Install encrypted Arch Linux with LVM on EFI
I recently switched to Arch Linux and I am very satisfied with this decision. Enclosed I would like to provide you with a setup summary how to install Arch Linux with the Logical Volume Manager (LVM) and an encrypted home partition.
USB flash installation media
First of all, download the latest arch image from here.
On Linux run the following command, replacing /dev/sdx with your drive, e.g. /dev/sdb. (Do not append a partition number, so do not use something like /dev/sdb1):
dd bs=4M if=/path/to/archlinux.iso of=/dev/sdx status=progress oflag=sync
On Windows use a media creation tool like rufus, USBwriter or win32diskimager. I highly recommend to use rufus as the GUI is quite straight forward. Since Rufus does not care if the drive is properly formatted or not and provides a GUI it may be the easiest and most robust tool to use.
Install Arch Linux
Set your keyboard layout
localectl --no-convert set-keymap de-latin1-nodeadkeysfor german keyboard, or search your keymap usinglocalectl list-keymaps | grep -i search_term. Replacesearch_termwith your language codeUse
wifi-menuto connect to networkVisit https://www.archlinux.org/mirrorlist/ on another computer, generate mirrorlist
Edit /etc/pacman.d/mirrorlist on the Arch computer and paste the faster servers
Update package indexes:
pacman -SyyyCreate the efi partition, 400MB is totaly fine:
fdisk /dev/nvme0n1* g (to create an empty GPT partition table) * n * 1 * enter * +400M * t * 1 (For EFI) * wCreate the boot partition:
fdisk /dev/nvme0n1- n
- 2
- enter
- +500M
- w
Create the LVM partition:
fdisk /dev/nvme0n1* n * 3 * enter * enter * t * 3 * 31 * w
Next, we are going to format our block devices with a file system:
mkfs.fat -F32 /dev/nvme0n1p1mkfs.ext2 /dev/nvme0n1p2Set up encryption
cryptsetup luksFormat /dev/nvme0n1p3cryptsetup open --type luks /dev/nvme0n1p3 lvm
Set up lvm:
pvcreate --dataalignment 1m /dev/mapper/lvmvgcreate tank /dev/mapper/lvmlvcreate -L 50GB tank -n lv_rootlvcreate -L 400GB tank -n lv_homemodprobe dm_modvgscanvgchange -ay
mkfs.ext4 /dev/tank/lv_rootmkfs.xfs /dev/tank/lv_homemount /dev/tank/lv_root /mntmkdir /mnt/bootmkdir /mnt/homemount /dev/nvme0n1p2 /mnt/bootmount /dev/tank/lv_home /mnt/homepacstrap -i /mnt basegenfstab -U -p /mnt >> /mnt/etc/fstabarch-chroot /mntpacman -S base-devel grub efibootmgr dosfstools openssh os-prober mtools linux-headers linux-lts linux-lts-headersEdit
/etc/mkinitcpio.confand addencrypt lvm2in betweenblockandfilesystemsmkinitcpio -p linuxmkinitcpio -p linux-ltsnano /etc/locale.gen(uncomment en_US.UTF-8, or another language of your choice)locale-genpasswd(for setting root password)Edit
/etc/default/grub: addcryptdevice=<PARTUUID>:tankto theGRUB_CMDLINE_LINUX_DEFAULTline If using standard device naming, the option will look like this:cryptdevice=/dev/nvme0n1p3:tankmkdir /boot/EFImount /dev/nvme0n1p1 /boot/EFIgrub-install --target=x86_64-efi --bootloader-id=grub_uefi --recheckcp /usr/share/locale/en\@quot/LC_MESSAGES/grub.mo /boot/grub/locale/en.mogrub-mkconfig -o /boot/grub/grub.cfgCreate swap file (with half the size of your physical ram):
fallocate -l 4G /swapfilechmod 600 /swapfilemkswap /swapfileecho '/swapfile none swap sw 0 0' | tee -a /etc/fstab
Setup timezone
ln -sf /usr/share/zoneinfo/Region/City /etc/localtimeConfigure hardware clock
hwclock --systohcSetup network echo
myhostname> /etc/hostname
cat << EOF > /etc/hosts
127.0.0.1 localhost
::1 localhost
27.0.1.1 myhostname.localdomain myhostname
EOF
- Install networkmanager
pacman -S networkmanager network-manager-applet dialog - Enable dhcp client daemon
systemctl enable dhcpcd.service - Enable networkmanager daemon
systemctl enable NetworkManager.service - Add a dns nameserver, edit
/etc/resolv.confand add a nameserver, for example8.8.8.8 - add a priviliged user
groupadd username
useradd -m -g initial_group -G wheel -s /bin/bash username, replace username with your account name
- Change password of your new account
passwd username
Install sudo and grant users of wheel group the privilige to execute any command
- pacman -S sudo
- edit
etc/sudoersand add/uncomment the line%wheel ALL=(ALL) ALL - (Optional) Install microcode updates,
pacman -S intel-ucodefor intel processors oramd-ucodefor amd processors. More infos here - Update and configure GRUB
grub-mkconfig -o /boot/grub/grub.cfg
Finish installation
exitumount -areboot
Congratulations! As soon as you restart your computer you will see a bootloader screen where you can start Arch. Then you can login with your user data after entering your encryption password.
It makes sense to install additional applications at this point, such as a window manager like I3 or another shell like zsh.
Post Installation
Here are some quick steps to install xorg and i3, as well as zsh as an alternate shell:
Install xorg and i3 window manager
pacman -S xorg-server xorg-init xorg-xrandr- Install video drivers, see here
pacman -S i3- edit
.xinitrcand addexec i3to start i3 viastartx
Install zsh
pacman -S zshchsh -s $(which zsh)