cmnSense
Download

Installing from the ISO

The cmnSense installer is the standard Debian installer with cmnSense and every package it needs on the image. It installs without network access and asks only what it has to.

1. Download and check the image

Get the ISO for your processor from the download page, together with SHA256SUMS and SHA256SUMS.sign. Checking the signature takes a minute and is worth it for the software that will guard your network: verifying downloads shows how.

2. Write it to a USB stick, or attach it to a VM

The image is a hybrid ISO: write it to a USB stick as it is, byte for byte. Everything on the stick is replaced.

On Linux

shell

lsblk                                   # find the stick, e.g. /dev/sdb
sudo dd if=cmnsense-0.2.2-amd64.iso of=/dev/sdX bs=4M status=progress oflag=sync

On macOS

shell

diskutil list                           # find the stick, e.g. /dev/disk4
diskutil unmountDisk /dev/diskN
sudo dd if=cmnsense-0.2.2-amd64.iso of=/dev/rdiskN bs=4m

On Windows

Use a tool that writes the image as is, such as Rufus in DD image mode. Tools that copy files onto a formatted stick produce media that does not boot.

In a virtual machine

Attach the ISO as a virtual CD in Proxmox, KVM, VMware or Hyper-V and boot from it. Give the machine at least 2 GB of memory, an 8 GB disk (10 GB on arm64) and one network interface per network the firewall will connect.

3. Choose an installer

The amd64 image boots with BIOS or UEFI, the arm64 image with UEFI. The boot menu offers:

Install cmnSenseThe text installer, the default
Graphical installThe same questions in a graphical installer
Install on the serial consoleFor appliances without a screen; the installed system keeps using the serial console
Expert installEvery question of the Debian installer, for unusual partitioning or hardware
Rescue modeDebian's rescue system, to repair an installed system

4. Answer the questions

  1. Language, location and keyboard. The location sets the time zone.
  2. Network. Pick the interface you will manage the firewall through, then DHCP or a static address, the host name and the domain. This becomes the firewall's first network configuration.
  3. Root password. For the console only: root cannot log in over SSH with a password.
  4. Disk. The whole disk is used, with one partition and swap. Nothing is written until you confirm.
  5. The cmnSense administrator password, at least 12 characters. It is the password of the admin user for the web interface and the CLI.

The installer then installs Debian and cmnSense from the image. No Debian mirror is contacted, and apt checks the cmnSense packages against the signing key on the image before installing them.

5. The first boot

On its first start the firewall takes over the network the installer configured, an interface set up by DHCP becomes ip address dhcp, and saves the configuration. Then it is ready:

shell

ssh admin@192.0.2.10                    # the CLI
https://192.0.2.10/                     # the web interface

The web interface starts with a self-signed certificate, so the browser warns about it once. You can replace it with an ACME or your own certificate later. Continue with the first steps.

After installation

The installed system uses the Debian mirrors with security updates and the cmnSense repository. Once it is online, apt update && apt upgrade as root keeps both up to date.

Unattended installation

The installer is a regular Debian installer with a preseed file, so every question can be answered in advance on the kernel command line or in your own preseed file, including the cmnSense ones: cmnsense/admin-password and cmnsense/admin-password-again. An installation whose preseeded administrator password is too short stops and asks instead of failing.