Network and users
This is the chapter that decides whether you ever see the machine again.
Every other step in this book fails loudly: a disk that will not format, a package that will not install, a kernel that drops to an emergency shell. This one fails quietly and politely. The machine reboots, comes up perfectly, runs beautifully – and does not let you in, because there is no account, or no network, or sshd was never enabled. On a headless box in another room, that means fetching a monitor and a keyboard, which is the chore this entire book exists to avoid.
So this chapter does all of it before the reboot, and ends with a checklist.
Unless a block says otherwise, every command runs inside the
chroot. Get back in with arch-chroot /mnt if you have left it.
Two accounts
| Account | UID | Groups | What it is for |
|---|---|---|---|
admin |
1000 | admin, wheel |
Administration. Passwordless sudo. |
user |
1001 | user |
Everything else. No special privileges. |
The split is the point. Day-to-day work – editing, browsing,
building, running other people’s code – happens as user, an
account that cannot reconfigure the system even by accident. When
you actually intend to administer the machine, you log in as
admin, where sudo does not argue.
admin can become root with no further check, so anything that
gets a shell as admin has root. That is a real reduction in
depth, and worth being deliberate about rather than copying it from
a tutorial.
The reasoning here: SSH is key-only, root login is disabled, and
admin exists to administer. A sudo password in that arrangement
mostly protects against someone who already has an admin shell –
at which point they can also wait and capture the password. It is
the same trade cloud images make by default.
If you would rather keep the prompt, skip the one file that grants
NOPASSWD and wheel membership alone gives admin ordinary
password-prompting sudo.
What has to be true before rebooting
- A hostname, so the machine knows what it is called.
- Networking that comes up by itself, including WiFi credentials if there is no ethernet.
- Accounts that exist and have passwords.
- SSH: your key installed, sshd enabled, passwords refused.
The last page turns that list into commands you can run to check each one, and only then reboots.