Prepare an ISO image for OS autoinstall on a dedicated server

Last update: October 13 2026Open in Markdown

You can prepare your own OS image that will be compatible with the OS autoinstall mechanism on a dedicated server in Selectel.

If you have no specific OS requirements, we recommend using standard images — from them you can install the OS automatically or manually.

1. Create an ISO image.
2. Upload the image to S3 storage.
3. Get a link to the object in storage.
4. Add the ISO image to the control panel.

1. Create an ISO image

The size of the OS image archive must be at least 3 GB less than the RAM size of the dedicated server. For example, if the server RAM size is 8 GB, the image archive size must not exceed 5 GB.

Ubuntu

We recommend preparing the system as the root user.

1. To prepare the archive with the image, install the OS without software RAID and without a swap partition. We recommend automatically installing the OS on your dedicated server; then some steps of the instructions will already be completed.

2. Check the status of the sssd package and remove it if it is installed:

   2.1. Check the status of the sssd package:

   dpkg -l sssd

   If the package is installed, the output will contain a line with the ii status, for example ii sssd 2.9.1-....

   2.2. If the sssd package is installed, remove it:

   sudo apt purge -y sssd
   sudo apt autoremove -y

3. Install the required packages:

   sudo apt install -y \
       openssh-server \
       cloud-init \
       grub2 \
       grub-efi-amd64-bin \
       mdadm \
       nftables

4. Update the OS kernel to the latest stable version:

   linux-image-generic-hwe-24.04
   linux-headers-generic-hwe-24.04

5. Update the system packages:

   apt update && apt upgrade -y

6. Prepare the cloud-init service for use in the image:

   6.1. Delete the files and directories that contain the current cloud-init configuration:

   rm -rf /etc/cloud/cloud.cfg.d /etc/cloud/cloud-init.disabled

   6.2. Delete data from the previous cloud-init run:

   cloud-init clean --logs

   6.3. Create the /etc/cloud/cloud.cfg.d directory:

   mkdir -p /etc/cloud/cloud.cfg.d

   6.4. Create the /etc/cloud/cloud.cfg file using the vi text editor:

   vi /etc/cloud/cloud.cfg

   6.5. Add the cloud-init configuration to the file:

   File /etc/cloud/cloud.cfg

   datasource_list:
       - NoCloud
       - None
   
   users:
       - default
   
   #disable_root: 1
   #ssh_pwauth:   0
   
   mount_default_fields: [~, ~, 'auto', 'defaults,nofail,x-systemd.requires=cloud-init.service', '0', '2']
   resize_rootfs_tmp: /dev
   ssh_deletekeys:   1
   ssh_genkeytypes:  ['rsa', 'ecdsa', 'ed25519']
   syslog_fix_perms: ~
   disable_vmware_customization: false
   
   cloud_init_modules:
       - disk_setup
       - growpart
       - resizefs
       - set_hostname
       - update_hostname
       - update_etc_hosts
       - users-groups
       - ssh
       - apt-configure
       - bootcmd
       - ca_certs
       - rsyslog
       - write_files
   
   cloud_config_modules:
       - mounts
       - locale
       - set-passwords
       - timezone
       - runcmd
       - snap
       - ssh_import_id
       - ubuntu_drivers
       - ntp
   
   cloud_final_modules:
       - package-update-upgrade-install
       - scripts-per-once
       - scripts-per-boot
       - scripts-per-instance
       - scripts-user
       - ssh-authkey-fingerprints
       - keys-to-console
       - final-message
       - power-state-change
       - lxd
       - puppet
       - chef
       - mcollective
       - salt_minion
       - phone_home
   
   system_info:
       default_user:
           name: cloud-user
           lock_passwd: true
           gecos: Cloud User
           groups: [adm, systemd-journal]
           sudo: ["ALL=(ALL) NOPASSWD:ALL"]
           shell: /bin/bash
       distro: ubuntu
       paths:
           cloud_dir: /var/lib/cloud
           templates_dir: /etc/cloud/templates
       ssh_svcname: sshd
   
   vendor_data:
       enabled: True
   
   # vim:syntax=yaml

   6.6. Exit the vi text editor saving changes:

   :wq

   6.7. Create the cloud-init-local.service file using the vi text editor:

   sudo vi /usr/lib/systemd/system/cloud-init-local.service

   6.8. Add the configuration to the file:

   [Unit]
   Description=Initial cloud-init job (pre-networking)
   DefaultDependencies=no
   Wants=network-pre.target
   After=hv_kvp_daemon.service
   After=systemd-remount-fs.service
   Before=NetworkManager.service
   Before=network-pre.target
   Before=shutdown.target
   Before=sysinit.target
   Conflicts=shutdown.target
   RequiresMountsFor=/var/lib/cloud
   ConditionPathExists=!/etc/cloud/cloud-init.disabled
   ConditionKernelCommandLine=!cloud-init=disabled
   ConditionEnvironment=!KERNEL_CMDLINE=cloud-init=disabled
   
   [Service]
   Type=oneshot
   ExecStartPre=sleep 30
   ExecStart=/usr/bin/cloud-init init --local
   RemainAfterExit=yes
   TimeoutSec=0
   
   # Output needs to appear in instance console output
   StandardOutput=journal+console
   
   [Install]
   WantedBy=cloud-init.target

   6.9. Exit the vi text editor saving changes:

   :wq

7. Add and configure the per-boot script:

   7.1. Create the boot_order_sort.sh script file using the vi text editor:

   sudo vi /var/lib/cloud/scripts/per-boot/boot_order_sort.sh

   7.2. Add the script text to the file:

   File boot_order_sort.sh

   #!/bin/bash
   
   # Retrieve the output of efibootmgr
   efi_output=$(LC_ALL=C efibootmgr 2>&1)
   
   # Check if the system supports EFI
   if [[ $? -ne 0 ]]; then
       echo "[WARNING] System does not support EFI, boot order will not be changed."
       exit 0
   fi
   
   # Extract the current boot entry (BootCurrent)
   current_os=$(echo "$efi_output" | grep -oP '(?<=BootCurrent: )[0-9A-F]{4}')
   # Extract the boot order (BootOrder)
   boot_order=$(echo "$efi_output" | grep -oP '(?<=BootOrder: )[0-9A-F,]+')
   
   # Declare an associative array to store BootXXXX values and their descriptions
   declare -A boot_dict
   # boot_order_sorted will contain the sorted boot order
   # removed_entries will contain boot numbers that are not in the sorted list (and are removed)
   boot_order_sorted=()
   removed_entries=()
   
   # Parse all BootXXXX entries with their descriptions (remove 'Boot' prefix and *)
   boot_entries=$(echo "$efi_output" | grep -oP '(?<=Boot)[0-9A-F]{4}\*?.*')
   
   if [[ -z "$boot_entries" ]]; then
       echo "[ERROR] No boot entries found in EFI output."
       exit 1
   fi
   
   # Do not delete entries if the current boot entry cannot be identified.
   if [[ -z "$current_os" ]] || ! printf '%s\n' "$boot_entries" | grep -qE "^${current_os}(\*|[[:space:]])"; then
       echo "[ERROR] Missing current boot entry; no changes made" >&2
       exit 1
   fi
   
   # Debug output
   echo "[INFO] Current Boot: ${current_os:-None}"
   echo "[INFO] Boot Order: ${boot_order:-None}"
   
   # Loop through and process each boot entry
   while read -r entry; do
       # Extract the four-digit boot number (excluding 'Boot' and '*')
       boot_number=$(echo "$entry" | grep -oP '^[0-9A-F]{4}')
       # Extract the description (everything after the boot number)
       # Compare labels only: different disks have different device paths/GUIDs.
       description=$(printf '%s\n' "$entry" | sed -E \
           -e 's/^[0-9A-F]{4}\*?[[:space:]]+//' \
           -e 's/\t.*//' \
           -e 's/[[:space:]]+(HD|PciRoot|Pci|VenHw|VenMsg|Acpi|USB|MAC|BBS|FvFile|File|Fv|NVMe)\(.*//' \
           -e 's/[[:space:]]+$//')
       # Ensure the boot_number is not empty and add to the dictionary
       if [[ -n "$boot_number" ]]; then
           boot_dict["$boot_number"]="$description"
       fi
       # Add entries containing "IP4" or "PXE", but not containing "HTTP", to the sorted list
       if [[ ("$description" =~ "IP4" || "$description" =~ "PXE" || "$description" =~ "IPv4" || "$description" =~ "NIC") && ! "$description" =~ "HTTP" ]]; then
           boot_order_sorted+=("$boot_number")
       fi
       echo "$boot_number: $description"
   done <<< "$boot_entries"
   
   # Add the current OS to the main list if it exists
   if [[ -n "$current_os" ]]; then
       boot_order_sorted+=("$current_os")
   fi
   
   # Find all entries with the same description as current_os and add them to the sorted list
   if [[ -n "$current_os" ]]; then
       current_description="${boot_dict[$current_os]}"
       for boot_number in "${!boot_dict[@]}"; do
           # If description matches the current OS but boot number is not the same, add it to the sorted list
           if [[ "$boot_number" != "$current_os" && "${boot_dict[$boot_number]}" == "$current_description" ]]; then
               boot_order_sorted+=("$boot_number")
           fi
       done
   fi
   
   # Find all boot numbers that are not in the main sorted list and remove them
   if [[ ${#boot_dict[@]} -eq 0 ]]; then
       echo "[INFO] No boot entries to process."
   else
       for boot_number in "${!boot_dict[@]}"; do
           if [[ ! " ${boot_order_sorted[*]} " =~ " $boot_number " ]]; then
               # Remove the boot entry from the system
               if efibootmgr -b "$boot_number" -B; then
                   removed_entries+=("$boot_number")
                   echo "[INFO] Removed Boot Entry: $boot_number"
               else
                   echo "[ERROR] Failed to remove Boot$boot_number" >&2
                   exit 1
               fi
           fi
       done
   fi
   
   # Convert the main boot order list to a comma-separated string
   if [[ ${#boot_order_sorted[@]} -eq 0 ]]; then
       boot_order_sorted_str="None"
   else
       boot_order_sorted_str=$(IFS=,; echo "${boot_order_sorted[*]}")
       if ! efibootmgr -o "$boot_order_sorted_str"; then
           echo "[ERROR] Failed to write BootOrder" >&2
           exit 1
       fi
       echo "[INFO] Updated boot order: $boot_order_sorted_str"
   fi
   
   # Show the final EFI boot entries for verification
   final_output=$(LC_ALL=C efibootmgr) || exit 1
   printf '%s\n' "$final_output"
   actual_order=$(printf '%s\n' "$final_output" | sed -n 's/^BootOrder: //p')
   if [[ "$boot_order_sorted_str" != None && "$actual_order" != "$boot_order_sorted_str" ]]; then
       echo "[ERROR] BootOrder verification failed" >&2
       exit 1
   fi

   7.3. Exit the vi text editor saving changes:

   :wq

   7.4. Set permissions for the boot_order_sort.sh file:

   sudo chmod 700 /var/lib/cloud/scripts/per-boot/boot_order_sort.sh

8. Optional: configure SSH. By default, when installing the OS, the cloud-init service sets a password only for the root user. You can use your own authentication scheme, for example, disable password login and login as the root user by creating a separate user with SSH key authorization. In this case, the root password passed during installation will be set, but will not be used.

   8.1. Open the /etc/ssh/sshd_config configuration file using the vi text editor:

   sudo vi /etc/ssh/sshd_config

   8.2. If you want to allow SSH login as the root user, modify or add the PermitRootLogin yes parameter.

   8.3. If you want to allow password authentication, modify or add the PasswordAuthentication yes parameter.

   8.4. Exit the vi text editor saving changes:

   :wq

9. Optional: configure grub:

   9.1. Open the /etc/default/grub configuration file using the vi text editor:

   sudo vi /etc/default/grub

   9.2. Change or add the parameters:

   GRUB_DEFAULT=0
   GRUB_TIMEOUT=5
   GRUB_DISTRIBUTOR=Ubuntu
   GRUB_CMDLINE_LINUX_DEFAULT="loglevel=3 quiet nomodeset"
   GRUB_CMDLINE_LINUX="rd.auto=1 net.ifnames=0 biosdevname=0"
   GRUB_PRELOAD_MODULES="part_gpt part_msdos"
   GRUB_TIMEOUT_STYLE=menu
   GRUB_TERMINAL_INPUT=console
   GRUB_GFXMODE=auto
   GRUB_GFXPAYLOAD_LINUX=keep
   GRUB_DISABLE_RECOVERY=true
   GRUB_DISABLE_OS_PROBER=false

   9.3. Exit the vi text editor saving changes:

   :wq

10. Optional: install and configure Fail2ban — a service for blocking IP addresses in case of failed authorization attempts:

    10.1. Install Fail2ban:

    fail2ban

    10.2. Open the /etc/fail2ban/jail.d/service.conf configuration file using the vi text editor:

    sudo vi /etc/fail2ban/jail.d/service.conf

    10.3. Change or add the parameters:

    [sshd]
    enabled = true
    port = ssh
    filter = sshd
    action = nftables[name=sshd, port=ssh, protocol=tcp]
    logpath = /var/log/auth.log
    maxretry = 10
    findtime = 3600
    bantime = 86400

    10.4. Exit the vi text editor saving changes:

    :wq

11. Optional: make additional changes to the system, such as installing extra software, packages, or performing other necessary settings for your image. Ensure that the changes made do not contradict the previous instruction steps.

12. Disable sleep and hibernation mode:

    systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target

13. Create a symbolic link for mdamd:

    ln -s /usr/sbin/mdadm /usr/bin/mdadm

14. Enable the systemd-resolved service:

    systemctl enable --now systemd-resolved
    ln -s /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf

15. Remove unused packages:

    apt autoremove -y

16. Apply the changes; to do this, reboot the system:

    systemctl reboot

17. Reset the unique system identifier so that each instance of the installed system receives its own identifier:

    truncate -s 0 /etc/machine-id /var/lib/dbus/machine-id

18. Prepare a file with a list of directories that should not be included in the OS image archive:

    18.1. Create the exclude.txt file using the vi text editor:

    sudo vi /root/exclude.txt

    18.2. Add to the exclude.txt file the list of directories to exclude from the archive:

    /tmp/*
    /proc/*
    /sys/*
    /dev/*
    /run/*
    /mnt/*
    /media/*
    /var/lib/lxcfs
    /var/spool/postfix
    /lost+found

    18.3. Exit the vi text editor saving changes:

    :wq

19. Create a file system archive:

    tar -czp -f /mnt/base.tar.gz --exclude-from=/root/exclude.txt /

Debian

We recommend preparing the system as the root user.

1. To prepare the archive with the image, install the OS without software RAID and without a swap partition. For example, you can automatically install the OS on your dedicated server; then some steps of the instructions will already be completed.

2. Check the status of the sssd package and remove it if it is installed:

   2.1. Check the status of the sssd package:

   dpkg -l sssd

   If the package is installed, the output will contain a line with the ii status, for example ii sssd 2.9.1-....

   2.2. If the sssd package is installed, remove it:

   sudo apt purge -y sssd
   sudo apt autoremove -y

3. Install the required packages:

   sudo apt install -y \
       openssh-server \
       cloud-init \
       grub2 \
       grub-efi-amd64-bin \
       mdadm \
       rsyslog \
       resolvconf \
       systemd-timesyncd \
       python3 \
       efibootmgr

4. Prepare the cloud-init service for use in the image:

   4.1. Delete the files and directories that contain the current cloud-init configuration:

   rm -rf /etc/cloud/cloud.cfg.d
   rm -rf /etc/cloud/cloud-init.disabled

   4.2. Create the /etc/cloud/cloud.cfg configuration file using the vi text editor:

   sudo vi /etc/cloud/cloud.cfg

   4.3. Add the configuration to the file:

   File /etc/cloud/cloud.cfg

   datasource_list:
       - NoCloud
       - None
       
   users:
       - default
       
   #disable_root: 1
   #ssh_pwauth:   0
   
   mount_default_fields: [~, ~, 'auto', 'defaults,nofail,x-systemd.requires=cloud-init.service', '0', '2']
   resize_rootfs_tmp: /dev
   ssh_deletekeys:   1
   ssh_genkeytypes:  ['rsa', 'ecdsa', 'ed25519']
   syslog_fix_perms: ~
   disable_vmware_customization: false
       
   cloud_init_modules:
       - disk_setup
       - growpart
       - resizefs
       - set_hostname
       - update_hostname
       - update_etc_hosts
       - users-groups
       - ssh
       - write-files
       - bootcmd
       - apt_configure
       - ca_certs
       - rsyslog
       
   cloud_config_modules:
       - mounts
       - locale
       - set-passwords
       - timezone
       - runcmd
       - ssh_import_id
       - ntp
       
   cloud_final_modules:
       - package-update-upgrade-install
       - scripts-per-once
       - scripts-per-boot
       - scripts-per-instance
       - scripts-user
       - ssh-authkey-fingerprints
       - keys-to-console
       - final-message
       - power-state-change
       - puppet
       - chef
       - mcollective
       - salt_minion
       - phone_home
       
   system_info:
       default_user:
           name: cloud-user
           lock_passwd: true
           gecos: Cloud User
           groups: [adm, systemd-journal]
           sudo: ["ALL=(ALL) NOPASSWD:ALL"]
           shell: /bin/bash
       distro: debian
       paths:
           cloud_dir: /var/lib/cloud
           templates_dir: /etc/cloud/templates
       ssh_svcname: sshd
       
   vendor_data:
       enabled: True

   4.4. Exit the vi text editor saving changes:

   :wq

5. Add and configure the per-boot script:

   5.1. Create the boot_order_sort.sh script file using the vi text editor:

   sudo vi /var/lib/cloud/scripts/per-boot/boot_order_sort.sh

   5.2. Add the script text to the file:

   File boot_order_sort.sh

   #!/bin/bash
   
   # Retrieve the output of efibootmgr
   efi_output=$(LC_ALL=C efibootmgr 2>&1)
   
   # Check if the system supports EFI
   if [[ $? -ne 0 ]]; then
       echo "[WARNING] System does not support EFI, boot order will not be changed."
       exit 0
   fi
   
   # Extract the current boot entry (BootCurrent)
   current_os=$(echo "$efi_output" | grep -oP '(?<=BootCurrent: )[0-9A-F]{4}')
   # Extract the boot order (BootOrder)
   boot_order=$(echo "$efi_output" | grep -oP '(?<=BootOrder: )[0-9A-F,]+')
   
   # Declare an associative array to store BootXXXX values and their descriptions
   declare -A boot_dict
   # boot_order_sorted will contain the sorted boot order
   # removed_entries will contain boot numbers that are not in the sorted list (and are removed)
   boot_order_sorted=()
   removed_entries=()
   
   # Parse all BootXXXX entries with their descriptions (remove 'Boot' prefix and *)
   boot_entries=$(echo "$efi_output" | grep -oP '(?<=Boot)[0-9A-F]{4}\*?.*')
   
   if [[ -z "$boot_entries" ]]; then
       echo "[ERROR] No boot entries found in EFI output."
       exit 1
   fi
   
   # Do not delete entries if the current boot entry cannot be identified.
   if [[ -z "$current_os" ]] || ! printf '%s\n' "$boot_entries" | grep -qE "^${current_os}(\*|[[:space:]])"; then
       echo "[ERROR] Missing current boot entry; no changes made" >&2
       exit 1
   fi
   
   # Debug output
   echo "[INFO] Current Boot: ${current_os:-None}"
   echo "[INFO] Boot Order: ${boot_order:-None}"
   
   # Loop through and process each boot entry
   while read -r entry; do
       # Extract the four-digit boot number (excluding 'Boot' and '*')
       boot_number=$(echo "$entry" | grep -oP '^[0-9A-F]{4}')
       # Extract the description (everything after the boot number)
       # Compare labels only: different disks have different device paths/GUIDs.
       description=$(printf '%s\n' "$entry" | sed -E \
           -e 's/^[0-9A-F]{4}\*?[[:space:]]+//' \
           -e 's/\t.*//' \
           -e 's/[[:space:]]+(HD|PciRoot|Pci|VenHw|VenMsg|Acpi|USB|MAC|BBS|FvFile|File|Fv|NVMe)\(.*//' \
           -e 's/[[:space:]]+$//')
       # Ensure the boot_number is not empty and add to the dictionary
       if [[ -n "$boot_number" ]]; then
           boot_dict["$boot_number"]="$description"
       fi
       # Add entries containing "IP4" or "PXE", but not containing "HTTP", to the sorted list
       if [[ ("$description" =~ "IP4" || "$description" =~ "PXE" || "$description" =~ "IPv4" || "$description" =~ "NIC") && ! "$description" =~ "HTTP" ]]; then
           boot_order_sorted+=("$boot_number")
       fi
       echo "$boot_number: $description"
   done <<< "$boot_entries"
   
   # Add the current OS to the main list if it exists
   if [[ -n "$current_os" ]]; then
       boot_order_sorted+=("$current_os")
   fi
   
   # Find all entries with the same description as current_os and add them to the sorted list
   if [[ -n "$current_os" ]]; then
       current_description="${boot_dict[$current_os]}"
       for boot_number in "${!boot_dict[@]}"; do
           # If description matches the current OS but boot number is not the same, add it to the sorted list
           if [[ "$boot_number" != "$current_os" && "${boot_dict[$boot_number]}" == "$current_description" ]]; then
               boot_order_sorted+=("$boot_number")
           fi
       done
   fi
   
   # Find all boot numbers that are not in the main sorted list and remove them
   if [[ ${#boot_dict[@]} -eq 0 ]]; then
       echo "[INFO] No boot entries to process."
   else
       for boot_number in "${!boot_dict[@]}"; do
           if [[ ! " ${boot_order_sorted[*]} " =~ " $boot_number " ]]; then
               # Remove the boot entry from the system
               if efibootmgr -b "$boot_number" -B; then
                   removed_entries+=("$boot_number")
                   echo "[INFO] Removed Boot Entry: $boot_number"
               else
                   echo "[ERROR] Failed to remove Boot$boot_number" >&2
                   exit 1
               fi
           fi
       done
   fi
   
   # Convert the main boot order list to a comma-separated string
   if [[ ${#boot_order_sorted[@]} -eq 0 ]]; then
       boot_order_sorted_str="None"
   else
       boot_order_sorted_str=$(IFS=,; echo "${boot_order_sorted[*]}")
       if ! efibootmgr -o "$boot_order_sorted_str"; then
           echo "[ERROR] Failed to write BootOrder" >&2
           exit 1
       fi
       echo "[INFO] Updated boot order: $boot_order_sorted_str"
   fi
   
   # Show the final EFI boot entries for verification
   final_output=$(LC_ALL=C efibootmgr) || exit 1
   printf '%s\n' "$final_output"
   actual_order=$(printf '%s\n' "$final_output" | sed -n 's/^BootOrder: //p')
   if [[ "$boot_order_sorted_str" != None && "$actual_order" != "$boot_order_sorted_str" ]]; then
       echo "[ERROR] BootOrder verification failed" >&2
       exit 1
   fi

   5.3. Exit the vi text editor saving changes:

   :wq

   5.4. Set permissions for the script file:

   sudo chmod 700 /var/lib/cloud/scripts/per-boot/boot_order_sort.sh

6. Optional: make additional changes to the system, such as installing extra software, packages, or performing other necessary settings for your image. Ensure that the changes made do not contradict the previous instruction steps.

7. Create a symbolic link for mdadm:

   ln -s /usr/sbin/mdadm /usr/bin/mdadm

8. Remove unused packages:

   apt autoremove -y

9. Apply the changes; to do this, reboot the system:

   systemctl reboot

10. Reset the unique system identifier so that each instance of the installed system receives its own identifier:

    truncate -s 0 /etc/machine-id /var/lib/dbus/machine-id

11. Prepare a file with a list of directories that should not be included in the OS image archive:

    11.1. Create the exclude.txt file using the vi text editor:

    sudo vi /root/exclude.txt

    11.2. Add to the exclude.txt file the list of directories to exclude from the archive:

    /tmp/*
    /proc/*
    /sys/*
    /dev/*
    /run/*
    /mnt/*
    /media/*
    /var/lib/lxcfs
    /var/spool/postfix
    /lost+found

    11.3. Exit the vi text editor saving changes:

    :wq

12. Create a file system archive:

    tar -czp -f /mnt/base.tar.gz --exclude-from=/root/exclude.txt /

Windows Server

1. To prepare the image archive, you can install the OS via autoinstall on your dedicated server, as some instruction steps will already be ready.

   To avoid incompatibility with server components, we recommend installing an extensive set of drivers that are not supplied with the system kernel.

2. Prepare the Cloudbase-Init service for use in the image:

   2.1. Install Cloudbase-Init.

   2.2. Open the cloudbase-init.conf configuration file. By default, the file is located in the C:\Program Files\Cloudbase Solutions\Cloudbase-Init\conf\ directory.

   2.3. Add the configuration to the file:

   File cloudbase-init.conf

   [DEFAULT]
   username=Administrator
   groups=Administrators
   inject_user_password=true
   config_drive_raw_hhd=false
   config_drive_cdrom=false
   config_drive_vfat=true
   config_drive_locations=partition
   bsdtar_path=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\bin\bsdtar.exe
   mtools_path=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\bin\
   verbose=true
   debug=true
   logdir=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\log\
   logfile=cloudbase-init.log
   default_log_levels=comtypes=INFO,suds=INFO,iso8601=WARN,requests=WARN
   logging_serial_port_settings=COM1,115200,N,8
   mtu_use_dhcp_config=false
   ntp_use_dhcp_config=false
   local_scripts_path=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\LocalScripts\
   check_latest_version=false
   metadata_services=cloudbaseinit.metadata.services.nocloudservice.NoCloudConfigDriveService
   plugins=cloudbaseinit.plugins.common.sethostname.SetHostNamePlugin,
           cloudbaseinit.plugins.common.userdata.UserDataPlugin,
           cloudbaseinit.plugins.windows.extendvolumes.ExtendVolumesPlugin,
           cloudbaseinit.plugins.common.sshpublickeys.SetUserSSHPublicKeysPlugin,
           cloudbaseinit.plugins.common.localscripts.LocalScriptsPlugin,
           cloudbaseinit.plugins.common.networkconfig.NetworkConfigPlugin

   2.4. Open the cloudbase-init-unattend.conf configuration file. By default, the file is located in the C:\Program Files\Cloudbase Solutions\Cloudbase-init\conf\ directory.

   2.5. Add the configuration to the file:

   File cloudbase-init-unattend.conf

   [DEFAULT]
   username=Administrator
   groups=Administrators
   inject_user_password=true
   config_drive_raw_hhd=false
   config_drive_cdrom=false
   config_drive_vfat=true
   config_drive_locations=partition
   bsdtar_path=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\bin\bsdtar.exe
   mtools_path=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\bin\
   verbose=true
   debug=true
   logdir=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\log\
   logfile=cloudbase-init-unattend.log
   default_log_levels=comtypes=INFO,suds=INFO,iso8601=WARN,requests=WARN
   logging_serial_port_settings=COM1,115200,N,8
   mtu_use_dhcp_config=false
   ntp_use_dhcp_config=false
   local_scripts_path=C:\Program Files\Cloudbase Solutions\Cloudbase-Init\LocalScripts\
   check_latest_version=false
   metadata_services=cloudbaseinit.metadata.services.nocloudservice.NoCloudConfigDriveService
   plugins=cloudbaseinit.plugins.common.sethostname.SetHostNamePlugin,
           cloudbaseinit.plugins.common.userdata.UserDataPlugin,
           cloudbaseinit.plugins.windows.extendvolumes.ExtendVolumesPlugin,
           cloudbaseinit.plugins.common.sshpublickeys.SetUserSSHPublicKeysPlugin,
           cloudbaseinit.plugins.common.localscripts.LocalScriptsPlugin,
           cloudbaseinit.plugins.common.networkconfig.NetworkConfigPlugin

3. Prepare Cloudbase-Init scripts — they are executed during the initial server configuration:

   3.1. To set network boot as the priority for the server, create the get_efi_network.ps1 script in the C:\Program Files\Cloudbase Solutions\Cloudbase-init\LocalScripts\ directory:

   File get_efi_network.ps1

   #ps1_x64
   
   $scriptPath = "C:\Scripts\set_boot_order.ps1"
       
   $scriptContent = @'
   $list_identifier_pxe = bcdedit /enum firmware |
       Select-String "U?EFI:?.*IP.*v?4|NIC.*Partition|Embedded NIC" -Context 1 |
       ForEach-Object { $_.Context.PreContext[0] } |
       ForEach-Object { $_ -replace "^identifier +", "" } |
       Sort-Object {Get-Random}
       
   foreach ($i in $list_identifier_pxe) {
       bcdedit /set "{fwbootmgr}" displayorder "$i" /addfirst
   }
   '@
       
   $folder = Split-Path $scriptPath
   if (-not (Test-Path $folder)) {
       New-Item -ItemType Directory -Path $folder -Force | Out-Null
   }
       
   Set-Content -Path $scriptPath -Value $scriptContent -Encoding UTF8
       
   $taskName = "SetUEFIBootOrder"
   for ($i = 0; $i -lt 5; $i++) {
       try {
           $action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-ExecutionPolicy Bypass -File `"$scriptPath`""
           if ($action) { break }
       } catch {
           Start-Sleep -Seconds 5
       }
   }
   $trigger = New-ScheduledTaskTrigger -AtStartup
   $principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -RunLevel Highest
   
   $taskExists = Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue
   
   if ($taskExists) {
       Set-ScheduledTask -TaskName $taskName -Action $action -Trigger $trigger -Principal $principal
   } else {
       Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $trigger -Principal $principal
   }
   
   Start-ScheduledTask -TaskName $taskName
   
   Remove-Item $script:MyInvocation.MyCommand.Path -Force

   3.2. To remove the CIDATA partition with Cloudbase-init configurations after initial setup is complete, create the remove_cidata.ps1 file in the C:\Program Files\Cloudbase Solutions\Cloudbase-init\LocalScripts\ directory:

   File remove_cidata.ps1

   #ps1_sysnative
   
   # find partition with a name CIDATA
   $DataPartition=Get-WMIObject Win32_Volume | ? { $_.Label -eq 'CIDATA' }
   
   # remove disk letter from CIDATA object
   $DataPartition.DriveLetter = $null
   
   # save changes
   $DataPartition.Put()
   
   # self delete this script
   Remove-Item $script:MyInvocation.MyCommand.Path -Force

   3.3. To disable NetBIOS on all network interfaces, create the disable_netbios.ps1 file in the C:\Program Files\Cloudbase Solutions\Cloudbase-Init\LocalScripts\ directory:

   File disable_netbios.ps1

   #ps1_sysnative
   
   # disables netbios on all interfaces
   $i = 'HKLM:\SYSTEM\CurrentControlSet\Services\netbt\Parameters\interfaces'
   Get-ChildItem $i | ForEach-Object {Set-ItemProperty -Path "$i\$($_.pschildname)" -name NetBiosOptions -value 2}
   
   # self delete this script
   Remove-Item $script:MyInvocation.MyCommand.Path -Force

   3.4. To disable Large Send Offload (LSO) technology on network interfaces to improve compatibility with hardware that does not properly support this feature, create the disable_large_send_offload.ps1 file in the C:\Program Files\Cloudbase Solutions\Cloudbase-Init\LocalScripts\ directory:

   File disable_large_send_offload.ps1

   #ps1_sysnative
   
   # disables large send offload on all adapters
   Disable-NetAdapterLso -Name *
   
   # self delete this script
   Remove-Item $script:MyInvocation.MyCommand.Path -Force

   3.5. For the disk to be correctly detected in WinPE mode, create two files:

   • the diskpart.ps1 script, which runs the diskpart utility and executes commands from the file in the C:\Program Files\Cloudbase Solutions\Cloudbase-Init\LocalScripts\ directory:
   File diskpart.ps1

   # This script executes diskpart script stored in diskpart.txt
   diskpart /s C:\diskpart.txt
   
   # delete diskpart.txt config file
   Remove-Item "C:\diskpart.txt" -Force
   
   # self delete this script
   Remove-Item $script:MyInvocation.MyCommand.Path -Force

   • the diskpart.txt file with commands that remove the NoDefaultDriveLetter attribute from the system partition in the C:\ directory:
   File diskpart.txt

   rem choose vol C where OS is stored
   sel vol C
   rem remove NoDefaultDriveLetter attribute from OS volume so it would be detected in WinPe without manual letter assignment
   attr vol clear nodefaultdriveletter

   3.6. To disable the use of DHCP on network interfaces, create the set_dhcp_disabled.ps1 file in the C:\Program Files\Cloudbase Solutions\Cloudbase-Init\LocalScripts\ directory:

   File set_dhcp_disabled.ps1

   #ps1_sysnative
   
   # set DHCP disabled on all network interfaces
   gci -Path HKLM:\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\ | Set-ItemProperty -Name EnableDhcp -Value 0
   
   # self delete this script
   Remove-Item $script:MyInvocation.MyCommand.Path -Force

4. Disable the AllowAdministratorLockout brute-force protection mechanism. This will prevent user account lockout in the system due to brute-force attacks or failed authorization attempts.

   4.1. Create the AllowAdministratorLockout.inf configuration file in the C:\ directory.

   4.2. Add the configuration to the file:

   [System Access]
   AllowAdministratorLockout = 0
   [Version]
   signature='$CHICAGO$'

   4.3. Apply the configuration file:

   secedit.exe /configure /db name.sdb /cfg C:\AllowAdministratorLockout.inf

   4.4. Delete the AllowAdministratorLockout.inf configuration file in the C:\ directory.

5. Configure the OpenSSH Server service:

   5.1. Create the OpenSSH sshd_config configuration file in the C:\ProgramData\ssh\ directory.

   5.2. Add the configuration to the file:

   File sshd_config

   # This is the sshd server system-wide configuration file. See
   # sshd_config(5) for more information.
   
   # The strategy used for options in the default sshd_config shipped with
   # OpenSSH is to specify options with their default value where
   # possible, but leave them commented. Uncommented options override the
   # default value.
   
   #Port 22
   #AddressFamily any
   #ListenAddress 0.0.0.0
   #ListenAddress ::
   
   #HostKey __PROGRAMDATA__/ssh/ssh_host_rsa_key
   #HostKey __PROGRAMDATA__/ssh/ssh_host_dsa_key
   #HostKey __PROGRAMDATA__/ssh/ssh_host_ecdsa_key
   #HostKey __PROGRAMDATA__/ssh/ssh_host_ed25519_key
   
   # Ciphers and keying
   #RekeyLimit default none
   
   # Logging
   #SyslogFacility AUTH
   #LogLevel INFO
   
   # Authentication:
   
   #LoginGraceTime 2m
   #PermitRootLogin prohibit-password
   #StrictModes yes
   #MaxAuthTries 6
   #MaxSessions 10
   
   #PubkeyAuthentication yes
   
   # The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
   # but this is overridden so installations will only check .ssh/authorized_keys
   AuthorizedKeysFile      .ssh/authorized_keys
   
   #AuthorizedPrincipalsFile none
   
   # For this to work you will also need host keys in %programData%/ssh/ssh_known_hosts
   #HostbasedAuthentication no
   # Change to yes if you don't trust ~/.ssh/known_hosts for
   # HostbasedAuthentication
   #IgnoreUserKnownHosts no
   # Don't read the user's ~/.rhosts and ~/.shosts files
   #IgnoreRhosts yes
   
   # To disable tunneled clear text passwords, change to no here!
   #PasswordAuthentication yes
   #PermitEmptyPasswords no
   
   # GSSAPI options
   #GSSAPIAuthentication no
   
   #AllowAgentForwarding yes
   #AllowTcpForwarding yes
   #GatewayPorts no
   #PermitTTY yes
   #PrintMotd yes
   #PrintLastLog yes
   #TCPKeepAlive yes
   #UseLogin no
   #PermitUserEnvironment no
   #ClientAliveInterval 0
   #ClientAliveCountMax 3
   #UseDNS no
   #PidFile /var/run/sshd.pid
   #MaxStartups 10:30:100
   #PermitTunnel no
   #ChrootDirectory none
   #VersionAddendum none
   
   # no default banner path
   #Banner none
   
   # override default of no subsystems
   Subsystem       sftp    sftp-server.exe
   
   # Example of overriding settings on a per-user basis
   #Match User anoncvs
   #       AllowTcpForwarding no
   #       PermitTTY no
   #       ForceCommand cvs server

   5.3. Enable automatic startup of OpenSSH when Windows boots:

   Set-Service -Name sshd -StartupType 'Automatic'

   5.4. Allow incoming connections; to do this, create a rule in the Windows firewall:

   # SSH added to firewall
   netsh advfirewall firewall add rule name="SSH server service" dir=in action=allow enable=yes protocol=TCP localport=22

6. To allow Selectel staff to check the server status without rebooting it as part of technical support, enable monitor support:

   powercfg.exe -x -monitor-timeout-ac 0
   powercfg.exe -x -monitor-timeout-dc 0

7. Prepare the system for cloning; to do this, remove unique data from the system:

   C:\Windows\System32\Sysprep\Sysprep.exe /generalize /quiet

8. Install Python version 3.12.7 or higher.

9. Update the Python package manager and install the required packages:

   python -m ensurepip --upgrade
   python -m pip install --upgrade pip
   python -m pip install pywinauto
   python -m pip install logging

10. Clear the cache:

    10.1. Stop the update services:

    net stop wuauserv
    net stop bits

    10.2. Delete temporary files:

    Remove-Item -Path "$env:TEMP\*" -Recurse -Force -ErrorAction SilentlyContinue

    10.3. Delete the update cache:

    Remove-Item -Path "C:\Windows\SoftwareDistribution\Download\*" -Recurse -Force -ErrorAction SilentlyContinue

    10.4. Clear the component store:

    Dism.exe /Online /Cleanup-Image /StartComponentCleanup /ResetBase

    10.5. Start the update services:

    net start wuauserv
    net start bits

11. Create an OS image in .img format. To create the image, we recommend using software that supports disk imaging, such as Clonezilla, Macrium Reflect, DiskGenius, Acronis, and do not recommend using the built-in Windows Backup tool.

12. Create an archive with the OS image:

    tar -czf base.tar.gz <img_name>

    Specify <img_name> — the name of the OS image in .img format that you created in step 11.

VMware ESXi

1. Optional: you can prepare the setup.tpl file yourself — this is a script that applies network and system settings during OS installation and ensures they persist after a reboot.

   For VMware ESXi, the OS automatic installation mechanism includes a prepared setup.tpl template that will be used if you do not upload your own script to S3 storage along with the ISO image archive.

   1.1. On your local computer, create the setup.tpl file.

   1.2. Add the script text to the file:

   File setup.tpl

   #!/bin/sh
   
   esxcli system hostname set --host="{{ userhostname }}"
   esxcli system account set -i root -p "{{ password }}" -c "{{ password }}"
   
   mkdir -p /etc/ssh/keys-root
   echo "" > /etc/ssh/keys-root/authorized_keys
   
   {% if user_ssh_key %}
   echo "{{ user_ssh_key }}" > /etc/ssh/keys-root/authorized_keys
   {% endif %}
   
   esxcli network ip dns server add --server=188.93.17.19
   esxcli network ip dns server add --server=188.93.16.19
   
   esxcli network ip interface ipv4 set -i vmk0 -I {{ ipv4_address }} -N {{ ipv4_netmask }} -t static
   esxcli network ip route ipv4 add -n default -g {{ ipv4_gateway }}
   
   cat << 'EOF' > /etc/rc.local.d/local.sh
   #!/bin/sh
   
   LOG="/var/log/local.sh.log"
   exec >> "$LOG" 2>&1
   
   echo "====================================================="
   echo "$(date) local.sh START"
   echo "====================================================="
   
   set -x
   
   TARGET_MAC="{{ local["boot_mac_address"] }}"
   VSWITCH="vSwitch0"
   
   TARGET_NIC="$(esxcli network nic list | awk -v mac="$TARGET_MAC" '$0 ~ mac {print $1; exit}')"
   CURRENT_UPLINKS="$(esxcli network vswitch standard list \
       | sed -n "/^${VSWITCH}\$/,/^$/p" \
       | sed -n 's/^[[:space:]]*Uplinks:[[:space:]]*//p' \
       | sed 's/,//g')"
   
   if [ -n "$TARGET_NIC" ] && { \
       [ "$(echo "$CURRENT_UPLINKS" | awk '{print NF}')" -ne 1 ] || \
       [ "$CURRENT_UPLINKS" != "$TARGET_NIC" ]; \
   }; then
       for nic in $CURRENT_UPLINKS; do
           esxcli network vswitch standard uplink remove -u $nic -v $VSWITCH
       done
       esxcli network vswitch standard uplink add -u $TARGET_NIC -v $VSWITCH
   fi
   
   esxcli network nic down -n $TARGET_NIC
   sleep 1
   esxcli network nic up -n $TARGET_NIC
   sleep 1
   esxcli network ip interface set -e false -i vmk0
   sleep 1
   esxcli network ip interface set -e true -i vmk0
   sleep 5
   esxcli network vswitch standard portgroup policy failover set -p "Management Network" -a $TARGET_NIC
   
   /sbin/auto-backup.sh
   
   exit 0
   EOF
   
   /sbin/auto-backup.sh
   
   esxcli system maintenanceMode set --enable yes
   esxcli system shutdown poweroff -r "Provisioning complete" -d 10

   1.3. Save the changes to the file.

2. Install a clean VMware ESXi. We recommend installing VMware ESXi in a virtual machine with a virtual disk of the minimum permissible size for the selected ESXi version to facilitate creating an archive with the OS image.

3. Configure a static IP address on the vmk0 network interface:

   esxcli network ip interface ipv4 set -i vmk0 -I 192.168.100.2 -N 255.255.255.0 -t static

   Here 192.168.100.2 is a service IP address for the OS automatic installation mechanism. Make sure that the subnet is not used in your infrastructure. Do not change this IP address when preparing the image.

4. Enable the SSH service:

   vim-cmd hostsvc/enable_ssh
   vim-cmd hostsvc/start_ssh

5. Enable the ESXi Shell console with access via DCUI:

   vim-cmd hostsvc/enable_esx_shell
   vim-cmd hostsvc/start_esx_shell

6. Add a public SSH key for the root user:

   6.1. Open the /etc/ssh/keys-root/authorized_keys file using the vi text editor:

   vi /etc/ssh/keys-root/authorized_keys

   6.2. Add a public SSH key to the file — this is a service key needed during image deployment for automatic configuration and transfer of setup.tpl. Do not change this key when preparing the image.

   ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCQItiaAt3k6jkxglmD8cmWc20vDB2JTE3uonJYP9+6LhpM4m4HwCdLwyNuCzH0wBMA6ysEzdHhKUwC3dk0J8e7jUEQzJ/N70C0YIGEFOcjUeaeEf1DtO9q60eOyYoTFCwbuXx+tDax+Jh0k3OqbBitjW9m9FxQYRc3hmzaMrEhi3dfAtGlzVEkoK33x+kW9HDCMiBSQMI+iI6vwmdnpD9uvj4viYQCyCIT4k/gO6NpncHrY61AMQLD+AiQhqwiFZHAevbfIJ8DFND0QrIgFKhk2kaUka/qe8NvvScV2RfRWgTKtSy5tNFlU1vQtJJI+G7HNz+OhwORGPl/flLeSDri6upoJLKX8ZuQuGFIaJaUFf5Fi1skT6U4aLSq2f5FbNeDT9aerr5b9sLlfW6JiYXdESga3RVv2scyKAKVMro/l10dXf21x6y5E3SCPe3ogjopLMHnlDMkVKbG2A6xFI5G7eoqW9kVzzbYLe9/uEsmrnw7UAE7kQh1Rzm1N+gQCYk= autoinstall

   6.3. Exit the vi text editor saving changes:

   :wq

7. Optional: make additional changes to the system, such as installing extra software, packages, or performing other necessary settings for your image. Ensure that the changes made do not contradict the previous instruction steps.

8. Create an archive with the OS image. For example, you can do this in a separate Linux virtual machine. To do this, connect the ESXi system disk to the Linux VM as a block device.

   8.1. Create a disk image in .img format:

   dd if=/dev/<disk_name> of=<img_name> bs=1M status=progress

   Specify:

   • <disk_name> — the name of the ESXi system disk connected to the Linux VM;
   • <img_name> — the image name in .img format, for example esxi.img.

   8.2. Create an archive with the OS image:

   tar -czvf base.tar.gz <img_name>

   Specify <img_name> — the name of the OS image in .img format that you created in step 8.1.

2. Upload the image to S3 storage

To upload the archive with the image to S3 storage, follow the Upload object instructions.

If, when creating the ISO image of VMware ESXi, you prepared the setup.tpl file, upload it to storage along with the image.

3. Get a link to the object in the storage

To get a link to an object in S3 storage, follow the Get a link to an object instructions.

4. Add the image to the control panel

1. In the control panel, in the top menu, click Products and select Dedicated servers.

2. Go to the Images section.

3. Click Add image.

4. Select the OS family.

5. Enter the image name.

6. Add the link to the image that you uploaded in step 2 to S3 storage.

7. If in step 6 you added the path to the image in S3 as a link, enter the Access key and Secret key.

8. Click Create image.