Check it, then reboot

Everything is in place. Before you give up your shell, confirm it – each of these is something that has locked someone out of a headless machine.

The pre-flight check

Run this inside the chroot:

echo "hostname : $(cat /etc/hostname)"
echo "accounts : $(getent passwd admin user | cut -d: -f1 | tr '\n' ' ')"
echo "passwords: $(passwd -S admin | awk '{print $2}') $(passwd -S user | awk '{print $2}')"
echo "sudo     : $(visudo -c >/dev/null 2>&1 && echo OK || echo BROKEN)"
echo "units    : $(systemctl is-enabled systemd-networkd systemd-resolved iwd sshd | tr '\n' ' ')"
echo "ssh key  : $(wc -l < /home/admin/.ssh/authorized_keys) key(s)"
echo "fstab    : $(grep -c '^UUID' /etc/fstab) entries"

(stdout)

hostname : myhost
accounts : admin user
passwords: P P
sudo     : OK
units    : enabled enabled enabled enabled
ssh key  : 3 key(s)
fstab    : 7 entries

P from passwd -S means a usable password is set; L means locked and NP means none at all. Both accounts must read P.

On WiFi, check this too

The credentials live outside the chroot’s view, so check them from the live system:

ls /mnt/var/lib/iwd/

An empty directory on a machine with no ethernet means it will boot and never appear on the network.

Unmount and reboot

Leave the chroot, release everything cleanly, and go:

Run this on the live system:

exit
swapoff /mnt/swap/swapfile
umount -R /mnt
reboot

umount -R unmounts the whole tree in the right order. If it complains that the target is busy, something still has a file open there – often a shell sitting in a directory under /mnt. Find it with fuser -m /mnt rather than forcing it; a lazy unmount can leave btrfs with writes that never landed.

Pull the stick out once the machine has powered down, or it will boot the installer again.

Connecting to the new machine

The installed system is a different host from the stick, and it will say so. On its first boot it generates its own SSH host keys, which have nothing to do with the ones on the USB stick, so the arch-iso entry in your SSH config no longer describes it.

Give the real machine its own entry:

Edit this file: ~/.ssh/config

Host myhost
    HostName 192.168.1.50
    User admin

Run this on your workstation:

ssh myhost

You will be asked to accept a new host key, which is correct and expected – this really is a machine you have never spoken to before. The address may also have changed: the machine is asking for its own DHCP lease now, under its own hostname, rather than the stick’s.

tip

If it does not answer, the fastest thing to check is whether it is on the network at all – look at your router’s lease table, or ping the address. A machine that has an address but refuses SSH is a different problem from one that never appeared, and the two want opposite kinds of investigation.

Once you are in as admin, the install is finished. Everything from here on is a running system you can change at will, and the next chapter is about keeping it that way.