locker.pet.tuwien.ac.at

Editor: markdown

Fileserver Setup Guide

Updated: 2025-04-28

1. System Overview

OS: Debian 12
Boot: UEFI
Root Filesystem: Encrypted with LUKS
Data Disks: Encrypted with LUKS, combined into a ZFS RAIDZ1 pool
Remote Unlock: Early-boot SSH access via Dropbear
Additional Service: Samba fileserver

2. Partitioning and Encryption

2.1 Partition Layout

/boot — Unencrypted ext4 (~1 GiB)
crypto_root — LUKS container for root filesystem
Additional disks (/dev/sdX, /dev/sdY, /dev/sdZ) — Encrypted individually with LUKS for ZFS

2.2 Encrypt Root Partition

cryptsetup luksFormat /dev/nvme0n1p3
cryptsetup open /dev/nvme0n1p3 cryptroot
mkfs.ext4 /dev/mapper/cryptroot
mount /dev/mapper/cryptroot /mnt

Add to /etc/crypttab:

sdd3_crypt UUID=9f9cbbf6-7a9a-4385-921a-a19ac82e5e98 none luks,discard

Update initramfs:

update-initramfs -u -k all

3. ZFS on Encrypted Data Disks

3.1 Install ZFS

apt install zfs-dkms zfsutils-linux

3.2 Encrypt and Open Data Disks

cryptsetup luksFormat /dev/sdX
cryptsetup open /dev/sdX zfs1_crypt
cryptsetup luksFormat /dev/sdY
cryptsetup open /dev/sdY zfs2_crypt
cryptsetup luksFormat /dev/sdZ
cryptsetup open /dev/sdZ zfs3_crypt

3.3 Create ZFS Pool

zpool create data raidz1 /dev/mapper/zfs1_crypt /dev/mapper/zfs2_crypt /dev/mapper/zfs3_crypt

Create ZFS datasets:

zfs create data/fileserver
zfs create -o compression=lz4 data/bup
zfs create data/bup/rsnapshot
zfs create data/bup/dumps
zfs create data/TimeMachineBackup

ZFS mounts automatically under /data.

3.4 Automount Encrypted Disks

Edit /etc/crypttab:

zfs1_crypt /dev/disk/by-id/ata-ST31500541AS_9XW03AK8 /root/.luks-keyfile luks
zfs2_crypt /dev/disk/by-id/ata-WDC_WD15EARS-00Z5B1_WD-WMAVU2107321 /root/.luks-keyfile luks
zfs3_crypt /dev/disk/by-id/ata-ST31500541AS_9XW03BPY /root/.luks-keyfile luks```

Update initramfs:

```bash
update-initramfs -u -k all

4. Remote Unlock with Dropbear SSH

4.1 Install Dropbear

apt install dropbear-initramfs

4.2 Configure Static IP

Edit /etc/default/grub:

GRUB_CMDLINE_LINUX="ip=128.130.140.134::128.130.140.129:255.255.255.128:locker:eno1:none"

Then update GRUB and initramfs:

update-grub
update-initramfs -u

4.3 Add SSH Key

echo 'ssh-ed25519 AAAA...' >> /etc/dropbear/initramfs/authorized_keys

4.4 Regenerate Initramfs

update-initramfs -u

Now you can SSH into the server during early boot and unlock the encrypted disks manually.

5. Samba Fileserver Setup

5.1 Requirements

Debian Linux
ZFS dataset mounted at /data/fileserver
Local Unix users with controlled UID/GID
Public read-only software share
Private authenticated files share
Only Mac clients connecting

5.2 Install Samba

sudo apt update
sudo apt install samba

5.3 Prepare ZFS Folders

sudo mkdir -p /data/fileserver/software
sudo chmod 755 /data/fileserver/software
sudo chown root:root /data/fileserver/software

5.4 Create Minimal Unix Users with UID/GID

Example for user fileshareuser. Use UID and GID from LDAP.

# Create a group first (if needed)
sudo addgroup --gid 2001 filesharegroup

# Create a system user without home directory, no shell login
sudo adduser --uid 2001 --gid 2001 --disabled-login --no-create-home fileshareuser

# Add Samba password
sudo smbpasswd -a fileshareuser

5.5 Create `/etc/samba/smb.conf`

sudo nano /etc/samba/smb.conf

Paste:

[global]
   workgroup = PET
   server string = PET Samba Server
   netbios name = PETSERVER
   security = user
   map to guest = Bad User
   smb ports = 445
   dns proxy = no

   # macOS optimization
   vfs objects = catia fruit streams_xattr
   fruit:metadata = stream
   fruit:resource = stream
   fruit:locking = none
   fruit:time machine = no

[files]
   path = /data/fileserver
   browseable = yes
   read only = no
   guest ok = no
   create mask = 0660
   directory mask = 0770

[software]
   path = /data/fileserver/software
   browseable = yes
   read only = yes
   guest ok = yes
   guest only = yes
   force user = nobody
   force group = nogroup
   fruit:resource = file
   fruit:metadata = netatalk
   fruit:model = MacSamba

5.6 Enable and Start Samba Services

sudo systemctl enable --now smbd
sudo systemctl disable --now nmbd

5.7 Advertise Server to Mac Clients

Install Avahi for Bonjour broadcasting:

sudo apt install avahi-daemon

Your server will now be visible under Network in Mac Finder as PETSERVER.local.

Scan from Linux:

avahi-browse -a
avahi-browse -rt _smb._tcp

6. Regular Maintenance

6.1 Updates

apt update
apt upgrade

6.2 ZFS Monitoring

zpool status
df -hT /data
zfs list

Scrub ZFS pools monthly:

zpool scrub data

6.3 Backup Critical Configs

cp /etc/crypttab /etc/fstab /etc/zfs/zpool.cache /root/
cp /etc/samba/smb.conf /root/smb.conf.backup

Notes

The system boots with encrypted root and encrypted ZFS data volumes.
Manual passphrase unlock is needed for /, then data disks are unlocked using stored secrets.
Early-boot Dropbear SSH access is available for remote unlocking.
Samba shares are available under /data/fileserver for authenticated users.

End of document

Original Markdown