Cloning preparation script for linux systems.

sysprep_linux.sh

#!/bin/bash
# Does the equivalent of sysprep for linux boxes to prepare them for cloning.
# Based on https://lonesysadmin.net/2013/03/26/preparing-linux-template-vms/
# For issues or updated versions of this script, browse to the following URL:
# https://gist.github.com/AfroThundr3007730/ff5229c5b1f9a018091b14ceac95aa55
# SPDX-License-Identifier: GPL-3.0-or-later

AUTHOR='AfroThundr'
BASENAME="${0##*/}"
MODIFIED='20240409'
VERSION='1.8.4'

sysprep.parse_args() {
    [[ -n $1 ]] || {
        printf 'No arguments specified, use -h for help.\n'
        exit 1
    }
    while [[ -n $1 ]]; do
        if [[ $1 == -v ]]; then
            printf '%s: Version %s, updated %s by %s\n' \
                "$BASENAME" "$VERSION" "$MODIFIED" "$AUTHOR"
            shift
            [[ -n $1 ]] || exit 0
        elif [[ $1 == -h ]]; then
            printf 'Cloning preparation script for linux systems.\n\n'
            printf 'Usage: %s [-v ] (-h | -y [-b] [-l <log_file>] [-s])\n\n' \
                "$BASENAME"
            printf 'Options:\n'
            printf '  -h  Display this help text.\n'
            printf '  -b  Used for firstboot (internal).\n'
            printf '  -l  Specify log file location.\n'
            printf '  -s  Shutdown on completion.\n'
            printf '  -v  Emit version header.\n'
            printf '  -y  Confirm sysprep.\n'
            exit 0
        elif [[ $1 == -b ]]; then
            FIRSTBOOT=true
            break
        elif [[ $1 == -l ]]; then
            LOGFILE=$2
            shift 2
        elif [[ $1 == -s ]]; then
            SHUTDOWN=true
            shift
        elif [[ $1 == -y ]]; then
            CONFIRM=true
            shift
        else
            printf 'Invalid argument specified, use -h for help.\n'
            exit 1
        fi
    done
}

utils.say() {
    LOGFILE=${LOGFILE:=/var/log/sysprep.log}
    if [[ -n $LOGFILE && ! $LOGFILE == no ]]; then
        [[ -f $LOGFILE ]] || UMASK=027 /usr/bin/touch "$LOGFILE"
        printf '%s: %s\n' "$(date -u +%FT%TZ)" "$@" | tee -a "$LOGFILE"
    else
        printf '%s: %s\n' "$(date -u +%FT%TZ)" "$@"
    fi
}

sysprep.apt_purge() {
    vers=$(/usr/bin/ls -tr /boot/vmlinuz-* | /usr/bin/head -n -1 |
           /usr/bin/grep -v "$(uname -r)" | /usr/bin/cut -d- -f2-)
    for i in $vers; do
        debs+="$(echo linux-{image,headers,modules}-"$i") "
    done
    /usr/bin/apt remove -qy --purge "$debs" &> /dev/null &&
        /usr/bin/apt autoremove -qy --purge &> /dev/null
}

sysprep.firstboot() {
    utils.say 'Running sysprep first-boot setup script.'
    [[ $DEBIAN_DERIV == true ]] && {
        /usr/bin/find /etc/ssh/*key &>/dev/null || {
            utils.say 'Regenerating SSH host keys...'
            /usr/sbin/dpkg-reconfigure openssh-server
        }
    }

    [[ $HOSTNAME == CHANGEME ]] && {
        utils.say 'Regenerating hostname and rebooting...'
        /usr/bin/hostnamectl set-hostname \
            "LINUX-$(tr -cd '[:upper:][:digit:]' < /dev/urandom | head -c 9)"
        /usr/bin/systemctl reboot
    }

    [[ -f /var/lib/aide/aide.db.gz ]] && {
        utils.say 'Regenerating AIDE database...'
        /usr/sbin/aide --update
        /usr/bin/mv -f /var/lib/aide/aide.db{.new,}.gz
    }

    utils.say 'Sysprep firtst-boot setup complete, disabling service.'
    /usr/bin/systemctl disable sysprep-firstboot
    exit 0
}

sysprep.clean_packages() {
    utils.say 'Removing old kernels.'
    if [[ $FEDORA_DERIV == true ]]; then
        if command -v dnf &> /dev/null; then
            rpms=$(/usr/bin/dnf repoquery --installonly --latest-limit=-1)
            /usr/bin/dnf remove -qy "$rpms"
        else
            if ! command -v package-cleanup &> /dev/null; then
                /usr/bin/yum install -qy yum-utils &> /dev/null
            fi
            /usr/bin/package-cleanup -qy --oldkernels --count=1 &> /dev/null
        fi
    elif [[ $DEBIAN_DERIV == true ]]; then
        if ! command -v purge-old-kernels &> /dev/null; then
            /usr/bin/apt install -qy byobu &> /dev/null
        fi
        /usr/bin/purge-old-kernels -qy --keep 1 &> /dev/null || sysprep.apt_purge
    fi

    utils.say 'Clearing package cache.'
    if [[ $FEDORA_DERIV == true ]]; then
        /usr/bin/yum clean all -q &> /dev/null
        /usr/bin/rm -rf /var/cache/yum/*
    elif [[ $DEBIAN_DERIV == true ]]; then
        /usr/bin/apt clean &> /dev/null
        /usr/bin/rm -rf /var/cache/apt/archives/*
    fi
    return 0
}

sysprep.clean_logs() {
    utils.say 'Clearing old logs.'
    /usr/sbin/logrotate -f /etc/logrotate.conf
    /usr/bin/find /var/log -type f -regextype posix-extended -regex \
        ".*/*(-[0-9]{8}|.[0-9]|.gz)$" -delete
    /usr/bin/rm -rf /var/log/journal && /usr/bin/mkdir /var/log/journal
    /usr/bin/rm -f /var/log/dmesg.old
    /usr/bin/rm -f /var/log/anaconda/*

    utils.say 'Clearing audit logs.'
    : > /var/log/audit/audit.log
    : > /var/log/wtmp
    : > /var/log/lastlog
    : > /var/log/grubby
    return 0
}

sysprep.clean_network() {
    utils.say 'Clearing udev persistent rules.'
    /usr/bin/rm -f /etc/udev/rules.d/70*

    utils.say 'Removing MACs/UUIDs from network sripts.'
    if [[ $FEDORA_DERIV == true ]]; then
        /usr/bin/sed -ri '/^(HWADDR|UUID)=/d' \
            /etc/sysconfig/network-scripts/ifcfg-*
    fi
    /usr/bin/sed -ri '/^(mac-address|uuid)=/d' \
        /etc/NetworkManager/system-connections/*
    return 0
}

sysprep.clean_files() {
    utils.say 'Cleaning out temp directories.'
    /usr/bin/rm -rf /tmp/*
    /usr/bin/rm -rf /var/tmp/*
    /usr/bin/rm -rf /var/cache/*

    utils.say 'Cleaning up root home directory.'
    unset HISTFILE
    : >/root/.bash_history
    /usr/bin/rm -f /root/anaconda-ks.cfg
    /usr/bin/rm -rf /root/.ssh/*
    /usr/bin/rm -rf /root/.gnupg/*
    return 0
}

sysprep.generalize() {
    utils.say 'Removing SSH host keys.'
    /usr/bin/rm -f /etc/ssh/*key*

    utils.say 'Clearing machine-id'
    : > /etc/machine-id

    utils.say 'Removing random-seed'
    /usr/bin/rm -f /var/lib/systemd/random-seed

    [[ -f /opt/McAfee/agent/bin/maconfig ]] && {
        utils.say 'Resetting McAfee Agent'
        /usr/bin/systemctl stop mcafee.ma
        command -V setenforce &>/dev/null && /usr/sbin/setenforce 0
        /opt/McAfee/agent/bin/maconfig -enforce -noguid
    }

    utils.say 'Resetting hostname.'
    /usr/bin/hostnamectl set-hostname 'CHANGEME'
    return 0
}

sysprep.setup_firstboot() {
    utils.say 'Enabling sysprep firstboot service.'
    FBSERVICE=/etc/systemd/system/sysprep-firstboot.service
    [[ -f $FBSERVICE ]] || /usr/bin/cat <<'EOF' > $FBSERVICE
[Unit]
Description=Sysprep first-boot setup tasks
[Service]
Type=simple
ExecStart=/usr/local/sbin/sysprep -y -b
[Install]
WantedBy=multi-user.target
EOF
    /usr/bin/systemctl enable sysprep-firstboot
    return 0
}

sysprep.run() {
    sysprep.parse_args "$@"

    [[ $CONFIRM == true ]] || {
        utils.say 'Confirm with -y to start sysprep.'
        exit 1
    }

    utils.say 'Beginning sysprep.'
    # shellcheck disable=SC1091
    source /etc/os-release
    if [[ $ID      =~ (fedora|rhel|centos) ||
          $ID_LIKE =~ (fedora|rhel|centos) ]]; then
        FEDORA_DERIV=true
    elif [[ $ID      =~ (debian|ubuntu|mint) ||
            $ID_LIKE =~ (debian|ubuntu|mint) ]]; then
        DEBIAN_DERIV=true
    else
        utils.say 'An unknown base linux distribution was detected.'
        utils.say 'This script works with Debian and Fedora based distros.'
        exit 1
    fi

    [[ $FIRSTBOOT == true ]] && sysprep.firstboot

    utils.say 'Stopping logging and auditing daemons.'
    /usr/bin/systemctl stop rsyslog.service
    /usr/sbin/service auditd stop

    sysprep.clean_packages

    sysprep.clean_logs

    sysprep.clean_network

    sysprep.clean_files

    sysprep.generalize

    sysprep.setup_firstboot

    utils.say 'End of sysprep.'
    [[ $SHUTDOWN == true ]] && {
        utils.say 'Shutting down the system.'
        /usr/bin/systemctl poweroff
    }
    exit 0
}

# Only execute if not being sourced
[[ ${BASH_SOURCE[0]} == "$0" ]] && sysprep.run "$@"

@boktai1000 I will admit that my choice of uppercasing the hostname was mostly for cosmetic reasons. The randomly generated hostname is similar to what a new Windows box will end up with after a sysprep, so I just copied that behavior.

As for software breaking on an uppercase name, the RFC doesn't actually prohibit an uppercase name, so they are still technically valid. It would seem that that particular program is making an overly strict assumption on what constitutes a valid hostname. Most implementations simply treat hostnames case-insensitively to avoid the issue, so 'LINUX' and 'linux' would be the same name.

I think I'll keep this particular quirk in for now (purely for cosmetic reasons at the moment), but if you find more info on why hostnames really should be lowercase at all times, or find more packages that break because of this, I'd be interested to know.

@AfroThundr3007730 note to self: check out https://github.com/ferricoxide/AMIgen7/blob/master/CleanChroot.sh