From nobody Mon Sep 07 07:57:48 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hdfZ96Zdlz6rdnB for ; Mon, 07 Sep 2026 07:57:53 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hdfZ94pV9z3xLb for ; Mon, 07 Sep 2026 07:57:53 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788767873; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dbwraX3FRpNJGwLPT8jjWrykTf3DzJ4ei+RUQWaX9uU=; b=vHOCVVrPcD8HELyym7DqfiZ9WvOZK9irS2b8beyOIXEnyan9jWK9Y73iP0EteD/b2wevYo KZy804IS+7FsWd2KBj0Bz1f9tOzD0ZWKnX0nU3J93jCN39gKaFNNZwIDS/0byo27XAcxvg t/CWeWFoo/Ly7luF6yDym1OHXoXVWFhMShSRNBFozrSr0hBTXWF2njoGBJ3jvrtobmQcv6 3/AI7CwkqYZGhYf4FBmbNqsiDHNqvMtJOQinTFpiOLLw5tJsTp2TGjqcl8IBCSTath3v6i eCFGdpX77KrMMFCoJc8mhFfi+v3JKr88gbRWhHLoG8ZAzi8dItzUcccFDYnSXQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1788767873; a=rsa-sha256; cv=none; b=XrUW0QtUXkbK+4Ko9vT1ouSTfuzLsN7GGQaauja5Eu3moZtkdpWT3r4F0QOdtBZ+N8cyvP 4GLTMeUj68tsLWH9Pk+i+ncRmr0Tr3h7qbXOWBosy88Ds/PZ3dYGaTp6WtSaZYwLbmLiBU o3JxEafDOMwGVLQ3OYoxFrJmiW/o5ulmVPszLYcSypz1yqsuZSH9j0rTctL5ei13Z4I3KA O1Ejz333j2LsdmeVW/r6S9CJeHldU/DIii5djTsgLLNEHbKJOm4K5nk0YNwTkIfQhFUDas zJimtFQNIs3pjlBtB7JjaRvJuAJBtInP1XGRR4X4t1wlHx0ZMGCtzlSWcr9fFg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788767873; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dbwraX3FRpNJGwLPT8jjWrykTf3DzJ4ei+RUQWaX9uU=; b=tDRC/fmqOGPgLM1njhSDycK1jSh+dFbc3qORar2Np92nToLgoGFYd0hsG6sBT9TNyYu+RM wEjW6b82CjsHKf1mO0SmBZVDbY26bGDMS2MURP4fQn+2dFt75Vl08nHCORNxXJB3/IIX9/ OiCsOWv5vDJbQY/N1v5o3UZNc+7i8UTq4PVklcvscqqpCSA0isxYW7gnjkFaPyxELQJF3X n0DTFhAkMVMLd1gOYzPpcnY/35Epv8XJQO1U5UU/le/Tip2gSfz5NKF4GJXijjan/TWovx qzHEDG12Z9lM9At8OCQHxu7vMKXr1c1+LaimCpFUsbAZkcJxnGknteajYjNAbg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hdfZ93DHSz17Zh for ; Mon, 07 Sep 2026 07:57:53 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3a5b1 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 07 Sep 2026 07:57:48 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Colin Percival Subject: git: a9710349513f - main - EC2: Add desktop flavour List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: cperciva X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: a9710349513f4c6ccb8bcff34fa9ea186fae6114 Auto-Submitted: auto-generated Date: Mon, 07 Sep 2026 07:57:48 +0000 Message-Id: <6a9e6e7c.3a5b1.4136d5fd@gitrepo.freebsd.org> The branch main has been updated by cperciva: URL: https://cgit.FreeBSD.org/src/commit/?id=a9710349513f4c6ccb8bcff34fa9ea186fae6114 commit a9710349513f4c6ccb8bcff34fa9ea186fae6114 Author: Colin Percival AuthorDate: 2026-09-07 07:54:04 +0000 Commit: Colin Percival CommitDate: 2026-09-07 07:54:04 +0000 EC2: Add desktop flavour Desktop AMIs have xrdp enabled and boot to a KDE desktop; they are as compatible as possible with EC2 Windows AMIs, setting a random password and printing it to the console in encrypted format to be retrieved using the EC2 GetPasswordData API. Two rc.d scripts are included in this commit which will not exist in the long term: ec2_addpass will become part of the ec2-scripts package, and ec2_desktop_extras will go away once its functionality is included elsewhere. MFC After: 1 month Relnotes: yes Sponsored by: Amazon --- release/Makefile.vm | 3 +- release/tools/ec2-desktop.conf | 73 ++++++++++++++++++++++++++++++++++++++++ release/tools/ec2_desktop_extras | 60 +++++++++++++++++++++++++++++++++ release/tools/ec2_setpass | 58 +++++++++++++++++++++++++++++++ 4 files changed, 193 insertions(+), 1 deletion(-) diff --git a/release/Makefile.vm b/release/Makefile.vm index 8296fc47a477..ca13971e9ad8 100644 --- a/release/Makefile.vm +++ b/release/Makefile.vm @@ -36,10 +36,11 @@ BASIC-CLOUDINIT_FSLIST?= ufs zfs BASIC-CLOUDINIT_DESC?= Images for VM with cloudinit disk config support EC2_FORMAT= raw EC2_FSLIST?= ufs zfs -EC2_FLAVOURS?= BASE BUILDER CLOUD-INIT SMALL +EC2_FLAVOURS?= BASE BUILDER CLOUD-INIT DESKTOP SMALL EC2-BASE_DESC= Amazon EC2 image EC2-BUILDER_DESC= Amazon EC2 AMI Builder image EC2-CLOUD-INIT_DESC= Amazon EC2 Cloud-Init image +EC2-DESKTOP_DESC= Amazon EC2 GUI image EC2-SMALL_DESC= Amazon EC2 small image GCE_FORMAT= raw GCE_FSLIST?= ufs zfs diff --git a/release/tools/ec2-desktop.conf b/release/tools/ec2-desktop.conf new file mode 100644 index 000000000000..c60ab7bf2ad7 --- /dev/null +++ b/release/tools/ec2-desktop.conf @@ -0,0 +1,73 @@ +#!/bin/sh + +. ${WORLDDIR}/release/tools/ec2.conf + +# Build with a (just under) 20 GB partition; all of the "desktop" bits +# significantly bloat the image compared with stock FreeBSD. +export VMSIZE=20000m + +# Packages to install into the image we're creating. In addition to packages +# present on all EC2 AMIs, we install: +# * amazon-ssm-agent (not enabled by default, but some users need to use +# it on systems not connected to the internet), +# * ec2-scripts, which provides a range of EC2ification startup scripts, +# * firstboot-pkg-upgrade, to install security updates at first boot, +# * firstboot-pkgs, to install packages at first boot, and +# * isc-dhcp44-client, used for IPv6 network setup, and +# * kde, to provide a useful desktop environment +# * chromium and libreoffice, to provide an office environment, +# * xorg, xrdp, and xorgxrdp, to provide the display server. +export VM_EXTRA_PACKAGES="${VM_EXTRA_PACKAGES} amazon-ssm-agent ec2-scripts \ + firstboot-pkg-upgrade firstboot-pkgs isc-dhcp44-client \ + kde chromium libreoffice xorg xrdp xorgxrdp" + +# Services to enable in rc.conf(5). +export VM_RC_LIST="${VM_RC_LIST} ec2_configinit ec2_ephemeral_swap \ + ec2_fetchkey ec2_setpass ec2_loghostkey firstboot_pkg_upgrade \ + firstboot_pkgs growfs growfs_postboot sshd dbus xrdp xrdp_sesman" + +vm_extra_pre_umount() { + # Limit firstboot_pkg_upgrade to the base system. + echo 'firstboot_pkg_upgrade_repos="FreeBSD-base"' >> ${DESTDIR}/etc/rc.conf + + # Don't allocate swap space when we first boot; that makes it + # impossible to grow the root filesystem later. + echo 'growfs_swap_size=0' >> ${DESTDIR}/etc/rc.conf + + # Give users a KDE desktop by default. + sed -i '' -e '/exec.*startplasma/s/^# //' ${DESTDIR}/usr/local/etc/xrdp/startwm.sh + + # Use UID/GID _xrdp. Disabled for now until the port supports this. + #sed -i '' -e '/SessionSockdirGroup/s/^#//' ${DESTDIR}/usr/local/etc/xrdp/sesman.ini + #sed -i '' -E -e '/runtime_(user|group)=_xrdp/s/^#//' ${DESTDIR}/usr/local/etc/xrdp/xrdp.ini + + # Set login password and print in encrypted form to the console. + # This will be removed from here once it lands in the ec2-scripts port. + install -m 755 ${WORLDDIR}/release/tools/ec2_setpass ${DESTDIR}/usr/local/etc/rc.d + metalog_add_data ./usr/local/etc/rc.d/ec2_setpass 0755 + + # Run some additional commands on first boot which won't be + # necessary once (a) the xrdp port gains host key generation as + # an rc.d script, and (b) pkg triggers are logged in METALOG and + # run from a firstboot script. + install -m 755 ${WORLDDIR}/release/tools/ec2_desktop_extras ${DESTDIR}/usr/local/etc/rc.d + metalog_add_data ./usr/local/etc/rc.d/ec2_desktop_extras 0755 + + # Any EC2 ephemeral disks seen when the system first boots will + # be "new" disks; there is no "previous boot" when they might have + # been seen and used already. + touch ${DESTDIR}/var/db/ec2_ephemeral_diskseen + metalog_add_data ./var/db/ec2_ephemeral_diskseen + + # Configuration common to all EC2 AMIs + ec2_common + + # Standard FreeBSD network configuration + ec2_base_networking + + # Add files from packages which weren't recorded in metalog + metalog_add_data ./usr/local/etc/dhclient.conf + metalog_add_data ./usr/local/etc/ssl/cert.pem + + return 0 +} diff --git a/release/tools/ec2_desktop_extras b/release/tools/ec2_desktop_extras new file mode 100644 index 000000000000..be9c23b4bfc7 --- /dev/null +++ b/release/tools/ec2_desktop_extras @@ -0,0 +1,60 @@ +#!/bin/sh + +# KEYWORD: firstboot +# PROVIDE: ec2_desktop_extras +# REQUIRE: ldconfig +# BEFORE: ec2_setpass +# BEFORE: xrdp + +# Forcibly enabled; this script will not be included (in fact will be +# deleted entirely) once its functionality is included elsewhere. +ec2_desktop_extras_enable=YES + +. /etc/rc.subr + +name="ec2_desktop_extras" +rcvar=ec2_desktop_extras_enable +start_cmd="ec2_desktop_extras_run" +stop_cmd=":" + +ec2_desktop_extras_run() +{ + + # These should run at first boot from pkg triggers, but those + # aren't included in VM images yet. + /usr/bin/makewhatis /usr/share/man + /usr/bin/makewhatis /usr/share/openssl/man + /usr/local/bin/fc-cache -s + /usr/local/bin/glib-compile-schemas /usr/local/share/glib-2.0/schemas + /usr/local/bin/gio-querymodules /usr/local/lib/gio/modules + /usr/local/bin/gdk-pixbuf-query-loaders --update-cache + /usr/local/bin/update-desktop-database -q + /usr/local/bin/update-mime-database /usr/local/share/mime + for d in /usr/local/share/icons/*/; do + [ -d "$d" ] || continue + /usr/local/bin/gtk-update-icon-cache -q -t -f "${d%/}" + done + + # This should from from an rc.d script in xrdp. + RSAKEYS=/usr/local/etc/xrdp/rsakeys.ini + PRIVATEKEY=/usr/local/etc/xrdp/key.pem + CERTIFICATE=/usr/local/etc/xrdp/cert.pem + # make sure rsakeys and certificates are private + umask 077 + # generate rsakeys.ini + [ -e "$RSAKEYS" ] || /usr/local/bin/xrdp-keygen xrdp "$RSAKEYS" && \ + # generate self-signed certificate + [ -e "$PRIVATEKEY" -a -e "$CERTIFICATE" ] || \ + /usr/bin/openssl req \ + -x509 \ + -newkey rsa:4096 \ + -keyout "$PRIVATEKEY" \ + -sha256 \ + -nodes \ + -out "$CERTIFICATE" \ + -days 365 \ + -subj "/CN=$(hostname)" +} + +load_rc_config $name +run_rc_command "$1" diff --git a/release/tools/ec2_setpass b/release/tools/ec2_setpass new file mode 100644 index 000000000000..6bc5a73dc33b --- /dev/null +++ b/release/tools/ec2_setpass @@ -0,0 +1,58 @@ +#!/bin/sh + +# KEYWORD: firstboot +# PROVIDE: ec2_setpass +# REQUIRE: ec2_fetchkey +# BEFORE: LOGIN + +# Define ec2_setpass_enable=YES in /etc/rc.conf to enable setting the +# account password and printing in encrypted format to the console. +: ${ec2_setpass_enable=NO} + +# We reuse the user name from ec2_fetchkey since that creates the user +# and fetches the SSH key which is used to encrypt the password. +: ${ec2_fetchkey_user=ec2-user} + +. /etc/rc.subr + +name="ec2_setpass" +rcvar=ec2_setpass_enable +start_cmd="ec2_setpass_run" +stop_cmd=":" + +ec2_setpass_run() +{ + + # If the user does not exist or has no SSH key, return. + HOMEDIR=$(pw user show ${ec2_fetchkey_user} 2>/dev/null | awk -F: '{print $9}') + SSHKEYFILE="${HOMEDIR}/.ssh/authorized_keys" + if [ -z "${HOMEDIR}" ] || ! [ -f "${SSHKEYFILE}" ]; then + return + fi + + # Print the RDP certificate fingerprint + echo "HOSTNAME: freebsd" + echo "RDPCERTIFICATE-SUBJECTNAME: freebsd" + FINGERSHA1=$(openssl x509 -in /usr/local/etc/xrdp/cert.pem \ + -noout -fingerprint -sha1 | cut -f 2- -d = | tr -d :) + FINGERSHA256=$(openssl x509 -in /usr/local/etc/xrdp/cert.pem \ + -noout -fingerprint -sha256 | cut -f 2- -d = | tr A-F a-f) + echo "RDPCERTIFICATE-THUMBPRINT: ${FINGERSHA1}" + echo "RDPCERTIFICATE-THUMBPRINT256: ${FINGERSHA256}" + + # Set a random password, and print it in encrypted format + PUBKEY=$(mktemp -t ec2_setpass) + ssh-keygen -e -m PKCS8 -f ${SSHKEYFILE} > ${PUBKEY} + PASSWD=`jot -cr 16 / z | tr '\\`' '-+' | rs -g 0` + echo "${PASSWD}" | pw usermod ${ec2_fetchkey_user} -h 0 + echo "Username: ${ec2_fetchkey_user}" + echo "Password: " + printf "%s" "${PASSWD}" | + openssl pkeyutl -encrypt -pubin -inkey ${PUBKEY} -pkeyopt rsa_padding_mode:pkcs1 | + base64 -w 0 + echo "" + echo 'Message: Windows is Ready to use' +} + +load_rc_config $name +run_rc_command "$1"