Installing Root Lock by HeartSuite – Part 2

After the first boot, Root Lock reads the startup and shutdown logs and adds the programs it finds. On serial the Dashboard can open by itself. On a graphical VM window, log in as root and type hs.

Overview: No commands are needed after the first boot into the Root Lock kernel. Root Lock reads the startup and shutdown logs and adds the programs it finds to the allowlist. When that is complete, the Dashboard opens on the serial console. A graphical VM window (hypervisor VNC, virt-manager, and similar) stays a normal login: log in as root and type hs or heartsuite.

Note

Cloud users skip live initial setup. On a pre-configured cloud instance, the Dashboard confirms initial setup completed during image build. Installer and initial setup logs from the image build are in /var/log/heartsuite/ and accessible via the provider’s serial console.

What happens after the first boot

Root Lock reads the startup and shutdown logs, adds the programs it finds to the allowlist, and reboots. This repeats until no new programs are found — typically three to five passes, depending on the distribution.

While initial setup is running, you will see:

Over SSH: each time you reconnect, the login shows a brief status line and drops you at a regular shell — no action needed:
```
HeartSuite initial setup is running — step N.
The system reboots automatically. Reconnect in a few minutes.
```
On the serial console (virsh console, AWS EC2 Serial Console or Get system log, Linode LISH, Azure Serial Console, GCP serial, IPMI serial-over-LAN): attach and press Enter once when you see Press Enter to start. Serial autologs in as root. During setup it shows the current step; when setup is finished the Dashboard can open there. To inspect logs: cat /var/log/heartsuite/install.log (installer) or cat /var/log/heartsuite/initial-setup-latest.log.
On a graphical console (the VM window, hypervisor VNC, virt-manager, Proxmox, and similar): that is a normal login. The Dashboard does not start by itself. During setup you may see kernel lines and a login prompt. When setup is finished, log in as root and type hs or heartsuite. Press Enter to start is serial-only.

The first time the Dashboard is in front of you, initial setup is complete.

Leave the host quiet

After the first reboot into the Root Lock kernel, leave the machine alone until setup finishes, because Root Lock is still adding startup and shutdown programs from those boots. Each SSH reconnect shows a status line and a shell. On a graphical VM window the login prompt stays, so log in once setup finishes rather than waiting for the Dashboard to replace it.

What already landed on the allowlist

When the Dashboard appears, Root Lock has already added the programs that executed at boot and shutdown. The Dashboard checklist starts at Program Allowlisting. In Setup Mode, Root Lock then logs the rest of the workload.

Package-install helpers, compilers, and one-shot probes that executed during those unattended boots are already allowlist entries even if they never execute again.

Run the services you will keep

Start the services this host will keep, and leave out throwaway tests, compilers, and extra shells, because everything that executes now lands in the review queues. In the review queues, approve programs that belong on this host and skip the one-shots, because approving them lets them run under Lockdown. Allowlisting Basics covers approve and skip.

Use Setup Mode for that kept workload. After Lockdown, add software through Protecting During Maintenance.

Cloud leftovers

On Cloud Path, Root Lock already finished initial setup during image preparation. First-boot leftovers (cloud-init, provisioning helpers) may still appear in the queues; skip any the host does not need at runtime.

Cloud images often ship a first-boot SSH policy that allows password login so you can reach the guest. After first boot, running sshd is typically key-only. Check the live sshd configuration for leftover cloud-init snippets.

If the Dashboard does not appear

If initial setup is still running, SSH reconnects show the status line above instead of the Dashboard. Wait a few minutes and reconnect. On a graphical VM window, a login prompt is normal; log in as root and type hs after setup finishes.

If repeated reconnects still show the status line rather than the Dashboard:

On serial, attach and press Enter. On a graphical VM window, log in as root and type hs. To inspect logs:

journalctl -t heartsuite
cat /var/log/heartsuite/install.log          # installer log
cat /var/log/heartsuite/initial-setup-latest.log   # or ls /var/log/heartsuite/ for step logs

Verify the Root Lock kernel is loaded:
```
uname -r
```
Expected output ends in HeartSuite.
If the wrong kernel booted, reboot and select the Root Lock kernel from the GRUB menu manually (requires serial console access on cloud).

If the issue persists, contact HeartSuite support at support@heartsecsuite.com and include /var/log/heartsuite/install.log and /var/log/heartsuite/initial-setup-latest.log — we’re happy to help.

If setup stops with an error

If something goes wrong during setup, the next login (SSH or serial console) shows an error with the reason and log location.

Two options are available:

[r] Retry — restarts the setup from where it stopped.
[q] Open shell — drops you to a shell to investigate before retrying. On the serial console, cat /var/log/heartsuite/install.log or cat /var/log/heartsuite/initial-setup-latest.log. AWS Get system log shows the serial buffer; CloudWatch needs the platform agent plus IAM, which Root Lock does not install.

Warning

Setup must complete before you activate Lockdown. If the initial allowlist is incomplete, the system may hang on boot or shutdown after activating Lockdown.

If retry does not clear the error, contact HeartSuite support at support@heartsecsuite.com and include the log path shown on the error screen — we’re happy to help.

When the Dashboard appears and initial setup is complete, continue to Verifying Installation.