FS Linux 11 Installation Guide

At the Installer boot menu:

Find your keyboard on the Keymap list, highlight it, and press Enter. (The most common one is American English)

The installation media is now scanned and additional installer components loaded.

You may need to locate the files requested (especially if they relate to your network or disk-drive interfaces) and place them on a USB stick which should be inserted at this stage. If you do have the required files select Yes, otherwise press Tab to select No then press Enter to continue. It may well be simpler just to use the unofficial installer images mentioned above that include all available non-free firmware.

Unless you are using DHCP (which is not advisable) you will be prompted to:

Backspace over the default hostname debian and type in the name you require (if not already retrieved via DNS), then press Enter. Enter the required Internet Domain name (if not found) and press Enter.

Twice as prompted.

Enter Desktop User for the name of the new user then press Enter to accept desktop as the username and enter a (real) password twice as prompted.

The installer now tries to set the time using NTP. If this is not possible at your site due to your firewall etc., you may need to press Enter to cancel this process.

If you started from a netinst CD image, the installer now assumes you will install only from the network, and jumps straight to the Choose your Debian archive mirror country part of the dialogue as detailed below.

If you are using DVD installer you will be prompted to scan additional DVDs. Scanning the additional DVDs (and obtaining copies of them in the first place) is entirely optional, and is only useful if you don’t have a reliable network connection to a suitable Debian mirror and hence would prefer not to download packages you could get from the DVD.

For each additional DVD you wish to scan, insert it in the drive, select Yes and press Enter to perform the scan (which takes a while.)

(If you are using DVDs, and are prompted to insert another DVD, you will need to use eject /dev/cdrom from another virtual console to do this)

Select No and press Enter to continue once you are done. If prompted, insert the “Debian GNU/Linux 11.<x>.<y> Bullseye - Official i386/amd64 Binary-1 DVD” back into the DVD-ROM drive and press Enter.

Select Yes and press Enter to use a network mirror (unless you have inadequate Internet access - but then you must scan all DVDs.)

Choose your Debian archive mirror country: Select from the list if available and press Enter. (If your country is not available choose the country nearest to you in a network connectivity sense.)

Select the fastest Debian mirror from those available.

Enter any necessary HTTP proxy information (usually left blank).

Software is downloaded briefly.

When prompted to join the popularity-contest, select No and press Enter

When prompted to choose packages, select SSH server by moving to that row with the arrow keys and pressing Space on it (unless you don’t want it).

Finally press, Enter to install the standard system.

The Debian standard system is now installed from the installation media plus any updates from the network mirror and/or security.debian.org site if they can be reached.

This can take a while, up to one and a half hours or more.

At Install GRUB to Master Boot Record select yes then select /dev/sda

When prompted, press Enter to install to the master boot record.

This step should only be needed if your CPU does not include a GPU and you do not have an add-on graphics card. In that case, you are using the motherboard graphics support. Disabling Wayland is known specifically to be necessary for the X11SCA-F motherboard, which uses the AST2500 graphics chip. If you don’t know that you need to disable Wayland, we recommend that you initially leave it enabled. Whether your choice works or not should be evident when you start the Second stage installation step below. The console may be very difficult, even impossible, to work with. In that case, please see the Wayland recovery NOTE below.

To disable Wayland:

Remove the DVD from the DVD-ROM drive (it should be auto-ejected), or unplug the USB drive, and press Enter to reboot into the newly installed system.

Switch to Virtual Console 2, by pressing Ctrl+Alt+F2.

Enter root and press Enter, then enter the root password you set earlier.

Unless you want an account that is set up to use the default desktop environment, delete the desktop user with:

Should you wish to make APT use an HTTP proxy for downloads, create the new file /etc/apt/apt.conf.d/00proxies using vi containing:

to use a proxy proxy.some.where at port 8080 for example.

Using your favourite text editor, eg vi, and comment out all cdrom entries (unless you don’t have a decent Internet connection and need to use DVDs, whereupon the dialogue presented below may differ) and check you have the equivalent of the following entries towards the top of the file, adding in contrib and/or non-free as needed:

and likewise the equivalent of the following entries towards the bottom of the file, again adding in contrib and/or non-free as needed:

(where you can use any suitable mirror instead of deb.debian.org)

Also add contrib and/or non-free to the lines referring to the security.debian.org mirror in the middle of the file.

Next tell APT to update its internal source list of packages using

So that the update mechanism will work correctly, run

In the /root/fsl11 directory, start fsadapt with

Set passwords for the oper and prog accounts with:

entering the passwords twice as prompted.

You can install some useful tools for working with the RAID, if you’re actually using it, with:

The Fourth stage installation section, below, assumes the first four of these tools have been installed. The six tools are:

where tag is the latest available release, 10.2.0 or later.

This will set the /usr2/fs link, set /usr2/fs-git permissions, and install default copies of all the FS related directories.

and enter y to confirm installation.

The FS must always be compiled as prog.

then

to confirm that everything compiled correctly (no news is good news).

Remove any DVD from the machine and restart the machine using reboot as root or Ctrl+Alt+Del whilst watching that everything starts up smoothly.

If your are using a RAID, follow the steps in this subsection to setup the second and third disks.

Your newly installed system should now be ready to be customized for your site’s requirements for a new FS installation. You will need to tailor the control files in /usr2/control and add suitable station specific software to /usr2/st, particularly antcn. See the files in the /usr2/fs/st.default/st-0.0.0 directory for starter versions of the latter.

If you have an existing FS installation you want to transfer to this machine, you will need to transfer your files and update their contents for use with FS 10.2 or later. For transferring and updating to FS 10.2, please see the appendix “Transferring an existing FS installation to FSL11” in the “FS 10.2 Update Notes” document at: https://nvi-inc.github.io/fs/releases/10/2/10.2#_transferring_an_existing_fs_installation_to_fsl11.

For stations that wish to conform to the additional security recommendations of the Center for Internet Security (CIS), move on to the CIS hardening FSL11 document.

There are a few changes you should consider for root's .bashrc file.

The readline package is used by bash, and other programs, to maintain a history of commands that can be edited and then re-executed. By default, it will retain edits of history entries that have not been re-executed. This makes the unedited history entries more difficult to locate and re-execute. Retaining the un-executed edits can be disabled for root by creating the file:

The $include /etc/inputrc line preserves the other system wide readline defaults.

You may want to add more hosts to the /etc/hosts, especially if do not have DNS. This will allow you to give a short alias to use when referring to other local machines. Even if you have DNS, you may wish to add additional aliases for your local hosts.

For use with ntpq -p, is recommended that you use a short alias as the canonical name (the first one after the IP address) for other local machines (and possibly remote ones as well). This will make the ntpq output easier to understand, particularly if the canonical names of the local machines only differ at the end of their names. That may make the differences hard to see given the short field available for the remote node ID in the ntpq output.

This subsection requires using nm-connection-editor on a graphic display (nmtui may be an option on a text terminal, but it has not been fully verified). You may need to be root or desktop to do this. All the subsections below assume you are in the program and have sufficient permissions.

If you do not need the functionality available in the Desktop environment, you can disable the desktop account. You can re-enable the account later if you need it. To disable it, execute:

You can undo this by using the -U option instead.

To prevent connecting with ssh using a key, create (or add desktop to an existing) DenyUsers line in /etc/ssh/sshd_config:

And restart sshd with:

You can undo the ssh block be removing the line (if it only has desktop) or removing desktop from the line and then restarting sshd.

If you use serial ports, it is strongly advised that you remove the ModemManager package to avoid conflicts over access to the ports. Execute this command:

If you enabled the weekly update job in fsadapt (it is strongly recommended), we recommend that you also remove the anacron package so that the job will run at a fixed time every week, even if the system is turned off for some periods of time. Execute this command:

The configuration described here (Internet site or mail sent by smarthost in the exim4 configuration, no incoming mail, reply-to filter, and modified user names), provides good support for system messages and the FS msg and rdbemsg utilities.

If mail from your system is being rejected by some servers because exim4 is not providing a Fully Qualified Domain Name (FQDN), in its HELO message, the following steps should fix the problem.

If your display sometimes starts with the wrong resolution, you may be able to configure a better resolution. The following is a description of something that worked for at least one system. The details of your system may require some changes (beyond the resolution and output name).

First you need to determine the correct resolution and output name. You may be able to do this with xrandr. If the screen currently has the correct resolution, you can just execute:

The output might look like:

Where the current screen resolution is 1920x1200 and the output name is VGA-1.

You can then generate the needed Modeline by executing:

Which might generate output:

As a test, you can make a script (use an appropriate name), that will enable that resolution. Use the output name (VGA-1 in this example) and the tokens following Modeline from above. There are three lines after the #!/bin/bash line.

Be sure to chmod u+x the file before executing.

If that is successful, you can use output name (VGA-1 in this example) and Modeline from above to make a file (you may need to create the directory first):

You should chmod the permissions for directory with o+rx and the file with o+r, if those are not already set.

You could then try restarting the display (after closing all windows) with:

or rebooting.

If there is a VLAN firewall in use on the local network, it may be necessary to use KeepAlive for TCP connections to prevent inactivity time-outs for network connections from the FS to the VLBI equipment when no activity is occurring with the system. For some devices, having the time-out break the connection may cause an issue with the number of connections available.

To use KeepAlive to prevent the inactivity time-outs, first install the package libkeepalive0:

Then add the follow lines for oper (and analogously for prog):

Then add the following alias for oper (and analogously for prog):

You will need to terminate the FS, log out, and log back in to activate these changes.

A similar alias can used to allow other individual applications to avoid the inactivity time-outs. (A better solution is available for ssh, discussed below.) It is also possible to put export LD_PRELOAD=libkeepalive.so in ~/.profile to enable it for all applications, but this may generate some error messages (in the case of xterm at least, the error is apparently benign).

If you need to have a persistent ssh connection, add the follow for oper (and analogously for prog):

This can be set selectively per remote system. The interval of 200 seconds is chosen to be less than the 300 seconds that some (possibly security hardened) servers may use.

If created the ~oper/.ssh directory, set its ownership (and analogously for prog) with:

If you use ssh as oper (and maybe prog), to run commands on other systems as part of FS operations, you may get login banners mixed in with the output. You can suppress the banners by adding the following for oper (and analogously for prog):

This will allow errors to be displayed while suppressing the login banners of remote systems. This can be set selectively per remote system.

Please check the end of the Use KeepAlive to prevent VLAN firewall inactivity time-out section for setting the ownership of ~/.ssh/config.

For good performance with NTP, please follow the recommendations in /usr2/fs/misc/ntp.txt.

Additionally, to make the ntpq -c pe output more readable for local devices, you can adjust the contents of /etc/hosts. The local devices should be listed in the file, but use a nickname (15 characters or less) that is meaningful locally in place of the canonical name (the first name after the IP address). The canonical name can be listed after the nickname.

If your system is using a RAID configuration, you may want to install the raid-events script. The script provides email notifications of when Rebuilds (and array checks) start and end. For full details on the script and installation instructions, please see the raid-events subsection in the Script descriptions section of the RAID Notes for FSL 11 document.

If you are using two systems, an operational and a spare, you may want to install the refresh_spare_usr2 script. The script can be used to backup the /usr2 partition on the operational system to the spare system. For full details on the script and installation instructions, please see the refresh_spare_usr2 subsection in the Script descriptions section of the RAID Notes for FSL 11 document.

This replaces the use of the giza package in pgperl with pgplot. It will restore the behavior of pgperl (used by plotlog) from distributions FSL10 and earlier. Full directions can be found in the INSTALL file in sub-directory libpgplot-perl.

This package uses the same pgperl source as the standard version, but it is built against pgplot instead. If pgperl receives a security update, the pgplot version will be overwritten. It is possible to prevent that if you prefer.

This section gives a recipe for upgrading, collecting best practices from this appendix and elsewhere in the FSL11 documents. Links to explanatory information are included.

All steps are to be performed by root:

If there is a kernel update available, the weekly cron job output will include a warning at the end with additional instructions depending on which type is available. There are two types of kernel updates:

Be sure to allow time to follow the instructions when planning to install these updates. As described in the ABI update warning, you will need to rebuild any out-of-tree modules after rebooting for that case. This is discussed in the Updating out-of-tree modules section below.

If an update fails, e.g., an updated kernel fails to boot or another problem is discovered, you can recover as described in FSL11 RAID document Recoverable testing section, if you were following that method, or from a shelf disk according to the FSL11 RAID document Recover from a shelf disk section if not and you have a good shelf disk.

If you do not use the weekly cron job, you can run the distributed copy of the weekly script manually to check for updates:

If there is no output, there are no updates to install.

If there is output, there are updates to install. You can install them by following the installation procedure in the Installing updates (upgrading) section above. (That section uses the alternate form of running the script given below.)

Any News items will be included in the output along with the packages to be updated. If you would like to just see any News items you can run the script with the --which=news option:

If there are updates available and no News items, you will only get the installation instructions.

You can use this form of running the script to check for updates initially, if you do not need to review which updates are available (you will still get warnings about kernel updates). As usual, you will see no output at all if there are no updates available.

In some cases, it may be necessary to remove an installed package because it has a known security flaw that has not been fixed. When a package is removed, any packages that depend on it will be removed as well. In same cases, a package that has been removed may be reinstalled later because another package that has an update recommends it, or recommends a package that depends on it.

When removing a flawed package, you should check carefully that no critical package that depends on it will be deleted as well. You can check which packages will be deleted with, as root:

The list of packages to be deleted will be displayed and you will prompted for whether to continue. If you are confident that no critical packages will be lost, you can confirm (Y). If don’t want to delete the listed packages, or need more time to think about it, you can stop (n).

Since subsequent upgrades may reinstall the flawed package, you should attempt to purge it after each upgrade. If the flawed package is not present, there should be nothing to remove. If it is present, you should reverify that nothing critical will be removed before confirming.

If you use the automatic weekly updates reminder (/etc/cron.weekly/apt-show-upgradeable), you can modify it to include a reminder about purging the flawed package, inserting, e.g.:

after:

You may also wish to adjust the white space on the apt upgrade line for alignment.

When support for Bullseye ends, currently expected at the end of August 2026, there will be no more security updates. At that time, the existing packages will subsequently be migrated to the historical Debian archive site. This will be visible in the output from the weekly cron job script as errors that the packages files can’t be found. Two steps are needed at that time:

This is useful if the computer is physically moved to a different site, its IP address changes, or its network information needs to be updated for a different reason. This is typically not needed if you use DHCP, though that may still require some of the changes in the Modify other system files step below (please let us know if you gain experience).

This subsection requires using nm-connection-editor on a graphic display (nmtui may be an option on a text terminal, but it has not been fully verified). You may need to be root or desktop to do this. This subsection assumes you are in the program and have sufficient permissions.

It is possible to increase the size of an LVM volume if there is additional room available in its volume group. These instructions assume you will be resizing a logical volume for a typical configuration. For example, for the logical volume mounted at /usr2, on RAID device /dev/md0, which is using /dev/sda2 and /dev/sdb2. Additionally, example pathnames are given in the instructions below for adjusting the size of the logical volume for /usr2. All these names may be different if you want to resize a different volume and/or your disk configuration is different.