LVM on LUKS Arch installation with systemd-boot
Sources:
- https://wiki.archlinux.org/index.php/Installation_guide
- https://wiki.archlinux.org/index.php/Dm-crypt/Encrypting_an_entire_system
Download Arch Linux. Prepare an installtion medium (A USB drive is used as an example below).
Find out the name of your USB drive with lsblk. Make sure that it is not mounted.
To mount the Arch ISO run the following command, replacing /dev/sdx
with your USB drive, e.g. /dev/sdb
. (do not append a partition number, so do not use something like /dev/sdb1
, you can find it by using lsblk
):
dd bs=4M if=/path/to/archlinux.iso of=/dev/sdx status=progress && sync
Boot from USB drive.
If the current font is unreadable or too small, change it:
setfont sun12x22
Check if you are running in UEFI mode:
ls /sys/firmware/efi/efivars
If no errors are ouputted and the directory exists then the system is booted in UEFI. Otherwise reboot in UEFI.
Check that there is an internet connection:
ping archlinux.org
ip a
On new install:
# set a root password
passwd root
# start ssh
systemctl list-unit-files -t service | grep ssh
systemctl start sshd
Then ssh in with another computer for copy/paste/etc.
After ssh'ing in:
Update the system clock:
timedatectl set-ntp true
Lastly to enable mirrors, edit /etc/pacman.d/mirrorlist
and locate your geographic region. Uncomment mirrors you would like to use. Adjust the list order as well if necessary: The higher a mirror is placed on the list the more priority it has when downloading packages.
Get the name of the disk to format/partition:
lsblk
The name should be something like /dev/nvme0n1
If you need to wipe data before install - shred the disk using the shred tool:
shred -v -n1 /dev/nvme0n1
Now partition the disk:
parted /dev/nvme0n1
2 partitions:
- EFI boot
- Rest for LVM
mklabel gpt
mkpart ESP fat32 1MiB 512MiB
set 1 boot on
name 1 efi
mkpart primary 512MiB 100%
name 2 lvm
print
quit
Once partitioned you can format the boot and swap partition (the LVM partition needs to be encrypted before it gets formatted) crypt
First modprobe for dm-crypt
modprobe dm-crypt
Now, encrypt the disk:
cryptsetup luksFormat /dev/nvme0n1p2
Open the disk with the password set above:
cryptsetup open --type luks /dev/nvme0n1p2 cryptlvm
Check the lvm disk exists:
ls /dev/mapper/cryptlvm
Create a physical volume:
pvcreate /dev/mapper/cryptlvm
Create a volume group:
vgcreate volume /dev/mapper/cryptlvm
Create logical partitions:
lvcreate -L50G volume -n swap # make size the same as amount of RAM
lvcreate -L100G volume -n root
lvcreate -l 100%FREE volume -n home
OR for all root:
lvcreate -L50G volume -n swap
lvcreate -l 100%FREE volume -n root
Format file system on logical partitions:
mkfs.ext4 /dev/volume/root
mkfs.ext4 /dev/volume/home # or leave out if only root
mkswap /dev/volume/swap
Mount the volumes and file systems:
mount /dev/volume/root /mnt
mkdir /mnt/home # leave out if only root partition
mkdir /mnt/boot
mount /dev/volume/home /mnt/home
mount /dev/nvme0n1p1 /mnt/boot
swapon /dev/volume/swap
Install base package, linux, firmware, lvm2 and utilities:
pacstrap /mnt base base-devel linux linux-firmware lvm2 vim git openssh networkmanager
Generate fstab
:
genfstab -U /mnt >> /mnt/etc/fstab
chroot
into system:
arch-chroot /mnt
Set time locale (choose a relevant locale):
ln -sf /usr/share/zoneinfo/America/Denver /etc/localtime
Set clock:
hwclock --systohc
Uncomment en_US.UTF-8 UTF-8
en_US ISO-8859-1
and other needed localizations in /etc/locale.gen
. Now run:
locale-gen
Create locale config file:
locale > /etc/locale.conf
Set the lang variable in the above file:
LANG=en_US.UTF-8
Add an hostname (any hostname of your choice as one line in the file. eg. myhostname
):
vim /etc/hostname
Update /etc/hosts
to contain:
127.0.1.1 myhostname.localdomain myhostname
127.0.0.1 localhost
::1 localhost
Because our filesystem is on LVM we will need to enable the correct mkinitcpio hooks.
Edit the /etc/mkinitcpio.conf
. Look for the HOOKS variable and move keyboard
to before the filesystems
and add encrypt
and lvm2
after keyboard
. Then add resume
after lvm2 and filesystem. Like:
HOOKS="base udev autodetect modconf block keyboard encrypt lvm2 filesystems resume fsck"
Regenerate the initramfs:
mkinitcpio -p linux
Install a bootloader:
bootctl --path=/boot/ install
Create bootloader. Edit /boot/loader/loader.conf
. Replace the file's contents with:
default arch
timeout 3
editor 0
The editor 0
ensures the configuration can't be changed on boot.
Next create a bootloader entry in /boot/loader/entries/arch.conf
title Arch Linux
linux /vmlinuz-linux
initrd /initramfs-linux.img
options cryptdevice=UUID={UUID}:cryptlvm root=/dev/volume/root resume=/dev/volume/swap quiet rw
Replace {UUID}
with the UUID of /dev/nvme0n1
. In order to get the UUID run the following command:
blkid
Or, while stil in vim, run:
:read ! blkid /dev/nnvme0n1
# change the root password
chpass
#Make a user and give access to sudo:
exit chroot
:
exit
unmount everything:
umount -R /mnt
and reboot
reboot