Most of my firewalls are on OpenBSD or FreeBSD. While deploying github runners on Alpine Linux, I thought it could have been a great idea to install Alpine Linux on a firewall, just to see if this distribution can do this job.
Syslinux Boot
Syslinux is using all available tty by default, including ttyS0. It means, when booting on a live-image of Alpine Linux, if a serial cable is plugged to the device, a prompt should appear and offers a way to modify the Linux kernel parameters.
boot> /boot/vmlinuz-lts initrd=/boot/initramfs-lts modules=loop,squashfs,sd-mod,usb-storage quiet console=ttyS0,115200 The default console for this installation should now use the serial console. The setup via setup-alpine process can be executed as usual after a successful login to the root user.
# setup-alpine Don't reboot the firewall right now though, Syslinux is not yet configured.
Persistent Configuration
Just after the installation, before rebooting, to keep the serial console the default way to use your device (or at least, to be able to use it in case of issue), Syslinux must be configured. Let create first our root with some useful mounted filesystems to avoid configuration issues.
# mount /dev/sda2 /mnt # mount /dev/sda1 /mnt/boot # mount -t proc proc /mnt/proc # mount -t devtmpfs devtmpfs /mnt/dev # mount -t sysfs sysfs /mnt/sys Great, the disk is correctly mounted and the new root should have all me need to create a chroot.
# chroot /mnt Syslinux configuration is located in /etc/update-extlinux.conf. Three new values must be updated to keep the serial console active: default_kernel_opts, serial_port and serial_baud.
# cat >> /etc/update-extlinux.conf << EOF default_kernel_opts="quiet rootfstype=ext4 console=ttyS0,115200" serial_port=0 serial_baud=115200 EOF update-extlinux command must be invoked to generate the correct configuration in /boot/boot/extlinux.conf.
# update-extlinux Then, sync the data to the disk to ensure everything has been correctly written and reboot the system.
# sync # reboot After the reboot, your firewall should give you access to a prompt via the serial console.
Conclusion
Alpine Linux is one of the most simple Linux distribution on the market. On many other alternative, configuring the serial console can quickly become complex. There, the configuration is really simple. The biggest complexity is when the parameters are passed to the kernel on the boot prompt (mostly due to the serial console itself). More information can be found here:
Enable Serial Console on Boot from the Official Alpine Linux documentation;
The kernel’s command-line parameters from kernel.org;
Bootloaders from the Official Alpine Linux documentation.
Anyway, as usual, have fun and happy hacking!
Cover Image by Christopher Politano on Unsplash
