{"id":47,"date":"2016-03-28T11:54:25","date_gmt":"2016-03-28T15:54:25","guid":{"rendered":"https:\/\/cyberbisson.com\/blog\/?p=47"},"modified":"2021-07-22T21:37:18","modified_gmt":"2021-07-23T01:37:18","slug":"creating-a-gentoo-workstation-in-a-vmware-virtual-machine-2","status":"publish","type":"post","link":"https:\/\/cyberbisson.com\/blog\/2016\/03\/28\/creating-a-gentoo-workstation-in-a-vmware-virtual-machine-2\/","title":{"rendered":"Creating a Gentoo Workstation in a VMware Virtual Machine"},"content":{"rendered":"<p><!-- Title: Creating a Gentoo Workstation in a VMware Virtual Machine\n  -- Categories: Linux\/Gentoo\n  -- Tags: Gentoo KDE LDAP Linux LVM samba \"virtual machine\" VMware\n  -- FB Open Graph: https:\/\/cyberbisson.com\/editorial\/gentoo-3d-small.png --><\/p>\n<div class=\"alignright right\">\n<img decoding=\"async\" src=\"\/editorial\/gentoo-3d-small.png\">\n<\/div>\n<p>Today I\u2019m going to walk through the process of creating a development workstation on <a href=\"https:\/\/en.wikipedia.org\/wiki\/Gentoo_Linux\">Gentoo Linux<\/a> as a (VMware Workstation) virtual machine.  This is something that I do myself with somewhat high frequency, and in a way, this page contains notes to myself so that this fairly manual process becomes a great deal less manual.  Perhaps it will be interesting to you, the reader, as a Gentoo Linux installation delves deeply into Linux system-level configuration, and provides a great way to familiarize yourself with how things work.<\/p>\n<p><!--more--><\/p>\n<p>We\u2019re going to be building up a workstation in such a way that we could easily take it from the virtualized hardware, and restore it onto a bare-metal system.  Certainly this would require a kernel reconfiguration as the drivers will be different, but there are a few choices along the way that would tie us more closely with a hypervisor that I will avoid (some of those hypervisor-centric choices make life easier, so I\u2019m certainly not saying that they are the wrong choices).<\/p>\n<p>Our workstation will be enabled on the corporate network using LDAP.  Naturally, your mileage may vary, so some sections will contain placeholder settings that you will have to replace with your own specific settings.  As I take down these notes, I have the following set-up:<\/p>\n<ul>\n<li>I happen to be running a Windows 7 host with VMware Workstation 12.0.  The host OS hopefully shouldn\u2019t matter.<\/li>\n<li>My corporate network supports LDAP user accounts, Windows domains, and LDAP auto-mounted file-shares.<\/li>\n<li>I am running on a 4 year old machine with a slightly under-powered graphics card, which will come into play below.<\/li>\n<li>I\u2019ve got 8 CPU cores to play with, and 18GB of RAM, so I\u2019m basically going to have a lot of processing power left after I create my VM.<\/li>\n<\/ul>\n<p>Now, let\u2019s get into it!<\/p>\n\n<h1>Creating the VM<\/h1>\n<p>The first step is to gather our installation media.  Gentoo images may be found <a href=\"https:\/\/www.gentoo.org\/downloads\/\">here<\/a>.  We will use the <tt>x86_64<\/tt> (a.k.a, <tt>amd64<\/tt>) \u201cMinimal Installation CD\u201d to proceed.<\/p>\n<p>Create a new VM with the following settings; the points below should mirror the virtual machine creation wizard:<\/p>\n<ul>\n<li>Workstation 12.0 support.  You could probably get away with less, as I\u2019m not using massive scale or EFI.<\/li>\n<li>Select the ISO image from Gentoo for your installer image.  This manifests in the VM as a CD-ROM in the drive.<\/li>\n<li>There is no reasonably recent Linux kernel available for the \u201cSelect a Guest Operating System\u201d screen, so go ahead and pick whatever 64-bit Linux flavor amuses you.  This is really just for VMware Tools installation, which would be nice, but we have other options that work with the 4.x Linux kernel.<\/li>\n<li>We\u2019re going to do a 4 processor (1 core per processor) system with 8GB of RAM to start.  Prefer processors to cores because this lets vNUMA do its thing.  I have, however, run similar machines with 1 CPU and 4 cores, without noticeable degradation.<\/li>\n<li>Use a <em>bridged<\/em> network connection to more adequately simulate a physical workstation.<\/li>\n<li>We may as well use the SAS SCSI connector rather than the parallel one, as it appears some OSes (Windows) are considering dropping support for the non-SAS SCSI.  The default SATA connection is fine, as well, and won\u2019t affect any of the instructions to come.<\/li>\n<li>For Gentoo, 32GB is <em>more<\/em> than enough for the entire system (the final image with everything described below takes about 16GB), so that will be our disk size.  We can always add disks later for development space, and other applications.<\/li>\n<li>Before exiting the wizard, \u201ccustomize\u201d the hardware.  Specifically, go to the USB controller, and bump it up to USB 3.0.  Go to the \u201cDisplay\u201d screen, and enable 3D graphics acceleration, and (if desired) specify monitor settings.<\/li>\n<\/ul>\n<p>Once we\u2019ve created the VM, go back and edit the settings.  Now we have options to modify\u2026<\/p>\n<ul>\n<li>Use the \u201cEnhanced keyboard\u201d if available.<\/li>\n<li>Report the battery information if you have a laptop.<\/li>\n<li>Enabling VNC might be useful if you&#8217;re running Linux and don\u2019t want to bother with a lot of server-side set-up.<\/li>\n<li>Don\u2019t bother with time sync\u2014we\u2019ll just use NTP and pretend like we\u2019re running a physical server.<\/li>\n<li>You can select \u201cBoot with EFI instead of BIOS\u201d in the \u201cAdvanced\u201d settings.  <em>We will not do this,<\/em> mainly because the current physical hardware around my office uses BIOS.  Selecting EFI will also change how the kernel should be configured, so be warned.  Supposedly UEFI only allows FAT32 for the boot partition\u2019s file-system, which is pretty unacceptable as well.<\/li>\n<\/ul>\n<h1>Booting Into the Installer<\/h1>\n<p><em>Let\u2019s power this bad-boy on!<\/em><\/p>\n<p>If you encounter a message about not being able to use 3D acceleration, you may have a graphics card on your host that doesn\u2019t support the latest-and-greatest version of DirectX.  Now you have to go into your VM\u2019s VMX file, and add the following (power off the machine, and close it in the Workstation UI first):<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">mks.enableD3DRenderer = \"TRUE\"\nmks.enableDX11Renderer = \"FALSE\"\nmks.gl.allowBlacklistedDrivers = \"TRUE\"\n<\/pre>\n<p>In older versions of VMware Workstation, you shouldn\u2019t see a problem, but recently (v12) the graphics rendering has been re-worked such that my aging hardware needs this work-around.<\/p>\n<p>After powering on, you should have booted cleanly into Gentoo\u2019s minimal OS.  First, we will want to set up SSH access because the Linux console is quite slow and can actually block commands\u2019 execution while waiting on <tt>stdout<\/tt>.  Of course, connecting to SSH also lets me copy from this page into the terminal.<\/p>\n<ul>\n<li>Update your root password to something memorable (<tt>passwd root<\/tt>).<\/li>\n<li>Check with <tt>\/etc\/ssh\/sshd_config<\/tt> that the <tt>PermitRootLogin<\/tt> option has been set to <tt>yes<\/tt>.<\/li>\n<li>Run: <tt>\/etc\/init.d\/sshd start<\/tt><\/li>\n<li>Check your IP (with \u201c<tt>ifconfig<\/tt>\u201d or \u201c<tt>ip addr<\/tt>\u201d), and now you can access the VM with SSH.<\/li>\n<\/ul>\n<p>Now it\u2019s time to bust out the old <a href=\"https:\/\/wiki.gentoo.org\/wiki\/Handbook:AMD64\">Gentoo Handbook (for AMD64)<\/a>.  This is the canonical (and quite well detailed) instruction manual for how to install and set-up Gentoo.  It explains what we\u2019re doing here in less terse (but also less specific) verbiage.<\/p>\n<h1>Setting Up Disks<\/h1>\n<p>Master Boot Record (MBR) is fairly straightforward to set-up with <tt>fdisk<\/tt>, but GUID Partition Table (GPT) allows partitions larger than 2TB, so we\u2019ll use that.  Note that Windows will not boot in BIOS mode if it sees a GPT label, so dual boot would not be possible on a physical box with Windows and Linux.  This is not a concern for us\u2014especially with virtual machines where we could just create a virtual Windows installation instead of a dual-boot.<\/p>\n<h2>Layout<\/h2>\n<p>We\u2019re aiming for a disk layout like this:<\/p>\n<table class=\"sortable\">\n<caption>Potential File-system Layout<\/caption>\n<tbody>\n<tr>\n<th>Mount Point<\/th>\n<th class=\"unsortable\">Size<\/th>\n<th>FS<\/th>\n<th>Device<\/th>\n<th class=\"unsortable\">Notes<\/th>\n<\/tr>\n<tr>\n<td><tt>\/boot<\/tt><\/td>\n<td>256MB<\/td>\n<td>ext2<\/td>\n<td><tt>\/dev\/sda1<\/tt><\/td>\n<td>Only contains kernel and bootloader.<\/td>\n<\/tr>\n<tr>\n<td>(swap)<\/td>\n<td>2GB<\/td>\n<td>swap<\/td>\n<td><tt>\/dev\/sda2<\/tt><\/td>\n<td>Ideally, match the RAM size.<\/td>\n<\/tr>\n<tr>\n<td><tt>\/<\/tt><\/td>\n<td>1GB<\/td>\n<td>ext4<\/td>\n<td><tt>\/dev\/sda3<\/tt><\/td>\n<td>Basic system functionality here.<\/td>\n<\/tr>\n<tr>\n<td><tt>\/opt<\/tt><\/td>\n<td>2GB<\/td>\n<td>ext4<\/td>\n<td><tt>\/dev\/sysvg0\/opt<\/tt><\/td>\n<td>Useful for manual installations.<\/td>\n<\/tr>\n<tr>\n<td><tt>\/tmp<\/tt><\/td>\n<td>1GB<\/td>\n<td>ext4<\/td>\n<td><tt>\/dev\/sysvg0\/tmp<\/tt><\/td>\n<td>Temporary space.<\/td>\n<\/tr>\n<tr>\n<td><tt>\/usr<\/tt><\/td>\n<td>16GB<\/td>\n<td>ext4<\/td>\n<td><tt>\/dev\/sysvg0\/usr<\/tt><\/td>\n<td>Majority of application data.<\/td>\n<\/tr>\n<tr>\n<td><tt>\/var<\/tt><\/td>\n<td>6GB<\/td>\n<td>ext4<\/td>\n<td><tt>\/dev\/sysvg0\/var<\/tt><\/td>\n<td>Logs and so on.<\/td>\n<\/tr>\n<tr>\n<td><tt>\/var\/tmp\/portage<\/tt><\/td>\n<td>16GB<\/td>\n<td>ext4<\/td>\n<td><tt>\/dev\/datvg0\/bldtmp0<\/tt><\/td>\n<td>Useful for building large packages (LibreOffice, Firefox).<\/td>\n<\/tr>\n<tr>\n<td><tt>\/stgdev<\/tt><\/td>\n<td>??GB<\/td>\n<td>ext4<\/td>\n<td><tt>\/dev\/datvg1\/stgdev0<\/tt><\/td>\n<td>Whatever space required for development.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Notice that we\u2019re calling for at least three Logical Volumes\u2014<tt>sysvg0<\/tt>, <tt>datvg0<\/tt>, and <tt>datvg1<\/tt>.  The <tt>sysvg0<\/tt> volume contains the system, and will occupy the 32GB disk that we\u2019ve allocated.  For <tt>datvg0<\/tt> (intended to hold temporary, large-size data) and <tt>datvg1<\/tt> (intended for development file-systems), we\u2019ll leave the disk backing as an exercise for the reader.  What we haven\u2019t listed here (and we will get to it next) is that the GRUB boot-loader needs a dedicated partition for its bits with GPT (not MBR, though)\u2014just 1\u20132MB will be fine, and its not mountable, so not worth adding to the table.<\/p>\n<h2>Configuring<\/h2>\n<p>The first thing we need to do now is set up the disk drives and file systems.<\/p>\n<h3>File-systems<\/h3>\n<p>Run \u201c<tt>parted -a optimal<\/tt>\u201d on your disk (likely <tt>\/dev\/sda<\/tt>).<\/p>\n<ul>\n<li>Create the label: <tt>mklabel gpt<\/tt><\/li>\n<li>Create the partitions:\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">mkpart primary ext2 1MiB 257MiB\nset 1 boot on\nname 1 BOOT0\n\nmkpart primary linux-swap 257MiB 2305MiB\nname 2 SWAP0\n\nmkpart primary ext4 2305MiB 3329MiB\nname 3 GENTOO_ROOT0\n\nmkpart primary 3329MiB 3331MiB\nname 4 GRUB0\nset 4 bios_grub on\n\nmkpart primary 3332MiB 100%\nname 5 SYSVG0\nset 5 lvm on\n<\/pre>\n<\/li>\n<\/ul>\n<p>You will notice that the numerical IDs for the GPT partitions correspond exactly to what the kernel adds to the <tt>\/dev<\/tt> directory.  Since we edited <tt>\/dev\/sda<\/tt>, the device for <tt>BOOT0<\/tt> will show up as <tt>\/dev\/sda1<\/tt>.<\/p>\n<p>I\u2019d like to throw in the following flags, but they don\u2019t seem to be implemented.  Perhaps they are only for UEFI.<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">set 2 swap on\nset 3 root on\n<\/pre>\n<p>Now let\u2019s create the Logical Volume Manager (LVM) set-up.  I love LVM\u2014especially for VMs because creating a virtual disk is as difficult as writing a new file to the host\u2019s file system.  This means if I\u2019m running out of space, I just add another disk with what I need and LVM gives the flexibility to expand my undersized file-system.<\/p>\n<ul>\n<li>First we\u2019ll add the physical volume to the system: <tt>pvcreate \/dev\/sda5<\/tt><\/li>\n<li>Next, create the Volume Group: <tt>vgcreate sysvg0 \/dev\/sda5<\/tt><\/li>\n<li>Finally, we will create the logical volumes as follows:\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">lvcreate -n opt0 -L 2G sysvg0\nlvcreate -n tmp0 -L 1G sysvg0\nlvcreate -n usr0 -L 16G sysvg0\nlvcreate -n var0 -L 6G sysvg0\n<\/pre>\n<\/li>\n<\/ul>\n<p>Now, let\u2019s make the file systems:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">mkfs -t ext2 -L BOOT0 \/dev\/sda1\nmkswap -L SWAP0 \/dev\/sda2\nmkfs -t ext4 -L GENTOO_ROOT0 \/dev\/sda3\n\nmkfs -t ext4 -L OPT0 \/dev\/sysvg0\/opt0\nmkfs -t ext4 -L TMP0 \/dev\/sysvg0\/tmp0\n\nmkfs -t ext4 -L GENTOO_USR0 -O sparse_super \/dev\/sysvg0\/usr0\nmkfs -t ext4 -L VAR0 -O sparse_super \/dev\/sysvg0\/var0\n<\/pre>\n<p>I give them labels, but I never really use the label.  You would specify this instead of the device name in <tt>\/etc\/fstab<\/tt>, which would make things more tolerable to device name changes.  Also note that I haven\u2019t really specified many file-system options.  The ext4 file-system is good at analyzing a disk partition and selecting reasonable defaults for performance.<\/p>\n<p>Now that we\u2019ve created all the storage, it\u2019s time to actually mount and use it.  This is a skeletal layout of what our new system will look like, and we\u2019re about to drop real files onto these file-systems.<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">swapon \/dev\/sda2\n\nmount \/dev\/sda3 \/mnt\/gentoo\ncd \/mnt\/gentoo\nmkdir -p boot opt stgdev tmp usr var\n\nmount \/dev\/sda1 boot\nmount \/dev\/sysvg0\/opt0 opt\nmount \/dev\/sysvg0\/tmp0 tmp\nmount \/dev\/sysvg0\/usr0 usr\nmount \/dev\/sysvg0\/var0 var\nchmod 1777 tmp\n\nmkdir -p var\/tmp\/portage\n<\/pre>\n<h3>Installing Gentoo Staging<\/h3>\n<p>Now that we have persistent storage, we will put down a snapshot of a basic OS.  From this snapshot, we will be able to compile packages, and ultimately install the software we really want to run.<\/p>\n<p>Just to be safe, let\u2019s give the clock a quick update.  I\u2019m going to:<\/p>\n<ul>\n<li>Set the time-zone to my local one: <tt>export TZ=EST5EDT<\/tt><\/li>\n<li>Set the time: <tt>date MMDDhhmmYYYY<\/tt><\/li>\n<\/ul>\n<p>Download the images as described in the <a href=\"https:\/\/wiki.gentoo.org\/wiki\/Handbook:AMD64\/Installation\/Stage\">Gentoo Handbook<\/a>.  Make sure the following file lives under your <tt>\/mnt\/gentoo<\/tt> directory.  There used to be a few, but as of this article, there is only <tt>stage3-amd64-YYYYMMDD.tar.bz2<\/tt> (from \u201c<tt>releases\/amd64\/autobuilds\/current-stage3-amd64<\/tt>\u201d).<\/p>\n<p>Now extract the \u201cstage\u201d archive:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">tar -xvjpf stage3-amd64-*.tar.bzip.bz2 --xattrs -C \/mnt\/gentoo\n<\/pre>\n<p>Now that we have a basic system on the disk, we should put down an <tt>\/etc\/fstab<\/tt>.  It will look something like this:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\"># &lt;fs&gt;\t\t\t&lt;mountpoint&gt;\t\t&lt;type&gt;\t&lt;opts&gt;\t\t\t\t\t\t&lt;dump\/pass&gt;\n\/dev\/hdc\t\t\/media\/cdrom\t\tauto\tnoauto,ro\t\t\t\t\t0 0\n\/dev\/fd0\t\t\/media\/floppy\t\tauto\tnoauto\t\t\t\t\t\t0 0\n\nproc\t\t\t\/proc\t\t\tproc\tnosuid,nodev,noexec,relatime\t\t\t0 0\nsysfs\t\t\t\/sys\t\t\tsysfs\tnosuid,nodev,noexec,relatime\t\t\t0 0\n\n\/dev\/sda3\t\t\/\t\t\text4\tnoatime,user_xattr,acl,barrier=1,data=ordered\t0 1\n\/dev\/sda2\t\tnone\t\t\tswap\tsw\t\t\t\t\t\t0 0\n\/dev\/sda1\t\t\/boot\t\t\text2\tnoauto,relatime,errors=continue\t\t\t1 2\n\/dev\/sysvg0\/usr0\t\/usr\t\t\text4\tnoatime,user_xattr,acl,barrier=1,data=ordered\t0 0\n\/dev\/sysvg0\/var0\t\/var\t\t\text4\tnoatime,user_xattr,acl,barrier=1,data=ordered\t0 0\n\/dev\/sysvg0\/tmp0\t\/tmp\t\t\text4\tnoatime,user_xattr,acl,barrier=1,data=ordered\t0 0\n\/dev\/sysvg0\/opt0\t\/opt\t\t\text4\tnoatime,user_xattr,acl,barrier=1,data=ordered\t0 0\n\n\/dev\/datvg0\/stgdev0\t\/stgdev\t\t\text4\tnoatime,user_xattr,acl,barrier=1,data=ordered\t0 0\n\/dev\/datvg0\/bldtmp0\t\/var\/tmp\/portage\text2\tnoauto,noatime\t\t\t\t\t0 0\n\n# This is my Windows machine, which is not in DNS...\n#\/\/10.11.12.13\/c$\t\/mnt\/windows-mach1\/c\tcifs\tnoauto,user=mbisson,dom=CORPDOMAIN,uid=12345,gid=567,dir_mode=0700,file_mode=0600\t0 0\n#\/\/10.11.12.13\/f$\t\/mnt\/windows-mach1\/f\tcifs\tnoauto,user=mbisson,dom=CORPDOMAIN,uid=12345,gid=567,dir_mode=0700,file_mode=0600\t0 0\n#\/\/10.11.12.13\/USB\t\/mnt\/windows-mach1\/usb\tcifs\tnoauto,user=mbisson,dom=CORPDOMAIN,uid=12345,gid=567,dir_mode=0700,file_mode=0600\t0 0\n<\/pre>\n<h1>Building A New System<\/h1>\n<p>Since we have finished with the disks, we can start to make the system real.  The first thing we do is configure the system-wide settings that will be used to build everything.  Edit <tt>etc\/portage\/make.conf<\/tt>, and make it like this:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\"># Please consult \/usr\/share\/portage\/config\/make.conf.example for a more\n# detailed example.\nCFLAGS=\"-O2 -march=native -fno-stack-protector -pipe\"\nCXXFLAGS=\"${CFLAGS}\"\n# WARNING: Changing your CHOST is not something that should be done lightly.\n# Please consult http:\/\/www.gentoo.org\/doc\/en\/change-chost.xml before changing.\nCHOST=\"x86_64-pc-linux-gnu\"\n\n# These are the USE flags that were used in addition to what is provided by the\n# profile used for building.\nUSE=\"-systemd ldap nfs offensive samba syslog\"\nCPU_FLAGS_X86=\"avx avx2 mmx mmxext sse sse2 sse3 ssse3 sse4_1 sse4_2\"\nMAKEOPTS=\"-j5\"\nFEATURES=\"-preserve-libs\"\nVIDEO_CARDS=\"vmware\"\nLINGUAS=\"en it ja\"\n\nGENTOO_MIRRORS=\"http:\/\/mirrors.rit.edu\/gentoo\/ http:\/\/mirror.lug.udel.edu\/pub\/gentoo\/\"\n\nPORTDIR=\"\/usr\/portage\"\nDISTDIR=\"${PORTDIR}\/distfiles\"\nPKGDIR=\"${PORTDIR}\/packages\"\n<\/pre>\n<p><em>Beware of the compiler option, \u201c<tt>-fno-stack-protector<\/tt>\u201d.<\/em>  It\u2019s probably best to leave it out, frankly, as I\u2019ve just kept it here because of a na\u00efve perception of reduced performance that is based on nothing.  Also, strip down <tt>LINGUAS<\/tt> to whatever languages you prefer.<\/p>\n<p>Now do:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">mkdir \/mnt\/gentoo\/etc\/portage\/repos.conf\ncp \/mnt\/gentoo\/usr\/share\/portage\/config\/repos.conf \/mnt\/gentoo\/etc\/portage\/repos.conf\/gentoo.conf\n<\/pre>\n<p>Since your network admin may block rsync traffic, you may wish to edit <tt>gentoo.conf<\/tt> so that <tt>sync-type<\/tt> is set to \u201c<tt>webrsync<\/tt>\u201d, and comment out <tt>sync-uri<\/tt>.<\/p>\n<h2>Entering the New System<\/h2>\n<p>Now we\u2019re going to <tt>chroot<\/tt> into the new system so we can begin manipulating it from there.  Perform the following steps to bring all the data from the installer\u2019s environment into our new system:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">cp -L \/etc\/resolv.conf \/mnt\/gentoo\/etc\/\nmount -t proc proc \/mnt\/gentoo\/proc\nmount --rbind \/sys \/mnt\/gentoo\/sys\nmount --make-rslave \/mnt\/gentoo\/sys\nmount --rbind \/dev \/mnt\/gentoo\/dev\nmount --make-rslave \/mnt\/gentoo\/dev\n<\/pre>\n<p>Now enter your system:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">chroot \/mnt\/gentoo \/bin\/bash\nsource \/etc\/profile\ncp \/proc\/mounts \/etc\/mtab\n<\/pre>\n<h2>Rebuilding the Stage<\/h2>\n<p>First, let\u2019s unmask some really interesting packages.  Create the following files with the following content:<\/p>\n<ul>\n<li><tt>\/etc\/portage\/package.accept_keywords\/clang<\/tt>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">sys-devel\/clang ~amd64\nsys-devel\/llvm  ~amd64\n<\/pre>\n<\/li>\n<li><tt>\/etc\/portage\/package.accept_keywords\/compiz<\/tt>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\"># All the following are required to use Compiz\ndev-python\/compizconfig-python         ~amd64\nx11-libs\/compiz-bcop                   ~amd64\nx11-libs\/compizconfig-backend-kconfig4 ~amd64\nx11-libs\/libcompizconfig               ~amd64\nx11-misc\/ccsm                          ~amd64\nx11-plugins\/compiz-plugins-extra       ~amd64\nx11-plugins\/compiz-plugins-main        ~amd64\nx11-plugins\/compiz-plugins-unsupported ~amd64\nx11-themes\/emerald-themes              ~amd64\nx11-wm\/compiz                          ~amd64\nx11-wm\/compiz-fusion                   ~amd64\nx11-wm\/emerald                         ~amd64\n<\/pre>\n<\/li>\n<li><tt>\/etc\/portage\/package.accept_keywords\/emacs<\/tt>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">app-editors\/emacs ~amd64\n<\/pre>\n<\/li>\n<li><tt>\/etc\/portage\/package.accept_keywords\/firefox<\/tt>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">=dev-libs\/nss-3.22.2 ~amd64\n=dev-libs\/nspr-4.12  ~amd64\n\nwww-client\/firefox   ~amd64\n<\/pre>\n<\/li>\n<li><tt>\/etc\/portage\/package.accept_keywords\/gcc<\/tt>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">sys-devel\/gcc ~amd64\n<\/pre>\n<\/li>\n<li><tt>\/etc\/portage\/package.accept_keywords\/gdb<\/tt>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">sys-devel\/gdb ~amd64\n<\/pre>\n<\/li>\n<li><tt>\/etc\/portage\/package.accept_keywords\/open-vm-tools<\/tt> (this is our substitute for the VMware Tools that come with Workstation)\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">app-emulation\/open-vm-tools      ~amd64\napp-emulation\/open-vm-tools-kmod ~amd64\n<\/pre>\n<\/li>\n<li><tt>\/etc\/portage\/package.accept_keywords\/tcsh<\/tt> (it seems the current unmasked version of this doesn\u2019t actually run with a newer GCC)\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">app-shells\/tcsh ~amd64\n<\/pre>\n<\/li>\n<li><tt>\/etc\/portage\/package.accept_keywords\/xf86-video-vmware<\/tt> (which would need to be something else if we move this Gentoo system to bare-metal)\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">x11-drivers\/xf86-video-vmware ~amd64\n<\/pre>\n<\/li>\n<\/ul>\n<p>Accept some licenses by adding this to <tt>\/etc\/portage\/package.license<\/tt>:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\">dev-java\/oracle-jdk-bin\tOracle-BCLA-JavaSE\nwww-plugins\/adobe-flash\tAdobeFlash-10.3 license AdobeFlash-11.x\n<\/pre>\n<p>Customize your USE flags for individual packages.  Ideally, this would be in <tt>\/etc\/portage\/package.use\/<\/tt> in a file by the same name as the package being customized.  I\u2019m showing them all together for brevity:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">app-doc\/doxygen                  dot\napp-editors\/emacs                toolkit-scroll-bars gzip-el xft\napp-emulation\/open-vm-tools-kmod vmhgfs\napp-emulation\/vmware-tools       vmware_guest_linux\napp-portage\/eix                  optimization strong-optimization tools\napp-shells\/tcsh                  catalogs\napp-text\/texlive                 xetex\napp-text\/texlive-core            xetex\ndev-db\/sqlite                    secure-delete\ndev-lang\/erlang                  doc\ndev-lang\/python                  sqlite\nkde-apps\/okular                  chm djvu dpi ebook mobi\nmedia-libs\/harfbuzz              icu\nmedia-libs\/lib-vpx               postproc # required for Firefox\nnet-fs\/samba                     swat winbind\nnet-im\/pidgin                    prediction\nnet-nds\/openldap                 sasl\nsys-block\/parted                 device-mapper\nsys-boot\/grub                    device-mapper\nsys-devel\/gcc                    graphite\nsys-devel\/llvm                   clang\nsys-process\/lsof                 rpc\nwww-client\/firefox               custom-optimization egl system-cairo system-icu system-jpeg system-libevent system-libvpx system-sqlite\nx11-wm\/compiz-fusion             emerald unsupported\n<\/pre>\n<p>Add to <tt>\/etc\/portage\/package.mask\/autofs<\/tt> because the latest version crashes:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">=net-fs\/autofs-5.1.1-r1\n<\/pre>\n<p>Because Clang has a top-of-tree package, let\u2019s mask it to pick only the latest <em>release<\/em> version.  Create <tt>\/etc\/portage\/package.mask\/clang<\/tt> with:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">&gt;=sys-devel\/clang-9999\n&gt;=sys-devel\/llvm-9999\n<\/pre>\n<p>Configure the locales.  If you don\u2019t do this, GLIBC builds a bunch of (about 500) language catalogs that you\u2019ll probably never use, and this takes a while.  I narrowed mine down to this (by editing <tt>\/etc\/locale.gen<\/tt>):<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\">en_US ISO-8859-1\nen_US.UTF-8 UTF-8\nja_JP.UTF-8 UTF-8\nja_JP EUC-JP\nit_IT ISO-8859-1\n<\/pre>\n<p>Now just run this to regenerate the catalogs: \u201c<tt>locale-gen<\/tt>\u201d.  Run \u201c<tt>eselect locale<\/tt>\u201d to choose your default <tt>LANG<\/tt> setting.<\/p>\n<p>Since we\u2019ve bumped up the GCC version, we should probably just rebuild GCC now, and then we can have all our system built against it (in our case, it\u2019s the difference between a 4.x GCC and 5.x, so it\u2019s a more interesting difference).<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">emerge gcc\n\n# Now switch to the new compiler and reload the environment\ngcc-config -l\ngcc-config 2 # Latest version here based on last command output\n. \/etc\/profile\n<\/pre>\n<p>Let\u2019s just rebuild everything now that we\u2019ve switched an important component.  This is totally optional because we\u2019re just making sure all the pre-installed packages use our new GCC with custom <tt>-march<\/tt> flag.<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\"># See it...\nemerge --pretend --deep --with-bdeps=y --emptytree --newuse --update @world\n\n# Do it.\nemerge --deep --with-bdeps=y --emptytree --newuse --update @world\n\n# Required for the next command...\nemerge app-portage\/gentoolkit\n\n# Check for broken dependencies (should be none)\nrevdep-rebuild --pretend\n\n# Clean up unused packages (probably none, too--maybe the old GCC)\nemerge --pretend --deep --with-bdeps=y --depclean\n<\/pre>\n<h2>Setting Up A Basic System<\/h2>\n<p>Before we go on, let\u2019s set the root password.  We don\u2019t want to forget, and have to boot into the installation CD just to get some known credentials on the system when we\u2019re done: <tt>passwd root<\/tt><\/p>\n<h3>Kernel<\/h3>\n<p>Let\u2019s install a kernel for the new OS.  This takes us one step closer to being able to boot into the real system instead of the installation CD.<\/p>\n<ul>\n<li>Run this to download (and install) the kernel sources: <tt>emerge gentoo-sources<\/tt><\/li>\n<li>I have a minimal kernel configuration file that allows us to boot into Linux on a VMware Workstation VM.  Copy <a href=\"\/download\/linux-4.4.3-kernel.config\">this file<\/a> to <tt>.config<\/tt> in <tt>\/usr\/src\/linux\/<\/tt>.  Unfortunately, I have lost the complete steps of what options to change, but the kernel\u2019s build system should be able to upgrade an older configuration file like this one here.<\/li>\n<li>Run \u201c<tt>make menuconfig<\/tt>\u201d to make any last minute changes.<\/li>\n<li>Build the kernel: <tt>make -j5<\/tt><\/li>\n<li>Install kernel modules in their permanent home: <tt>make modules_install<\/tt><\/li>\n<li>Now we can put the kernel executable where the boot-loader can find it (make sure <tt>\/boot<\/tt> is mounted): <tt>make install<\/tt><\/li>\n<li>Get rid of all the build objects unless you plan on rebuilding soon.  They take up a bit of disk space: <tt>make clean<\/tt><\/li>\n<\/ul>\n<h3>Boot-loader<\/h3>\n<p>Now we install the boot-loader.  I\u2019m selecting GRUB2.<\/p>\n<ul>\n<li>Install the support applications: <tt>emerge grub<\/tt><\/li>\n<li>Now install the boot-loader to your bootable disk: <tt>grub2-install \/dev\/sda<\/tt>\u2014if you get a warning saying \u201cthis GPT partition label contains no BIOS Boot Partition\u201d, you have forgotten to \u201cset 4 bios_grub on\u201d in <tt>parted<\/tt>.<\/li>\n<li>Edit <tt>\/etc\/default\/grub<\/tt>, and set the following options (the last two just make things prettier, really):\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">GRUB_CMDLINE_LINUX=\"root=\/dev\/sda3 rootfstype=ext4 dolvm\"\nGRUB_GFXMODE=1152x864\nGRUB_GFXPAYLOAD_LINUX=keep\nGRUB_THEME=\"\/boot\/themes\/starfield\/theme.txt\"\n<\/pre>\n<\/li>\n<li>Now we just create the config that the boot-loader uses into <tt>\/boot<\/tt>: <tt>grub2-mkconfig -o \/boot\/grub\/grub.cfg<\/tt><\/li>\n<\/ul>\n<h3>Time Zones<\/h3>\n<p>Set the time zone for our new machine\u2014I\u2019m in Cambridge, MA (USA), so I do:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">echo \"US\/Eastern\" &gt; \/etc\/timezone\nemerge --config sys-libs\/timezone-data\n<\/pre>\n<h3>Networking<\/h3>\n<p>To make sure we have networking support when we start the new OS, we will change <tt>\/etc\/conf.d\/net<\/tt>.  First, provide all the silly names that the kernel has come up with over the years:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">cd \/etc\/init.d\/\nln -s net.lo net.eth0\nln -s net.lo net.enp2s1\nln -s net.lo net.eno16777736\n<\/pre>\n<p>These symlinks are for <tt>init<\/tt>, which will use different configuration settings based on the name of the script that was invoked.  Most recently, the ethernet interface has been \u201c<tt>eno16777736<\/tt>\u201d, so that\u2019s likely the only link we\u2019ll really need.<\/p>\n<p>Now edit <tt>\/etc\/conf.d\/net<\/tt> to set up a basic DHCP configuration (if you have information for a static network configuration, go ahead and do that instead of DHCP):<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\"># Please review \/usr\/share\/doc\/netifrc-*\/net.example.bz2 for more configuration\n# options.\nmodules=\"dhcpcd\"\n\ndns_domain=\"yourdomain.foo\"\nnis_domain=\"yourdomain.foo\"\ndns_search=\"yourdomain.foo\"\n\nconfig_eno16777736=\"dhcp\"\ndhcpcd_eno16777736=\"-h\" # -4 to disable IPv6\n\nconfig_eth0=\"dhcp\"\ndhcpcd_eth0=\"-h\" # -4 to disable IPv6\n\nconfig_enp2s1=\"dhcp\"\ndhcpcd_enp2s1=\"-h\" # -4 to disable IPv6\n<\/pre>\n<h3>Installing Useful Packages<\/h3>\n<p>Next, we will install some important (non-graphical) packages.  These are basic things like <tt>sudo<\/tt> and VMware Tools, as well as things that Gentoo lets you choose, like a cron, syslog, and DHCP client implementation.<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">emerge --pretend --deep --with-bdeps=y app-admin\/logrotate app-admin\/pwgen app-admin\/sudo app-admin\/syslog-ng app-arch\/p7zip app-editors\/vim app-emulation\/open-vm-tools app-portage\/eix app-portage\/mirrorselect app-shells\/tcsh games-misc\/wtf net-dns\/bind-tools net-fs\/nfs-utils net-fs\/samba net-ftp\/proftpd net-misc\/dhcpcd net-misc\/iperf net-misc\/netkit-fingerd net-misc\/netkit-telnetd net-misc\/ntp sys-block\/parted sys-devel\/gdb sys-fs\/exfat-utils sys-fs\/lvm2 sys-fs\/quota sys-process\/lsof sys-process\/vixie-cron\n<\/pre>\n<p>You will probably need to stuff a few more files into <tt>\/etc\/portage\/package.use\/<\/tt> as a result of the \u201c<tt>--pretend<\/tt>\u201d dry-run.  Once you are satisfied, go ahead and install these items.<\/p>\n<h3>Syslog<\/h3>\n<p>Setting up <tt>syslog-ng<\/tt> to do log rotation is pretty easy at this point, since we\u2019ve just installed the <tt>logrotate<\/tt> tool.  All the work in <tt>cron<\/tt> has been taken care of for us, so we just edit <tt>\/etc\/logrotate.d\/syslog-ng<\/tt>, and change the section like so:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">\/var\/log\/messages {\n    monthly\n    missingok\n    sharedscripts\n    rotate 24 # Keep two years, I guess...\n    compress\n    postrotate\n        \/etc\/init.d\/syslog-ng reload &gt; \/dev\/null 2&gt;&amp;1 || true\n    endscript\n}\n<\/pre>\n<h3>Configuring<\/h3>\n<p>We should configure the tools we\u2019ve installed so far by customizing what\u2019s located in <tt>\/etc\/conf.d\/<\/tt>.  We will change the host name, domain, and so on.  Make the following changes in the following files:<\/p>\n<ul>\n<li><tt>.\/consolefont<\/tt>: <tt>consolefont = \"Lat2-Terminus16\"<\/tt> (this is a bit less chunky, but the same size as the kernel\u2019s font, so it will be nicer to look at on the plain console)<\/li>\n<li><tt>.\/hostname<\/tt>: <tt>hostname = \"my_host01\"<\/tt><\/li>\n<li><tt>.\/ntp-client<\/tt>: <tt>NTPCLIENT_OPTS=\"-s -b -u ntp_server1 ntp_server2\"<\/tt><\/li>\n<\/ul>\n<p>Change <tt>\/etc\/issue<\/tt> and <tt>\/etc\/issue.logo<\/tt> from \u201c<tt>\\O<\/tt>\u201d to \u201c<tt>\\o<\/tt>\u201d, since the original command rarely contains reasonable output.  This is the file the system uses to display a nice welcome message when someone gets a console.<\/p>\n<p><!--You can make your welcome message to console users more insteresting by editing <tt>\/etc\/login.defs<\/tt>, and changing the <tt>ISSUE_FILE<\/tt> to <tt>\/etc\/issue.logo<\/tt>.  This is totally irrelevant, but fun.\n--><\/p>\n<p>Configuring SMB is slightly more complicated, but not too bad.  Some things to note\u2014for my network, I get users and groups from LDAP, so SAMBA should know how to acquire this information as well.  If your domain is \u201c<tt>mydomain.foo<\/tt>\u201d, your LDAP suffix will be \u201c<tt>dc=mydomain,dc=foo<\/tt>\u201d.  Replace \u201c<tt>ldap-server1.mydomain.foo<\/tt>\u201d with a proper LDAP FQDN.<\/p>\n<ul>\n<li>First, create a basic configuration: <tt>cp \/etc\/samba\/smb.conf.example \/etc\/samba\/smb.conf<\/tt><\/li>\n<li>Now, edit <tt>\/etc\/samba\/smb.conf<\/tt>, add or change the following settings:\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"ini\">   workgroup = CORPDOMAIN\n   server string = Matt Bisson's (Gentoo Linux) workstation\n\n   passdb backend = ldapsam:ldaps:\/\/ldap-server1.mydomain.foo:636\n   ldap ssl = start tls\n   ldap suffix = dc=mydomain,dc=foo\n   ldap user suffix = ou=people\n   ldap group suffix = ou=group\n<\/pre>\n<\/li>\n<\/ul>\n<p>Add this to the end of the file to share your development area.<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"ini\"># Share the development storage area\n[stgdev]\n   comment = Storage for development sandboxes\n   path = \/stgdev\n   browseable = no\n   guest ok = no\n   writable = yes\n<\/pre>\n<p>If you are OK with the root account logging into the machine with SSH, you can edit <tt>\/etc\/ssh\/sshd_config<\/tt> to set \u201c<tt>PermitRootLogin yes<\/tt>\u201d.  Most likely, you will log in with a normal user account that can escalate its privileges, so you won\u2019t need to do this.<\/p>\n<p>Customize the \u201c<tt>eselect<\/tt>\u201d items.  The <tt>eselect<\/tt> tool alters system-wide settings on Gentoo for any packages that register with the tool.  We will want to check back with this subsystem at various points, so familiarize yourself with it if you have not used it.  Most <tt>eselect<\/tt> modules support basic list\/set\/show functionality.  Run through the items now (there are only a few) and customize what you like.  This is highly dependent upon what\u2019s on your system, so I won\u2019t bother writing down exact command invocations.<\/p>\n<h3>Creating a Local User<\/h3>\n<p>Create local user so you can still get into the system if LDAP fails you for some reason.  Root access is not always available for various window managers or services.<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">useradd -c 'Matt Bisson (Local)' -d \/home\/mbisson.local -m -s \/bin\/tcsh -g 100 mbisson.local\npasswd mbisson.local\n<\/pre>\n<p>Add this user to the <tt>wheel<\/tt> group so it can become super-user when needed.  Add it to some privileged groups as well, like: <tt>floppy<\/tt>, <tt>audio<\/tt>, <tt>cdrom<\/tt>, <tt>tape<\/tt>, <tt>video<\/tt>, <tt>cdrw<\/tt>, <tt>usb<\/tt>, <tt>users<\/tt>, and <tt>portage<\/tt>.  In fact, you probably want to think about adding any user that you wish to be \u201cadministrators\u201d to these groups.<\/p>\n<h3>Start Services<\/h3>\n<p>Now, let\u2019s add important services to the appropriate run-level so the start after boot-up:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">rc-update add consolefont     boot\nrc-update add ConsoleKit      default\nrc-update add lvm             boot\nrc-update add lvmetad         boot\nrc-update add net.eno16777736 default\nrc-update add nfs             default\nrc-update add nfsclient       default\nrc-update add ntp-client      default\nrc-update add numlock         boot\nrc-update add sshd            default\nrc-update add syslog-ng       default\nrc-update add vixie-cron      default\nrc-update add vmware-tools    default\n<\/pre>\n<h3>Setting up LDAP<\/h3>\n<p>The development workstations at my place of business are a lot more usable when they are set up on LDAP.  This way, we can use our account and credentials that are known across the corporate infrastructure, as well as have AutoFS access to network file-systems without hard-coding them in <tt>\/etc\/fstab<\/tt>.  Let\u2019s do this before moving on to more complicated pieces of software (read: \u201cthe GUIs\u201d).<\/p>\n<p>Find out your local LDAP information.  For me, I will be using TLS with certificate-based authentication of the LDAP server, and the following hosts server up LDAP(S) on port 636: <tt>ldap-server1.mydomain.foo<\/tt> and <tt>ldap-server2.mydomain.foo<\/tt>.<\/p>\n<p>Install the LDAP support for Pluggable Authentication Modules (PAM) and Name Service Switch (NSS) as well as the AutoFS service.  Note that AutoFS 5.0.7 does not build with GCC 5 apparently, so you may have to unmask a later version (also, only 5.5.1 worked for me, as 5.5.1-r2 actually crashed when attempting to mount a file-system)!<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">emerge --deep --with-bdeps=y pam_ldap nss_ldap autofs\n\n# Installation warned me that these might be wrong, so it might be good to\n# check that this is as you want it:\nchown root:mail \/var\/spool\/mail\/\nchmod 03775 \/var\/spool\/mail\/\n<\/pre>\n<p>Next, we have to grab the certificate to validate the LDAP servers.<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">cd \/etc\/ssl\/cert\/\nwget http:\/\/intranet.mydomain.foo\/sipublic\/ldap\/ldap-cert-mydomain.pem\n<\/pre>\n<p>Edit <tt>\/etc\/pam.d\/system-auth<\/tt> (order matters):<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\">auth\t\trequired\tpam_env.so\nauth\t\tsufficient\tpam_ldap.so no_warn\nauth\t\trequired\tpam_unix.so try_first_pass likeauth nullok\nauth\t\toptional\tpam_permit.so\n\naccount\t\tsufficient\tpam_ldap.so no_warn ignore_authinfo_unavail ignore_unknown_user\naccount\t\trequired\tpam_unix.so\naccount\t\toptional\tpam_permit.so\n\npassword\trequired\tpam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 retry=3\npassword\tsufficient\tpam_ldap.so use_authtok use_first_pass debug\npassword\trequired\tpam_unix.so try_first_pass use_authtok nullok sha512 shadow\npassword\toptional\tpam_permit.so\n\nsession\t\trequired\tpam_limits.so\nsession\t\trequired\tpam_env.so\nsession\t\toptional\tpam_ldap.so\nsession\t\trequired\tpam_unix.so\nsession\t\toptional\tpam_permit.so\n<\/pre>\n<p>Edit <tt>\/etc\/ldap.conf<\/tt>, and remove all settings except for the following ones (use your own local LDAP server where applicable):<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">base dc=mydomain,dc=foo\nuri ldaps:\/\/ldap-server1.mydomain.foo:636 ldaps:\/\/ldap-server2.mydomain.foo:636\nldap_version 3\nbind_policy soft\n\npam_filter objectClass=posixAccount\n\nnss_base_passwd\t\tou=people,dc=mydomain,dc=foo?one\nnss_base_shadow\t\tou=people,dc=mydomain,dc=foo?one\nnss_base_group\t\tou=group,dc=mydomain,dc=foo?sub\nnss_base_netgroup\tou=netgroup,dc=mydomain,dc=foo?one\n\nssl\t\toff\ntls_checkpeer\tyes\ntls_reqcert\tdemand\ntls_cacert\t\/etc\/ssl\/certs\/ldap-cert-mydomain.pem\ntls_cacertfile\t\/etc\/ssl\/certs\/ldap-cert-mydomain.pem\n\nnss_reconnect_tries 4           # number of times to double the sleep time\nnss_reconnect_sleeptime 1       # initial sleep value\nnss_reconnect_maxsleeptime 16   # max sleep value to cap at\nnss_reconnect_maxconntries 2    # how many tries before sleeping\n\nnss_initgroups_ignoreusers ldap,openldap,mysql,syslog,root,postgres\n<\/pre>\n<p>Edit <tt>\/etc\/openldap\/ldap.conf<\/tt>\u2014this is basically the contents of the entire file (note that changing the password is not allowed on my set-up, so I give a helpful message):<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">BASE\t\tdc=mydomain,dc=foo\nURI\t\tldaps:\/\/ldap-server1.mydomain.foo:636 ldaps:\/\/ldap-server2.mydomain.foo:636\n\nldap_version\t3\n\nSSL\t\toff\nTLS\t\thard\nTLS_REQCERT\tdemand\nTLS_CACERT\t\/etc\/ssl\/certs\/ldap-cert-mydomain.pem\nBIND_POLICY\tsoft\n\npam_password_prohibit_message Please use https:\/\/password-change-o.mydomain.foo\/ to change your password.\n<\/pre>\n<p>Edit <tt>\/etc\/nsswitch.conf<\/tt>, changing the following settings (ignore the others):<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"conf\">passwd:\t\tfiles ldap\nshadow:\t\tfiles ldap\ngroup:\t\tfiles ldap\n\nhosts:\t\tfiles dns # ldap -- This seems to hang??\n\nnetgroup:\tldap [NOTFOUND=return] files\nautomount:\tldap files\n<\/pre>\n<p>Edit <tt>\/etc\/autofs\/autofs_ldap_auth.conf<\/tt> to enable TLS.  The settings might already be this way:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"xml\">&lt;?xml version=\"1.0\" ?&gt;\n&lt;!--\nThis file contains a single entry with multiple attributes tied to it.\nSee autofs_ldap_auth.conf(5) for more information.\n--&gt;\n \n&lt;autofs_ldap_sasl_conf\n usetls=\"no\"\n tlsrequired=\"no\"\n authrequired=\"no\"\n\/&gt;\n<\/pre>\n<p>Finally, edit the AutoFS configuration (<tt>\/etc\/conf.d\/autofs<\/tt>).  Some of the settings below are left as comments in the configuration because they match the defaults, but they\u2019re still important to know.  Similar settings exist in <tt>\/etc\/autofs\/autofs.conf<\/tt>, if you prefer to make the changes there:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\"># MASTER_MAP_NAME - default map name for the master map.\n#MASTER_MAP_NAME=\"auto.master\"\n\n# NEGATIVE_TIMEOUT - set the default negative timeout for\n#                    failed mount attempts (default 60).\n#NEGATIVE_TIMEOUT=60\n\n# UMOUNT_WAIT - time to wait for a response from umount(8).\n#UMOUNT_WAIT=12\n\n# BROWSE_MODE - maps are browsable by default.\nBROWSE_MODE=\"yes\"\n\n# Define server URIs\n#\n# LDAP_URI - space seperated list of server uris of the form\n#            &lt;proto&gt;:\/\/&lt;server&gt;[\/] where &lt;proto&gt; can be ldap\n#            or ldaps. The option can be given multiple times.\n#            Map entries that include a server name override\n#            this option.\n#\n#            This configuration option can also be used to\n#            request autofs lookup SRV RRs for a domain of\n#            the form &lt;proto&gt;:\/\/\/[&lt;domain dn&gt;]. Note that a\n#            trailing \"\/\" is not allowed when using this form.\n#            If the domain dn is not specified the dns domain\n#            name (if any) is used to construct the domain dn\n#            for the SRV RR lookup. The server list returned\n#            from an SRV RR lookup is refreshed according to\n#            the minimum ttl found in the SRV RR records or\n#            after one hour, whichever is less.\nLDAP_URI=\"ldaps:\/\/ldap-server1.mydomain.foo:636 ldaps:\/\/ldap-server2.mydomain.foo:636\"\n\n# Define base dn for map dn lookup.\n#\n# SEARCH_BASE - base dn to use for searching for map search dn.\n#               Multiple entries can be given and they are checked\n#               in the order they occur here.\nSEARCH_BASE=\"ou=automount,dc=mydomain,dc=foo\"\n\n# Other common LDAP schema naming info\nMAP_OBJECT_CLASS=\"automountMap\"\nENTRY_OBJECT_CLASS=\"automount\"\nMAP_ATTRIBUTE=\"ou\"\nENTRY_ATTRIBUTE=\"cn\"\nVALUE_ATTRIBUTE=\"automountInformation\"\n\n# AUTH_CONF_FILE - set the default location for the SASL\n#                          authentication configuration file.\nAUTH_CONF_FILE=\"\/etc\/autofs\/autofs_ldap_auth.conf\"\n<\/pre>\n<p>Now just enable AutoFS on boot, and test that you can talk to LDAP.<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">rc-update add autofs default\n\n# You should find mbisson's user information:\nldapsearch -H ldaps:\/\/ldap-server1.mydomain.foo -D \"uid=mbisson,ou=people,dc=mydomain,dc=foo\" uid=mbisson -x -W -LLL\n<\/pre>\n<h3>Power Off<\/h3>\n<p>Let\u2019s reboot and see if the system actually comes up before we take a snapshot.  Reboot (even from your chroot environment is fine).  If the system doesn\u2019t come up how you like, fix the errors and reboot until it does.  After you\u2019ve done all that, it\u2019s smart to power off the VM and take a snapshot (or clone).  This can be the base system for any future customizations, like using X, making a web server, etc.<\/p>\n<h1>Making A Development Workstation<\/h1>\n<p>Let\u2019s make the bare-bones Linux installation a bit more useful.  Up to this point, we could have gone in the direction of making a mail server, a Bugzilla site, or whatever.  Now we\u2019re going to install a UI and make this more functional as a development workstation.  All of this is optional, so feel free to skip any of the below.<\/p>\n<h2>Installing X Windows<\/h2>\n<p>First, update your <tt>USE<\/tt> flags to enable some important settings.  We\u2019re slowly adding these flags as we build up the system, so you might end up building packages more than just once throughout the course of installation.  This is OK as far as I\u2019m concerned, because I\u2019d rather have a locally-consistent set of libraries and utilities the entire time, rather than save myself 30 minutes of compilation.  It\u2019s all a choice, though\u2014if you\u2019re still with me, edit <tt>\/etc\/portage\/make.conf<\/tt> accordingly:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">USE=\"-systemd dbus dga fontconfig ldap nfs offensive opengl samba syslog X\"\n<\/pre>\n<p>Add some more per-package <tt>USE<\/tt> flags that facilitate installing the new packages given the new settings (again, preferably in their own file):<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\">media-libs\/mesa   xa\nx11-libs\/libdrm   libkms\nmedia-libs\/imlib2 png\n<\/pre>\n<p>Now install Xorg.  The new <tt>USE<\/tt> flags will make sure everything gets included.<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">emerge --deep --with-bdeps=y --newuse app-misc\/oneko x11-apps\/mesa-progs x11-apps\/xdm x11-base\/xorg-x11 x11-misc\/xteddy x11-terms\/xterm x11-wm\/twm x11-apps\/xsm\n\n# X will want this, so add it to the init scripts\nrc-update add dbus default\n<\/pre>\n<p>Xorg should be able to automatically configure itself and run, but I prefer to explicitly specify devices, as well as a 1920\u00d71200 screen size to match my physical monitor.  Drop this file into <tt>\/etc\/X11\/xorg.conf<\/tt> to achieve that.  Since you\u2019re currently running in a virtualized Gentoo installation, the VMware graphics drivers provide tons of monitor options, meaning that skipping this step is totally reasonable.<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"conf\">Section \"ServerLayout\"\n    Identifier\t\"Custom X.org Configuration for 1920x1200\"\n    Screen\t0 \"Screen0\" 0 0\n    InputDevice\t\"Mouse0\"    \"CorePointer\"\n    InputDevice\t\"Keyboard0\"    \"CoreKeyboard\"\nEndSection\n\nSection \"Files\"\n    ModulePath\t\"\/usr\/lib64\/xorg\/modules\"\n    FontPath\t\"\/usr\/share\/fonts\/misc\/\"\n    FontPath\t\"\/usr\/share\/fonts\/TTF\/\"\n    FontPath\t\"\/usr\/share\/fonts\/OTF\/\"\n    FontPath\t\"\/usr\/share\/fonts\/Type1\/\"\n    FontPath\t\"\/usr\/share\/fonts\/100dpi\/\"\n    FontPath\t\"\/usr\/share\/fonts\/75dpi\/\"\nEndSection\n\nSection \"Module\"\n    Load\t\"dri\"\n    Load\t\"dbe\"\n    Load\t\"record\"\n    Load\t\"glx\"\n    Load\t\"dri2\"\n    Load\t\"extmod\"\nEndSection\n\nSection \"InputDevice\"\n    Identifier\t\"Keyboard0\"\n    Driver\t\"kbd\"\nEndSection\n\nSection \"InputDevice\"\n    Identifier\t\"Mouse0\"\n    Driver\t\"mouse\"\n    Option\t\"Protocol\"    \"auto\"\n    Option\t\"Device\"    \"\/dev\/input\/mice\"\n    Option\t\"ZAxisMapping\"    \"4 5 6 7\"\nEndSection\n\nSection \"Device\"\n    Identifier\t\"Card0\"\n    Driver\t\"vmware\"\n    BusID\t\"PCI:0:15:0\"\nEndSection\n\nSection \"Monitor\"\n    Identifier\t\"Monitor0\"\n    VendorName\t\"VMware\"\n    ModelName\t\"Virtual Monitor\"\nEndSection\n\nSection \"Screen\"\n    Identifier\t\"Screen0\"\n    Device\t\"Card0\"\n    Monitor\t\"Monitor0\"\n    SubSection\t\"Display\"\n        Viewport\t0 0\n        Depth\t\t24\n#       Modes\t\t\"1600x1200\"\n        Modes\t\t\"1920x1200\"\n    EndSubSection\nEndSection\n<\/pre>\n<p>Install some more fonts\u2026 why not?<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">emerge --pretend --deep --with-bdeps=y media-fonts\/aquafont media-fonts\/aquapfont media-fonts\/cheapskatefonts media-fonts\/corefonts media-fonts\/dejavu media-fonts\/freefont media-fonts\/freefonts media-fonts\/fs-fonts media-fonts\/inconsolata media-fonts\/ja-ipafonts media-fonts\/lfpfonts-fix media-fonts\/lfpfonts-var media-fonts\/terminus-font media-fonts\/ttf-bitstream-vera media-fonts\/ubuntu-font-family\n<\/pre>\n<p>Looking at the <tt>60-latin<\/tt> fontconfig file, we can see that the system prefers some fonts by default:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"xml\">&lt;alias&gt;\n    &lt;family&gt;serif&lt;\/family&gt;\n    &lt;prefer&gt;\n        &lt;family&gt;DejaVu Serif&lt;\/family&gt;\n        &lt;family&gt;Bitstream Vera Serif&lt;\/family&gt;\n        &lt;family&gt;Times New Roman&lt;\/family&gt;\n        &lt;family&gt;Thorndale AMT&lt;\/family&gt;\n        &lt;family&gt;Luxi Serif&lt;\/family&gt;\n        &lt;family&gt;Nimbus Roman No9 L&lt;\/family&gt;\n        &lt;family&gt;Times&lt;\/family&gt;\n    &lt;\/prefer&gt;\n&lt;\/alias&gt;\n&lt;alias&gt;\n    &lt;family&gt;sans-serif&lt;\/family&gt;\n    &lt;prefer&gt;\n        &lt;family&gt;DejaVu Sans&lt;\/family&gt;\n        &lt;family&gt;Bitstream Vera Sans&lt;\/family&gt;\n        &lt;family&gt;Luxi Sans&lt;\/family&gt;\n        &lt;family&gt;Nimbus Sans L&lt;\/family&gt;\n        &lt;family&gt;Arial&lt;\/family&gt;\n        &lt;family&gt;Albany AMT&lt;\/family&gt;\n        &lt;family&gt;Helvetica&lt;\/family&gt;\n        &lt;family&gt;Verdana&lt;\/family&gt;\n        &lt;family&gt;Lucida Sans Unicode&lt;\/family&gt;\n        &lt;family&gt;BPG Glaho International&lt;\/family&gt; &lt;!-- lat,cyr,arab,geor --&gt;\n        &lt;family&gt;Tahoma&lt;\/family&gt; &lt;!-- lat,cyr,greek,heb,arab,thai --&gt;\n    &lt;\/prefer&gt;\n&lt;\/alias&gt;\n&lt;alias&gt;\n    &lt;family&gt;monospace&lt;\/family&gt;\n    &lt;prefer&gt;\n        &lt;family&gt;DejaVu Sans Mono&lt;\/family&gt;\n        &lt;family&gt;Bitstream Vera Sans Mono&lt;\/family&gt;\n        &lt;family&gt;Inconsolata&lt;\/family&gt;\n        &lt;family&gt;Luxi Mono&lt;\/family&gt;\n        &lt;family&gt;Nimbus Mono L&lt;\/family&gt;\n        &lt;family&gt;Andale Mono&lt;\/family&gt;\n        &lt;family&gt;Courier New&lt;\/family&gt;\n        &lt;family&gt;Cumberland AMT&lt;\/family&gt;\n        &lt;family&gt;Courier&lt;\/family&gt;\n    &lt;\/prefer&gt;\n&lt;\/alias&gt;\n<\/pre>\n<p>Make sure to at least install <tt>media-fonts\/dejavu<\/tt> or <tt>media-fonts\/ttf-bitstream-vera<\/tt> (included in the command above), because Luxi Sans is a really ugly choice for a bold-face font (which KDE uses a bunch).<\/p>\n<p>You probably want to enable sub-pixel hinting for your fonts and the Liberation font package.  Do this with \u201c<tt>eselect fontconfig<\/tt>\u201d.  The options may be different, so I won\u2019t list them here, but I\u2019m selecting \u201c<tt>10-sub-pixel-rgb.conf<\/tt>\u201d for my sub-pixel setting.  This same <tt>eselect<\/tt> module enables various fonts\u2014<em>be sure to enable the fonts you just installed (if they are not enabled by default).<\/em><\/p>\n<p>If you\u2019re content to just run basic X Windows with the TWM window manager, you can add the display manager to your runlevel, and stop here:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">rc-update add xdm default\n<\/pre>\n<p>You\u2019ve installed X.  Doesn\u2019t it seem like a good time to power down and take another snapshot?<\/p>\n<h2>KDE<\/h2>\n<p>Apparently KDE versions 4 and 5 cannot live alongside each other, so you have to choose if you want the old (KDE4) or the new (Plasma).  The next two sections should be considered mutually exclusive.<\/p>\n<p>At any rate, you will want to finish populating your <tt>USE<\/tt> flags in <tt>\/etc\/portage\/make.conf<\/tt> like so:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">USE=\"-systemd aspell bash-completion cjk cxx dbus dga emacs fontconfig kde ldap nfs offensive opengl plasma pulseaudio samba sound syslog vim-syntax X\"\n<\/pre>\n<p>Once you\u2019ve done this, run \u201c<tt>eselect profile list<\/tt>\u201d.  What you choose here will determine if you do KDE4 or Plasma (the next sections mention exactly what to select).  Choose wisely.<\/p>\n<h3>KDE4<\/h3>\n<p>Great, we\u2019re going with KDE 4, which is a solid, nice looking desktop environment.  As you will see below, we can even through Compiz into the mix to add eye-candy to an already fairly decent situation.  Select \u201c<tt>default\/linux\/amd64\/##.#\/desktop\/kde<\/tt>\u201d as your profile.<\/p>\n<p>Provide <tt>\/etc\/portage\/package.use\/cmake<\/tt> to disable something pointless that causes circular dependencies:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">dev-util\/cmake -emacs\n<\/pre>\n<p>Throw in PIM support if you\u2019re interested.  The desktop widgets already support it.  In <tt>\/etc\/portage\/package.use\/kde-meta<\/tt>:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">kde-apps\/kde-meta kdepim\n<\/pre>\n<p>Now install everything (this could take a while\u2014like hours): <tt>emerge --pretend --deep --with-bdeps=y --newuse kdebase-runtime-meta kde-meta<\/tt><\/p>\n<p>Once everything has fully installed, modify your <tt>\/etc\/conf.d\/xdm<\/tt> file to use the KDE login and display manager by setting \u201c<tt>DISPLAYMANAGER=\"kdm\"<\/tt>\u201d.<\/p>\n<p>If you don\u2019t care about preventing root from logging in, edit <tt>\/usr\/share\/config\/kdm\/kdmrc<\/tt> to set \u201c<tt>AllowRootLogin=true<\/tt>\u201d.  Remember that you can cause some damage with this, so it\u2019s probably best that you just log in with the local user you created earlier and run individual commands as the root user.  This mirrors our discussions about SSH.<\/p>\n<p>Once you log in, you can customize all kinds of features like multiple desktops (which I can\u2019t live without) and point-to-focus.<\/p>\n<h3>Compiz<\/h3>\n<p>Well, you\u2019re done with KDE4, so now you can (optionally) add some graphical toys.  Compiz lets you manifest multiple desktops as the sides of a cube, set tool-tips on fire, and so forth.  Its window manager, Emerald, also has some non-superficial customizations as well.  When I have a graphics card capable of acceleration, I prefer this over basic KDE.  You can configure absolutely everything in Compiz, even to the point of making it provide you absolutely no functionality whatsoever(!).<\/p>\n<p>Compiz is considered the \u201cold way\u201d so it\u2019s worth taking a snapshot of your VM before installing in case things go sideways and you just want to skip it.<\/p>\n<p>Install the packages.  We already configured the system (by default, Compiz is masked), so this should just work: \u201c<tt>emerge --deep --with-bdeps=y x11-wm\/compiz-fusion<\/tt>\u201d.  <em>Note: I had to download <tt>compiz-plugins-unsupported-0.8.8.tar.bz2<\/tt> from another machine because it wasn\u2019t online<\/em> (but you can get it <a href=\"\/download\/compiz-plugins-unsupported-0.8.8.tar.bz2\">from me<\/a>).<\/p>\n<p>Before continuing, you probably want to open a terminal window just in case something goes wrong with the next bit.  Once you have installed, enable Compiz to replace KWin as the window manager.  To do this, in the KDE System Settings application, navigate to \u201cDefault Applications\u201d \u2192 \u201cWindow Manager.\u201d  Here you can select Compiz as your different window manager.<\/p>\n<p>Remember how we opened a terminal before starting Compiz?  On the console, you might have to just type \u201c<tt>emerald<\/tt>\u201d to get some sane behavior.  If you can\u2019t seem to get to the Compiz settings from the KDE menu, the command is \u201c<tt>ccsm<\/tt>\u201d.<\/p>\n<p>Check off all the reasonable boxes (everything is off by default, even window borders).<\/p>\n<ul>\n<li>\u201cKDE Compatibility.\u201d<\/li>\n<li>Enable \u201cWindow Decoration,\u201d and set the \u201cCommand\u201d to \u201c<tt>\/usr\/bin\/emerald --replace<\/tt>\u201d.<\/li>\n<li>Enable \u201cDesktop Cube,\u201d because otherwise, what\u2019s the point?<\/li>\n<li>Enable \u201cRotate Cube\u201d\u2014change the \u201cInitiate\u201d setting to be something without a Ctrl+Alt, as some versions of VMware claim this key combination.<\/li>\n<li>Enable \u201c3D Windows\u201d because this makes your Desktop Cube look a little cooler.<\/li>\n<li>Enable \u201cMinimize Effect,\u201d \u201cMove Window,\u201d \u201cPlace Windows,\u201d and \u201cResize Window,\u201d because these are all basic operations that one expects.<\/li>\n<li>Shift Switcher\u2014change Next and Previous Window settings to use Alt+TAB.<\/li>\n<li>Enable \u201cWorkarounds\u201d\u2014particularly the \u201cFix screen updates in XGL with fglrx\u201d as it fixes some bad redrawing issues.<\/li>\n<li>I also like \u201cSession Management,\u201d \u201cMinimize Effect,\u201d and \u201cResize Info.\u201d<\/li>\n<\/ul>\n<p>Welcome to your loud-and-proud Compiz desktop.  <a href=\"#what-else\">Enjoy!<\/a><\/p>\n<h3>Plasma<\/h3>\n<p>Eventually, KDE4 will be dropped from support in Gentoo, and the next generation (i.e., \u201cKDE5\u201d) will be the Plasma Desktop.  Follow these steps to use the latest and greatest version of KDE.<\/p>\n<p>First, select \u201c<tt>default\/linux\/amd64\/##.#\/desktop\/plasma<\/tt>\u201d as your profile.  This automatically installs everything we need on our next <tt>emerge<\/tt>.<\/p>\n<p>Now, let\u2019s make some appropriate changes to the <tt>USE<\/tt> flags for Plasma, by adding the following to <tt>\/etc\/portage\/package.use\/kde-plasma<\/tt>:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\">kda-plasma\/plasma-meta grub networkmanager\n<\/pre>\n<p>Installing Plasma now means just a \u201cworld\u201d <tt>emerge<\/tt>:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">emerge --pretend --deep --with-bdeps=y --newuse @world\n\n# Do this if you want to install Konsole (which I use extensively).\nemerge --pretend --deep --with-bdeps=y --newuse plasma-meta konsole\n<\/pre>\n<p>Now that everything is installed, we probably want to use Plasma\u2019s display manager.  The KDE4 managed, <tt>kdm<\/tt> no longer exists, and has been replaced by <tt>sddm<\/tt>.  Alter <tt>\/etc\/conf.d\/xdm<\/tt> to read \u201c<tt>DISPLAYMANAGER=\"sddm\"<\/tt>\u201d.<\/p>\n<p>Annoyingly, SDDM does not simply proceed without a configuration, so run the following <em>before starting your X server:<\/em><\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">sddm --example-config &gt; \/etc\/sddm.conf\n<\/pre>\n<p>That\u2019s it!  Now you\u2019re ready to get computing with the latest KDE environment.<\/p>\n<h2><span id=\"what-else\"><\/span>What Else to Install?<\/h2>\n<p>Now that you\u2019ve got a pretty basic set-up with a desktop environment, it\u2019s time to decide what you want to run.<\/p>\n<h3>Gentoo packages<\/h3>\n<p>Here are some useful packages that I install.  Installation should be fairly effortless:<\/p>\n<ul>\n<li><tt>app-doc\/doxygen<\/tt><\/li>\n<li><tt>app-emacs\/ebuild-mode<\/tt><\/li>\n<li><tt>app-text\/enscript<\/tt><\/li>\n<li><tt>app-text\/texlive<\/tt><\/li>\n<li><tt>dev-lisp\/sbcl<\/tt><\/li>\n<li><tt>dev-util\/global<\/tt><\/li>\n<li><tt>dev-vcs\/git<\/tt><\/li>\n<li><tt>media-gfx\/graphviz<\/tt><\/li>\n<li><tt>net-ftp\/ncftp<\/tt><\/li>\n<li><tt>net-im\/pidgin<\/tt><\/li>\n<li><tt>sys-devel\/clang<\/tt><\/li>\n<li><tt>virtual\/emacs<\/tt><\/li>\n<li><tt>x11-plugins\/pidgin-sipe<\/tt><\/li>\n<\/ul>\n<p>Building the browser is time-consuming, so I\u2019m doing that last.<\/p>\n<ul>\n<li><tt>www-client\/firefox<\/tt>\u2014this requires larger <tt>\/var\/tmp\/portage<\/tt>, so if you set up a data volume group, it\u2019s always nice to have an 8GB partition laying around to have temporary build space.<\/li>\n<li><tt>www-plugins\/adobe-flash<\/tt><\/li>\n<\/ul>\n<p>I used to always install <tt>app-text\/acroread<\/tt>, but it requires all sorts of x86 compatibility garbage, so beware\u2014Okular does the same job, and is installed with KDE already.<\/p>\n<h3>Non-Gentoo packages<\/h3>\n<p>There are a few packages outside Gentoo\u2019s package management that will be useful.  Let\u2019s talk about those.<\/p>\n<h4>Eclipse<\/h4>\n<p>Some people use Java.  Some people use Eclipse.  Some people use Eclipse with Java.  I don\u2019t personally do much in Java, but it seems like something reasonable to have on a developer\u2019s workstation.<\/p>\n<p>To use Eclipse, you obviously need a Java Runtime Environment (JRE).  By default, Gentoo uses the OpenJDK (code-name: \u201cicedtea\u201d) in a binary format.  Installing the binary JRE distribution is as simple as emerging <tt>virtual\/jre<\/tt>, but I prefer to build what I can from source.  I will say that building the JDK requires more than 8GB of disk space, so it\u2019s not a quick task\u2014a binary distribution is quite reasonable.<\/p>\n<p>Get ready to install the JDK you want by creating a file like <tt>\/etc\/portage\/package.accept_keywords\/jdk<\/tt>:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\">dev-java\/icedtea        ~amd64\ndev-java\/oracle-jre-bin ~amd64\n<\/pre>\n<p>Unfortunately, building the JDK from source requires ANT, which requires a JDK, so we have a circular dependency.  First we install the JDK with a binary distribution, then install the JDK we want (from source), and finally go back and clean out the binary version.<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">emerge --pretend --deep --with-bdeps=y virtual\/jdk virtual\/jre\nemerge --pretend --deep --with-bdeps=y dev-java\/icedtea\n\n# We are changing the JVM to the non icedtea-bin variety:\neselect java-vm set system 1\n<\/pre>\n<p>Next we should edit the JDK build configuration to specify that we\u2019re using icedtea instead of icedtea-bin.  Edit <tt>\/etc\/java-config-2\/build\/jdk.conf<\/tt>, and add the following:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"raw\">*=icedtea\n<\/pre>\n<p>Now clean out the binary distribution: <tt>emerge --pretend --deep --with-bdeps=y --depclean<\/tt><\/p>\n<p>Now that our JRE dependency has been satisfied, we can download Eclipse.<\/p>\n<p>For some reason eclipse packages everything under an \u201ceclipse\u201d directory, so if you already have one in place, you\u2019ll have to move it aside.  When the coast is clear, you\u2019re going to drop it into the <tt>\/opt<\/tt> directory.  Unpack the archive you downloaded into <tt>\/opt<\/tt>, and rename it to something version specific:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">tar -xvzf eclipse-java-mars-2-linux-gtk-x86_64.tar.gz -C \/opt\/\nmv \/opt\/eclipse \/opt\/eclipse-mars.2\n\nln -s \/opt\/eclipse-mars.2\/eclipse \/usr\/local\/bin\/eclipse\n<\/pre>\n<h4>Perforce (Helix)<\/h4>\n<p>In case you haven\u2019t noticed, Perforce has been renamed to Helix.  Go to the <a href=\"https:\/\/www.perforce.com\/downloads\/helix\">download page<\/a>, and get the Helix P4V Visual Client and Helix P4 Command Line.  Then we\u2019re just going to drop them into <tt>\/opt<\/tt> and make symlinks in <tt>\/usr\/local<\/tt>.<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\"># Helix P4V GUI\ntar -xvzf p4v.tgz -C \/opt\nchown -Rh root:root \/opt\/p4v-$P4V_VERSION\/\ncd \/usr\/local\/bin\nln -s \/opt\/p4v-$P4V_VERSION\/bin\/p4admin \/usr\/local\/bin\/\nln -s \/opt\/p4v-$P4V_VERSION\/bin\/p4merge \/usr\/local\/bin\/\nln -s \/opt\/p4v-$P4V_VERSION\/bin\/p4v     \/usr\/local\/bin\/\nln -s \/opt\/p4v-$P4V_VERSION\/bin\/p4vc    \/usr\/local\/bin\/\n\n# Helix P4 Command-line\nmkdir -p \/opt\/p4-$P4_VERSION\/bin\ncp p4 \/opt\/p4-$P4_VERSION\/bin\nchmod 755 \/opt\/p4-$P4_VERSION\/bin\/p4\nln -s \/opt\/p4-$P4_VERSION\/bin\/p4 \/usr\/local\/bin\n<\/pre>\n<h1>Troubleshooting<\/h1>\n<p>Here are some steps to take when things go wrong.<\/p>\n<h2>Booting Into the Installer Again<\/h2>\n<p>You\u2019re in the middle of installing the OS, and you rebooted, but the system isn\u2019t actually coming up.  Plan B is to head back into the installer\u2019s minimal OS, and make modifications to things from there.<\/p>\n<ol>\n<li>Power on the VM and go into the BIOS screen.  You need to set the CD-ROM drive ahead of the hard disk in order to boot back into the installation media.<\/li>\n<li>If you\u2019re going to enter the OS through SSH, you may want to sort this out before entering a chroot environment.  This is optional (and listed above).<\/li>\n<ul>\n<li>Update your root password to something memorable (<tt>passwd root<\/tt>).<\/li>\n<li>Check with <tt>\/etc\/ssh\/sshd_config<\/tt> that the <tt>PermitRootLogin<\/tt> option has been set to <tt>yes<\/tt>.<\/li>\n<li>Run <tt>\/etc\/init.d\/sshd start<\/tt>.<\/li>\n<li>Check your IP (with \u201c<tt>ifconfig<\/tt>\u201d or \u201c<tt>ip addr<\/tt>\u201d), and now you can access the VM with SSH.<\/li>\n<\/ul>\n<li>Set up the LVM:\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">lvscan\nvgchange -ay\n<\/pre>\n<\/li>\n<li>Chroot into the new environment.<\/li>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">mount \/dev\/sda3 \/mnt\/gentoo\ncp -L \/etc\/resolv.conf \/mnt\/gentoo\/etc\/\nmount -t proc proc \/mnt\/gentoo\/proc\nmount --rbind \/sys \/mnt\/gentoo\/sys\nmount --make-rslave \/mnt\/gentoo\/sys\nmount --rbind \/dev \/mnt\/gentoo\/dev\nmount --make-rslave \/mnt\/gentoo\/dev\nchroot \/mnt\/gentoo \/bin\/bash\n. \/etc\/profile\n<\/pre>\n<li>Mount all the disks.  \u201c<tt>mount -a<\/tt>\u201d should do the trick, but you may need to mount each one by name.  Check with <tt>\/etc\/fstab<\/tt> if you can\u2019t remember.<\/li>\n<li>When you are about to shut down, it\u2019s nicer if you do an \u201c<tt>umount -a<\/tt>\u201d as well.<\/li>\n<li>Don\u2019t forget to set the boot order back so that you don\u2019t boot from the installation CD.<\/li>\n<\/ol>\n<h2>Taking a Simple Back-up<\/h2>\n<p>Let\u2019s say you need to totally reconfigure your disks for some reason.  The simplest thing to do would be to save off your data somewhere else, destroy your partitions, and recreate them.  This becomes easy with a virtual machine.<\/p>\n<p>Boot the installation CD.  We don\u2019t want to have any of the system disks being busy when we read \/ write.<\/p>\n<ul>\n<li>First, create a new disk that\u2019s large enough to back up your files.<\/li>\n<li>Now run \u201c<tt>parted -a optimal \/dev\/sdb<\/tt>\u201d (assuming <tt>\/dev\/sdb<\/tt> is the disk you just added).\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">mklabel gpt\nmkpart primary ext4 0% 100%\n<\/pre>\n<\/li>\n<li>Format: <tt>mkfs -t ext4 \/dev\/sdb1<\/tt><\/li>\n<li>Make a mount point and mount the \u201cbackup\u201d area (we\u2019re making a mount point for the \u201csource\u201d of the back-ups as well):\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">mkdir \/mnt\/src \/mnt\/backup\nmount -r \/dev\/sdb1 \/mnt\/backup\n<\/pre>\n<\/li>\n<li>Do backups:\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">cd \/mnt\n\nmount -r \/dev\/sda1 src\ntar -cvpf backup\/boot.tar -C src .\numount \/dev\/sda1\n\nmount -r \/dev\/sda3 src\ntar -cvpf backup\/root.tar -C src .\numount src\n\nmount -r \/dev\/sysvg0\/opt0 src\ntar -cvpf backup\/opt.tar -C src .\numount src\n\nmount -r \/dev\/sysvg0\/tmp0 src\ntar -cvpf backup\/tmp.tar -C src .\numount src\n\nmount -r \/dev\/sysvg0\/usr0 src\ntar -cvpf backup\/usr.tar -C src .\numount src\n\nmount -r \/dev\/sysvg0\/var0 src\ntar -cvpf backup\/var.tar -C src .\numount src\n<\/pre>\n<\/li>\n<\/ul>\n<p>Re-partition all your disks how you like them\u2026<\/p>\n<p>Now, we can just restore what we backed up:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">tar -xvpf backup\/root.tar -C \/mnt\/gentoo\ntar -xvpf backup\/boot.tar -C \/mnt\/gentoo\/boot\ntar -xvpf backup\/opt.tar -C \/mnt\/gentoo\/opt\ntar -xvpf backup\/tmp.tar -C \/mnt\/gentoo\/tmp\nchmod 1777 \/mnt\/gentoo\/tmp\ntar -xvpf backup\/usr.tar -C \/mnt\/gentoo\/usr\ntar -xvpf backup\/var.tar -C \/mnt\/gentoo\/var\n<\/pre>\n<p>You might need to chroot into the restored environment to re-install GRUB and re-write its configuration file.<\/p>\n<p><center><\/p>\n<hr width=\"75%\">\n<p><\/center><\/p>\n<p class=\"copyright-info\">Gentoo and the Gentoo \u201cg\u201d logo are trademarks of the Gentoo Foundation, Inc, and are subject to the <a href=\"https:\/\/www.gentoo.org\/inside-gentoo\/foundation\/name-logo-guidelines.html\">name and logo usage guidelines<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Today I\u2019m going to walk through the process of creating a development workstation on Gentoo Linux as a (VMware Workstation) virtual machine. This is something that I do myself with somewhat high frequency, and in a way, this page contains notes to myself so that this fairly manual process becomes a great deal less manual. &hellip; <a href=\"https:\/\/cyberbisson.com\/blog\/2016\/03\/28\/creating-a-gentoo-workstation-in-a-vmware-virtual-machine-2\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Creating a Gentoo Workstation in a VMware Virtual Machine&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26,25],"tags":[27,34,30,28,29,31,32,33],"class_list":["post-47","post","type-post","status-publish","format-standard","hentry","category-gentoo","category-linux","tag-gentoo","tag-kde","tag-ldap","tag-linux","tag-lvm","tag-samba","tag-virtual-machine","tag-vmware"],"_links":{"self":[{"href":"https:\/\/cyberbisson.com\/blog\/wp-json\/wp\/v2\/posts\/47","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyberbisson.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyberbisson.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyberbisson.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyberbisson.com\/blog\/wp-json\/wp\/v2\/comments?post=47"}],"version-history":[{"count":6,"href":"https:\/\/cyberbisson.com\/blog\/wp-json\/wp\/v2\/posts\/47\/revisions"}],"predecessor-version":[{"id":116,"href":"https:\/\/cyberbisson.com\/blog\/wp-json\/wp\/v2\/posts\/47\/revisions\/116"}],"wp:attachment":[{"href":"https:\/\/cyberbisson.com\/blog\/wp-json\/wp\/v2\/media?parent=47"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyberbisson.com\/blog\/wp-json\/wp\/v2\/categories?post=47"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyberbisson.com\/blog\/wp-json\/wp\/v2\/tags?post=47"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}