Prepare an ISO image for OS autoinstall on a dedicated server

Last update: September 07 2026Open in Markdown

You can prepare your own OS image that will be compatible with the OS autoinstall mechanism on a dedicated server in Selectel.

If you do not have specific OS requirements, we recommend using standard images — you can install the OS via autoinstall or manually.

1. Create an ISO image.
2. Upload the image to S3 storage.
3. Get a link to the object in the storage.
4. Add the ISO image to the control panel.

1. Create an ISO image

The size of the OS image archive must be at least 3 GB less than the RAM size of the dedicated server. For example, if the server RAM size is 8 GB, the image archive size must not exceed 5 GB.

Ubuntu

We recommend preparing the system as the root user.

1. To prepare the image archive, install the OS without software RAID and without a swap partition. We recommend installing the OS via autoinstall on your dedicated server, as some instruction steps will already be performed.

2. Check the status of the sssd package and remove it if it is installed:

   2.1. Check the status of the sssd: package:

   dpkg -l sssd

   If the package is installed, a line with the status ii will appear in the response, for example iisssd2.9.1-....

   2.2. If the sssd package is installed, remove it:

   sudo apt purge -y sssd
   sudo apt autoremove -y

3. Install the required packages:

   sudo apt install -y \
       openssh-server \
       cloud-init \
       grub2 \
       grub-efi-amd64-bin \
       mdadm \
       nftables

4. Update the OS kernel to the latest stable version:

   linux-image-generic-hwe-24.04
   linux-headers-generic-hwe-24.04

5. Update the system packages:

   apt update && apt upgrade -y

6. Prepare the cloud-init service for use in the image:

   6.1. Remove files and directories that contain the current cloud-init: configuration:

   rm -rf /etc/cloud/cloud.cfg.d /etc/cloud/cloud-init.disabled

   6.2. Delete data from the previous cloud-init: execution:

   cloud-init clean --logs

   6.3. Create the /etc/cloud/cloud.cfg.d: directory:

   mkdir -p /etc/cloud/cloud.cfg.d

   6.4. Create the /etc/cloud/cloud.cfg file using the vi: text editor:

   vi /etc/cloud/cloud.cfg

   6.5. Add the cloud-init: configuration to the file:

   The /etc/cloud/cloud.cfg file

   datasource_list:
       - NoCloud
       - None
   
   users:
       - default
   
   #disable_root: 1
   #ssh_pwauth:   0
   
   mount_default_fields: [~, ~, 'auto', 'defaults,nofail,x-systemd.requires=cloud-init.service', '0', '2']
   resize_rootfs_tmp: /dev
   ssh_deletekeys:   1
   ssh_genkeytypes:  ['rsa', 'ecdsa', 'ed25519']
   syslog_fix_perms: ~
   disable_vmware_customization: false
   
   cloud_init_modules:
       - disk_setup
       - growpart
       - resizefs
       - set_hostname
       - update_hostname
       - update_etc_hosts
       - users-groups
       - ssh
       - apt-configure
       - bootcmd
       - ca_certs
       - rsyslog
       - write_files
   
   cloud_config_modules:
       - mounts
       - locale
       - set-passwords
       - timezone
       - runcmd
       - snap
       - ssh_import_id
       - ubuntu_drivers
       - ntp
   
   cloud_final_modules:
       - package-update-upgrade-install
       - scripts-per-once
       - scripts-per-boot
       - scripts-per-instance
       - scripts-user
       - ssh-authkey-fingerprints
       - keys-to-console
       - final-message
       - power-state-change
       - lxd
       - puppet
       - chef
       - mcollective
       - salt_minion
       - phone_home
   
   system_info:
       default_user:
           name: cloud-user
           lock_passwd: true
           gecos: Cloud User
           groups: [adm, systemd-journal]
           sudo: ["ALL=(ALL) NOPASSWD:ALL"]
           shell: /bin/bash
       distro: ubuntu
       paths:
           cloud_dir: /var/lib/cloud
           templates_dir: /etc/cloud/templates
       ssh_svcname: sshd
   
   vendor_data:
       enabled: True
   
   # vim:syntax=yaml

   6.6. Exit the vi text editor with your changes saved:

   :wq

   6.7. Create the cloud-init-local.service file using the vi: text editor:

   sudo vi /usr/lib/systemd/system/cloud-init-local.service

   6.8. Add the configuration to the file:

   [Unit]
   Description=Initial cloud-init job (pre-networking)
   DefaultDependencies=no
   Wants=network-pre.target
   After=hv_kvp_daemon.service
   After=systemd-remount-fs.service
   Before=NetworkManager.service
   Before=network-pre.target
   Before=shutdown.target
   Before=sysinit.target
   Conflicts=shutdown.target
   RequiresMountsFor=/var/lib/cloud
   ConditionPathExists=!/etc/cloud/cloud-init.disabled
   ConditionKernelCommandLine=!cloud-init=disabled
   ConditionEnvironment=!KERNEL_CMDLINE=cloud-init=disabled
   
   [Service]
   Type=oneshot
   ExecStartPre=sleep 30
   ExecStart=/usr/bin/cloud-init init --local
   RemainAfterExit=yes
   TimeoutSec=0
   
   # Output needs to appear in instance console output
   StandardOutput=journal+console
   
   [Install]
   WantedBy=cloud-init.target

   6.9. Exit the vi text editor with your changes saved:

   :wq

7. Add and configure the per-boot script:

   7.1. Create the boot_order_sort.sh script file using the vi: text editor:

   sudo vi /var/lib/cloud/scripts/per-boot/boot_order_sort.sh

   7.2. Add the script text to the file:

   The boot_order_sort.sh file

   #!/bin/bash
   
   # Retrieve the output of efibootmgr
   efi_output=$(efibootmgr -D 2>&1)
   
   # Check if the system supports EFI
   if [[ $? -ne 0 ]]; then
       echo "[WARNING] System does not support EFI, boot order will not be changed."
       exit 0
   fi
   
   # Extract the current boot entry (BootCurrent)
   current_os=$(echo "$efi_output" | grep -oP '(?<=BootCurrent: )[0-9A-F]{4}')
   # Extract the boot order (BootOrder)
   boot_order=$(echo "$efi_output" | grep -oP '(?<=BootOrder: )[0-9A-F,]+')
   
   # Declare an associative array to store BootXXXX values and their descriptions
   declare -A boot_dict
   # boot_order_sorted will contain the sorted boot order
   # removed_entries will contain boot numbers that are not in the sorted list (and are removed)
   boot_order_sorted=()
   removed_entries=()
   
   # Parse all BootXXXX entries with their descriptions (remove 'Boot' prefix and *)
   boot_entries=$(echo "$efi_output" | grep -oP '(?<=Boot)[0-9A-F]{4}\\*?.*')
   
   if [[ -z "$boot_entries" ]]; then
       echo "[ERROR] No boot entries found in EFI output."
       exit 1
   fi
   
   # Debug output
   echo "[INFO] Current Boot: ${current_os:-None}"
   echo "[INFO] Boot Order: ${boot_order:-None}"
   
   # Loop through and process each boot entry
   while read -r entry; do
       # Extract the four-digit boot number (excluding 'Boot' and '*')
       boot_number=$(echo "$entry" | grep -oP '^[0-9A-F]{4}')
       # Extract the description (everything after the boot number)
       description=$(echo "$entry" | sed 's/^[0-9A-F]\{4\}\\* //')
       # Ensure the boot_number is not empty and add to the dictionary
       if [[ -n "$boot_number" ]]; then
           boot_dict["$boot_number"]="$description"
       fi
       # Add entries containing "IP4" or "PXE", but not containing "HTTP", to the sorted list
       if [[ ("$description" =~ "IP4" || "$description" =~ "PXE" || "$description" =~ "IPv4" || "$description" =~ "NIC") && ! "$description" =~ "HTTP" ]]; then
           boot_order_sorted+=("$boot_number")
       fi
       echo "$boot_number: $description"
   done <<< "$boot_entries"
   
   # Add the current OS to the main list if it exists
   if [[ -n "$current_os" ]]; then
       boot_order_sorted+=("$current_os")
   fi
   
   # Find all entries with the same description as current_os and add them to the sorted list
   if [[ -n "$current_os" ]]; then
       current_description="${boot_dict[$current_os]}"
       for boot_number in "${!boot_dict[@]}"; do
           # If description matches the current OS but boot number is not the same, add it to the sorted list
           if [[ "$boot_number" != "$current_os" && "${boot_dict[$boot_number]}" == "$current_description" ]]; then
               boot_order_sorted+=("$boot_number")
           fi
       done
   fi
   
   # Find all boot numbers that are not in the main sorted list and remove them
   if [[ $ -eq 0 ]]; then
       echo "[INFO] No boot entries to process."
   else
       for boot_number in "${!boot_dict[@]}"; do
           if [[ ! " ${boot_order_sorted[*]} " =~ " $boot_number " ]]; then
               # Remove the boot entry from the system
               efibootmgr -b "$boot_number" -B > /dev/null 2>&1
               removed_entries+=("$boot_number")  # Add removed boot number to the removed entries list
               echo "[INFO] Removed Boot Entry: $boot_number"
           fi
       done
   fi
   
   # Convert the main boot order list to a comma-separated string
   if [[ $ -eq 0 ]]; then
       boot_order_sorted_str="None"
   else
       boot_order_sorted_str=$(IFS=,; echo "${boot_order_sorted[*]}")
       efibootmgr -o "$boot_order_sorted_str" > /dev/null 2>&1
       echo "[INFO] Updated boot order: $boot_order_sorted_str"
   fi
   
   # Show the final EFI boot entries for verification
   efibootmgr -D

   7.3. Exit the vi text editor with your changes saved:

   :wq

   7.4. Set permissions for the boot_order_sort.sh: file:

   sudo chmod 700 /var/lib/cloud/scripts/per-boot/boot_order_sort.sh

8. Optional: configure SSH. By default, during OS installation, the cloud-init service sets a password only for the root user. You can use your own authentication scheme, for example, disable password login and login as the root user by creating a separate user with SSH key authorization. In this case, the root password provided during installation will be set but will not be used.

   8.1. Open the /etc/ssh/sshd_config configuration file using the vi: text editor:

   sudo vi /etc/ssh/sshd_config

   8.2. If you want to allow SSH login as the root user, change or add the PermitRootLogin yes. parameter.

   8.3. If you want to allow password authentication, change or add the PasswordAuthentication yes. parameter.

   8.4. Exit the vi text editor with your changes saved:

   :wq

9. Optional: configure grub:

   9.1. Open the /etc/default/grub configuration file using the vi: text editor:

   sudo vi /etc/default/grub

   9.2. Change or add the parameters:

   GRUB_DEFAULT=0
   GRUB_TIMEOUT=5
   GRUB_DISTRIBUTOR=Ubuntu
   GRUB_CMDLINE_LINUX_DEFAULT="loglevel=3 quiet nomodeset"
   GRUB_CMDLINE_LINUX="rd.auto=1 net.ifnames=0 biosdevname=0"
   GRUB_PRELOAD_MODULES="part_gpt part_msdos"
   GRUB_TIMEOUT_STYLE=menu
   GRUB_TERMINAL_INPUT=console
   GRUB_GFXMODE=auto
   GRUB_GFXPAYLOAD_LINUX=keep
   GRUB_DISABLE_RECOVERY=true
   GRUB_DISABLE_OS_PROBER=false

   9.3. Exit the vi text editor with your changes saved:

   :wq

10. Optional: install and configure Fail2ban — a service that blocks an IP address in case of failed authorization attempts:

    10.1. Install Fail2ban:

    fail2ban

    10.2. Open the /etc/fail2ban/jail.d/service.conf configuration file using the vi: text editor:

    sudo vi /etc/fail2ban/jail.d/service.conf

    10.3. Change or add the parameters:

    [sshd]
    enabled = true
    port = ssh
    filter = sshd
    action = nftables[name=sshd, port=ssh, protocol=tcp]
    logpath = /var/log/auth.log
    maxretry = 10
    findtime = 3600
    bantime = 86400

    10.4. Exit the vi text editor with your changes saved:

    :wq

11. Optional: make additional changes to the system, such as installing extra software, packages, or performing other necessary settings for your image. Ensure that the changes made do not contradict the previous instruction steps.

12. Disable sleep and hibernation mode:

    systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target

13. Create a symbolic link for mdamd:

    ln -s /usr/sbin/mdadm /usr/bin/mdadm

14. Enable the system-resolved: service:

    systemctl enable --now systemd-resolved
    ln -s /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf

15. Remove unused packages:

    apt autoremove -y

16. Apply the changes; to do this, reboot the system:

    systemctl reboot

17. Reset the unique system identifier so that each instance of the installed system receives its own identifier:

    truncate -s 0 /etc/machine-id /var/lib/dbus/machine-id

18. Prepare a file with a list of directories that should not be included in the OS image archive:

    18.1. Create the exclude.txt file using the vi: text editor:

    sudo vi /root/exclude.txt

    18.2. Add to the exclude.txt file the list of directories to be excluded from the archive:

    /tmp/*
    /proc/*
    /sys/*
    /dev/*
    /run/*
    /mnt/*
    /media/*
    /var/lib/lxcfs
    /var/spool/postfix
    /lost+found

    18.3. Exit the vi text editor with your changes saved:

    :wq

19. Create a file system archive:

    tar -czp -f /mnt/base.tar.gz --exclude-from=/root/exclude.txt /

Debian

We recommend preparing the system as the root user.

1. To prepare the image archive, install the OS without software RAID and without a swap partition. For example, you can install the OS via autoinstall on your dedicated server, as some instruction steps will already be ready.

2. Check the status of the sssd package and remove it if it is installed:

   2.1. Check the status of the sssd: package:

   dpkg -l sssd

   If the package is installed, a line with the status ii will appear in the response, for example iisssd2.9.1-....

   2.2. If the sssd package is installed, remove it:

   sudo apt purge -y sssd
   sudo apt autoremove -y

3. Install the required packages:

   sudo apt install -y \
       openssh-server \
       cloud-init \
       grub2 \
       grub-efi-amd64-bin \
       mdadm \
       rsyslog \
       resolvconf \
       systemd-timesyncd \
       python3 \
       efibootmgr

4. Prepare the cloud-init service for use in the image:

   4.1. Remove files and directories that contain the current cloud-init: configuration:

   rm -rf /etc/cloud/cloud.cfg.d
   rm -rf /etc/cloud/cloud-init.disabled

   4.2. Create the /etc/cloud/cloud.cfg configuration file using the vi: text editor:

   sudo vi /etc/cloud/cloud.cfg

   4.3. Add the configuration to the file:

   The /etc/cloud/cloud.cfg file

   datasource_list:
       - NoCloud
       - None
       
   users:
       - default
       
   #disable_root: 1
   #ssh_pwauth:   0
   
   mount_default_fields: [~, ~, 'auto', 'defaults,nofail,x-systemd.requires=cloud-init.service', '0', '2']
   resize_rootfs_tmp: /dev
   ssh_deletekeys:   1
   ssh_genkeytypes:  ['rsa', 'ecdsa', 'ed25519']
   syslog_fix_perms: ~
   disable_vmware_customization: false
       
   cloud_init_modules:
       - disk_setup
       - growpart
       - resizefs
       - set_hostname
       - update_hostname
       - update_etc_hosts
       - users-groups
       - ssh
       - write-files
       - bootcmd
       - apt_configure
       - ca_certs
       - rsyslog
       
   cloud_config_modules:
       - mounts
       - locale
       - set-passwords
       - timezone
       - runcmd
       - ssh_import_id
       - ntp
       
   cloud_final_modules:
       - package-update-upgrade-install
       - scripts-per-once
       - scripts-per-boot
       - scripts-per-instance
       - scripts-user
       - ssh-authkey-fingerprints
       - keys-to-console
       - final-message
       - power-state-change
       - puppet
       - chef
       - mcollective
       - salt_minion
       - phone_home
       
   system_info:
       default_user:
           name: cloud-user
           lock_passwd: true
           gecos: Cloud User
           groups: [adm, systemd-journal]
           sudo: ["ALL=(ALL) NOPASSWD:ALL"]
           shell: /bin/bash
       distro: debian
       paths:
           cloud_dir: /var/lib/cloud
           templates_dir: /etc/cloud/templates
       ssh_svcname: sshd
       
   vendor_data:
       enabled: True

   4.4. Exit the vi text editor with your changes saved:

   :wq

5. Add and configure the per-boot script:

   5.1. Create the boot_order_sort.sh script file using the vi: text editor:

   sudo vi /var/lib/cloud/scripts/per-boot/boot_order_sort.sh

   5.2. Add the script text to the file:

   The boot_order_sort.sh file

   #!/bin/bash
   
   # Retrieve the output of efibootmgr
   efi_output=$(efibootmgr -D 2>&1)
       
   # Check if the system supports EFI
   if [[ $? -ne 0 ]]; then
       echo "[WARNING] System does not support EFI, boot order will not be changed."
       exit 0
   fi
       
   # Extract the current boot entry (BootCurrent)
   current_os=$(echo "$efi_output" | grep -oP '(?<=BootCurrent: )[0-9A-F]{4}')
   # Extract the boot order (BootOrder)
   boot_order=$(echo "$efi_output" | grep -oP '(?<=BootOrder: )[0-9A-F,]+')
   
   # Declare an associative array to store BootXXXX values and their descriptions
   declare -A boot_dict
   # boot_order_sorted will contain the sorted boot order
   # removed_entries will contain boot numbers that are not in the sorted list (and are removed)
   boot_order_sorted=()
   removed_entries=()
   
   # Parse all BootXXXX entries with their descriptions (remove 'Boot' prefix and *)
   boot_entries=$(echo "$efi_output" | grep -oP '(?<=Boot)[0-9A-F]{4}\\*?.*')
   
   if [[ -z "$boot_entries" ]]; then
       echo "[ERROR] No boot entries found in EFI output."
       exit 1
   fi
       
   # Debug output
   echo "[INFO] Current Boot: ${current_os:-None}"
   echo "[INFO] Boot Order: ${boot_order:-None}"
   
   # Loop through and process each boot entry
   while read -r entry; do
       # Extract the four-digit boot number (excluding 'Boot' and '*')
       boot_number=$(echo "$entry" | grep -oP '^[0-9A-F]{4}')
       # Extract the description (everything after the boot number)
       description=$(echo "$entry" | sed 's/^[0-9A-F]\{4\}\\* //')
       # Ensure the boot_number is not empty and add to the dictionary
       if [[ -n "$boot_number" ]]; then
           boot_dict["$boot_number"]="$description"
       fi
       # Add entries containing "IP4" or "PXE", but not containing "HTTP", to the sorted list
       if [[ ("$description" =~ "IP4" || "$description" =~ "PXE" || "$description" =~ "IPv4" || "$description" =~ "NIC") && ! "$description" =~ "HTTP" ]]; then
           boot_order_sorted+=("$boot_number")
       fi
       echo "$boot_number: $description"
   done <<< "$boot_entries"
       
   # Add the current OS to the main list if it exists
   if [[ -n "$current_os" ]]; then
       boot_order_sorted+=("$current_os")
   fi
       
   # Find all entries with the same description as current_os and add them to the sorted list
   if [[ -n "$current_os" ]]; then
       current_description="${boot_dict[$current_os]}"
       for boot_number in "${!boot_dict[@]}"; do
           # If description matches the current OS but boot number is not the same, add it to the sorted list
           if [[ "$boot_number" != "$current_os" && "${boot_dict[$boot_number]}" == "$current_description" ]]; then
               boot_order_sorted+=("$boot_number")
           fi
       done
   fi
       
   # Find all boot numbers that are not in the main sorted list and remove them
   if [[ $ -eq 0 ]]; then
       echo "[INFO] No boot entries to process."
   else
       for boot_number in "${!boot_dict[@]}"; do
           if [[ ! " ${boot_order_sorted[*]} " =~ " $boot_number " ]]; then
               # Remove the boot entry from the system
               efibootmgr -b "$boot_number" -B > /dev/null 2>&1
               removed_entries+=("$boot_number")  # Add removed boot number to the removed entries list
               echo "[INFO] Removed Boot Entry: $boot_number"
           fi
       done
   fi
       
   # Convert the main boot order list to a comma-separated string
   if [[ $ -eq 0 ]]; then
       boot_order_sorted_str="None"
   else
       boot_order_sorted_str=$(IFS=,; echo "${boot_order_sorted[*]}")
       efibootmgr -o "$boot_order_sorted_str" > /dev/null 2>&1
       echo "[INFO] Updated boot order: $boot_order_sorted_str"
   fi
       
   # Show the final EFI boot entries for verification
   efibootmgr -D

   5.3. Exit the vi text editor with your changes saved:

   :wq

   5.4. Set permissions for the script file:

   sudo chmod 700 /var/lib/cloud/scripts/per-boot/boot_order_sort.sh

6. Optional: make additional changes to the system, such as installing extra software, packages, or performing other necessary settings for your image. Ensure that the changes made do not contradict the previous instruction steps.

7. Create a symbolic link for mdamd:

   ln -s /usr/sbin/mdadm /usr/bin/mdadm

8. Remove unused packages:

   apt autoremove -y

9. Apply the changes; to do this, reboot the system:

   systemctl reboot

10. Reset the unique system identifier so that each instance of the installed system receives its own identifier:

    truncate -s 0 /etc/machine-id /var/lib/dbus/machine-id

11. Prepare a file with a list of directories that should not be included in the OS image archive:

    11.1. Create the exclude.txt file using the vi: text editor:

    sudo vi /root/exclude.txt

    11.2. Add to the exclude.txt file the list of directories to be excluded from the archive:

    /tmp/*
    /proc/*
    /sys/*
    /dev/*
    /run/*
    /mnt/*
    /media/*
    /var/lib/lxcfs
    /var/spool/postfix
    /lost+found

    11.3. Exit the vi text editor with your changes saved:

    :wq

12. Create a file system archive:

    tar -czp -f /mnt/base.tar.gz --exclude-from=/root/exclude.txt /

Windows Server

1. To prepare the image archive, you can install the OS via autoinstall on your dedicated server, as some instruction steps will already be ready.

   To avoid incompatibility with server components, we recommend installing an extensive set of drivers that are not supplied with the system kernel.

2. Prepare the Cloudbase-Init service for use in the image:

   2.1. Install Cloudbase-Init.

   2.2. Open the cloudbase-init.conf configuration file. By default, the file is in the C:\Program Files\Cloudbase Solutions\Cloudbase-Init\conf\. directory.

   2.3. Add the configuration to the file:

   The cloudbase-init.conf file

   [DEFAULT]
   username=Administrator
   groups=Administrators
   inject_user_password=true
   config_drive_raw_hhd=false
   config_drive_cdrom=false
   config_drive_vfat=true
   config_drive_locations=partition
   bsdtar_path=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\bin\bsdtar.exe
   mtools_path=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\bin\
   verbose=true
   debug=true
   logdir=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\log\
   logfile=cloudbase-init.log
   default_log_levels=comtypes=INFO,suds=INFO,iso8601=WARN,requests=WARN
   logging_serial_port_settings=COM1,115200,N,8
   mtu_use_dhcp_config=false
   ntp_use_dhcp_config=false
   local_scripts_path=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\LocalScripts\
   check_latest_version=false
   metadata_services=cloudbaseinit.metadata.services.nocloudservice.NoCloudConfigDriveService
   plugins=cloudbaseinit.plugins.common.sethostname.SetHostNamePlugin,
           cloudbaseinit.plugins.common.userdata.UserDataPlugin,
           cloudbaseinit.plugins.windows.extendvolumes.ExtendVolumesPlugin,
           cloudbaseinit.plugins.common.sshpublickeys.SetUserSSHPublicKeysPlugin,
           cloudbaseinit.plugins.common.localscripts.LocalScriptsPlugin,
           cloudbaseinit.plugins.common.networkconfig.NetworkConfigPlugin

   2.4. Open the cloudbase-init-unattend.conf configuration file. By default, the file is in the C:\Program Files\Cloudbase Solutions\Cloudbase-init\conf\. directory.

   2.5. Add the configuration to the file:

   The cloudbase-init-unattend.conf file

   [DEFAULT]
   username=Administrator
   groups=Administrators
   inject_user_password=true
   config_drive_raw_hhd=false
   config_drive_cdrom=false
   config_drive_vfat=true
   config_drive_locations=partition
   bsdtar_path=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\bin\bsdtar.exe
   mtools_path=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\bin\
   verbose=true
   debug=true
   logdir=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\log\
   logfile=cloudbase-init-unattend.log
   default_log_levels=comtypes=INFO,suds=INFO,iso8601=WARN,requests=WARN
   logging_serial_port_settings=COM1,115200,N,8
   mtu_use_dhcp_config=false
   ntp_use_dhcp_config=false
   local_scripts_path=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\LocalScripts\
   check_latest_version=false
   metadata_services=cloudbaseinit.metadata.services.nocloudservice.NoCloudConfigDriveService
   plugins=cloudbaseinit.plugins.common.sethostname.SetHostNamePlugin,
           cloudbaseinit.plugins.common.userdata.UserDataPlugin,
           cloudbaseinit.plugins.windows.extendvolumes.ExtendVolumesPlugin,
           cloudbaseinit.plugins.common.sshpublickeys.SetUserSSHPublicKeysPlugin,
           cloudbaseinit.plugins.common.localscripts.LocalScriptsPlugin,
           cloudbaseinit.plugins.common.networkconfig.NetworkConfigPlugin

3. Prepare Cloudbase-Init scripts — they are executed during the initial server setup:

   3.1. To set network booting as a priority, create the get_efi_network.ps1 script in the C:\Program Files\Cloudbase Solutions\Cloudbase-init\LocalScripts\: directory:

   The get_efi_network.ps1 file

   #ps1_x64
   
   $scriptPath = "C:\Scripts\set_boot_order.ps1"
       
   $scriptContent = @'
   $list_identifier_pxe = bcdedit /enum firmware |
       Select-String "U?EFI:?.*IP.*v?4|NIC.*Partition|Embedded NIC" -Context 1 |
       ForEach-Object { $_.Context.PreContext[0] } |
       ForEach-Object { $_ -replace "^identifier +", "" } |
       Sort-Object {Get-Random}
       
   foreach ($i in $list_identifier_pxe) {
       bcdedit /set "{fwbootmgr}" displayorder "$i" /addfirst
   }
   '@
       
   $folder = Split-Path $scriptPath
   if (-not (Test-Path $folder)) {
       New-Item -ItemType Directory -Path $folder -Force | Out-Null
   }
       
   Set-Content -Path $scriptPath -Value $scriptContent -Encoding UTF8
       
   $taskName = "SetUEFIBootOrder"
   for ($i = 0; $i -lt 5; $i++) {
       try {
           $action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-ExecutionPolicy Bypass -File `"$scriptPath`""
           if ($action) { break }
       } catch {
           Start-Sleep -Seconds 5
       }
   }
   $trigger = New-ScheduledTaskTrigger -AtStartup
   $principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -RunLevel Highest
   
   $taskExists = Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue
   
   if ($taskExists) {
       Set-ScheduledTask -TaskName $taskName -Action $action -Trigger $trigger -Principal $principal
   } else {
       Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $trigger -Principal $principal
   }
   
   Start-ScheduledTask -TaskName $taskName
   
   Remove-Item $script:MyInvocation.MyCommand.Path -Force

   3.2. To remove the CIDATA partition with Cloudbase-init configurations after the initial setup is complete, create the remove_cidata.ps1 file in the C:\Program Files\Cloudbase Solutions\Cloudbase-init\LocalScripts\: directory:

   The remove_cidata.ps1 file

   #ps1_sysnative
   
   # find partition with a name CIDATA
   $DataPartition=Get-WMIObject Win32_Volume | ? { $_.Label -eq 'CIDATA' }
   
   # remove disk letter from CIDATA object
   $DataPartition.DriveLetter = $null
   
   # save changes
   $DataPartition.Put()
   
   # self delete this script
   Remove-Item $script:MyInvocation.MyCommand.Path -Force

   3.3. To disable NetBIOS on all network interfaces, create the disable_netbios.ps1 file in the C:\Program Files\Cloudbase Solutions\Cloudbase-Init\LocalScripts\: directory:

   The disable_netbios.ps1 file

   #ps1_sysnative
   
   # disables netbios on all interfaces
   $i = 'HKLM:\SYSTEM\CurrentControlSet\Services\netbt\Parameters\interfaces'
   Get-ChildItem $i | ForEach-Object {Set-ItemProperty -Path "$i\$($_.pschildname)" -name NetBiosOptions -value 2}
   
   # self delete this script
   Remove-Item $script:MyInvocation.MyCommand.Path -Force

   3.4. To disable Large Send Offload (LSO) technology on network interfaces to improve compatibility with hardware that incorrectly supports this function, create the disable_large_send_offload.ps1 file in the C:\Program Files\Cloudbase Solutions\Cloudbase-Init\LocalScripts\: directory:

   The disable_large_send_offload.ps1 file

   #ps1_sysnative
   
   # disables large send offload on all adapters
   Disable-NetAdapterLso -Name *
   
   # self delete this script
   Remove-Item $script:MyInvocation.MyCommand.Path -Force

   3.5. To ensure the disk is correctly detected in WinPE mode, create two files:

   • the diskpart.ps1 script, which runs the diskpart utility and executes commands from the file in the C:\Program Files\Cloudbase Solutions\Cloudbase-Init\LocalScripts\: directory:
   The diskpart.ps1 file

   # This script executes diskpart script stored in diskpart.txt
   diskpart /s C:\diskpart.txt
   
   # delete diskpart.txt config file
   Remove-Item "C:\diskpart.txt" -Force
   
   # self delete this script
   Remove-Item $script:MyInvocation.MyCommand.Path -Force

   • the diskpart.txt file with commands that remove the NoDefaultDriveLetter attribute from the system partition in the C:\: directory:
   The diskpart.txt file

   rem choose vol C where OS is stored
   sel vol C
   rem remove NoDefaultDriveLetter attribute from OS volume so it would be detected in WinPe without manual letter assignment
   attr vol clear nodefaultdriveletter

   3.6. To disable the use of DHCP on network interfaces, create the set_dhcp_disabled.ps1 file in the C:\Program Files\Cloudbase Solutions\Cloudbase-Init\LocalScripts\: directory:

   The set_dhcp_disabled.ps1 file

   #ps1_sysnative
   
   # set DHCP disabled on all network interfaces
   gci -Path HKLM:\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\ | Set-ItemProperty -Name EnableDhcp -Value 0
   
   # self delete this script
   Remove-Item $script:MyInvocation.MyCommand.Path -Force

4. Disable the password guessing protection mechanism AllowAdministratorLockout. This will prevent the user account from being locked in the system due to password guessing or failed authorization attempts.

   4.1. Create the AllowAdministratorLockout.inf configuration file in the C:\. directory.

   4.2. Add the configuration to the file:

   [System Access]
   AllowAdministratorLockout = 0
   [Version]
   signature='$CHICAGO$'

   4.3. Apply the configuration file:

   secedit.exe /configure /db name.sdb /cfg C:\AllowAdministratorLockout.inf

   4.4. Delete the AllowAdministratorLockout.inf configuration file in the C:\. directory.

5. Configure the OpenSSH Server: service:

   5.1. Create the OpenSSH sshd_config configuration file in the C:\ProgramData\ssh\. directory.

   5.2. Add the configuration to the file:

   The sshd_config file

   # This is the sshd server system-wide configuration file. See
   # sshd_config(5) for more information.
   
   # The strategy used for options in the default sshd_config shipped with
   # OpenSSH is to specify options with their default value where
   # possible, but leave them commented. Uncommented options override the
   # default value.
   
   #Port 22
   #AddressFamily any
   #ListenAddress 0.0.0.0
   #ListenAddress ::
   
   #HostKey __PROGRAMDATA__/ssh/ssh_host_rsa_key
   #HostKey __PROGRAMDATA__/ssh/ssh_host_dsa_key
   #HostKey __PROGRAMDATA__/ssh/ssh_host_ecdsa_key
   #HostKey __PROGRAMDATA__/ssh/ssh_host_ed25519_key
   
   # Ciphers and keying
   #RekeyLimit default none
   
   # Logging
   #SyslogFacility AUTH
   #LogLevel INFO
   
   # Authentication:
   
   #LoginGraceTime 2m
   #PermitRootLogin prohibit-password
   #StrictModes yes
   #MaxAuthTries 6
   #MaxSessions 10
   
   #PubkeyAuthentication yes
   
   # The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
   # but this is overridden so installations will only check .ssh/authorized_keys
   AuthorizedKeysFile      .ssh/authorized_keys
   
   #AuthorizedPrincipalsFile none
   
   # For this to work you will also need host keys in %programData%/ssh/ssh_known_hosts
   #HostbasedAuthentication no
   # Change to yes if you don't trust ~/.ssh/known_hosts for
   # HostbasedAuthentication
   #IgnoreUserKnownHosts no
   # Don't read the user's ~/.rhosts and ~/.shosts files
   #IgnoreRhosts yes
   
   # To disable tunneled clear text passwords, change to no here!
   #PasswordAuthentication yes
   #PermitEmptyPasswords no
   
   # GSSAPI options
   #GSSAPIAuthentication no
   
   #AllowAgentForwarding yes
   #AllowTcpForwarding yes
   #GatewayPorts no
   #PermitTTY yes
   #PrintMotd yes
   #PrintLastLog yes
   #TCPKeepAlive yes
   #UseLogin no
   #PermitUserEnvironment no
   #ClientAliveInterval 0
   #ClientAliveCountMax 3
   #UseDNS no
   #PidFile /var/run/sshd.pid
   #MaxStartups 10:30:100
   #PermitTunnel no
   #ChrootDirectory none
   #VersionAddendum none
   
   # no default banner path
   #Banner none
   
   # override default of no subsystems
   Subsystem       sftp    sftp-server.exe
   
   # Example of overriding settings on a per-user basis
   #Match User anoncvs
   #       AllowTcpForwarding no
   #       PermitTTY no
   #       ForceCommand cvs server

   5.3. Enable automatic startup of OpenSSH when Windows boots:

   Set-Service -Name sshd -StartupType 'Automatic'

   5.4. Allow incoming connections; to do this, create a rule in the Windows firewall:

   # SSH добавлен in firewall
   netsh advfirewall firewall add rule name="SSH server service" dir=in action=allow enable=yes protocol=TCP localport=22

6. To allow Selectel staff to check the server status without rebooting it as part of technical support, enable monitor support:

   powercfg.exe -x -monitor-timeout-ac 0
   powercfg.exe -x -monitor-timeout-dc 0

7. Prepare the system for cloning; to do this, remove unique data from the system:

   C:\Windows\System32\Sysprep\Sysprep.exe /generalize /quiet

8. Install Python version 3.12.7 or higher.

9. Update the Python package manager and install the necessary packages:

   python -m ensurepip --upgrade
   python -m pip install --upgrade pip
   python -m pip install pywinauto
   python -m pip install logging

10. Clear the cache:

    10.1. Stop the update services:

    net stop wuauserv
    net stop bits

    10.2. Delete temporary files:

    Remove-Item -Path "$env:TEMP\\*" -Recurse -Force -ErrorAction SilentlyContinue

    10.3. Delete the update cache:

    Remove-Item -Path "C:\Windows\SoftwareDistribution\Download\\*" -Recurse -Force -ErrorAction SilentlyContinue

    10.4. Clear the component store:

    Dism.exe /Online /Cleanup-Image /StartComponentCleanup /ResetBase

    10.5. Start the update services:

    net start wuauserv
    net start bits

11. Create an OS image in .img format. To create an image, we recommend using software that supports disk image creation, for example, Clonezilla, Macrium Reflect, DiskGenius, Acronis, and we do not recommend using the built-in Windows backup tool.

12. Create an archive with the OS image:

    tar -czf base.tar.gz <img_name>

    Specify <img_name> — the name of the OS image in .img format that you created in step 11.

VMware ESXi

1. Optional: you can prepare the setup.tpl file yourself — it is a script that applies network and system settings during the OS installation stage and ensures they are saved after a reboot.

   For VMware ESXi, the OS autoinstall mechanism includes a setup.tpl template, which will be used if you do not upload your own script to S3 storage along with the ISO image archive.

   1.1. On your local computer, create the setup.tpl. file.

   1.2. Add the script text to the file:

   The setup.tpl file

   #!/bin/sh
   
   esxcli system hostname set --host="{{ userhostname }}"
   esxcli system account set -i root -p "{{ password }}" -c "{{ password }}"
   
   mkdir -p /etc/ssh/keys-root
   echo "" > /etc/ssh/keys-root/authorized_keys
   
   {% if user_ssh_key %}
   echo "{{ user_ssh_key }}" > /etc/ssh/keys-root/authorized_keys
   {% endif %}
   
   esxcli network ip dns server add --server=188.93.17.19
   esxcli network ip dns server add --server=188.93.16.19
   
   esxcli network ip interface ipv4 set -i vmk0 -I {{ ipv4_address }} -N {{ ipv4_netmask }} -t static
   esxcli network ip route ipv4 add -n default -g {{ ipv4_gateway }}
   
   cat << 'EOF' > /etc/rc.local.d/local.sh
   #!/bin/sh
   
   LOG="/var/log/local.sh.log"
   exec >> "$LOG" 2>&1
   
   echo "====================================================="
   echo "$(date) local.sh START"
   echo "====================================================="
   
   set -x
   
   TARGET_MAC="{{ local["boot_mac_address"] }}"
   VSWITCH="vSwitch0"
   
   TARGET_NIC="$(esxcli network nic list | awk -v mac="$TARGET_MAC" '$0 ~ mac {print $1; exit}')"
   CURRENT_UPLINKS="$(esxcli network vswitch standard list \
       | sed -n "/^${VSWITCH}\$/,/^$/p" \
       | sed -n 's/^[[:space:]]*Uplinks:[[:space:]]*//p' \
       | sed 's/,//g')"
   
   if [ -n "$TARGET_NIC" ] && { \
       [ "$(echo "$CURRENT_UPLINKS" | awk '{print NF}')" -ne 1 ] || \
       [ "$CURRENT_UPLINKS" != "$TARGET_NIC" ]; \
   }; then
       for nic in $CURRENT_UPLINKS; do
           esxcli network vswitch standard uplink remove -u $nic -v $VSWITCH
       done
       esxcli network vswitch standard uplink add -u $TARGET_NIC -v $VSWITCH
   fi
   
   esxcli network nic down -n $TARGET_NIC
   sleep 1
   esxcli network nic up -n $TARGET_NIC
   sleep 1
   esxcli network ip interface set -e false -i vmk0
   sleep 1
   esxcli network ip interface set -e true -i vmk0
   sleep 5
   esxcli network vswitch standard portgroup policy failover set -p "Management Network" -a $TARGET_NIC
   
   /sbin/auto-backup.sh
   
   exit 0
   EOF
   
   /sbin/auto-backup.sh
   
   esxcli system maintenanceMode set --enable yes
   esxcli system shutdown poweroff -r "Provisioning complete" -d 10

   1.3. Save the changes to the file.

2. Install a clean VMware ESXi. We recommend installing VMware ESXi in a virtual machine with a virtual disk of the minimum permissible size for the selected ESXi version to facilitate creating an archive with the OS image.

3. Configure a static IP address on the vmk0: network interface:

   esxcli network ip interface ipv4 set -i vmk0 -I 192.168.100.2 -N 255.255.255.0 -t static

   Here 192.168.100.2 is the service IP address for the OS autoinstall mechanism. Ensure that the subnet is not used in your infrastructure. Do not change this IP address when preparing the image.

4. Enable the SSH service:

   vim-cmd hostsvc/enable_ssh
   vim-cmd hostsvc/start_ssh

5. Enable the ESXi Shell console with access via DCUI:

   vim-cmd hostsvc/enable_esx_shell
   vim-cmd hostsvc/start_esx_shell

6. Add a public SSH key for the root: user:

   6.1. Open the /etc/ssh/keys-root/authorized_keys file using the vi: text editor:

   vi /etc/ssh/keys-root/authorized_keys

   6.2. Add the public SSH key to the file — it is a service key required during the image deployment process for automatic configuration and transfer of setup.tpl. Do not change this key when preparing the image.

   ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCQItiaAt3k6jkxglmD8cmWc20vDB2JTE3uonJYP9+6LhpM4m4HwCdLwyNuCzH0wBMA6ysEzdHhKUwC3dk0J8e7jUEQzJ/N70C0YIGEFOcjUeaeEf1DtO9q60eOyYoTFCwbuXx+tDax+Jh0k3OqbBitjW9m9FxQYRc3hmzaMrEhi3dfAtGlzVEkoK33x+kW9HDCMiBSQMI+iI6vwmdnpD9uvj4viYQCyCIT4k/gO6NpncHrY61AMQLD+AiQhqwiFZHAevbfIJ8DFND0QrIgFKhk2kaUka/qe8NvvScV2RfRWgTKtSy5tNFlU1vQtJJI+G7HNz+OhwORGPl/flLeSDri6upoJLKX8ZuQuGFIaJaUFf5Fi1skT6U4aLSq2f5FbNeDT9aerr5b9sLlfW6JiYXdESga3RVv2scyKAKVMro/l10dXf21x6y5E3SCPe3ogjopLMHnlDMkVKbG2A6xFI5G7eoqW9kVzzbYLe9/uEsmrnw7UAE7kQh1Rzm1N+gQCYk= autoinstall

   6.3. Exit the vi text editor with your changes saved:

   :wq

7. Optional: make additional changes to the system, such as installing extra software, packages, or performing other necessary settings for your image. Ensure that the changes made do not contradict the previous instruction steps.

8. Create an archive with the OS image. For example, you can do this in a separate Linux virtual machine. To do this, connect the ESXi system disk to the Linux VM as a block device.

   8.1. Create a disk image in .img: format:

   dd if=/dev/<disk_name> of=<img_name> bs=1M status=progress

   Specify:

   • <disk_name> — the name of the ESXi system disk that is connected to the Linux VM;
   • <img_name> — the name of the image in .img format, for example esxi.img.

   8.2. Create an archive with the OS image:

   tar -czvf base.tar.gz <img_name>

   Specify <img_name> — the name of the OS image in .img format that you created in step 8.1.

2. Upload the image to S3 storage

To upload the image archive to S3 storage, use the Upload Object instruction.

If while creating the ISO image for VMware ESXi you prepared the setul.tpl file, upload it to the storage along with the image.

3. Get a link to the object in the storage

To get a link to an object in S3 storage, use the Get a Link to an Object instruction.

4. Add the image to the control panel

1. In the control panel in the top menu, click Products and select Dedicated Servers.

2. Go to the Images section.

3. Click Add Image.

4. Select the OS family.

5. Enter the image name.

6. Add a link to the image you uploaded to S3 storage in step 2.

7. If in step 6 you added the path to the image in S3 as the link, enter the Access key and Secret key.

8. Click Create Image.