Install encrypted Arch Linux with LVM on EFI
I recently switched to Arch Linux and I am very satisfied with this decision. Enclosed I would like to provide you with a setup summary how to install Arch Linux with the Logical Volume Manager (LVM) and an encrypted home partition.
USB flash installation media
First of all, download the latest arch image from here.
On Linux run the following command, replacing /dev/sdx with your drive, e.g. /dev/sdb. (Do not append a partition number, so do not use something like /dev/sdb1):
dd bs=4M if=/path/to/archlinux.iso of=/dev/sdx status=progress oflag=sync
On Windows use a media creation tool like rufus, USBwriter or win32diskimager. I highly recommend to use rufus as the GUI is quite straight forward. Since Rufus does not care if the drive is properly formatted or not and provides a GUI it may be the easiest and most robust tool to use.
Install Arch Linux
Set your keyboard layout
localectl --no-convert set-keymap de-latin1-nodeadkeys
for german keyboard, or search your keymap usinglocalectl list-keymaps | grep -i search_term
. Replacesearch_term
with your language codeUse
wifi-menu
to connect to networkVisit https://www.archlinux.org/mirrorlist/ on another computer, generate mirrorlist
Edit /etc/pacman.d/mirrorlist on the Arch computer and paste the faster servers
Update package indexes:
pacman -Syyy
Create the efi partition, 400MB is totaly fine:
fdisk /dev/nvme0n1
* g (to create an empty GPT partition table) * n * 1 * enter * +400M * t * 1 (For EFI) * w
Create the boot partition:
fdisk /dev/nvme0n1
- n
- 2
- enter
- +500M
- w
Create the LVM partition:
fdisk /dev/nvme0n1
* n * 3 * enter * enter * t * 3 * 31 * w
Next, we are going to format our block devices with a file system:
mkfs.fat -F32 /dev/nvme0n1p1
mkfs.ext2 /dev/nvme0n1p2
Set up encryption
cryptsetup luksFormat /dev/nvme0n1p3
cryptsetup open --type luks /dev/nvme0n1p3 lvm
Set up lvm:
pvcreate --dataalignment 1m /dev/mapper/lvm
vgcreate tank /dev/mapper/lvm
lvcreate -L 50GB tank -n lv_root
lvcreate -L 400GB tank -n lv_home
modprobe dm_mod
vgscan
vgchange -ay
mkfs.ext4 /dev/tank/lv_root
mkfs.xfs /dev/tank/lv_home
mount /dev/tank/lv_root /mnt
mkdir /mnt/boot
mkdir /mnt/home
mount /dev/nvme0n1p2 /mnt/boot
mount /dev/tank/lv_home /mnt/home
pacstrap -i /mnt base
genfstab -U -p /mnt >> /mnt/etc/fstab
arch-chroot /mnt
pacman -S base-devel grub efibootmgr dosfstools openssh os-prober mtools linux-headers linux-lts linux-lts-headers
Edit
/etc/mkinitcpio.conf
and addencrypt lvm2
in betweenblock
andfilesystems
mkinitcpio -p linux
mkinitcpio -p linux-lts
nano /etc/locale.gen
(uncomment en_US.UTF-8, or another language of your choice)locale-gen
passwd
(for setting root password)Edit
/etc/default/grub
: addcryptdevice=<PARTUUID>:tank
to theGRUB_CMDLINE_LINUX_DEFAULT
line If using standard device naming, the option will look like this:cryptdevice=/dev/nvme0n1p3:tank
mkdir /boot/EFI
mount /dev/nvme0n1p1 /boot/EFI
grub-install --target=x86_64-efi --bootloader-id=grub_uefi --recheck
cp /usr/share/locale/en\@quot/LC_MESSAGES/grub.mo /boot/grub/locale/en.mo
grub-mkconfig -o /boot/grub/grub.cfg
Create swap file (with half the size of your physical ram):
fallocate -l 4G /swapfile
chmod 600 /swapfile
mkswap /swapfile
echo '/swapfile none swap sw 0 0' | tee -a /etc/fstab
Setup timezone
ln -sf /usr/share/zoneinfo/Region/City /etc/localtime
Configure hardware clock
hwclock --systohc
Setup network echo
myhostname
> /etc/hostname
cat << EOF > /etc/hosts
127.0.0.1 localhost
::1 localhost
27.0.1.1 myhostname.localdomain myhostname
EOF
- Install networkmanager
pacman -S networkmanager network-manager-applet dialog
- Enable dhcp client daemon
systemctl enable dhcpcd.service
- Enable networkmanager daemon
systemctl enable NetworkManager.service
- Add a dns nameserver, edit
/etc/resolv.conf
and add a nameserver, for example8.8.8.8
- add a priviliged user
groupadd username
useradd -m -g initial_group -G wheel -s /bin/bash username
, replace username with your account name
- Change password of your new account
passwd username
Install sudo
and grant users of wheel
group the privilige to execute any command
- pacman -S sudo
- edit
etc/sudoers
and add/uncomment the line%wheel ALL=(ALL) ALL
- (Optional) Install microcode updates,
pacman -S intel-ucode
for intel processors oramd-ucode
for amd processors. More infos here - Update and configure GRUB
grub-mkconfig -o /boot/grub/grub.cfg
Finish installation
exit
umount -a
reboot
Congratulations! As soon as you restart your computer you will see a bootloader screen where you can start Arch. Then you can login with your user data after entering your encryption password.
It makes sense to install additional applications at this point, such as a window manager like I3 or another shell like zsh.
Post Installation
Here are some quick steps to install xorg and i3, as well as zsh as an alternate shell:
Install xorg and i3 window manager
pacman -S xorg-server xorg-init xorg-xrandr
- Install video drivers, see here
pacman -S i3
- edit
.xinitrc
and addexec i3
to start i3 viastartx
Install zsh
pacman -S zsh
chsh -s $(which zsh)