Cloning preparation script for linux systems.

sysprep_linux.sh

#!/bin/bash
# Does the equivalent of sysprep for linux boxes to prepare them for cloning.
# Based on https://lonesysadmin.net/2013/03/26/preparing-linux-template-vms/
# For issues or updated versions of this script, browse to the following URL:
# https://gist.github.com/AfroThundr3007730/ff5229c5b1f9a018091b14ceac95aa55
# SPDX-License-Identifier: GPL-3.0-or-later

AUTHOR='AfroThundr'
BASENAME="${0##*/}"
MODIFIED='20240409'
VERSION='1.8.4'

sysprep.parse_args() {
    [[ -n $1 ]] || {
        printf 'No arguments specified, use -h for help.\n'
        exit 1
    }
    while [[ -n $1 ]]; do
        if [[ $1 == -v ]]; then
            printf '%s: Version %s, updated %s by %s\n' \
                "$BASENAME" "$VERSION" "$MODIFIED" "$AUTHOR"
            shift
            [[ -n $1 ]] || exit 0
        elif [[ $1 == -h ]]; then
            printf 'Cloning preparation script for linux systems.\n\n'
            printf 'Usage: %s [-v ] (-h | -y [-b] [-l <log_file>] [-s])\n\n' \
                "$BASENAME"
            printf 'Options:\n'
            printf '  -h  Display this help text.\n'
            printf '  -b  Used for firstboot (internal).\n'
            printf '  -l  Specify log file location.\n'
            printf '  -s  Shutdown on completion.\n'
            printf '  -v  Emit version header.\n'
            printf '  -y  Confirm sysprep.\n'
            exit 0
        elif [[ $1 == -b ]]; then
            FIRSTBOOT=true
            break
        elif [[ $1 == -l ]]; then
            LOGFILE=$2
            shift 2
        elif [[ $1 == -s ]]; then
            SHUTDOWN=true
            shift
        elif [[ $1 == -y ]]; then
            CONFIRM=true
            shift
        else
            printf 'Invalid argument specified, use -h for help.\n'
            exit 1
        fi
    done
}

utils.say() {
    LOGFILE=${LOGFILE:=/var/log/sysprep.log}
    if [[ -n $LOGFILE && ! $LOGFILE == no ]]; then
        [[ -f $LOGFILE ]] || UMASK=027 /usr/bin/touch "$LOGFILE"
        printf '%s: %s\n' "$(date -u +%FT%TZ)" "$@" | tee -a "$LOGFILE"
    else
        printf '%s: %s\n' "$(date -u +%FT%TZ)" "$@"
    fi
}

sysprep.apt_purge() {
    vers=$(/usr/bin/ls -tr /boot/vmlinuz-* | /usr/bin/head -n -1 |
           /usr/bin/grep -v "$(uname -r)" | /usr/bin/cut -d- -f2-)
    for i in $vers; do
        debs+="$(echo linux-{image,headers,modules}-"$i") "
    done
    /usr/bin/apt remove -qy --purge "$debs" &> /dev/null &&
        /usr/bin/apt autoremove -qy --purge &> /dev/null
}

sysprep.firstboot() {
    utils.say 'Running sysprep first-boot setup script.'
    [[ $DEBIAN_DERIV == true ]] && {
        /usr/bin/find /etc/ssh/*key &>/dev/null || {
            utils.say 'Regenerating SSH host keys...'
            /usr/sbin/dpkg-reconfigure openssh-server
        }
    }

    [[ $HOSTNAME == CHANGEME ]] && {
        utils.say 'Regenerating hostname and rebooting...'
        /usr/bin/hostnamectl set-hostname \
            "LINUX-$(tr -cd '[:upper:][:digit:]' < /dev/urandom | head -c 9)"
        /usr/bin/systemctl reboot
    }

    [[ -f /var/lib/aide/aide.db.gz ]] && {
        utils.say 'Regenerating AIDE database...'
        /usr/sbin/aide --update
        /usr/bin/mv -f /var/lib/aide/aide.db{.new,}.gz
    }

    utils.say 'Sysprep firtst-boot setup complete, disabling service.'
    /usr/bin/systemctl disable sysprep-firstboot
    exit 0
}

sysprep.clean_packages() {
    utils.say 'Removing old kernels.'
    if [[ $FEDORA_DERIV == true ]]; then
        if command -v dnf &> /dev/null; then
            rpms=$(/usr/bin/dnf repoquery --installonly --latest-limit=-1)
            /usr/bin/dnf remove -qy "$rpms"
        else
            if ! command -v package-cleanup &> /dev/null; then
                /usr/bin/yum install -qy yum-utils &> /dev/null
            fi
            /usr/bin/package-cleanup -qy --oldkernels --count=1 &> /dev/null
        fi
    elif [[ $DEBIAN_DERIV == true ]]; then
        if ! command -v purge-old-kernels &> /dev/null; then
            /usr/bin/apt install -qy byobu &> /dev/null
        fi
        /usr/bin/purge-old-kernels -qy --keep 1 &> /dev/null || sysprep.apt_purge
    fi

    utils.say 'Clearing package cache.'
    if [[ $FEDORA_DERIV == true ]]; then
        /usr/bin/yum clean all -q &> /dev/null
        /usr/bin/rm -rf /var/cache/yum/*
    elif [[ $DEBIAN_DERIV == true ]]; then
        /usr/bin/apt clean &> /dev/null
        /usr/bin/rm -rf /var/cache/apt/archives/*
    fi
    return 0
}

sysprep.clean_logs() {
    utils.say 'Clearing old logs.'
    /usr/sbin/logrotate -f /etc/logrotate.conf
    /usr/bin/find /var/log -type f -regextype posix-extended -regex \
        ".*/*(-[0-9]{8}|.[0-9]|.gz)$" -delete
    /usr/bin/rm -rf /var/log/journal && /usr/bin/mkdir /var/log/journal
    /usr/bin/rm -f /var/log/dmesg.old
    /usr/bin/rm -f /var/log/anaconda/*

    utils.say 'Clearing audit logs.'
    : > /var/log/audit/audit.log
    : > /var/log/wtmp
    : > /var/log/lastlog
    : > /var/log/grubby
    return 0
}

sysprep.clean_network() {
    utils.say 'Clearing udev persistent rules.'
    /usr/bin/rm -f /etc/udev/rules.d/70*

    utils.say 'Removing MACs/UUIDs from network sripts.'
    if [[ $FEDORA_DERIV == true ]]; then
        /usr/bin/sed -ri '/^(HWADDR|UUID)=/d' \
            /etc/sysconfig/network-scripts/ifcfg-*
    fi
    /usr/bin/sed -ri '/^(mac-address|uuid)=/d' \
        /etc/NetworkManager/system-connections/*
    return 0
}

sysprep.clean_files() {
    utils.say 'Cleaning out temp directories.'
    /usr/bin/rm -rf /tmp/*
    /usr/bin/rm -rf /var/tmp/*
    /usr/bin/rm -rf /var/cache/*

    utils.say 'Cleaning up root home directory.'
    unset HISTFILE
    : >/root/.bash_history
    /usr/bin/rm -f /root/anaconda-ks.cfg
    /usr/bin/rm -rf /root/.ssh/*
    /usr/bin/rm -rf /root/.gnupg/*
    return 0
}

sysprep.generalize() {
    utils.say 'Removing SSH host keys.'
    /usr/bin/rm -f /etc/ssh/*key*

    utils.say 'Clearing machine-id'
    : > /etc/machine-id

    utils.say 'Removing random-seed'
    /usr/bin/rm -f /var/lib/systemd/random-seed

    [[ -f /opt/McAfee/agent/bin/maconfig ]] && {
        utils.say 'Resetting McAfee Agent'
        /usr/bin/systemctl stop mcafee.ma
        command -V setenforce &>/dev/null && /usr/sbin/setenforce 0
        /opt/McAfee/agent/bin/maconfig -enforce -noguid
    }

    utils.say 'Resetting hostname.'
    /usr/bin/hostnamectl set-hostname 'CHANGEME'
    return 0
}

sysprep.setup_firstboot() {
    utils.say 'Enabling sysprep firstboot service.'
    FBSERVICE=/etc/systemd/system/sysprep-firstboot.service
    [[ -f $FBSERVICE ]] || /usr/bin/cat <<'EOF' > $FBSERVICE
[Unit]
Description=Sysprep first-boot setup tasks
[Service]
Type=simple
ExecStart=/usr/local/sbin/sysprep -y -b
[Install]
WantedBy=multi-user.target
EOF
    /usr/bin/systemctl enable sysprep-firstboot
    return 0
}

sysprep.run() {
    sysprep.parse_args "$@"

    [[ $CONFIRM == true ]] || {
        utils.say 'Confirm with -y to start sysprep.'
        exit 1
    }

    utils.say 'Beginning sysprep.'
    # shellcheck disable=SC1091
    source /etc/os-release
    if [[ $ID      =~ (fedora|rhel|centos) ||
          $ID_LIKE =~ (fedora|rhel|centos) ]]; then
        FEDORA_DERIV=true
    elif [[ $ID      =~ (debian|ubuntu|mint) ||
            $ID_LIKE =~ (debian|ubuntu|mint) ]]; then
        DEBIAN_DERIV=true
    else
        utils.say 'An unknown base linux distribution was detected.'
        utils.say 'This script works with Debian and Fedora based distros.'
        exit 1
    fi

    [[ $FIRSTBOOT == true ]] && sysprep.firstboot

    utils.say 'Stopping logging and auditing daemons.'
    /usr/bin/systemctl stop rsyslog.service
    /usr/sbin/service auditd stop

    sysprep.clean_packages

    sysprep.clean_logs

    sysprep.clean_network

    sysprep.clean_files

    sysprep.generalize

    sysprep.setup_firstboot

    utils.say 'End of sysprep.'
    [[ $SHUTDOWN == true ]] && {
        utils.say 'Shutting down the system.'
        /usr/bin/systemctl poweroff
    }
    exit 0
}

# Only execute if not being sourced
[[ ${BASH_SOURCE[0]} == "$0" ]] && sysprep.run "$@"

My apologies I did not realize I could comment on your script but I do have some feedback for you!

I've noticed what may be an issue with your script in regards to the hostname changes. It seems that certain packages complain or warn when a Linux host has a hostname that contains Upper-case characters.

Real host name can only contain lower-case characters, digits, dashes, and periods (with populated subdomains)

When I changed it to something all lowercase, the error went away, and I was allowed to change the hostname.

Looking at RFC 1178 it seems advised to use lowercase when the option is available.

• https://tr.opensuse.org/SDB:Why_should_username,_hostname_and_domainname_be_written
• https://tools.ietf.org/html/rfc1178

Seems like adjusting line 159 and 161 of your script from

        echo 'echo "LINUX-$(' \
                'dd if=/dev/urandom |' \
                'tr -cd [:upper:][:digit:] |' \

to

        echo 'echo "linux-$(' \
                'dd if=/dev/urandom |' \
                'tr -cd [:lower:][:digit:] |' \

Should be sufficient to resolve this. If there's a use-case you're aware of where having upper is better I'd love to know, I'm always trying to learn more.

Again thank you from the script - it has been a real time saver, and hopefully this feedback was valuable!

@boktai1000 I will admit that my choice of uppercasing the hostname was mostly for cosmetic reasons. The randomly generated hostname is similar to what a new Windows box will end up with after a sysprep, so I just copied that behavior.

As for software breaking on an uppercase name, the RFC doesn't actually prohibit an uppercase name, so they are still technically valid. It would seem that that particular program is making an overly strict assumption on what constitutes a valid hostname. Most implementations simply treat hostnames case-insensitively to avoid the issue, so 'LINUX' and 'linux' would be the same name.

I think I'll keep this particular quirk in for now (purely for cosmetic reasons at the moment), but if you find more info on why hostnames really should be lowercase at all times, or find more packages that break because of this, I'd be interested to know.

@AfroThundr3007730 note to self: check out https://github.com/ferricoxide/AMIgen7/blob/master/CleanChroot.sh