of course a straight USB key. You can't use the target system yet which will be running Bering-uClibc 7.x, as there is no way to boot it yet...... well ... unless you do this ...

Preparing the Flash Media

For a standard Bering-uClibc 7.x installation, the flash media must:

  • Be at least 130MB in size for a full installation.
    • By removing some of the large Packages this can be reduced significantly. 8MB is probably the absolute bare minimum.
  • Have a single disk partition, which is flagged as bootable.
  • Have a FAT32 file system on the boot partition.
Partition and format your media

(Note: I used Windows 10 pro to do this, I don't have other Windows versions.)

You need the right tools to do that in Windows, so let's download them:

  • First: go to this site 7-Zip, (I picked it because it is popular and easy to use and free).
  • Second: You will have to download a Windows compatible version of syslinux, a click on that link syslinux-6.03 will download it.
  • Once downloaded, use File Explorer to go to your Downloads folder,
    • just click, the 7z2501-x64.exe installer in the Downloads folder , Windows will install it in C:\Program Files\7-Zip\ folder .
    • For Syslinux-6.0.3, in your Downloads folder, double click syslinux-6.0.3.zip. Click Extract all in the Extract folder tool in the Windows File Explorer pink outlined tab. Now, accept the C:\Users\username\Downloads\syslinux-6.0.3 that File Explorer proposes and click Extract, Note: username will show your Windows username.


Insert a USB key, and note which device it is assign to: D: , E: ... etc ... I will assume it is D: for what follows.

  • Format the USB key:
    • in File Explorer, right click USB Drive (D:), and chose Format.... Make sure the File system is FAT32 (Default) and click Start
  • Open up a terminal window in administrator mode:
    • Search for cmd in Windows search bar, and choose in the black window Command Prompt System >>> Run as administrator. Say YES to the allow question ...
  • Make the key Bootable with Syslinux:
    • In the, just opened, terminal window entitled: "Administrator Command Prompt", type what follows, one line at the time (the Bold part only):
      • C:\Windows\system32>cd C:\Users\username\Downloads\syslinux-6.03\bios\win32, don't forget to replace username with your Windows 'username' and press enter
      • C:\Users\username\Downloads\syslinux-6.03\bios\win32>syslinux.exe -a -m -i -s D:, press enter
      • Ok, maybe you want to know what this mumbu-jumbo is all about ?, well type syslinux.exe and find out.
  • You can breathe now, there will be no more command lines ... :-)
Installing a distribution on the USB key

Ok let's get a distribution archive from the Bering-uClibc site:

  • in any browser on your Windows PC, enter:
https://sourceforge.net/projects/leaf/files/Bering-uClibc/ in the URL or simply right click on the link
  • Pick up a version, preferably the latest. For this tutorial, I picked up 7.5.1 x86_64 VGA:
https://sourceforge.net/projects/leaf/files/Bering-uClibc/7.5.1/Bering-uClibc_7.5.1_x86_64_syslinux_vga.tar.gz/download
  • Right click on the link to start downloading the tar.gz archive. Windows will put it in your Downloads directory (C:\Users\username\Downloads\)
  • Time for 7-Zip: (Note: 7-Zip will unpack the archive in two steps, first it unzip to tar, second untar to files)
    • With Windows File Explorer, get to your Downloads folder, and right click Bering-uClibc_7.5.1_x86_64_syslinux_vga.tar.gz, and choose open width 7-Zip and choose Open archive. This will open a 7-Zip window.
    • In the newly opened 7-Zip window, click the blue extract bar... and accept the Copy to: C:\Users\username\Downloads\Bering-uClibc/7.5.1/Bering-uClibc_7.5.1_x86_64_syslinux_vga.tar, click OK. (Note the ..._vga.tar at the end of the line.)
    • Still in 7-Zip window, look for the bar containing: C:\Users\username\Downloads\Bering-uClibc/7.5.1/Bering-uClibc_7.5.1_x86_64_syslinux_vga.tar.gz\, just underneath the colored icons, and delete the .gz\ at the end of the line, to get to the tar archive, type enter.
    • Now click the blue extract bar again but this time change the destination to the USB key with: Copy to: D:\, click OK. 7-Zip will untar the archive to the USB key. You can also click on the ... in the Copy to: window to choose the destination.
  • and we are done
  • Remove the flash media from your Windows PC and proceed to the next Chapter.

Copying a syslinux Image to a Flash Media from a working Linux PC

The Images suitable for flash media (boot media type syslinux) are delivered as .tar.gz files which must be extracted onto suitably prepared flash media. The generic term "flash media" includes Compact Flash cards and USB "pen" or "thumb" drives. SD cards can also be used, but care must be taken if your target hardware has an SD card slot since Linux might then enumerate the SD card as /dev/mmcblk0 and /dev/mmcblk0p1 for the first partition. This will not be the case when this same SD card is inserted in an SD-to-USB converter in your external PC, the SD card will be seen as /dev/sdb... assuming your external PC's hard disk is already /dev/sda.

Although installing LEAF on a hard disk drive will be less reliable than on solid state devices like USB key, compact flash, SD, or SSD, the same procedure can be used. If you remember that the storage media will only be used on boot, you can always try to find a way to spin down your drive with hdparm in hdsupp.lrp, to reduce it's wear, but I have not tested this.

The structure of the files and directories within the .tar.gz file is as follows:

firmware.tgz
leaf.cfg
modules.sqfs
readme
syslinux/
  syslinux.cfg
  syslinux.dpy
  linux
*.lrp



The following steps assumes that the flash media will be prepared on a separate Linux PC system using a USB interface such as a 'Compact Flash-to-USB' or an 'SD-to-USB' adapter, and of course a straight USB key. You can't use the target system yet which will be running Bering-uClibc 7.x, as there is no way to boot it yet...... well ... unless you do this

Preparing the Flash Media

For a standard Bering-uClibc 7.x installation, the flash media must:

  • Be at least 130MB in size for a full installation.
    • By removing some of the large Packages this can be reduced significantly. 8MB is probably the absolute bare minimum.
  • Have a single disk partition, which is flagged as bootable.
  • Have a FAT32 file system on the boot partition. It is advised to format the disk with "-r 1024" to have enough root directory entries to install the Packages.
partition and format your media

On your external PC running Linux, insert your flash media, and run:

dmesg 
or
sudo fdisk -l

to see which device your media is assigned to, let's assume it is detected as: /dev/sdb...

in which case, start the fdisk utility to partition your media.

sudo fdisk /dev/sdb

The safest approach is to delete any existing partition on the media. To delete a partition type "d", to create a new partition type "n", choose "p" for a new primary partition, "1" for the partition number, accept the default values for First and Last Sector. To change the partition system id to W95 FAT32, type "t" and "b". Lastly make the partition bootable, type "a" and "1" to make the first partition bootable.

You may have a look before writing the changes to your media with the command "p". It should show something like this:

Device      Boot      Start         End           Blocks      Id         System
/dev/sdb1    *         2048        524287         261120        b         W95 FAT32

Save your changes with the command "w" and leave the fdisk utility with "q".


Format the flash media:

sudo mkfs.vfat -r 1024 /dev/sdb1

Next you need to install the SYSLINUX bootloader onto the boot partition. Simply run:

sudo syslinux -i /dev/sdb1

Install the MBR code on the flash media: Please note the /dev/sdb, not sdb1, this will write the Syslinux mbr code (mbr.bin) into the master boot record of the media.

dd bs=440 count=1 if=/usr/lib/syslinux/mbr/mbr.bin of=/dev/sdb

Running syslinux -i results in file ldlinux.sys being created in the root of the FAT32 file system. Do not attempt to edit or move this file since that will break the SYSLINUX operation.

For Bering-uClibc 5.x the Linux kernel and the SYSLINUX configuration files have been relocated to the syslinux/ directory of the boot disk. However, file ldlinux.sys should remain in the root directory (although by using the -d directory argument to syslinux this can be moved to a different pre-existing directory on the boot disk, if desired).


Mount the media:

sudo mount /dev/sdb1 /mnt
cd /mnt

Extract your tarball: extract the contents of your tar.gz downloaded file with a command like the following

sudo tar -xvzf ~/Download/Bering-uClibc/7.0.2/Bering-uClibc_7.0.2_x86_64_syslinux_serial115200.tar.gz

Note: that this assumes the downloaded file is located in your $HOME/Download directory.

Do these extra steps if you are using the *_syslinux_vga.* images

When making the flash media from an external PC, we used the built-in PC's syslinux program. Since we don't know at this stage which syslinux version was used to generate the distribution c32 files, we have to copy hdt.c32, menu.c32, vesamenu.c32, libcom32.c32 and libutil.c32 files from the built-in syslinux program we used to create ldlinux.sys to ./syslinux directory of your mounted flash media.

For instance, in SYSLINUX 6.03 these files are in syslinux-6.03/bios/com32/hdt/hdt.c32, syslinux-6.03/bios/com32/menu/menu.c32, and syslinux-6.03/bios/com32/menu/vesamenu.c32.

They can also be found in /usr/lib/syslinux/modules/bios on Debian's...

An easy way to find these files is to:

cd /
sudo find . | grep /syslinux/modules/bios


Note: You don't have to do these extra steps if you are using the *_syslinux_serial.* images since they do not use these *.c32 files, so there will be no version conflicts.

A very important reminder here, before un-mounting your media: you should check that the variables PKGPATH=/dev/sda1:vfat in /mnt/leaf.cfg and LEAFCFG=/dev/sda1:vfat in /mnt/syslinux/syslinux.cfg will point to the correct device once inserted on your target platform. For most platform /dev/sda1 will be fine if it is the first and only media installed, but if you are using an SD card slot on your target, you might have to change sda1 to mmclbk0p1.

This all becomes irrelevant if you use leafinstall script to generate a new LEAF installation since UUIDs will be used to identify the medias.

Finally:

cd 
sudo umount /mnt


Remove the flash media from the Linux PC and proceed to the next Chapter.

Copying a syslinux Image to a Flash Media using the firewall itself, which is running a 7.0.0 USB image

In case you don't have an external PC running Linux, we can use the firewall PC itself if it is booted with one of the 7.0.0 USB images (Bering-uClibc_x86_ser.img or Bering-uClibc_x86_vga.img , see this.). It then becomes a suitable Linux PC since it contains all the software and files to generate a new flash media. You will have to use command lines either from a vga or serial console or from an ssh session from a browser on a Windows or Mac PC. This last ssh session might be easier to use as it will allow you to copy a large line of text when we come to the wget command.

If not already done boot your firewall PC with one of the 7.0.0 USB image.

If you have a vga or serial console you can skip the SSH session setup. Just log-in by typing root and set a strong password, then exit the LEAF configuration menu with q and proceed to Preparing the Flash Media.

SSH session setup

As a safety precaution, for the first time you will connect to to your firewall, make sure there are no Ethernet connections between your firewall and your LAN, or your ISP hardware (modem cable). Then connect a network cable between the "external PC network port" and the "firewall internal interface port", in our case eth1, the one pre-configured with static IP address 192.168.1.254.

Manually set the IP address of your Linux, Windows or Mac's external PC, to a fixed address like 192.168.1.2 and a network masq of 255.255.255.0 .


  • If you don't get a browser response, try to connect the network cable to the other(s) network port of the firewall, until you get a browser response, it will be eth1 if you didn't know.


  • You will be greeted with a single active webpage, the Webconf Password page, asking for a user name and a password. You will be stuck in this page up until you do set a Username and a Password and click Apply. Once done, and even if the webpage does not appear to have changed, you will have total access to all of the items in the left hand Configuration column; they will be outlined in blue as you pass your mouse over them.


  • We will now configure an SSH access to your firewall. This will give you a CLI (command line interface) console equivalent to the vga or serial console that you don't have, but that we need for what follows...
  1. Under the Interface Style line at the bottom of the left column, click switch to expert, click dropbear and /etc/default/dropbear. At the end of the file add: DB_OPTIONS=" -B ", click save and restart dropbear. This will allow us a first blank password login.
  2. From you external PC, in a terminal window, open up an SSH session by typing:
   ssh root@192.168.1.254
  1. Login as user "root", no password is required at this point, as you will be asked to set a password for the root account, set a strong password. You will then be presented with the LEAF configuration menu, have a look at this paragraphe to see what it looks like. On Windows use Putty of course but, recently, "they finally saw the light", as ssh(d) is now available in Windows 10 Pro.
  2. Just to be on the safe side and totally paranoid, now that the root password is set, add the comment # symbol at the beginning of the line DB_OPTIONS=" -B " you previously added in /etc/default/dropbear. If in doubts about what -B does, type dropbear -h on your new console access.


  • When done, if you want to preserve all of these changes, on the console in the LEAF configuration menu hit s) Save configuration, if not there run lrcfg. Or use Webconf > Save To Disk > Backup Packages. Saving like that is a habit you will have to develop, it is the price to pay for having everything running in rams, but you'll learn it rather quickly after some failed configuration changes :-) .


  • Ok using the ssh session console we can proceed to the next paragraph Preparing the Flash Media
Preparing the Flash Media

For a standard Bering-uClibc 7.x installation, the flash media must:

  • Be at least 130MB in size for a full installation.
    • By removing some of the large Packages this can be reduced significantly. 8MB is probably the absolute bare minimum.
  • Have a single disk partition, which is flagged as bootable.
  • Have a FAT32 file system on the boot partition. It is advised to format the disk with "-r 1024" to have enough root directory entries to install the Packages.
partition and format your media

On your firewall PC running LEAF 7.0.0 Linux, insert an other flash media (USB key) on a spare USB port ... :-), and run:

dmesg 
or
fdisk -l

these will show which device your media was assigned to, it should be detected as: /dev/sdb... the still plugged-in 7.0.0 key is /dev/sda

in which case, start the fdisk utility to partition your media.

fdisk /dev/sdb

The safest approach is to delete any existing partition on the media. To delete a partition type "d", to create a new partition type "n", choose "p" for a new primary partition, "1" for the partition number, accept the default values for First and Last Sector. To change the partition system id to W95 FAT32, type "t" and "b". Lastly make the partition bootable, type "a" and "1" to make the first partition bootable.

You may have a look before writing the changes to your media with the command "p". It should show something like this:

Device      Boot      Start         End           Blocks      Id         System
/dev/sdb1    *         2048        524287         261120        b         W95 FAT32

Save your changes with the command "w" and leave the fdisk utility with "q".


Format the flash media:

mkfs.vfat -r 1024 /dev/sdb1

Next you need to install the SYSLINUX bootloader onto the boot partition. Simply run:

syslinux -i /dev/sdb1


Install the MBR code on the flash media: Please note /dev/sdb, not sdb1, this will write the Syslinux mbr code (mbr.bin) into the master boot record of the media.

cd /usr/share/syslinux
dd bs=440 count=1 if=mbr.bin of=/dev/sdb


Running syslinux -i results in file ldlinux.sys being created in the root of the FAT32 file system. Do not attempt to edit or move this file since that will break the SYSLINUX operation.

For Bering-uClibc 5.x the Linux kernel and the SYSLINUX configuration files have been relocated to the syslinux/ directory of the boot disk. However, file ldlinux.sys should remain in the root directory.


Mount the media:

mount /dev/sdb1 /mnt
cd /mnt

Now it is time to connect the firewall PC to the internet, with a network cable between eth0 of the firewall to the cable modem.

Check if eth0 was configured with a proper IP address from your ISP DHCP server

ip addr

If everything went well, you should get a response like:

3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
   link/ether 00:0c:b7:53:89:10 brd ff:ff:ff:ff:ff:ff
   inet 104.121.123.10/24 brd 255.255.255.255 scope global dynamic noprefixroute eth0

With your Windows or Mac PC, go to the LEAF download page https://sourceforge.net/projects/leaf/files/Bering-uClibc/ and pick the version you want to download and copy it's link. Here I have chosen 7.5.1 x86_64_syslinux_vga.tar.gz

https://sourceforge.net/projects/leaf/files/Bering-uClibc/7.5.1/Bering-uClibc_7.5.1_x86_64_syslinux_vga.tar.gz/download

notice: do not include the /download at the end of the line. Copying that line in wget is easier from the Windows or Mac Pc using the SSH session. On a vga or serial console you will have to type the whole line by hand.

run the command:

wget https://sourceforge.net/projects/leaf/files/Bering-uClibc/7.5.1/Bering-uClibc_7.5.1_x86_64_syslinux_vga.tar.gz -O /mnt/distrib

Once done, Extract your tarball, run:

tar -xvzf distrib

Ok done, now remove the 7.0.0 USB key from your firewall, and;

reboot

If everything went well you should have 7.5.1 running on the firewall .

Copying an isolinux Image to CD-ROM

The CD-ROM Images (boot media type isolinux) are delivered as .iso files which must be copied to CD-ROM media using an optical media "burning" program. Alternatively and especially for testing purposes, a Virtual PC solution (such as qemu or Virtualbox) can boot directly from a .iso file.

The structure of the files and directories within the ISO image is as follows:

firmware.tgz
isolinux/
  boot.cat
  isolinux.bin
  isolinux.cfg
  isolinux.dpy
  linux
leaf.cfg
modules.sqfs
readme
*.lrp


Install from CD-ROM to hard disk

Once you have created an ISO image file as shown above, you'll be able to boot from the ISO image. By default the Package hdsupp.lrp will be installed with all programs in place to format your already partitioned hard disk, install a bootloader and copy all files from the ISO image to the hard disk. It also makes the necessary changes to syslinux.cfg and leaf.cfg. The remaining step before reboot is eventually to toogle the bootable flag for your hard disk partition.

We assume in the following steps, that your hard disk is known as /dev/sda and you need only one partition.

Step 1: Partition your hard disk

Start the fdisk utility to partition your hard disk.

fdisk /dev/sda

To create a new partition type "n", choose "p" for a new primary partition, "1" for the partition number, accept the default values for First and Last Sector. To change the partition system id to W95 FAT32, choose "t" and "b".

You may have a look before writing the changes to your hard disk with the command "p". It should show something like this:

Device      Boot      Start         End           Blocks      Id         System
/dev/sda1             2048        524287         261120        b         W95 FAT32

Save your changes with the command "w".

Step 2: Install to hard disk

To run the installation from CD ROM to hard disk, start the LEAF configuration menu with "lrcfg". Choose "i) Install to FAT partition". It will show the available FAT partitions:

Available partitions to install LEAF:
1) /dev/sda1 - 261120 kB W95 FAT32
Select partition:

Type "1" to select your partition /dev/sda1 as installation target.

Syslinux will be installed to /dev/sda1, MBR code on /dev/sda1 will be updated.
Are you shure? (y/N)

Type "y", if you are shure and want to continue.

Format /dev/sda1? (y/N)?

Again type "y", if you are shure and want to continue. Your storage device will now be formatted.

Copy all files to storage? (y/N)?

Usually you will and respond with "y". Wait until you are requested to press any key to return.

Step 3: Toogle the bootable flag for your partition.

Last step is to toggle the bootable flag for the partition /dev/sda1. Again run fdisk.

fdisk /dev/sda

Print your partition table to screen with the command "p". It should look like this:

Device      Boot      Start         End           Blocks      Id         System
/dev/sda1    *        2048        524287         261120        b         W95 FAT32

If the asterisk is missing below the Boot row, type "a" and "1" to make the first partition bootable, and save your changes with the command "w". Otherwise leave the fdisk utility with "q".

Reboot, but be shure, that you have removed the CD from the drive before it the boot process starts.

Creating a multi-boot image with syslinux bootloader

Note1: This has only been tested with syslinux version 6.03, therefore LEAF Bering-uClibc 6.1.3 or later is required
You don't have to do all the steps in this section anymore since the same result can be obtained by running the script "leafinstall" on a working LEAF Bering-uClibc 6.1.3 or later system. The section is left here anyway as a reference.

This section describes how to create a multiboot setup with Syslinux bootloader. That way you can either have two partitions with the same setup to always have a working setup when updating the router with a new version or to have different setups side-by-side.

LEAF multiboot.png

It is assumed that you use an ISO Image (/dev/sr0) to start with, but it will also be possible to install from an USB stick (e.g. /dev/sdb), on the condition that you install the Package hdsupp.lrp, which contains essential utilities like fdisk, syslinux, etc ... The recipe is given for a graphical display, changes needed if the LEAF router only has a serial console read the section Syslinux setup for a serial console

The disk layout will be:

/dev/sda1 - the boot partition, formatted with vfat
/dev/sda2 - the first partition with LEAF formatted with ext4
/dev/sda3 - the second partition with LEAF formatted with ext4

You need to have a syslinux bootloader on all partitions and chainload from /dev/sda1. This is a restriction by Syslinux not being able to load a kernel and initrd from another partition without chainloading.

Create, format the partitions and make /dev/sda1 bootable

We will create a boot partition on /dev/sda with 4MB of size, the two data partitions /dev/sda2 and /dev/sda3 with 200MB each.

To create the partitions run

# fdisk /dev/sda
Command (m for help): n
Select (default p): p
Partition number (1-4, default 1): 1
First sector [...]: ENTER
Last sector (...): +4M

Repeat for /dev/sda2 and /dev/sda3 but change the partition number and choose +200M instead of +4M.

Make the first partition /dev/sda1 bootable

 Command (m for help): a
 Partition number (1-3, default 3): 1

With the command p (print) you can see if everything is as expected. There should be three partitions of type "Linux", where the first is marked bootable with an asterisk.

Save your changes with w.

Format the partitions

The first (boot) partition will be formatted with vfat; the remaining data partitions with ext4. Currently extlinux does not support 64bit ext4, therefor we need to be careful with format command and disable the 64bit feature. To manually disable the "64bit" feature when creating ext4 volumes, use -O ^64bit in the mke2fs (or equivalent) command. That is, an hyphen, immediately followed by an upper-case letter "O", a space character, the caret "^" symbol, followed by "64bit" (no hyphen).

# mkfs.vfat /dev/sda1
# mkfs.ext4 -O ^64bit /dev/sda2
# mkfs.ext4 -O ^64bit /dev/sda3
Mount the data source

Before moving on you may create for your convenience a second mount point to mount the data source (here the ISO image /dev/sr0) until the following tasks are finished.

# mkdir /cdrom
# mount /dev/sr0 /cdrom
Install syslinux to the boot partition install the Master Boot Record mbr and create a boot menu

To install syslinux to /dev/sda1 mount /dev/sda1 to /mnt and create the syslinux directory:

# mount /dev/sda1 /mnt
# mkdir /mnt/syslinux

Unmount /dev/sda1 and install syslinux:

# umount /mnt
# syslinux -i /dev/sda1 -d syslinux

Next we install the Master Boot Record mbr to /dev/sda:

# dd bs=440 count=1 if=/usr/share/syslinux/mbr.bin of=/dev/sda

Finally the boot menu will be created. Again mount /dev/sda1 to /mnt and copy the necessary files from the data source mounted on /dev/cdrom. In case you use a USB stick instead of the ISO image the source will be syslinux instead isolinux

# mount /dev/sda1 /mnt
# cp /cdrom/isolinux/*.c32 /mnt/syslinux
# cp /cdrom/isolinux/leaf.jpg /mnt/syslinux
# cp /cdrom/isolinux/memtest.bin /mnt/syslinux

The boot menu will be in /mnt/syslinux/syslinux.cfg and should look like this:

# Wait for 3 seconds before booting up the default entry.
TIMEOUT 30

DEFAULT sda2

UI vesamenu.c32
MENU RESOLUTION 640 480
MENU BACKGROUND leaf.jpg

MENU HIDDEN

MENU COLOR sel 7;37;40    #ff000000 #20ff8000 all
MENU COLOR border 30;44 #00000000 #00000000 none

MENU COLOR tabmsg 31;40 #ff0000ff #00000000 none
MENU COLOR cmdmark 31;40 #ff0f0f0f #00000000 none
MENU COLOR cmdline 31;40 #ff0f0f0f #00000000 none
MENU COLOR timeout_msg 31;40 #ff0f0f0f #00000000 none
MENU COLOR timeout 31;40 #ff0000ff #00000000 none

#MENU AUTOBOOT Bering-uClibc {VERSION} Automatic boot in # second{,s}...

MENU TABMSGROW 21
MENU CMDLINEROW 21
MENU TIMEOUTROW 28
MENU HIDDENROW -1

MENU BEGIN 
LABEL sda2 
  MENU LABEL Boot LEAF Bering-uClibc from /dev/sda2
  com32 chain.c32
  append hd0 2
  
LABEL sda3
  MENU LABEL Boot LEAF Bering-uClibc from /dev/sda2
  com32 chain.c32
  append hd0 3

LABEL Hardware Test
  MENU LABEL Hardware Test
  MENU CLEAR
  KERNEL hdt.c32

LABEL memtest
 linux memtest.bin
MENU END

The boot menu can be copied from /cdrom/isolinux.cfg renamed to /mnt/syslinux/syslinux.cfg

# cp /cdrom/isolinux/isolinux.cfg /mnt/syslinux/syslinux.cfg

and edited accordingly.

Unmount /dev/sda1.

Install syslinux/extlinux to /dev/sda2 and /dev/sda3

Now it's time to make /dev/sda2 and /dev/sda3 bootable for the chainloading. Therefor the bootloader needs to be installed to the mounted partitions into /syslinux and a configuration file /syslinux/syslinux.cfg needs to be provided.

For /dev/sda2 we run:

# mount -t ext4 /dev/sda2 /mnt
# mkdir /mnt/syslinux
# extlinux -i /mnt/syslinux

Create syslinux.cfg in /mnt/syslinux with the content:

DEFAULT sda2
label sda2
kernel /linux
APPEND initrd=/initrd.lrp rw root=/dev/ram0 LEAFCFG=/dev/sda2:ext4 PKGPATH=/dev/sda2:ext4 reboot=bios usb_wait=3 intel_idle.max_cstate=0 processor.max_cstate=1 VERBOSE=1 quiet

Unmount /mnt.

Repeat this step for /dev/sda3 and replace every occurence of "sda2" with "sda3".

Install LEAF to the partitions

Mount /dev/sda2 to /mnt, copy the files from data source and disable PKGPATH in leaf.cfg.

# mount -t ext4 /dev/sda2 /mnt
# cp /cdrom/* /mnt

The PKGPATH in /mnt/leaf.cfg needs to be commented and changed to

#PKGPATH=[.../dev/sda1:vfat,...]

Important is the # sign to comment the PKGPATH, which is sourced in syslinux.cfg

Unmount /mnt and repeat this step for /dev/sda3.

Unmount /cdrom and reboot. If everything went well, you'll be able to boot from /dev/sda1 and then to either boot /dev/sda2 or /dev/sda3.

Syslinux setup for a serial console

If the LEAF router has no graphical display but serial line access, setting up is similar as described above. The relevant changes are the files necessary to get the output on the serial line. The relevant changes are the files needed for the Syslinux bootloader and the menu.

LEAF multiboot serial.png

Install syslinux to the boot partition install the Master Boot Record mbr and create a boot menu

To install syslinux to /dev/sda1 mount /dev/sda1 to /mnt and create the syslinux directory:

# mount /dev/sda1 /mnt
# mkdir /mnt/syslinux

Unmount /dev/sda1 and install syslinux:

# umount /mnt
# syslinux -i /dev/sda1 -d syslinux

Next we install the Master Boot Record mbr to /dev/sda:

# dd bs=440 count=1 if=/usr/share/syslinux/mbr.bin of=/dev/sda

Finally the boot menu will be created. Again mount /dev/sda1 to /mnt and copy the necessary files from the data source mounted (usually /dev/sdb, we assume it is mounted on /mnt2, which needs to be created first). The source files will be in /mnt2/syslinux.

# mkdir /mnt2
# mount /dev/sdb1 /mnt2
# mount /dev/sda1 /mnt
# cp /mnt2/syslinux/chain.c32 /mnt/syslinux
# cp /mnt2/syslinux/libcom32.c32 /mnt/syslinux
# cp /mnt2/syslinux/libutil.c32 /mnt/syslinux
# cp /mnt2/syslinux/menu.c32 /mnt/syslinux
# cp /mnt2/syslinux/vesamenu.c32 /mnt/syslinux

The boot menu (TIMEOUT set to 20 sec) will be in /mnt/syslinux/syslinux.cfg and should look like this:

SERIAL 0 115200
DEFAULT sda2
TIMEOUT 200

UI vesamenu.c32
MENU BEGIN

MENU TITLE LEAF Bering-uClibc Boot Menu

label sda2
MENU LABEL Boot Default [sda2]
com32 chain.c32
append hd0 2

label sda3
MENU LABEL Boot Backup [sda3]
com32 chain.c32
append hd0 3
MENU END

Unmount /dev/sda1.

Install syslinux/extlinux to /dev/sda2 and /dev/sda3

Now it's time to make /dev/sda2 and /dev/sda3 bootable for the chainloading. Therefor the bootloader needs to be installed to the mounted partitions into /syslinux and a configuration file /syslinux/syslinux.cfg needs to be provided.

For /dev/sda2 we run:

# mount -t ext4 /dev/sda2 /mnt
# mkdir /mnt/syslinux
# extlinux -i /mnt/syslinux

Create syslinux.cfg in /mnt/syslinux with the content:

SERIAL 0 115200
DEFAULT sda2

label sda2
kernel /linux
APPEND initrd=/initrd.lrp rw root=/dev/ram0 LEAFCFG=/dev/sda2:ext4 PKGPATH=/dev/sda2:ext4 console=ttyS0,115200n8 reboot=bios usb_wait=3 intel_idle.max_cstate=0 processor.max_cstate=1 VERBOSE=1 quiet

Unmount /mnt.

Repeat this step for /dev/sda3 and replace every occurence of "sda2" with "sda3".

Copying a pxelinux Image to a Network Boot Server

Note: pxelinux boot support is currently under development and is not yet available in the standard Bering-uClibc 7.x downloads.

Much of the complexity of a pxelinux installation is associated with setup of the DHCP server that delivers the PXE boot filename, the TFTP server that delivers the initial boot image etc. These are not specific to Bering-uClibc 7.x and so are not covered in detail here but some guidelines and pointers to other sources of information can be found in the Network Booting Appendix.

The Images suitable for network booting (boot media type pxelinux) are delivered as .tar.gz files which must be extracted onto suitable file server(s).

The structure of the files and directories within the .tar.gz file is as follows:

tftpboot/
  bering-uclibc/
    5/
      gpxelinux.0
      pxelinux.0
      pxelinux.cfg/
        default
      pxelinux.dpy
fileserver/
  bering-uclibc/
    5/
      pxelinux/
          initrd.lrp
          linux
      firmware.tgz
      leaf.cfg
      modules.tgz
      readme
      *.lrp
File Server Protocol Selection

Bering-uClibc 7.x supports a number of different file sharing protocol options for network boot and installation (or at least it is planned to). These are:

FTP 
File Transfer Protocol, on TCP port 21
TFTP 
Trivial File Transfer Protocol, on UDP port 69
  • Note that a TFTP server is essential for delivering the initial boot image, (g)pxelinux.0, and its configuration file.
  • The same TFTP server can also be used for delivering the Linux kernel file (linux) and the initial RAM disk file (initrd.lrp).
HTTP 
HyperText Transport Protocol, on TCP port 80
SSH 
Secure SHell, on TCP port 22
  • Note that this is not supported by (g)pxelinux.0 for delivering the Linux kernel file (linux) and the initial RAM disk files (initrd.lrp nd initmod.lrp) and hence cannot be used as the only network boot protocol.

For the purposes of this document it is assumed that TFTP will be used only to deliver (g)pxelinux.0 and pxelinux.cfg/default and that an HTTP server will be used to deliver the remainder of the files.

DHCP Server Configuration

It is assumed that you know how to configure your DHCP server for PXE booting. See the Network Booting Appendix for some Hints and Tips.

In summary, the DHCP server needs to:

  • Issue an IPv4 address to the Bering-uClibc 7.x machine.
  • Specify the "next server" IP address and a PXE "boot filename". Based on the structure within the pxelinux .tar.gz file this "boot filename" probably needs to be specified as: bering-uclibc/5/gpxelinux.0 since it is normally relative to the tftpboot/ level of the directory structure.



Prev Up Next