LVM on LUKS Arch installation with systemd-boot

arch_linux_installation.md

Arch Linux Installation

LVM on LUKS Arch installation with systemd-boot

Sources:

• https://wiki.archlinux.org/index.php/Installation_guide
• https://wiki.archlinux.org/index.php/Dm-crypt/Encrypting_an_entire_system

USB

Download Arch Linux. Prepare an installtion medium (A USB drive is used as an example below).

Find out the name of your USB drive with lsblk. Make sure that it is not mounted.

To mount the Arch ISO run the following command, replacing /dev/sdx with your drive, e.g. /dev/sdb. (do not append a partition number, so do not use something like /dev/sdb1):

dd bs=4M if=/path/to/archlinux.iso of=/dev/sdx status=progress && sync

Preparation

Boot from USB drive.

If the current font is unreadable or too small, change it:

setfont sun12x22

Check if you are running in UEFI mode:

ls /sys/firmware/efi/efivars

If no errors are ouputted and the directory exists then the system is booted in UEFI. Otherwise reboot in UEFI.

Check that there is an internet connection:

ping archlinux.org

Update the system clock:

timedatectl set-ntp true

Lastly to enable mirrors, edit /etc/pacman.d/mirrorlist and locate your geographic region. Uncomment mirrors you would like to use. Adjust the list order as well if necessary: The higher a mirror is placed on the list the more priority it has when downloading packages.

Partitioning

Get the name of the disk to format/partition:

lsblk

The name should be something like /dev/sda

First shred the disk using the shred tool:

shred -v -n1 /dev/sdX

Now partition the disk using gdisk:

gdisk /dev/sda

Partition 1 should be an EFI boot partition (code: ef00) of 512MB. Partition 2 should be a Linux LVM partition (8e00). The 2nd partition can take up the full disk or only a part of it. Remember to write the partition table changes to the disk on configuration completion.

Once partitioned you can format the boot partition (the LVM partition needs to be encrypted before it gets formatted)

mkfs.fat -F32 /dev/sda1

Encryption

First modprobe for dm-crypt

modprobe dm-crypt

Now, encrypt the disk:

cryptsetup luksFormat /dev/sda2

Open the disk with the password set above:

cryptsetup open --type luks /dev/sda2 cryptlvm

Check the lvm disk exists:

ls /dev/mapper/cryptlvm

Create a physical volume:

pvcreate /dev/mapper/cryptlvm

Create a volume group:

vgcreate volume /dev/mapper/cryptlvm

Create logical partitions:

lvcreate -L20G volume -n swap
lvcreate -L40G volume -n root
lvcreate -l 100%FREE volume -n home

Format file system on logical partitions:

mkfs.ext4 /dev/volume/root
mkfs.ext4 /dev/volume/home
mkswap /dev/volume/swap

Mount the volumes and file systems:

mount /dev/volume/root /mnt
mkdir /mnt/home
mkdir /mnt/boot
mount /dev/volume/home /mnt/home
mount /dev/sda1 /mnt/boot
swapon /dev/volume/swap

Installation

Install base package, linux, firmware, lvm2 and utilities:

pacstrap /mnt base base-devel linux linux-fimware lvm2 vim

Generate fstab:

genfstab -U /mnt >> /mnt/etc/fstab

chroot into system:

arch-chroot /mnt

Set time locale (choose a relevant locale):

ln -sf /usr/share/zoneinfo/Africa/Johannesburg /etc/localtime

Set clock:

hwclock --systohc

Uncomment en_US.UTF-8 UTF-8 en_US ISO-8859-1 and other needed localizations in /etc/locale.gen. Now run:

locale-gen

Create locale config file:

locale > /etc/locale.conf

Set the lang variable in the above file:

LANG=en_US.UTF-8

Add an hostname (any hostname of your choice as one line in the file. eg. myhostname):

vim /etc/hostname

Update /etc/hosts to contain:

127.0.1.1   myhostname.localdomain  myhostname

Because our filesystem is on LVM we will need to enable the correct mkinitcpio hooks.

Edit the /etc/mkinitcpio.conf. Look for the HOOKS variable and move keyboard to before the filesystems and add encrypt and lvm2 after keyboard. Like:

HOOKS="base udev autodetect modconf block keyboard encrypt lvm2 filesystems fsck"

Regenerate the initramfs:

mkinitcpio -p linux

Install a bootloader:

bootctl --path=/boot/ install

Create bootloader. Edit /boot/loader/loader.conf. Replace the file's contents with:

default arch
timeout 3
editor 0

The editor 0 ensures the configuration can't be changed on boot.

Next create a bootloader entry in /boot/loader/entries/arch.conf

title Arch Linux
linux /vmlinuz-linux
initrd /initramfs-linux.img
options cryptdevice=UUID={UUID}:cryptlvm root=/dev/volume/root quiet rw

Replace {UUID} with the UUID of /dev/sda2. In order to get the UUID run the following command:

blkid

Or, while stil in vim, run:

:read ! blkid /dev/sda2

Complete

exit chroot:

exit

unmount everything:

umount -R /mnt

and reboot

reboot