Custom partitions

[organizedkaos]

Hello,

Is there a way to specify custom partitions using the ISO installer? The custom partitions are part of the stig requirements and currently the ISO installer does not offer this option. I attempted installing Oracle Linux 9.2/9.3 with the custom partitions and then using the network installer but then I don't have the ability (that I have found yet) to flip the install to airgap since it is installed as an online build.

[RagnarSTS]

So after one sus clones the repo, copy it onto the /home/securityonion folder so-setup-network or so-setup doesn't give you the option to do airgap anymore?
Or is the problem the whole git clone thing that appears non-functional as of last summer?

[organizedkaos]

Correct. When I clone the repo, cd into the directory and use sudo bash so-setup-network I get all the other install options except being able to choose "Standard" or "Airgap" for a standalone install. When installing from the iso I select standalone and then it asks me "Standard" or "Airgap".

[reyesj2]

Correct, if you do so-setup-network you cannot do an airgap install since the resources needed are pulled from the internet.

If you wanted to have custom partitions and then later install as airgap the easiest way will be to create a custom kickstart.
You can copy the ks.cfg from the Security Onion ISO and modify it. (add additional partitions needed)

You would then put that custom kickstart file onto a USB. Then when you boot from the ISO you'd point your server to that kickstart file by replacing inst.ks=hd:LABEL=Security-Onion..... with inst.ks=hd:LABEL=USBNAME:/customks.cfg

[organizedkaos]

@reyesj2 I was actually working on that method. I am still working out the partitions in the ks.cfg to my requirements but I was able to use a different kickstart file from the boot line. I wasn't done with my testing to say it was the answer but since you mentioned it I will gladly proceed forward with launching the custom ks as needed.

[reyesj2]

Heres an example I've done before. Based on the default ks.cfg. No particular value for the STIG partitions other than /var docker file system lives there and will need space so make sure you set it to atleast 50GB. Since they're lvms you can add additional space later, but since its xfs file system you can't shrink volumes.

Not the entire kickstart just added to the relevant portion of the kickstart

    echo -e "logvol / --fstype=xfs --vgname system --size=$(($ROOTPART*1000)) --name=root" >> $TEMPDRIVE
    # Start create partitions recommended by STIGs
    echo -e "logvol /tmp --fstype=xfs --vgname system --size=2000 --name=tmp --fsoptions=\"nodev,nosuid,noexec\"" >> $TEMPDRIVE
    echo -e "logvol swap --vgname system --size=8192 --name=swap" >> $TEMPDRIVE
    echo -e "logvol /home --fstype=xfs --vgname system --size=10000 --name=home" >> $TEMPDRIVE
    # /var contains docker images. We need to make sure it's large enough to hold them. Post soup can take 50GB
    echo -e "logvol /var --fstype=xfs --vgname system --size=50000 --name=var" >> $TEMPDRIVE
    echo -e "logvol /var/log --fstype=xfs --vgname system --size=6000 --name=varlog" >> $TEMPDRIVE
    echo -e "logvol /var/log/audit --fstype=xfs --vgname system --size=4000 --name=varlogaudit" >> $TEMPDRIVE
    echo -e "logvol /var/tmp --fstype=xfs --vgname system --size=2000 --name=vartmp"
    # End create partitions recommended by STIGs
    echo -e "logvol /nsm --fstype=xfs --vgname system --grow --size=1 --name=nsm" >> $TEMPDRIVE
    ```