ljfranklin/arch-install.md

## arch-install.md

      
    Raw
  

              arch-install.md
            
          
    Install Arch Linux

Create a bootable Arch Linux USB


Download arch ISO from https://www.archlinux.org/download/
Copy the ISO to the USB drive:

From a Linux machine:

# replace sdX with usb drive listed by `fdisk -l`,
# e.g. `/dev/sdb`, do NOT append a partition number
sudo dd bs=4M if=/path/to/archlinux.iso of=/dev/sdX status=progress && sync


See windows or macOS instructions if you don't have access to a Linux machine.


Disable Secure Boot temporarily

To ensure we can boot off the USB, we're going to disable Secure Boot temporarily.
We'll re-enable it after we create the partitions.

Enter the BIOS, on my machine pressing F2 on boot.
Set "Settings > Secure Boot > Secure Boot Enable" to "Disabled"

Create partitions


Plug in USB drive, reboot, press F12 on boot and select USB drive from Boot list.

You should now see a terminal prompt and be logged in as root


Run wifi-menu to connect to internet

Wait a couple seconds and run ping archlinux.org to verify connectivity


Identify your root disk with fdisk -l, often /dev/sda or /dev/nvme0n1 on my laptop
Optional: Delete existing partitions with wipefs -a /dev/sdX or securely wipe existing data
See the Arch Wiki for a more in-depth guide to encrypting your partitions.
Create EFI, Boot, and System partitions:

parted -s /dev/ROOT_DEVICE \
  mklabel gpt \
  mkpart ESP fat32 1MiB 550MiB \
  set 1 boot on \
  mkpart primary ext4 550MiB 806MiB \
  set 2 lvm on \
  mkpart primary ext4 806MiB 100%


Create encrypted container on system partition: cryptsetup luksFormat /dev/SYSTEM_PARTITION.


Make sure you type YES not yes
You'll be prompted to enter your encryption password


Format system partition: cryptsetup open /dev/SYSTEM_PARTITION system && mkfs.ext4 /dev/mapper/system
Create encrypted container on boot partition: cryptsetup luksFormat /dev/BOOT_PARTITION
Format boot partition: cryptsetup open /dev/BOOT_PARTITION cryptboot && mkfs.ext4 /dev/mapper/cryptboot

Perform initial Arch installation


Install base package group: pacstrap /mnt base base-devel
Mount the partitions:
mount /dev/mapper/system /mnt
mkdir /mnt/boot
mount /dev/mapper/cryptboot /mnt/boot
mkdir /mnt/boot/efi
mount /dev/EFI_PARTITION /mnt/boot/efi


Create swapfile:
fallocate -l 4096 /mnt/swapfile
chmod 600 /mnt/swapfile
mkswap /mnt/swapfile


Generate Filesystem table to ensure partitions are mounted at boot: genfstab -U /mnt >> /mnt/etc/fstab
Add the swap entry: echo -e "\n/swapfile\tnone\tswap\tdefaults\t0 0" >> /mnt/etc/fstab
Change root into /mnt: arch-chroot /mnt
Set your timezone:
ln -sf /usr/share/zoneinfo/REGION/CITY /etc/localtime
# e.g. ln -sf /usr/share/zoneinfo/American/Los_Angeles /etc/localtime


Sync time with hardware clock: hwclock --systohc
Turn on NTP to ensure clock stays in sync: timedatectl set-ntp true
Generate localizations:
# uncomment 'en_US.UTF-8 UTF-8' and other other needed localizations
vi /etc/locale.gen
locale-gen
echo "LANG=en_US.UTF-8" > /etc/locale.conf


Set your hostname: echo YOUR_HOSTNAME > /etc/hostname
Install wireless utilities: pacman -S wpa_supplicant wpa_actiond dialog wget
Set root password: passwd
Create a non-root user:
useradd -m -G wheel -s /bin/bash YOUR_NAME
passwd YOUR_NAME
pacman -S sudo

visudo
# uncomment "%wheel ALL=(ALL) ALL"


If you have an Intel CPU, enable microcode updates: pacman -S intel-ucode
Install GRUB bootloader:
pacman -S grub efibootmgr


Configure GRUB to unlock encrypted root filesystem on boot:
# get UUID for **root** partition (should say TYPE="crypto_LUKS")
blkid
# update grub config
vi /etc/default/grub
# add 'cryptdevice=UUID=<device-UUID>:lvm' to the 'GRUB_CMDLINE_LINUX' option list
# uncomment 'GRUB_ENABLE_CRYPTODISK=y'

# create keyfile to unlock root partition on boot (avoids a second password prompt)
# the `/crypto_keyfile.bin` can be changed with the `cryptkey` GRUB option
dd bs=512 count=4 if=/dev/urandom of=/crypto_keyfile.bin
chmod 000 /crypto_keyfile.bin
chmod 600 /boot/initramfs-linux* # ensure non-root users can't read keyfile
cryptsetup luksAddKey /dev/ROOT_PARTITION /crypto_keyfile.bin

vi /etc/mkinitcpio.conf
# Replace 'FILES=()' with 'FILES=(/crypto_keyfile.bin)'
# Add additional hooks to existing hooks array: 'HOOKS=(... keyboard keymap encrypt lvm2)'

# regenerate initramfs
mkinitcpio -p linux


Note: this setup prompts for a password at boot to unlock the encrypted root partition.
Follow these directions to use a keyfile from a USB instead.


Install GRUB:
grub-mkconfig -o /boot/grub/grub.cfg
grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=grub --recheck


Configure crypttab and fstab to unlock /boot and /boot/efi at boot:
# create randomtext keyfile
dd bs=512 count=4 if=/dev/urandom of=/etc/boot-keyfile
chmod 600 /etc/boot-keyfile
cryptsetup luksAddKey /dev/BOOT_PARTITION /etc/boot-keyfile
# get UUID for **boot** partition (should say TYPE="crypto_LUKS")
blkid
echo -e "\ncryptboot\tUUID=<device-UUID>\t/etc/boot-keyfile" >> /etc/crypttab


Note: Once the root filesystem is unlocked, the keyfile will be viewable in plain text if you have root access.
Follow these directions for a more secure two-factor unlock method.


Exit from chroot and reboot. You can now remove the USB drive.
On boot, you should now be prompted to enter your encryption password to proceed.
If successful, you should now see the GRUB menu. Select "Arch Linux" and hit enter.
You should then see a login prompt. Enter root and the password you created in the previous passwd step.
reboot again, we're going to go a step farther and encrypt our bootloader as well.
Press F2 to go into BIOS setup:

Set an Admin Password so someone can't just turn Secure Boot back off without a password


Note: you or an attacker can still reset the BIOS password and boot settings by opening the case and messing with some jumpers


Re-enable Secure Boot
Delete all pre-loaded keys, "Settings > Secure Boot > Expert Key Management > Enable Custom Mode + Delete All Keys" on my Dell XPS


We'll generate new keys in a subsequent step


Exit BIOS, boot back into Arch as non-root user
Download and install cryptboot utility
# TODO: change this back after PR is merged
# wget -O cryptboot.tgz https://github.com/xmikos/cryptboot/archive/v1.1.0.tar.gz
wget -O cryptboot.tgz https://github.com/ljfranklin/cryptboot/archive/master.tar.gz
tar xvf cryptboot.tgz
cd ./cryptboot-*
sudo pacman -S efitools sbsigntools
sudo install -Dm755 cryptboot /usr/bin/cryptboot
sudo install -Dm755 cryptboot-efikeys /usr/bin/cryptboot-efikeys
sudo install -Dm755 cryptboot-grub-warning /etc/cryptboot-grub-warning
sudo install -Dm644 cryptboot.conf /etc/cryptboot.conf


Generate and install new UEFI Secure Boot keys:
sudo su root
cryptboot-efikeys create # enter any cosmetic ID when prompted for Common Name
cryptboot-efikeys enroll
cryptboot update-grub
ln -s /etc/cryptboot-grub-warning /usr/local/bin/grub-install

Important!!!: Going forward use cryptboot update-grub rather than grub-install.
Failure to run cryptboot to re-sign your bootloader will cause subsequent Secure Boots to fail.
reboot, login, and verify Secure Boot is shown as "enabled":
bootctl status 2> /dev/null | grep "Secure Boot"


Congrats! The current environment is not much to look at right now, but next we'll install a shiny graphical environment and a tiling window manager. Deeper down the Arch Linux rabbit hole we go...

TODO


Add instructions about reformatting root partition, but keeping boot partitions
How much of this can be scripted?