Kickstart commands and options reference

auth or authconfig - use authselect instead

device

deviceprobe

dmraid

install - use the subcommands or methods directly as commands

lilo

lilocheck

mouse

multipath

bootloader --upgrade

ignoredisk --interactive

partition --active

reboot --kexec

upgrade (This command had already previously been deprecated.)

btrfs

part/partition btrfs

part --fstype btrfs or partition --fstype btrfs

logvol --fstype btrfs

raid --fstype btrfs

unsupported_hardware

authselect

module

--autoscreenshot - Take a screenshot at every step during installation. These screenshots are stored in /tmp/anaconda-screenshots/ during the installation, and after the installation finishes you can find them in /root/anaconda-screenshots.

This option should not be used when deploying a system because it can disrupt package installation.

Previously, the cdrom command had to be used together with the install command. The install command has been deprecated and cdrom can be used on its own, because it implies install.

This command has no options.

To actually run the installation, one of cdrom, harddrive, hmc, nfs, liveimg, or url must be specified.

For a fully automatic installation, you must either specify one of the available modes (graphical, text, or cmdline) in the Kickstart file, or you must use the console= boot option. If no mode is specified, the system will use graphical mode if possible, or prompt you to choose from VNC and text mode.

This mode is useful on IBM Z systems with the x3270 terminal.

partition - Partition containing the driver disk. Note that the partition must be specified as a full path (for example, /dev/sdb1), not just the partition name (for example, sdb1).

--source= - URL for the driver disk. Examples include:

driverdisk --source=ftp://path/to/dd.img
driverdisk --source=http://path/to/dd.img
driverdisk --source=nfs:host:/path/to/dd.img

--biospart= - BIOS partition containing the driver disk (for example, 82p2).

--agreed (required) - Accept the EULA. This option must always be used, otherwise the eula command is meaningless.

--enable or --enabled - Initial Setup is started the first time the system boots.

--disable or --disabled - Initial Setup is not started the first time the system boots.

--reconfig - Enable the Initial Setup to start at boot time in reconfiguration mode. This mode enables the language, mouse, keyboard, root password, security level, time zone and networking configuration options in addition to the default ones.

--non-interactive - Performs the installation in a completely non-interactive mode. This mode will terminate the installation when user interaction is required.

For a fully automatic installation, you must either specify one of the available modes (graphical, text, or cmdline) in the Kickstart file, or you must use the console= boot option. If no mode is specified, the system will use graphical mode if possible, or prompt you to choose from VNC and text mode.

The halt command is equivalent to the shutdown -H command. For more details, see the shutdown(8) man page.

For other completion methods, see the poweroff, reboot, and shutdown commands.

--biospart= - BIOS partition to install from (such as 82).

--partition= - Partition to install from (such as sdb2).

--dir= - Directory containing the variant directory of the installation tree, or the ISO image of the full installation DVD.

Previously, the harddrive command had to be used together with the install command. The install command has been deprecated and harddrive can be used on its own, because it implies install.

To actually run the installation, one of cdrom, harddrive, hmc, nfs, liveimg, or url must be specified.

The install command must be followed by an installation method command. The installation method command must be on a separate line.

The methods include:

--url= - The location to install from. Supported protocols are HTTP, HTTPS, FTP, and file.

--url= - The location to install from. Supported protocols are HTTP, HTTPS, FTP, and file.

--proxy= - Specify an HTTP, HTTPS or FTP proxy to use while performing the installation.

--checksum= - An optional argument with the SHA256 checksum of the image file, used for verification.

--noverifyssl - Disable SSL verification when connecting to an HTTPS server.

The image can be the squashfs.img file from a live ISO image, a compressed tar file (.tar, .tbz, .tgz, .txz, .tar.bz2, .tar.gz, or .tar.xz.), or any file system that the installation media can mount. Supported file systems are ext2, ext3, ext4, vfat, and xfs.

When using the liveimg installation mode with a driver disk, drivers on the disk will not automatically be included in the installed system. If necessary, these drivers should be installed manually, or in the %post section of a kickstart script.

Previously, the liveimg command had to be used together with the install command. The install command has been deprecated and liveimg can be used on its own, because it implies install.

To actually run the installation, one of cdrom, harddrive, hmc, nfs, liveimg, or url must be specified.

--host= - Send logging information to the given remote host, which must be running a syslogd process configured to accept remote logging.

--port= - If the remote syslogd process uses a port other than the default, set it using this option.

--level= - Specify the minimum level of messages that appear on tty3. All messages are still sent to the log file regardless of this level, however. Possible values are debug, info, warning, error, or critical.

--server= - Server from which to install (host name or IP).

--dir= - Directory containing the variant directory of the installation tree.

--opts= - Mount options to use for mounting the NFS export. (optional)

Previously, the nfs command had to be used together with the install command. The install command has been deprecated and nfs can be used on its own, because it implies install.

To actually run the installation, one of cdrom, harddrive, hmc, nfs, liveimg, or url must be specified.

--osname OSNAME - Management root for OS installation.

--url URL - URL of the repository to install from.

--ref REF - Name of the branch from the repository to be used for installation.

--remote REMOTE - Management root for OS installation.

--nogpg - Disable GPG key verification.

For more information about the OStree tools, see the upstream documentation: https://ostree.readthedocs.io/en/latest/

The poweroff option is equivalent to the shutdown -P command. For more details, see the shutdown(8) man page.

For other completion methods, see the halt, reboot, and shutdown Kickstart commands. The halt option is the default completion method if no other methods are explicitly specified in the Kickstart file.

The poweroff command is highly dependent on the system hardware in use. Specifically, certain hardware components such as the BIOS, APM (advanced power management), and ACPI (advanced configuration and power interface) must be able to interact with the system kernel. Consult your hardware documentation for more information on you system’s APM/ACPI abilities.

--eject - Attempt to eject the bootable media (DVD, USB, or other media) before rebooting.

--kexec - Uses the kexec system call instead of performing a full reboot, which immediately loads the installed system into memory, bypassing the hardware initialization normally performed by the BIOS or firmware.

Use of the reboot option might result in an endless installation loop, depending on the installation media and method.

The reboot option is equivalent to the shutdown -r command. For more details, see the shutdown(8) man page.

Specify reboot to automate installation fully when installing in command line mode on IBM Z.

For other completion methods, see the halt, poweroff, and shutdown Kickstart options. The halt option is the default completion method if no other methods are explicitly specified in the Kickstart file.

--nomount or --romount - Controls how the installed system is mounted in the rescue environment. By default, the installation program finds your system and mount it in read-write mode, telling you where it has performed this mount. You can optionally select to not mount anything (the --nomount option) or mount in read-only mode (the --romount option). Only one of these two options can be used.

The shutdown Kickstart option is equivalent to the shutdown command. For more details, see the shutdown(8) man page.

For other completion methods, see the halt, poweroff, and reboot Kickstart options. The halt option is the default completion method if no other methods are explicitly specified in the Kickstart file.

--username - Provides the name of the user. This option is required.

password - The password to use for the user. This option is required.

--iscrypted - If this option is present, the password argument is assumed to already be encrypted. This option is mutually exclusive with --plaintext. To create an encrypted password, you can use Python:

$ python3 -c 'import crypt,getpass;pw=getpass.getpass();print(crypt.crypt(pw) if (pw==getpass.getpass("Confirm: ")) else exit())'

--plaintext - If this option is present, the password argument is assumed to be in plain text. This option is mutually exclusive with --iscrypted

--lock - If this option is present, this account is locked by default. This means that the user will not be able to log in from the console.

--sshkey - If this is option is present, then the <password> string is interpreted as an ssh key value.

By default, the ssh server is not started during the installation. To make ssh available during the installation, boot the system with the kernel boot option inst.sshd.

If you want to disable root ssh access, while allowing another user ssh access, use the following:

sshpw --username=example_username example_password --plaintext
sshpw --username=root example_password --lock

To simply disable root ssh access, use the following:

sshpw --username=root --lock

--non-interactive - Performs the installation in a completely non-interactive mode. This mode will terminate the installation when user interaction is required.

Note that for a fully automatic installation, you must either specify one of the available modes (graphical, text, or cmdline) in the Kickstart file, or you must use the console= boot option. If no mode is specified, the system will use graphical mode if possible, or prompt you to choose from VNC and text mode.

--url= - The location to install from. Supported protocols are HTTP, HTTPS, FTP, and file.

--mirrorlist= - The mirror URL to install from.

--proxy= - Specify an HTTP, HTTPS or FTP proxy to use while performing the installation.

--noverifyssl - Disable SSL verification when connecting to an HTTPS server.

--metalink=URL - Specify the metalink URL to install from. Variable substitution is done for $releasever and $basearch in the URL.

To install from a HTTP server:

url --url http://server/path

To install from a FTP server:

url --url ftp://username:password@server/path

To install from a local file:

liveimg --url=file:///images/install/squashfs.img --noverifyssl

Previously, the url command had to be used together with the install command. The install command has been deprecated and url can be used on its own, because it implies install.

To actually run the installation, one of cdrom, harddrive, hmc, nfs, liveimg, or url must be specified.

--host= - Connect to the VNC viewer process listening on the given host name.

--port= - Provide a port that the remote VNC viewer process is listening on. If not provided, Anaconda uses the VNC default port of 5900.

--password= - Set a password which must be provided to connect to the VNC session. This is optional, but recommended.

Previously, the auth or authconfig Kickstart commands called the authconfig tool. This tool has been deprecated in CentOS 8. These Kickstart commands now use the authselect-compat tool to call the new authselect tool. For a description of the compatibility layer and its known issues, see the manual page authselect-migration(7). The installation program will automatically detect use of the deprecated commands and install on the system the authselect-compat package to provide the compatibility layer.

Passwords are shadowed by default.

When using OpenLDAP with the SSL protocol for security, make sure that the SSLv2 and SSLv3 protocols are disabled in the server configuration. This is due to the POODLE SSL vulnerability (CVE-2014-3566). See https://access.redhat.com/solutions/1234843 for details.

This command passes all options to the authselect command. Refer to the authselect(8) manual page and the authselect --help command for more details.

This command replaces the deprecated auth or authconfig commands deprecated in CentOS 8 together with the authconfig tool.

Passwords are shadowed by default.

When using OpenLDAP with the SSL protocol for security, make sure that the SSLv2 and SSLv3 protocols are disabled in the server configuration. This is due to the POODLE SSL vulnerability (CVE-2014-3566). See https://access.redhat.com/solutions/1234843 for details.

--enabled or --enable - Reject incoming connections that are not in response to outbound requests, such as DNS replies or DHCP requests. If access to services running on this machine is needed, you can choose to allow specific services through the firewall.

--disabled or --disable - Do not configure any iptables rules.

--trust - Listing a device here, such as em1, allows all traffic coming to and from that device to go through the firewall. To list more than one device, use the option more times, such as --trust em1 --trust em2. Do not use a comma-separated format such as --trust em1, em2.

incoming - Replace with one or more of the following to allow the specified services through the firewall.

--port= - You can specify that ports be allowed through the firewall using the port:protocol format. For example, to allow IMAP access through your firewall, specify imap:tcp. Numeric ports can also be specified explicitly; for example, to allow UDP packets on port 1234 through, specify 1234:udp. To specify multiple ports, separate them by commas.

--service= - This option provides a higher-level way to allow services through the firewall. Some services (like cups, avahi, and so on.) require multiple ports to be open or other special configuration in order for the service to work. You can specify each individual port with the --port option, or specify --service= and open them all at once.

--use-system-defaults - Do not configure the firewall at all. This option instructs anaconda to do nothing and allows the system to rely on the defaults that were provided with the package or ostree. If this option is used with other options then all other options will be ignored.

--name= - Provides the name of the group.

--gid= - The group’s GID. If not provided, defaults to the next available non-system GID.

If a group with the given name or GID already exists, this command fails.

The user command can be used to create a new group for the newly created user.

--vckeymap= - Specify a VConsole keymap which should be used. Valid names correspond to the list of files in the /usr/lib/kbd/keymaps/xkb/ directory, without the .map.gz extension.

--xlayouts= - Specify a list of X layouts that should be used as a comma-separated list without spaces. Accepts values in the same format as setxkbmap(1), either in the layout format (such as cz), or in the layout (variant) format (such as cz (qwerty)).

--switch= - Specify a list of layout-switching options (shortcuts for switching between multiple keyboard layouts). Multiple options must be separated by commas without spaces. Accepts values in the same format as setxkbmap(1).

Either the --vckeymap= or the --xlayouts= option must be used.

--addsupport= - Add support for additional languages. Takes the form of comma-separated list without spaces. For example:

lang en_US --addsupport=cs_CZ,de_DE,en_UK

Certain languages (for example, Chinese, Japanese, Korean, and Indic languages) are not supported during text-mode installation. If you specify one of these languages with the lang command, the installation process continues in English, but the installed system uses your selection as its default language.

--name= - Specifies the name of the module to enable. Replace NAME with the actual name.

--stream= - Specifies the name of the module stream to enable. Replace STREAM with the actual name.

Using a combination of this command and the %packages section allows you to install packages provided by the enabled module and stream combination, without specifying the module and stream explicitly. Modules must be enabled before package installation. After enabling a module with the module command, you can install the packages enabled by this module by listing them in the %packages section.

A single module command can enable only a single module and stream combination. To enable multiple modules, use multiple module commands. Enabling a module multiple times with different streams is not possible.

In CentOS 8, modules are present only in the AppStream repository. To list available modules, use the yum module list command on an installed CentOS 8 system with a valid subscription.

For more information about modules and streams, see the Installing, managing, and removing user space components document.

name - Replace with either root, user or luks to enforce the policy for the root password, user passwords, or LUKS passphrase, respectively.

--minlen= - Sets the minimum allowed password length, in characters. The default is 6.

--minquality= - Sets the minimum allowed password quality as defined by the libpwquality library. The default value is 1.

--strict - Enables strict password enforcement. Passwords which do not meet the requirements specified in --minquality= and --minlen= will not be accepted. This option is disabled by default.

--notstrict - Passwords which do not meet the minimum quality requirements specified by the --minquality= and -minlen= options will be allowed, after Done is clicked twice in the GUI. For text mode interface, a similar mechanism is used.

--emptyok - Allows the use of empty passwords. Enabled by default for user passwords.

--notempty - Disallows the use of empty passwords. Enabled by default for the root password and the LUKS passphrase.

--changesok - Allows changing the password in the user interface, even if the Kickstart file already specifies a password. Disabled by default.

--nochanges - Disallows changing passwords which are already set in the Kickstart file. Enabled by default.

This command can only be used inside the %anaconda section.

The libpwquality library is used to check minimum password requirements (length and quality). You can use the pwscore and pwmake commands provided by the libpwquality package to check the quality score of a password, or to create a random password with a given score. See the pwscore(1) and pwmake(1) man page for details about these commands.

--name= - The repository id. This option is required. If a repository has a name which conflicts with another previously added repository, it is ignored. Because the installation program uses a list of preset repositories, this means that you cannot add repositories with the same names as the preset ones.

--baseurl= - The URL to the repository.

--mirrorlist= - The URL pointing at a list of mirrors for the repository.

--metalink= - The URL with metalink for the repository.

--install - Save the provided repository configuration on the installed system in the /etc/yum.repos.d/ directory. Without using this option, a repository configured in a Kickstart file will only be available during the installation process, not on the installed system.

--cost= - An integer value to assign a cost to this repository. If multiple repositories provide the same packages, this number is used to prioritize which repository will be used before another. Repositories with a lower cost take priority over repositories with higher cost.

--excludepkgs= - A comma-separated list of package names that must not be pulled from this repository. This is useful if multiple repositories provide the same package and you want to make sure it comes from a particular repository. Both full package names (such as publican) and globs (such as gnome-*) are accepted.

--includepkgs= - A comma-separated list of package names and globs that are allowed to be pulled from this repository. Any other packages provided by the repository will be ignored. This is useful if you want to install just a single package or set of packages from a repository while excluding all other packages the repository provides.

--proxy=[protocol://][username[:password]@]host[:port] - Specify an HTTP/HTTPS/FTP proxy to use just for this repository. This setting does not affect any other repositories, nor how the install.img is fetched on HTTP installations.

--noverifyssl - Disable SSL verification when connecting to an HTTPS server.

Repositories used for installation must be stable. The installation can fail if a repository is modified before the installation concludes.

--iscrypted - If this option is present, the password argument is assumed to already be encrypted. This option is mutually exclusive with --plaintext. To create an encrypted password, you can use python:

$ python -c 'import crypt,getpass;pw=getpass.getpass();print(crypt.crypt(pw) if (pw==getpass.getpass("Confirm: ")) else exit())'

--plaintext - If this option is present, the password argument is assumed to be in plain text. This option is mutually exclusive with --iscrypted.

--lock - If this option is present, the root account is locked by default. This means that the root user will not be able to log in from the console. This option will also disable the Root Password screens in both the graphical and text-based manual installation.

--enforcing - Enables SELinux with the default targeted policy being enforcing.

--permissive - Outputs warnings based on the SELinux policy, but does not actually enforce the policy.

--disabled - Disables SELinux completely on the system.

--disabled= - Disable the services given in the comma separated list.

--enabled= - Enable the services given in the comma separated list.

--username= - The user for which the key will be installed.

KEY - The SSH key.

--role= - Set the intended system role. Available values are:

--sla= - Set the Service Level Agreement. Available values are:

--usage= - The intended usage of the system. Available values are:

--addon= - Specifies additional layered products or features. You can use this option multiple times.

Enter the values with spaces and enclose them in double quotes:

syspurpose --role="Red Hat Enterprise Linux Server"

While it is strongly recommended that you configure System Purpose, it is an optional feature of the CentOS installation program. If you want to enable System Purpose after the installation completes, you can do so using the syspurpose command-line tool.

timezone - the time zone to set for the system.

--utc - If present, the system assumes the hardware clock is set to UTC (Greenwich Mean) time.

--nontp - Disable the NTP service automatic starting.

--ntpservers= - Specify a list of NTP servers to be used as a comma-separated list without spaces.

--name= - Provides the name of the user. This option is required.

--gecos= - Provides the GECOS information for the user. This is a string of various system-specific fields separated by a comma. It is frequently used to specify the user’s full name, office number, and so on. See the passwd(5) man page for more details.

--groups= - In addition to the default group, a comma separated list of group names the user should belong to. The groups must exist before the user account is created. See the group command.

--homedir= - The home directory for the user. If not provided, this defaults to /home/username.

--lock - If this option is present, this account is locked by default. This means that the user will not be able to log in from the console. This option will also disable the Create User screens in both the graphical and text-based manual installation.

--password= - The new user’s password. If not provided, the account will be locked by default.

--iscrypted - If this option is present, the password argument is assumed to already be encrypted. This option is mutually exclusive with --plaintext. To create an encrypted password, you can use python:

$ python -c 'import crypt,getpass;pw=getpass.getpass();print(crypt.crypt(pw) if (pw==getpass.getpass("Confirm: ")) else exit())'

--plaintext - If this option is present, the password argument is assumed to be in plain text. This option is mutually exclusive with --iscrypted

--shell= - The user’s login shell. If not provided, the system default is used.

--uid= - The user’s UID (User ID). If not provided, this defaults to the next available non-system UID.

--gid= - The GID (Group ID) to be used for the user’s group. If not provided, this defaults to the next available non-system group ID.

Consider using the --uid and --gid options to set IDs of regular users and their default groups at range starting at 5000 instead of 1000. That is because the range reserved for system users and groups, 0-999, might increase in the future and thus overlap with IDs of regular users.

Files and directories are created with various permissions, dictated by the application used to create the file or directory. For example, the mkdir command creates directories with all permissions enabled. However, applications are prevented from granting certain permissions to newly created files, as specified by the user file-creation mask setting.

--startxonboot - Use a graphical login on the installed system.

Because CentOS 8 does not include the KDE Desktop Environment, do not use the --defaultdesktop= documented in upstream.

--activate - activate this device in the installation environment.

--no-activate - do not activate this device in the installation environment.

--bootproto= - One of dhcp, bootp, ibft, or static. The default option is dhcp; the dhcp and bootp options are treated the same. To disable ipv4 configuration of the device, use --noipv4 option.

network --bootproto=dhcp

network --bootproto=bootp

network --bootproto=ibft

network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver=10.0.2.1

network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver=192.168.2.1,192.168.3.1

--device= - specifies the device to be configured (and eventually activated in Anaconda) with the network command.

network --bootproto=dhcp --device=em1

--ip= - IP address of the device.

--ipv6= - IPv6 address of the device, in the form of address[/prefix length] - for example, 3ffe:ffff:0:1::1/128 `. If prefix is omitted, `64 is used. You can also use auto for automatic configuration, or dhcp for DHCPv6-only configuration (no router advertisements).

--gateway= - Default gateway as a single IPv4 address.

--ipv6gateway= - Default gateway as a single IPv6 address.

--nodefroute - Prevents the interface being set as the default route. Use this option when you activate additional devices with the --activate= option, for example, a NIC on a separate subnet for an iSCSI target.

--nameserver= - DNS name server, as an IP address. To specify more than one name server, use this option once, and separate each IP address with a comma.

--netmask= - Network mask for the installed system.

--hostname= - The host name for the installed system. The host name can either be a fully-qualified domain name (FQDN) in the format host_name.domainname, or a short host name with no domain. Many networks have a Dynamic Host Configuration Protocol (DHCP) service which automatically supplies connected systems with a domain name; to allow DHCP to assign the domain name, only specify a short host name.

--ethtool= - Specifies additional low-level settings for the network device which will be passed to the ethtool program.

--onboot= - Whether or not to enable the device at boot time.

--dhcpclass= - The DHCP class.

--mtu= - The MTU of the device.

--noipv4 - Disable IPv4 on this device.

--noipv6 - Disable IPv6 on this device.

--bondslaves= - When this option is used, the bond device specified by the --device= option is created using slaves defined in the --bondslaves= option. For example:

network --device=bond0 --bondslaves=em1,em2

--bondopts= - a list of optional parameters for a bonded interface, which is specified using the --bondslaves= and --device= options. Options in this list must be separated by commas (“,”) or semicolons (“;”). If an option itself contains a comma, use a semicolon to separate the options. For example:

network --bondopts=mode=active-backup,balance-rr;primary=eth1

--vlanid= - Specifies virtual LAN (VLAN) ID number (802.1q tag) for the device created using the device specified in --device= as a parent. For example, network --device=em1 --vlanid=171 creates a virtual LAN device em1.171.

--interfacename= - Specify a custom interface name for a virtual LAN device. This option should be used when the default name generated by the --vlanid= option is not desirable. This option must be used along with --vlanid=. For example:

network --device=em1 --vlanid=171 --interfacename=vlan171

--teamslaves= - Team device specified by the --device= option will be created using slaves specified in this option. Slaves are separated by commas. A slave can be followed by its configuration, which is a single-quoted JSON string with double quotes escaped by the \ character. For example:

network --teamslaves="p3p1'{\"prio\": -10, \"sticky\": true}',p3p2'{\"prio\": 100}'"

--teamconfig= - Double-quoted team device configuration which is a JSON string with double quotes escaped by the \ character. The device name is specified by --device= option and its slaves and their configuration by --teamslaves= option. For example:

network --device team0 --activate --bootproto static --ip=10.34.102.222 --netmask=255.255.255.0 --gateway=10.34.102.254 --nameserver=10.34.39.2 --teamslaves="p3p1'{\"prio\": -10, \"sticky\": true}',p3p2'{\"prio\": 100}'" --teamconfig="{\"runner\": {\"name\": \"activebackup\"}}"

--bridgeslaves= - When this option is used, the network bridge with device name specified using the --device= option will be created and devices defined in the --bridgeslaves= option will be added to the bridge. For example:

network --device=bridge0 --bridgeslaves=em1

--bridgeopts= - An optional comma-separated list of parameters for the bridged interface. Available values are stp, priority, forward-delay, hello-time, max-age, and ageing-time. For information about these parameters, see the bridge setting table in the nm-settings(5) man page or at https://developer.gnome.org/NetworkManager/0.9/ref-settings.html.

--bindto=mac - Bind the device configuration (ifcfg) file on the installed system to the device MAC address (HWADDR) instead of the default binding to the interface name (DEVICE). Note that this option is independent of the --device= option - --bindto=mac will be applied even if the same network command also specifies a device name, link, or bootif.

The ethN device names such as eth0 are no longer available in CentOS 8 due to changes in the naming scheme. For more information about the device naming scheme, see the upstream document Predictable Network Interface Names.

If you used a Kickstart option or a boot option to specify an installation repository on a network, but no network is available at the start of the installation, the installation program displays the Network Configuration window to set up a network connection prior to displaying the Installation Summary window. For more details, see the Configuring network and host name options section of the Performing a standard installation document.

--computer-ou=OU= - Provide the distinguished name of an organizational unit in order to create the computer account. The exact format of the distinguished name depends on the client software and membership software. The root DSE portion of the distinguished name can usually be left out.

--no-password - Join automatically without a password.

--one-time-password= - Join using a one-time password. This is not possible with all types of realm.

--client-software= - Only join realms which can run this client software. Valid values include sssd and winbind. Not all realms support all values. By default, the client software is chosen automatically.

--server-software= - Only join realms which can run this server software. Possible values include active-directory or freeipa.

--membership-software= - Use this software when joining the realm. Valid values include samba and adcli. Not all realms support all values. By default, the membership software is chosen automatically.

moduleName - Replace with the name of the kernel module which should be installed.

--opts= - Options to pass to the kernel module. For example:

device --opts="aic152x=0x340 io=11"

--type= - Selects one of the predefined automatic partitioning schemes you want to use. Accepts the following values:

--fstype= - Selects one of the available file system types. The available values are ext2, ext3, ext4, xfs, and vfat. The default file system is xfs.

--nohome - Disables automatic creation of the /home partition.

--nolvm - Do not use LVM for automatic partitioning. This option is equal to --type=plain.

--noboot - Do not create a /boot partition.

--noswap - Do not create a swap partition.

--encrypted - Encrypts all partitions with Linux Unified Key Setup (LUKS). This is equivalent to checking the Encrypt partitions check box on the initial partitioning screen during a manual graphical installation.

--luks-version=LUKS_VERSION - Specifies which version of LUKS format should be used to encrypt the filesystem. This option is only meaningful if --encrypted is specified.

--passphrase= - Provides a default system-wide passphrase for all encrypted devices.

--escrowcert=URL_of_X.509_certificate - Stores data encryption keys of all encrypted volumes as files in /root, encrypted using the X.509 certificate from the URL specified with URL_of_X.509_certificate. The keys are stored as a separate file for each encrypted volume. This option is only meaningful if --encrypted is specified.

--backuppassphrase - Adds a randomly-generated passphrase to each encrypted volume. Store these passphrases in separate files in /root, encrypted using the X.509 certificate specified with --escrowcert. This option is only meaningful if --escrowcert is specified.

--cipher= - Specifies the type of encryption to use if the Anaconda default aes-xts-plain64 is not satisfactory. You must use this option together with the --encrypted option; by itself it has no effect. Available types of encryption are listed in the Security hardening in RHEL 8 document, but Red Hat strongly recommends using either aes-xts-plain64 or aes-cbc-essiv:sha256.

--pbkdf=PBKDF - Sets Password-Based Key Derivation Function (PBKDF) algorithm for LUKS keyslot. See also the man page cryptsetup(8). This option is only meaningful if --encrypted is specified.

--pbkdf-memory=PBKDF_MEMORY - Sets the memory cost for PBKDF. See also the man page cryptsetup(8). This option is only meaningful if --encrypted is specified.

--pbkdf-time=PBKDF_TIME - Sets the number of milliseconds to spend with PBKDF passphrase processing. See also --iter-time in the man page cryptsetup(8). This option is only meaningful if --encrypted is specified, and is mutually exclusive with --pbkdf-iterations.

--pbkdf-iterations=PBKDF_ITERATIONS - Sets the number of iterations directly and avoids PBKDF benchmark. See also --pbkdf-force-iterations in the man page cryptsetup(8). This option is only meaningful if --encrypted is specified, and is mutually exclusive with --pbkdf-time.

The autopart option cannot be used together with the part/partition, raid, logvol, or volgroup options in the same Kickstart file.

The autopart command is not mandatory, but you must include it if there are no part of mount commands in your Kickstart script.

It is recommended to use the autopart --nohome Kickstart option when installing on a single FBA DASD of the CMS type. This ensures that the installation program does not create a separate /home partition. The installation then proceeds successfully.

If you lose the LUKS passphrase, any encrypted partitions and their data is completely inaccessible. There is no way to recover a lost passphrase. However, you can save encryption passphrases with the --escrowcert and create backup encryption passphrases with the --backuppassphrase options.

--append= - Specifies additional kernel parameters. To specify multiple parameters, separate them with spaces. For example:

bootloader --location=mbr --append="hdd=ide-scsi ide=nodma"

%packages
-plymouth
%end

--boot-drive= - Specifies which drive the boot loader should be written to, and therefore which drive the computer will boot from. If you use a multipath device as the boot drive, specify only one member of the device.

--leavebootorder - The installation program will add CentOS 8 to the top of the list of installed systems in the boot loader, and preserve all existing entries as well as their order.

--driveorder= - Specifies which drive is first in the BIOS boot order. For example:

bootloader --driveorder=sda,hda

--location= - Specifies where the boot record is written. Valid values are the following:

--nombr - Do not install the boot loader to the MBR.

--password= - If using GRUB2, sets the boot loader password to the one specified with this option. This should be used to restrict access to the GRUB2 shell, where arbitrary kernel options can be passed.

--iscrypted - Normally, when you specify a boot loader password using the --password= option, it is stored in the Kickstart file in plain text. If you want to encrypt the password, use this option and an encrypted password.

bootloader --iscrypted --password=grub.pbkdf2.sha512.10000.5520C6C9832F3AC3D149AC0B24BE69E2D4FB0DBEEDBD29CA1D30A044DE2645C4C7A291E585D4DC43F8A4D82479F8B95CA4BA4381F8550510B75E8E0BB2938990.C688B6F0EF935701FF9BD1A8EC7FE5BD2333799C98F28420C5CC8F1A2A233DE22C83705BB614EA17F3FDFDF4AC2161CEA3384E56EB38A2E39102F5334C47405E

--timeout= - Specifies the amount of time the boot loader waits before booting the default option (in seconds).

--default= - Sets the default boot image in the boot loader configuration.

--extlinux - Use the extlinux boot loader instead of GRUB2. This option only works on systems supported by extlinux.

--disabled — This option is a stronger version of --location=none. While --location=none simply disables boot loader installation, --disabled disables boot loader installation and also disables installation of the package containing the boot loader, thus saving space.

Red Hat recommends setting up a boot loader password on every system. An unprotected boot loader can allow a potential attacker to modify the system’s boot options and gain unauthorized access to the system.

In some cases, a special partition is required to install the boot loader on AMD64, Intel 64, and 64-bit ARM systems. The type and size of this partition depends on whether the disk you are installing the boot loader to uses the Master Boot Record (MBR) or a GUID Partition Table (GPT) schema. For more information, see the Configuring boot loader section of the Performing a standard installation document.

Device names in the sdX (or /dev/sdX) format are not guaranteed to be consistent across reboots, which can complicate usage of some Kickstart commands. When a command calls for a device node name, you can instead use any item from /dev/disk. For example, instead of:

part / --fstype=xfs --onpart=sda1

part / --fstype=xfs --onpart=/dev/disk/by-path/pci-0000:00:05.0-scsi-0:0:0:0-part1

part / --fstype=xfs --onpart=/dev/disk/by-id/ata-ST3160815AS_6RA0C882-part1

The --upgrade option is deprecated in CentOS 8.

--all - Erases all partitions from the system.

--drives= - Specifies which drives to clear partitions from. For example, the following clears all the partitions on the first two drives on the primary IDE controller:

clearpart --drives=hda,hdb --all

clearpart --drives=disk/by-id/scsi-58095BEC5510947BE8C0360F604351918

clearpart --drives=disk/by-id/dm-uuid-mpath-2416CD96995134CA5D787F00A5AA11017

--initlabel - Initializes a disk (or disks) by creating a default disk label for all disks in their respective architecture that have been designated for formatting (for example, msdos for x86). Because --initlabel can see all disks, it is important to ensure only those drives that are to be formatted are connected.

clearpart --initlabel --drives=names_of_disks

clearpart --initlabel --drives=dasda,dasdb,dasdc

--list= - Specifies which partitions to clear. This option overrides the --all and --linux options if used. Can be used across different drives. For example:

clearpart --list=sda2,sda3,sdb1

--disklabel=LABEL - Set the default disklabel to use. Only disklabels supported for the platform will be accepted. For example, on the 64-bit Intel and AMD architectures, the msdos and gpt disklabels are accepted, but dasd is not accepted.

--linux - Erases all Linux partitions.

--none (default) - Do not remove any partitions.

--cdl - Reformat any LDL DASDs to CDL format.

Device names in the sdX (or /dev/sdX) format are not guaranteed to be consistent across reboots, which can complicate usage of some Kickstart commands. When a command calls for a device node name, you can instead use any item from /dev/disk. For example, instead of:

part / --fstype=xfs --onpart=sda1

part / --fstype=xfs --onpart=/dev/disk/by-path/pci-0000:00:05.0-scsi-0:0:0:0-part1

part / --fstype=xfs --onpart=/dev/disk/by-id/ata-ST3160815AS_6RA0C882-part1

If the clearpart command is used, then the part --onpart command cannot be used on a logical partition.

--nic= (required) - The name of the device to be activated.

--dcb= - Establish Data Center Bridging (DCB) settings.

--autovlan - Discover VLANs automatically. This option is enabled by default.

--drives=driveN,…​ - Replace driveN with one of sda, sdb,…​, hda,…​ and so on.

--only-use - Specifies a list of disks for the installation program to use. All other disks are ignored. For example, to use disk sda during installation and ignore all other disks:

ignoredisk --only-use=sda

ignoredisk --only-use=disk/by-id/dm-uuid-mpath-2416CD96995134CA5D787F00A5AA11017

ignoredisk --only-use=disk/by-id/scsi-58095BEC5510947BE8C0360F604351918

The --interactive option is deprecated in CentOS 8. This option allowed users to manually navigate the advanced storage screen.

To ignore a multipath device that does not use logical volume management (LVM), use the format disk/by-id/dm-uuid-mpath-WWID, where WWID is the world-wide identifier for the device. For example, to ignore a disk with WWID 2416CD96995134CA5D787F00A5AA11017, use:

ignoredisk --drives=disk/by-id/dm-uuid-mpath-2416CD96995134CA5D787F00A5AA11017

Multipath devices that use LVM are not assembled until after Anaconda has parsed the Kickstart file. Therefore, you cannot specify these devices in the format dm-uuid-mpath. Instead, to ignore a multipath device that uses LVM, use the format disk/by-id/scsi-WWID, where WWID is the world-wide identifier for the device. For example, to ignore a disk with WWID 58095BEC5510947BE8C0360F604351918, use:

ignoredisk --drives=disk/by-id/scsi-58095BEC5510947BE8C0360F604351918

Never specify multipath devices by device names like mpatha. Device names such as this are not specific to a particular disk. The disk named /dev/mpatha during installation might not be the one that you expect it to be. Therefore, the clearpart command could target the wrong disk.

Device names in the sdX (or /dev/sdX) format are not guaranteed to be consistent across reboots, which can complicate usage of some Kickstart commands. When a command calls for a device node name, you can instead use any item from /dev/disk. For example, instead of:

part / --fstype=xfs --onpart=sda1

part / --fstype=xfs --onpart=/dev/disk/by-path/pci-0000:00:05.0-scsi-0:0:0:0-part1

part / --fstype=xfs --onpart=/dev/disk/by-id/ata-ST3160815AS_6RA0C882-part1

--ipaddr= (required) - the IP address of the target to connect to.

--port= (required) - the port number. If not present, --port=3260 is used automatically by default.

--target= - the target IQN (iSCSI Qualified Name).

--iface= - bind the connection to a specific network interface instead of using the default one determined by the network layer. Once used, it must be specified in all instances of the iscsi command in the entire Kickstart file.

--user= - the user name required to authenticate with the target

--password= - the password that corresponds with the user name specified for the target

--reverse-user= - the user name required to authenticate with the initiator from a target that uses reverse CHAP authentication

--reverse-password= - the password that corresponds with the user name specified for the initiator

If you use the iscsi command, you must also assign a name to the iSCSI node, using the iscsiname command. The iscsiname command must appear before the iscsi command in the Kickstart file.

Wherever possible, configure iSCSI storage in the system BIOS or firmware (iBFT for Intel systems) rather than use the iscsi command. Anaconda automatically detects and uses disks configured in BIOS or firmware and no special configuration is necessary in the Kickstart file.

If you must use the iscsi command, ensure that networking is activated at the beginning of the installation, and that the iscsi command appears in the Kickstart file before you refer to iSCSI disks with commands such as clearpart or ignoredisk.

If you use the iscsi parameter in your Kickstart file, you must specify iscsiname earlier in the Kickstart file.

The mntpoint is where the partition is mounted and must be of one of the following forms:

--vgname=name - name of the volume group.

--name=name - name of the logical volume.

--noformat - Use an existing logical volume and do not format it.

--useexisting - Use an existing logical volume and reformat it.

--fstype= - Sets the file system type for the logical volume. Valid values are xfs, ext2, ext3, ext4, swap, and vfat.

--fsoptions= - Specifies a free form string of options to be used when mounting the filesystem. This string will be copied into the /etc/fstab file of the installed system and should be enclosed in quotes.

--mkfsoptions= - Specifies additional parameters to be passed to the program that makes a filesystem on this partition. No processing is done on the list of arguments, so they must be supplied in a format that can be passed directly to the mkfs program. This means multiple options should be comma-separated or surrounded by double quotes, depending on the filesystem.

--fsprofile= - Specifies a usage type to be passed to the program that makes a filesystem on this partition. A usage type defines a variety of tuning parameters to be used when making a filesystem. For this option to work, the filesystem must support the concept of usage types and there must be a configuration file that lists valid types. For ext2, ext3, and ext4, this configuration file is /etc/mke2fs.conf.

--label= - Sets a label for the logical volume.

--grow - Tells the logical volume to grow to fill available space (if any), or up to the maximum size setting, if one is specified. A minimum size must be given, using either the --percent= option or the --size= option.

--size= - The size of the logical volume in MiB. This option cannot be used together with the --percent= option.

--percent= - The size of the logical volume, as a percentage of the free space in the volume group after any statically-sized logical volumes are taken into account. This option cannot be used together with the --size= option.

--maxsize= - The maximum size in MiB when the logical volume is set to grow. Specify an integer value here such as 500 (do not include the unit).

--recommended - Use this option when creating a logical volume to determine the size of this volume automatically, based on your system’s hardware. For details about the recommended scheme, see Recommended partitioning scheme for AMD64, Intel 64, and 64-bit ARM systems.

--resize - Resize a logical volume. If you use this option, you must also specify --useexisting and --size.

--encrypted - Specifies that this logical volume should be encrypted with Linux Unified Key Setup (LUKS), using the passphrase provided in the --passphrase= option. If you do not specify a passphrase, the installation program uses the default, system-wide passphrase set with the autopart --passphrase command, or stops the installation and prompts you to provide a passphrase if no default is set.

--passphrase= - Specifies the passphrase to use when encrypting this logical volume. You must use this option together with the --encrypted option; it has no effect by itself.

--cipher= - Specifies the type of encryption to use if the Anaconda default aes-xts-plain64 is not satisfactory. You must use this option together with the --encrypted option; by itself it has no effect. Available types of encryption are listed in the Security hardening in RHEL 8 document, but Red Hat strongly recommends using either aes-xts-plain64 or aes-cbc-essiv:sha256.

--escrowcert=URL_of_X.509_certificate - Store data encryption keys of all encrypted volumes as files in /root, encrypted using the X.509 certificate from the URL specified with URL_of_X.509_certificate. The keys are stored as a separate file for each encrypted volume. This option is only meaningful if --encrypted is specified.

--luks-version=LUKS_VERSION - Specifies which version of LUKS format should be used to encrypt the filesystem. This option is only meaningful if --encrypted is specified.

--backuppassphrase - Add a randomly-generated passphrase to each encrypted volume. Store these passphrases in separate files in /root, encrypted using the X.509 certificate specified with --escrowcert. This option is only meaningful if --escrowcert is specified.

--pbkdf=PBKDF - Sets Password-Based Key Derivation Function (PBKDF) algorithm for LUKS keyslot. See also the man page cryptsetup(8). This option is only meaningful if --encrypted is specified.

--pbkdf-memory=PBKDF_MEMORY - Sets the memory cost for PBKDF. See also the man page cryptsetup(8). This option is only meaningful if --encrypted is specified.

--pbkdf-time=PBKDF_TIME - Sets the number of milliseconds to spend with PBKDF passphrase processing. See also --iter-time in the man page cryptsetup(8). This option is only meaningful if --encrypted is specified, and is mutually exclusive with --pbkdf-iterations.

--pbkdf-iterations=PBKDF_ITERATIONS - Sets the number of iterations directly and avoids PBKDF benchmark. See also --pbkdf-force-iterations in the man page cryptsetup(8). This option is only meaningful if --encrypted is specified, and is mutually exclusive with --pbkdf-time.

--thinpool - Creates a thin pool logical volume. (Use a mount point of none)

--metadatasize=size - Specify the metadata area size (in MiB) for a new thin pool device.

--chunksize=size - Specify the chunk size (in KiB) for a new thin pool device.

--thin - Create a thin logical volume. (Requires use of --poolname)

--poolname=name - Specify the name of the thin pool in which to create a thin logical volume. Requires the --thin option.

--profile=name - Specify the configuration profile name to use with thin logical volumes. If used, the name will also be included in the metadata for the given logical volume. By default, the available profiles are default and thin-performance and are defined in the /etc/lvm/profile/ directory. See the lvm(8) man page for additional information.

--cachepvs= - A comma-separated list of physical volumes which should be used as a cache for this volume.

--cachemode= - Specify which mode should be used to cache this logical volume - either writeback or writethrough.

--cachesize= - Size of cache attached to the logical volume, specified in MiB. This option requires the --cachepvs= option.

Do not use the dash (-) character in logical volume and volume group names when installing CentOS using Kickstart. If this character is used, the installation finishes normally, but the /dev/mapper/ directory will list these volumes and volume groups with every dash doubled. For example, a volume group named volgrp-01 containing a logical volume named logvol-01 will be listed as /dev/mapper/volgrp—​01-logvol—​01.

Create the partition first, create the logical volume group, and then create the logical volume:

part pv.01 --size 3000
volgroup myvg pv.01
logvol / --vgname=myvg --size=2000 --name=rootvol

Create the partition first, create the logical volume group, and then create the logical volume to occupy 90% of the remaining space in the volume group:

For more information regarding LVM, see the Configuring and managing logical volumes in RHEL 8 document.

If you lose the LUKS passphrase, any encrypted partitions and their data is completely inaccessible. There is no way to recover a lost passphrase. However, you can save encryption passphrases with the --escrowcert and create backup encryption passphrases with the --backuppassphrase options.

device - The block device to mount.

mntpoint - Where to mount the device. It must be a valid mount point, such as / or /usr, or none if the device is unmountable (for example swap).

--reformat= - Specifies a new format (such as ext4) to which the device should be reformatted.

--mkfsoptions= - Specifies additional options to be passed to the command which creates the new file system specified in --reformat=. The list of options provided here is not processed, so they must be specified in a format that can be passed directly to the mkfs program. The list of options should be either comma-separated or surrounded by double quotes, depending on the file system. See the mkfs man page for the file system you want to create (for example mkfs.ext4(8) or mkfs.xfs(8)) for specific details.

--mountoptions= - Specifies a free form string that contains options to be used when mounting the file system. The string will be copied to the /etc/fstab file on the installed system and should be enclosed in double quotes. See the mount(8) man page for a full list of mount options, and fstab(5) for basics.

Unlike most other storage configuration commands in Kickstart, mount does not require you to describe the entire storage configuration in the Kickstart file. You only need to ensure that the described block device exists on the system. However, if you want to create the storage stack with all the devices mounted, you must use other commands such as part to do so.

You can not use mount together with other storage-related commands such as part, logvol, or autopart in the same Kickstart file.

reconfigure - Reconfigure a specific NVDIMM device into a given mode. Additionally, the specified device is implicitly marked as to be used, so a subsequent nvdimm use command for the same device is redundant. This action uses the following format:

nvdimm reconfigure [--namespace=NAMESPACE] [--mode=MODE] [--sectorsize=SECTORSIZE]

use - Specify a NVDIMM device as a target for installation. The device must be already configured to the sector mode by the nvdimm reconfigure command. This action uses the following format:

nvdimm use [--namespace=NAMESPACE|--blockdevs=DEVICES]

By default, all NVDIMM devices are ignored by the installation program. You must use the nvdimm command to enable installation on these devices.

mntpoint - Where the partition is mounted. The value must be of one of the following forms:

--size= - The minimum partition size in MiB. Specify an integer value here such as 500 (do not include the unit).

--grow - Tells the logical volume to grow to fill available space (if any), or up to the maximum size setting, if one is specified.

--maxsize= - The maximum partition size in MiB when the partition is set to grow. Specify an integer value here such as 500 (do not include the unit).

--noformat - Specifies that the partition should not be formatted, for use with the --onpart command.

--onpart= or --usepart= - Specifies the device on which to place the partition. For example:

partition /home --onpart=hda1

partition pv.1 --onpart=hda2

--ondisk= or --ondrive= - Forces the partition to be created on a particular disk. For example, --ondisk=sdb puts the partition on the second SCSI disk on the system.

part / --fstype=xfs --grow --asprimary --size=8192 --ondisk=disk/by-id/dm-uuid-mpath-2416CD96995134CA5D787F00A5AA11017

part / --fstype=xfs --grow --asprimary --size=8192 --ondisk=disk/by-id/scsi-58095BEC5510947BE8C0360F604351918

--asprimary - Forces the partition to be allocated as a primary partition. If the partition cannot be allocated as primary (usually due to too many primary partitions being already allocated), the partitioning process fails. This option only makes sense when the disk uses a Master Boot Record (MBR); for GUID Partition Table (GPT)-labeled disks this option has no meaning.

--fsprofile= - Specifies a usage type to be passed to the program that makes a filesystem on this partition. A usage type defines a variety of tuning parameters to be used when making a filesystem. For this option to work, the filesystem must support the concept of usage types and there must be a configuration file that lists valid types. For ext2, ext3, ext4, this configuration file is /etc/mke2fs.conf.

--mkfsoptions= - Specifies additional parameters to be passed to the program that makes a filesystem on this partition. This is similar to --fsprofile but works for all filesystems, not just the ones that support the profile concept. No processing is done on the list of arguments, so they must be supplied in a format that can be passed directly to the mkfs program. This means multiple options should be comma-separated or surrounded by double quotes, depending on the filesystem.

--fstype= - Sets the file system type for the partition. Valid values are xfs, ext2, ext3, ext4, swap, vfat, efi and biosboot.

--fsoptions - Specifies a free form string of options to be used when mounting the filesystem. This string will be copied into the /etc/fstab file of the installed system and should be enclosed in quotes.

--label= - assign a label to an individual partition.

--recommended - Determine the size of the partition automatically. For details about the recommended scheme, see Recommended partitioning scheme for AMD64, Intel 64, and 64-bit ARM.

--onbiosdisk - Forces the partition to be created on a particular disk as discovered by the BIOS.

--encrypted - Specifies that this partition should be encrypted with Linux Unified Key Setup (LUKS), using the passphrase provided in the --passphrase option. If you do not specify a passphrase, Anaconda uses the default, system-wide passphrase set with the autopart --passphrase command, or stops the installation and prompts you to provide a passphrase if no default is set.

--luks-version=LUKS_VERSION - Specifies which version of LUKS format should be used to encrypt the filesystem. This option is only meaningful if --encrypted is specified.

--passphrase= - Specifies the passphrase to use when encrypting this partition. You must use this option together with the --encrypted option; by itself it has no effect.

--cipher= - Specifies the type of encryption to use if the Anaconda default aes-xts-plain64 is not satisfactory. You must use this option together with the --encrypted option; by itself it has no effect. Available types of encryption are listed in the Security hardening in RHEL 8 document, but Red Hat strongly recommends using either aes-xts-plain64 or aes-cbc-essiv:sha256.

--escrowcert=URL_of_X.509_certificate - Store data encryption keys of all encrypted partitions as files in /root, encrypted using the X.509 certificate from the URL specified with URL_of_X.509_certificate. The keys are stored as a separate file for each encrypted partition. This option is only meaningful if --encrypted is specified.

--backuppassphrase - Add a randomly-generated passphrase to each encrypted partition. Store these passphrases in separate files in /root, encrypted using the X.509 certificate specified with --escrowcert. This option is only meaningful if --escrowcert is specified.

--pbkdf=PBKDF - Sets Password-Based Key Derivation Function (PBKDF) algorithm for LUKS keyslot. See also the man page cryptsetup(8). This option is only meaningful if --encrypted is specified.

--pbkdf-memory=PBKDF_MEMORY - Sets the memory cost for PBKDF. See also the man page cryptsetup(8). This option is only meaningful if --encrypted is specified.

--pbkdf-time=PBKDF_TIME - Sets the number of milliseconds to spend with PBKDF passphrase processing. See also --iter-time in the man page cryptsetup(8). This option is only meaningful if --encrypted is specified, and is mutually exclusive with --pbkdf-iterations.

--pbkdf-iterations=PBKDF_ITERATIONS - Sets the number of iterations directly and avoids PBKDF benchmark. See also --pbkdf-force-iterations in the man page cryptsetup(8). This option is only meaningful if --encrypted is specified, and is mutually exclusive with --pbkdf-time.

--resize= - Resize an existing partition. When using this option, specify the target size (in MiB) using the --size= option and the target partition using the --onpart= option.

The part command is not mandatory, but you must include either part, autopart or mount in your Kickstart script.

The --active option is deprecated in CentOS 8.

If partitioning fails for any reason, diagnostic messages appear on virtual console 3.

All partitions created are formatted as part of the installation process unless --noformat and --onpart are used.

Device names in the sdX (or /dev/sdX) format are not guaranteed to be consistent across reboots, which can complicate usage of some Kickstart commands. When a command calls for a device node name, you can instead use any item from /dev/disk. For example, instead of:

part / --fstype=xfs --onpart=sda1

part / --fstype=xfs --onpart=/dev/disk/by-path/pci-0000:00:05.0-scsi-0:0:0:0-part1

part / --fstype=xfs --onpart=/dev/disk/by-id/ata-ST3160815AS_6RA0C882-part1

If you lose the LUKS passphrase, any encrypted partitions and their data is completely inaccessible. There is no way to recover a lost passphrase. However, you can save encryption passphrases with the --escrowcert and create backup encryption passphrases with the --backuppassphrase options.

mntpoint - Location where the RAID file system is mounted. If it is /, the RAID level must be 1 unless a boot partition (/boot) is present. If a boot partition is present, the /boot partition must be level 1 and the root (/) partition can be any of the available types. The partitions* (which denotes that multiple partitions can be listed) lists the RAID identifiers to add to the RAID array.

--level= - RAID level to use (0, 1, 4, 5, 6, or 10). See Supported RAID types for information about various available RAID levels.

--device= - Name of the RAID device to use - for example, --device=root.

--chunksize= - Sets the chunk size of a RAID storage in KiB. In certain situations, using a different chunk size than the default (512 Kib) can improve the performance of the RAID.

--spares= - Specifies the number of spare drives allocated for the RAID array. Spare drives are used to rebuild the array in case of drive failure.

--fsprofile= - Specifies a usage type to be passed to the program that makes a filesystem on this partition. A usage type defines a variety of tuning parameters to be used when making a filesystem. For this option to work, the filesystem must support the concept of usage types and there must be a configuration file that lists valid types. For ext2, ext3, and ext4, this configuration file is /etc/mke2fs.conf.

--fstype= - Sets the file system type for the RAID array. Valid values are xfs, ext2, ext3, ext4, swap, and vfat.

--fsoptions= - Specifies a free form string of options to be used when mounting the filesystem. This string will be copied into the /etc/fstab file of the installed system and should be enclosed in quotes.

--mkfsoptions= - Specifies additional parameters to be passed to the program that makes a filesystem on this partition. No processing is done on the list of arguments, so they must be supplied in a format that can be passed directly to the mkfs program. This means multiple options should be comma-separated or surrounded by double quotes, depending on the filesystem.

--label= - Specify the label to give to the filesystem to be made. If the given label is already in use by another filesystem, a new label will be created.

--noformat - Use an existing RAID device and do not format the RAID array.

--useexisting - Use an existing RAID device and reformat it.

--encrypted - Specifies that this RAID device should be encrypted with Linux Unified Key Setup (LUKS), using the passphrase provided in the --passphrase option. If you do not specify a passphrase, Anaconda uses the default, system-wide passphrase set with the autopart --passphrase command, or stops the installation and prompts you to provide a passphrase if no default is set.

--luks-version=LUKS_VERSION - Specifies which version of LUKS format should be used to encrypt the filesystem. This option is only meaningful if --encrypted is specified.

--cipher= - Specifies the type of encryption to use if the Anaconda default aes-xts-plain64 is not satisfactory. You must use this option together with the --encrypted option; by itself it has no effect. Available types of encryption are listed in the Security hardening in RHEL 8 document, but Red Hat strongly recommends using either aes-xts-plain64 or aes-cbc-essiv:sha256.

--passphrase= - Specifies the passphrase to use when encrypting this RAID device. You must use this option together with the --encrypted option; by itself it has no effect.

--escrowcert=URL_of_X.509_certificate - Store the data encryption key for this device in a file in /root, encrypted using the X.509 certificate from the URL specified with URL_of_X.509_certificate. This option is only meaningful if --encrypted is specified.

--backuppassphrase - Add a randomly-generated passphrase to this device. Store the passphrase in a file in /root, encrypted using the X.509 certificate specified with --escrowcert. This option is only meaningful if --escrowcert is specified.

--pbkdf=PBKDF - Sets Password-Based Key Derivation Function (PBKDF) algorithm for LUKS keyslot. See also the man page cryptsetup(8). This option is only meaningful if --encrypted is specified.

--pbkdf-memory=PBKDF_MEMORY - Sets the memory cost for PBKDF. See also the man page cryptsetup(8). This option is only meaningful if --encrypted is specified.

--pbkdf-time=PBKDF_TIME - Sets the number of milliseconds to spend with PBKDF passphrase processing. See also --iter-time in the man page cryptsetup(8). This option is only meaningful if --encrypted is specified, and is mutually exclusive with --pbkdf-iterations.

--pbkdf-iterations=PBKDF_ITERATIONS - Sets the number of iterations directly and avoids PBKDF benchmark. See also --pbkdf-force-iterations in the man page cryptsetup(8). This option is only meaningful if --encrypted is specified, and is mutually exclusive with --pbkdf-time.

If you lose the LUKS passphrase, any encrypted partitions and their data is completely inaccessible. There is no way to recover a lost passphrase. However, you can save encryption passphrases with the --escrowcert and create backup encryption passphrases with the --backuppassphrase options.

--add-boot - Creates a separate /boot partition in addition to the platform-specific partition created by the base command.

This command cannot be used toegether with autopart, because autopart does everything the reqpart command does and, in addition, creates other partitions or logical volumes such as / and swap. In contrast with autopart, this command only creates platform-specific partitions and leaves the rest of the drive empty, allowing you to create a custom layout.

vg_name/lv_name - Sets the name of the volume group and logical volume to create the snapshot from.

--name=snapshot_name - Sets the name of the snapshot. This name must be unique within the volume group.

--when=pre-install|post-install - Sets if the snapshot is created before the installation begins or after the installation is completed.

--noformat - Use an existing volume group and do not format it.

--useexisting - Use an existing volume group and reformat it. If you use this option, do not specify a partition. For example:

volgroup centos00 --useexisting --noformat

--pesize= - Set the size of the volume group’s physical extents in KiB. The default value is 4096 (4 MiB), and the minimum value is 1024 (1 MiB).

--reserved-space= - Specify an amount of space to leave unused in a volume group in MiB. Applicable only to newly created volume groups.

--reserved-percent= - Specify a percentage of total volume group space to leave unused. Applicable only to newly created volume groups.

Create the partition first, then create the logical volume group, and then create the logical volume. For example:

part pv.01 --size 10000
volgroup volgrp pv.01 `
[command]`logvol / --vgname=volgrp --size=2000 --name=root

Do not use the dash (-) character in logical volume and volume group names when installing CentOS using Kickstart. If this character is used, the installation finishes normally, but the /dev/mapper/ directory will list these volumes and volume groups with every dash doubled. For example, a volume group named volgrp-01 containing a logical volume named logvol-01 will be listed as /dev/mapper/volgrp—​01-logvol—​01.

On IBM Z, if zerombr is specified, any Direct Access Storage Device (DASD) visible to the installation program which is not already low-level formatted is automatically low-level formatted with dasdfmt. The command also prevents user choice during interactive installations.

If zerombr is not specified and there is at least one unformatted DASD visible to the installation program, a non-interactive Kickstart installation exits unsuccessfully.

If zerombr is not specified and there is at least one unformatted DASD visible to the installation program, an interactive installation exits if the user does not agree to format all visible and unformatted DASDs. To circumvent this, only activate those DASDs that you will use during installation. You can always add more DASDs after installation is complete.

--devnum - The device number (zFCP adapter device bus ID).

--wwpn - The device’s World Wide Port Name (WWPN). Takes the form of a 16-digit number, preceded by 0x.

--fcplun - The device’s Logical Unit Number (LUN). Takes the form of a 16-digit number, preceded by 0x.

--enable - Enable kdump on the installed system.

--disable - Disable kdump on the installed system.

--reserve-mb= - The amount of memory you want to reserve for kdump, in MiB. For example:

%addon com_redhat_kdump --enable --reserve-mb=128
%end

--enablefadump - Enable firmware-assisted dumping on systems which allow it (notably, IBM Power Systems servers).

content-type - Type of the security content. Possible values are datastream, archive, rpm, and scap-security-guide.

content-url - Location of the security content. The content must be accessible using HTTP, HTTPS, or FTP; local storage is currently not supported. A network connection must be available to reach content definitions in a remote location.

datastream-id - ID of the data stream referenced in the content-url value. Used only if content-type is datastream.

xccdf-id - ID of the benchmark you want to use.

xccdf-path - Path to the XCCDF file which should be used; given as a relative path in the archive.

profile - ID of the profile to be applied. Use default to apply the default profile.

fingerprint - A MD5, SHA1 or SHA2 checksum of the content referenced by content-url.

tailoring-path - Path to a tailoring file which should be used, given as a relative path in the archive.

The following is an example %addon org_fedora_oscap section which uses content from the scap-security-guide on the installation media:

%addon org_fedora_oscap
content-type = scap-security-guide
profile = pci-dss
%end

The following is a more complex example which loads a custom profile from a web server:

%addon org_fedora_oscap
content-type = datastream
content-url = http://www.example.com/scap/testing_ds.xml
datastream-id = scap_example.com_datastream_testing
xccdf-id = scap_example.com_cref_xccdf.xml
profile =  xccdf_example.com_profile_my_profile
fingerprint = 240f2f18222faa98856c3b4fc50c4195
%end

Additional information about the OpenSCAP installation program add-on is available at https://www.open-scap.org/tools/oscap-anaconda-addon/.

For more information about the profiles available in the SCAP Security Guide and what they do, see the OpenSCAP Portal.