Installing Arch Linux on an SSD with plain boot but encrypted /, /home, etc.

arch-install-encrypted.md

Arch Linux on LUKS

Mostly follows the Arch Linux install guide, but with tips from these for the encryption setup:

• https://gist.github.com/binaerbaum/535884a7f5b8a8697557
• https://gist.github.com/OdinsPlasmaRifle/e16700b83624ff44316f87d9cdbb5c94
• https://wiki.archlinux.org/index.php/Systemd-boot#Standard_root_installations
• Uses an unencrypted /boot with LUKS on LVM for / and /home

Partitoning

Find the correct disk and clear all existing partitions with sgdisk:

# fdisk -l
# sgdisk --zap-all /dev/sda

Use gdisk to create a new GUID partition table (press "o") and two partitions (press "n"):

• Partition 1: 512M (or more) for /boot with type "EF00"
• Partition 2: the rest of the disk for LVM with type "8E00" (we will create root, home, etc here using LVM)

# gdisk /dev/sda

Format the boot partition with mkfs.fat:

# mkfs.fat -F32 /dev/sda1

Create Encrypted LUKS partition

Uses 128-bit AES (double to -s 512 if you want 256 bit) and sha256, because the NSA is not my adversary, but I don't want random people to be able to get my shit if I lose my laptop. Creates the encrypted device and then LVM inside it, for as many partitions as you want.

# cryptsetup -v -y -c aes-xts-plain64 -s 256 -h sha256 -i 2000 --use-urandom luksFormat /dev/sda2
# cryptsetup open /dev/sda2 luks
# pvcreate /dev/mapper/luks
# vgcreate vg0 /dev/mapper/luks
# lvcreate --size 6G vg0 --name root
# lvcreate -l +100%FREE vg0 --name home
# mkfs.ext4 /dev/mapper/vg0-root
# mkfs.ext4 /dev/mapper/vg0-home

Normal Arch Installation

Follow the Arch Linux install guide here, as from now it's mostly the same:

# mount /dev/mapper/vg0-root /mnt
# mkdir /mnt/{boot,home}
# mount /dev/mapper/vg0-home /mnt/home
# mount /dev/sda1 /mnt/boot
# pacstrap /mnt base base-devel vim
# genfstab -U /mnt >> /mnt/etc/fstab
# arch-chroot /mnt
...

Things to note:

• You must edit the mkinitcpio.conf file before generating the initramfs to add support for lvm2
  • Then adjust HOOKS according to the dm-crypt system configuration guide (using either base or systemd variants)
  • probably need to add dm-crypt ext4 to MODULES (?)
• When creating /boot/loader/entries/arch.conf, pay attention to the options for kernel command line
  • If using busybox initramfs (ie, udev in HOOKS): cryptdevice=UUID:vg0 root=/dev/mapper/vg0-root where the UUID is that of the underlying encrypted block device (ie, sda2), not the ext4 partition
  • If using systemd initramfs (ie, systemd in HOOKS): luks.name=0000-0000-0000-0000=vg0 root=/dev/mapper/vg0-root where the UUID is that of the underlying encrypted block device (ie, sda2)

# bootctl --path=/boot install

After Install

# useradd -m aorth
# passwd aorth
# pacman -S xorg-server xf86-video-fbdev
# pacman -S plasma-desktop sddm breeze-gtk konsole