Compare commits
10 commits
077aec5d56
...
5920fb3b2e
| Author | SHA1 | Date | |
|---|---|---|---|
|
5920fb3b2e | ||
|
|
83c1403e91 | ||
|
|
f32097bc53 | ||
|
|
97455800f4 | ||
|
|
8e8d57a1f2 | ||
|
|
2eb3d0c374 | ||
|
|
a901659584 | ||
|
|
36c057967b | ||
|
|
b31ef40510 | ||
|
|
b76d7cac69 |
1 changed files with 455 additions and 235 deletions
690
README.md
690
README.md
|
|
@ -1,260 +1,480 @@
|
||||||
# Install Arch Linux with encrypted filesystem(optional) and on btrfs partition (UEFI)
|
# ArchLinux install encrypted btrfs
|
||||||
Official guide for basic install: [https://wiki.archlinux.org/index.php/Installation_Guide](https://wiki.archlinux.org/index.php/Installation_Guide)
|
|
||||||
|
# Install Arch Linux on EFI system with full filesystem (including /boot) encrypted and on btrfs partition
|
||||||
|
|
||||||
|
Official guide for basic install: [https://wiki.archlinux.org/index.php/Installation\_Guide](https://wiki.archlinux.org/index.php/Installation_Guide)
|
||||||
it is always good to consult with official guide, cause arch config might change in time
|
it is always good to consult with official guide, cause arch config might change in time
|
||||||
For setting up different locale than pl check official guide
|
For setting up different locale, or better explanations check out Arch Wiki
|
||||||
|
|
||||||
# 1. Boot ISO
|
|
||||||
### Download the ISO file from [https://www.archlinux.org](https://www.archlinux.org/)
|
|
||||||
### Put on pedrive
|
|
||||||
>dd if=archlinux.img of=/dev/sdX bs=16M && sync
|
|
||||||
|
|
||||||
### Boot from the usb.
|
|
||||||
|
|
||||||
### Set keymap
|
|
||||||
>loadkeys pl
|
|
||||||
|
|
||||||
### Update clock
|
|
||||||
>timedatectl set-ntp true
|
|
||||||
|
|
||||||
### Optionally (recommended) update mirrorlist
|
|
||||||
>reflector --country 'Poland' --age 24 --verbose --sort rate --save /etc/pacman.d/mirrorlist
|
|
||||||
|
|
||||||
# 2. Prepare Disk
|
|
||||||
|
|
||||||
### Update btrfs-progs
|
## 1. Boot ISO
|
||||||
>pacman -Syy btrfs-progs
|
|
||||||
|
|
||||||
### Display disks setup
|
|
||||||
>fdisk -l
|
|
||||||
|
|
||||||
### Create partitions (if you have not already)
|
|
||||||
>fdisk /dev/sdX
|
|
||||||
1. 100MB EFI partition
|
|
||||||
2. 100% size partiton # ( encrypted optionally) for BTRFS, this partition will require formatting AFTER encryption if you do encryption
|
|
||||||
### Swap will be as file in its own subvolume
|
|
||||||
|
|
||||||
>mkfs.vfat -F32 /dev/sdX1
|
|
||||||
|
|
||||||
### ----------------- encryption (optional) ------------------
|
|
||||||
|
|
||||||
### Setup the encryption of the system, don't use letters outside en-us keyboard like ąęć etc. for password
|
|
||||||
### Grub have partial support for luks2 now, but can handle only pbkdf2
|
|
||||||
>cryptsetup -c=aes-xts-plain64 --key-size=512 --hash=sha512 --iter-time=3000 --pbkdf=pbkdf2 --use-random luksFormat --type=luks2 /dev/sdX2
|
|
||||||
|
|
||||||
>cryptsetup luksOpen /dev/sdX2 MainPart
|
#### Download the ISO file from [https://www.archlinux.org](https://www.archlinux.org/)
|
||||||
|
|
||||||
### Formatting as btrfs now when it is already encrypted
|
|
||||||
>mkfs.btrfs -L "Arch Linux" /dev/mapper/MainPart
|
|
||||||
|
|
||||||
|
|
||||||
### ---------------- end of encryption ------------------------
|
|
||||||
|
|
||||||
### Format the partition if not yet formatted:
|
|
||||||
>pacman -Syy btrfs-progs
|
|
||||||
|
|
||||||
>mkfs.btrfs -L "Arch Linux" /dev/sdX2
|
#### Put on pendrive
|
||||||
|
|
||||||
### Mount partition to be able to create btrfs subvolumes
|
|
||||||
### If using encryption, change /dev/sdX2 to /dev/mapper/MainPart:
|
|
||||||
>mount /dev/sdX2 /mnt
|
|
||||||
|
|
||||||
## Create subvolumes
|
|
||||||
### Using more complicated sheme, (but there actually is only need for separate @swap subvolume , other files can be on default top subvolume)
|
|
||||||
|
|
||||||
>btrfs su cr /mnt/@
|
|
||||||
|
|
||||||
>btrfs su cr /mnt/@swap
|
```bash
|
||||||
|
dd if=archlinux.img of=/dev/sdX bs=16M && sync
|
||||||
|
```
|
||||||
|
|
||||||
>btrfs su cr /mnt/@home
|
#### Boot from the USB.
|
||||||
|
|
||||||
>btrfs su cr /mnt/@var
|
#### Optional (**experimental** approach to have desktop environment during install):
|
||||||
|
|
||||||
>btrfs su cr /mnt/@tmp
|
##### Extend writable space so you can install basic desktop in live environment and for example use gparted for partitioning or open this tutorial in web browser or whatever you want.
|
||||||
|
|
||||||
>btrfs su cr /mnt/@snapshots
|
<p class="callout warning">Remember this area is saved in your RAM, so make sure you have enough of it</p>
|
||||||
|
|
||||||
#### disable copy on write on var, tmp and swap
|
```
|
||||||
>chattr +C /mnt/@var
|
mount -o remount,size=5G /run/archiso/cowspace
|
||||||
>chattr +C /mnt/@tmp
|
|
||||||
>chattr +C /mnt/@swap
|
|
||||||
|
|
||||||
>umount /mnt
|
pacman -Syy plasma-desktop glibc konsole xorg
|
||||||
|
pacman -Scc
|
||||||
### If using encryption, change /dev/sdX2 to /dev/mapper/MainPart:
|
|
||||||
>mount -o defaults,noatime,discard,ssd,subvol=@ /dev/sdX2 /mnt
|
|
||||||
|
|
||||||
>mkdir /mnt/swap
|
|
||||||
|
|
||||||
>mkdir /mnt/home
|
startplasma-wayland
|
||||||
|
```
|
||||||
|
|
||||||
>mkdir /mnt/var
|
#### Set key map
|
||||||
|
|
||||||
>mkdir /mnt/tmp
|
```bash
|
||||||
|
loadkeys pl
|
||||||
|
```
|
||||||
|
|
||||||
>mkdir /mnt/snapshots
|
#### Update clock
|
||||||
|
|
||||||
>mkdir /mnt/efi # for EFI partition /dev/sdX1
|
```bash
|
||||||
|
timedatectl set-ntp true
|
||||||
### If using encryption, change /dev/sdX2 to /dev/mapper/MainPart
|
```
|
||||||
### for swap subvolume add nodatacow option to disable CoW (works only if its separate partition)
|
|
||||||
### Discard ssd and noatime are for ssd disks only
|
|
||||||
|
|
||||||
>mount -o defaults,noatime,nodatacow,discard,ssd,subvol=@swap /dev/sdX2 /mnt/swap
|
|
||||||
|
|
||||||
>mount -o defaults,noatime,discard,ssd,subvol=@home /dev/sdX2 /mnt/home
|
#### Optionally (recommended) update mirrorlist
|
||||||
|
|
||||||
>mount -o defaults,noatime,discard,ssd,subvol=@var /dev/sdX2 /mnt/var
|
```bash
|
||||||
|
reflector --country 'Poland' --age 24 --verbose --sort rate --save /etc/pacman.d/mirrorlist
|
||||||
|
```
|
||||||
|
|
||||||
>mount -o defaults,noatime,discard,ssd,subvol=@tmp /dev/sdX2 /mnt/tmp
|
## 2. Prepare Disk
|
||||||
|
|
||||||
>mount -o defaults,noatime,discard,ssd,subvol=@snapshots /dev/sdX2 /mnt/snapshots
|
#### Update btrfs-progs
|
||||||
|
|
||||||
>mount /dev/sdX1 /mnt/efi
|
```bash
|
||||||
|
pacman -Syy btrfs-progs
|
||||||
|
```
|
||||||
# 3. Install Arch Linux
|
|
||||||
|
|
||||||
### Select the mirror to be used if not updated with reflector on start
|
|
||||||
>nano /etc/pacman.d/mirrorlist
|
|
||||||
|
|
||||||
### This command can be customized with additional packages
|
|
||||||
>pacstrap /mnt/ base base-devel git btrfs-progs efibootmgr linux linux-headers linux-firmware mkinitcpio dhcpcd bash-completion sudo
|
|
||||||
|
|
||||||
### Use genfstab with -U parameter if no encryption
|
|
||||||
>genfstab /mnt >> /mnt/etc/fstab
|
|
||||||
|
|
||||||
### If using swapfile check if nodatacow is added for @swap
|
|
||||||
>nano /mnt/etc/fstab
|
|
||||||
|
|
||||||
|
|
||||||
|
#### Display disks and partitions
|
||||||
# 4. Configure the system
|
|
||||||
|
|
||||||
### Switch to installed system root user
|
|
||||||
>arch-chroot /mnt /bin/bash
|
|
||||||
|
|
||||||
### Nano can be usefull when editing config files
|
|
||||||
>pacman -Syy nano
|
|
||||||
|
|
||||||
### Setup system clock
|
|
||||||
>ln -s /usr/share/zoneinfo/Europe/Warsaw /etc/localtime
|
|
||||||
|
|
||||||
>hwclock --systohc --utc
|
```bash
|
||||||
|
lsblk
|
||||||
### Set the hostname
|
```
|
||||||
>/etc/hostname
|
|
||||||
>>myhostname
|
|
||||||
|
|
||||||
### Edit vconsole
|
|
||||||
>/etc/vconsole.conf
|
|
||||||
>>KEYMAP=pl
|
|
||||||
>>FONT=Lat2-Terminus16.psfu.gz
|
|
||||||
>>FONT_MAP=8859-2
|
|
||||||
|
|
||||||
### Setup locale
|
|
||||||
### Uncomment pl_PL.UTF-8 in /etc/locale.gen and then:
|
|
||||||
>locale-gen
|
|
||||||
|
|
||||||
### Update locale
|
|
||||||
>/etc/locale.conf
|
|
||||||
>>LANG=pl_PL.UTF-8
|
|
||||||
>>LC_ALL=pl_PL.UTF-8
|
|
||||||
|
|
||||||
### Hosts
|
|
||||||
>/etc/hosts
|
|
||||||
>>127.0.0.1 localhost
|
|
||||||
>>::1 localhost
|
|
||||||
>>127.0.1.1 myhostname.localdomain myhostname
|
|
||||||
|
|
||||||
### Now create 4GiB swap file. nodatacow is already on @swap but if you follow exactly then @swap is on same partition as other subvolumes and nodatacow will not work for whole subvolume so you need to disavle CoW manualy :
|
|
||||||
>touch /swap/swapfile
|
|
||||||
### Check if C attribute is enabled with
|
|
||||||
>lsattr /swap/swapfile'
|
|
||||||
|
|
||||||
### If not then disable COW for swapfile manually:
|
#### Create partitions (if you have not already)
|
||||||
>chattr +C /swap/swapfile
|
|
||||||
|
|
||||||
### Expanding empty file to 4GiB swap file
|
|
||||||
>dd if=/dev/zero of=/swap/swapfile bs=1024K count=4096
|
|
||||||
|
|
||||||
>chmod 600 /swap/swapfile
|
|
||||||
|
|
||||||
### Format the swap file.
|
|
||||||
>mkswap /swap/swapfile
|
|
||||||
|
|
||||||
### Turn swap file on.
|
|
||||||
>swapon /swap/swapfile
|
|
||||||
|
|
||||||
### You also need to update /etc/fstab to mount swapfile on boot:
|
|
||||||
>/etc/fstab
|
|
||||||
>>/swap/swapfile none swap sw 0 0
|
|
||||||
|
|
||||||
### Set password for root
|
|
||||||
>passwd
|
|
||||||
### Add real user
|
|
||||||
>useradd -m MYUSERNAME
|
|
||||||
|
|
||||||
>passwd MYUSERNAME
|
```bash
|
||||||
|
fdisk /dev/sdX
|
||||||
### Configure mkinitcpio with modules needed for the initrd image
|
```
|
||||||
>nano /etc/mkinitcpio.conf
|
|
||||||
### Remove 'fsck' and add 'keyboard', 'keymap', 'encrypt' and 'btrfs' to HOOKS before filesystems
|
1. 100MB EFI partition
|
||||||
### If no encryption then only remove fsck and add on that place btrfs
|
2. 100% size partiton # ( encrypted optionally) for BTRFS partition, this partition will require formatting AFTER encryption if you do encryption
|
||||||
>HOOKS=(... keyboard keymap block encrypt btrfs ... filesystems ...)
|
|
||||||
|
##### Swap will bin in file with CoW disabled, which will be prepared later
|
||||||
###### optionally add BINARIES=(/usr/bin/btrfs) for rescue?
|
|
||||||
|
#### Format EFI partition
|
||||||
### Regenerate initrd images
|
|
||||||
>mkinitcpio -P
|
```Bash
|
||||||
|
mkfs.vfat -F32 /dev/sdX1
|
||||||
# 5. Install bootloader
|
```
|
||||||
|
|
||||||
### Setup grub (UEFI)
|
##### ----------------- encryption (optional) ------------------
|
||||||
>pacman -S grub efibootmgr os-prober dosfstools mtools
|
|
||||||
|
|
||||||
|
#### Setup the encryption of the system,
|
||||||
### -------------encryption only---------------------
|
|
||||||
>nano /etc/default/grub
|
<p class="callout info">Don't use regional letters (not in en-us keyboard) like ąęć etc. for password. This requires additional steps, which are not covered by this tutorial.</p>
|
||||||
>>GRUB_ENABLE_CRYPTODISK=y
|
|
||||||
### Find UUID (PARTUUID for /dev/sdX2) of crypto partition so we can add it to grub config
|
#### Grub have some kind of support for luks2, but not entirely, so for more fail-safe setup use luks1
|
||||||
>blkid
|
|
||||||
### Now set this line including proper UUID in place of "\<device-UUID>":
|
```bash
|
||||||
####(temporarly you cen use /dev/sdX2 in place of UUID and change it later easy in gui mode)
|
cryptsetup -c=aes-xts-plain64 --key-size=512 --hash=sha512 --iter-time=3000 --pbkdf=pbkdf2 --use-random luksFormat --type=luks1 /dev/sdX2
|
||||||
>/etc/default/grub
|
|
||||||
>>GRUB_CMDLINE_LINUX="cryptdevice=UUID=\<device-UUID>:MainPart:allow-discards
|
cryptsetup luksOpen /dev/sdX2 MainPart
|
||||||
### allow-discards is only for ssd
|
```
|
||||||
|
|
||||||
### Generate key so grub don't ask twice for password on boot
|
### Formatting as btrfs now when it is already encrypted
|
||||||
>dd bs=512 count=4 if=/dev/random of=/crypto_keyfile.bin iflag=fullblock
|
|
||||||
>chmod 600 /crypto_keyfile.bin
|
```bash
|
||||||
>chmod 600 /boot/initramfs-linux*
|
mkfs.btrfs -L "Arch Linux" /dev/mapper/MainPart
|
||||||
>cryptsetup luksAddKey /dev/sdX2 /crypto_keyfile.bin
|
```
|
||||||
### If you change name of key file there is need to add kernel parameter like cryptkey=rootfs:path
|
|
||||||
### Crypto_keyfile.bin is the default name that kernel will guess anyway
|
##### ---------------- end of encryption ------------------------
|
||||||
### Now add this file to mkinitcpio.conf
|
|
||||||
>/etc/mkinitcpio.conf
|
#### Format the partition if not yet formatted:
|
||||||
>>FILES=(/crypto_keyfile.bin)
|
|
||||||
|
```bash
|
||||||
>mkinitcpio -P
|
pacman -Syy btrfs-progs
|
||||||
### -------------encryption end---------------------
|
|
||||||
|
mkfs.btrfs -L "Arch Linux" /dev/sdX2
|
||||||
### Install
|
```
|
||||||
>grub-install --target=x86_64-efi --efi-directory=/efi --bootloader-id=GRUB
|
|
||||||
>grub-mkconfig -o /boot/grub/grub.cfg
|
#### Mount partition to be able to create btrfs subvolumes
|
||||||
|
|
||||||
### Exit new system
|
##### If using encryption, change **/dev/sdX2** to **/dev/mapper/MainPart**:
|
||||||
>exit
|
|
||||||
|
```bash
|
||||||
### Unmount all partitions
|
mount /dev/sdX2 /mnt
|
||||||
>swapoff -a
|
```
|
||||||
>umount -R /mnt
|
|
||||||
|
#### Create subvolumes
|
||||||
### Reboot into the new system, don't forget to remove the CD/pendrive
|
|
||||||
>reboot
|
##### This scheme can be adjusted to your needs, I'd suggest at least one subvolume for root (@) and one for snapshots (@snapshots). varlog and tmp are created to easily disable Copy on Write on` /var/log` and `/tmp`.
|
||||||
### or
|
|
||||||
>shutdown now
|
```bash
|
||||||
|
btrfs su cr /mnt/@
|
||||||
## Addtitional tips
|
|
||||||
### To get proper locale and keymap, check:
|
btrfs su cr /mnt/@home
|
||||||
>localectl status
|
|
||||||
### On KDE plasma , also set settings > ... > keyboard layout && regional settings
|
btrfs su cr /mnt/@varlog
|
||||||
|
|
||||||
|
btrfs su cr /mnt/@tmp
|
||||||
|
|
||||||
|
btrfs su cr /mnt/@snapshots
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
##### Disable copy on write on `/var/log` and `/tmp`
|
||||||
|
|
||||||
|
```bash
|
||||||
|
chattr +C /mnt/@varlog
|
||||||
|
chattr +C /mnt/@tmp
|
||||||
|
umount /mnt
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
#### If using encryption, change **/dev/sdX2** to **/dev/mapper/MainPart**:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
mount -o defaults,noatime,discard,ssd,subvol=@ /dev/sdX2 /mnt
|
||||||
|
|
||||||
|
mkdir /mnt/home
|
||||||
|
|
||||||
|
mkdir -p /mnt/var/log
|
||||||
|
|
||||||
|
mkdir /mnt/tmp
|
||||||
|
|
||||||
|
mkdir /mnt/snapshots
|
||||||
|
|
||||||
|
mkdir /mnt/efi # for EFI partition /dev/sdX1
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Discard and ssd options and are for ssd disks only
|
||||||
|
|
||||||
|
#### If using encryption, change **/dev/sdX2** to **/dev/mapper/MainPart**
|
||||||
|
|
||||||
|
```bash
|
||||||
|
mount -o defaults,noatime,discard,ssd,subvol=@home /dev/sdX2 /mnt/home
|
||||||
|
|
||||||
|
mount -o defaults,noatime,discard,ssd,subvol=@varlog /dev/sdX2 /mnt/var/log
|
||||||
|
|
||||||
|
mount -o defaults,noatime,discard,ssd,subvol=@tmp /dev/sdX2 /mnt/tmp
|
||||||
|
|
||||||
|
mount -o defaults,noatime,discard,ssd,subvol=@snapshots /dev/sdX2 /mnt/snapshots
|
||||||
|
|
||||||
|
mount /dev/sdX1 /mnt/efi
|
||||||
|
```
|
||||||
|
|
||||||
|
# 3. Install Arch Linux
|
||||||
|
|
||||||
|
#### Select the mirror to be used if not updated with reflector on start
|
||||||
|
|
||||||
|
```bash
|
||||||
|
vim /etc/pacman.d/mirrorlist
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Install base system:
|
||||||
|
|
||||||
|
##### This command can be customized with additional packages (**btrfs-progs is necessary to let the system boot up from btrfs partition !**)
|
||||||
|
|
||||||
|
```bash
|
||||||
|
pacstrap /mnt/ base base-devel git btrfs-progs efibootmgr linux linux-headers linux-firmware mkinitcpio dhcpcd bash-completion sudo
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Generate fstab:
|
||||||
|
|
||||||
|
##### Use genfstab with -U parameter if no encryption
|
||||||
|
|
||||||
|
```bash
|
||||||
|
genfstab /mnt >> /mnt/etc/fstab
|
||||||
|
```
|
||||||
|
|
||||||
|
####
|
||||||
|
|
||||||
|
# 4. Configure the system
|
||||||
|
|
||||||
|
#### Switch to installed system root user
|
||||||
|
|
||||||
|
```bash
|
||||||
|
arch-chroot /mnt /bin/bash
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Setup system clock
|
||||||
|
|
||||||
|
```bash
|
||||||
|
ln -s /usr/share/zoneinfo/Europe/Warsaw /etc/localtime
|
||||||
|
|
||||||
|
hwclock --systohc --utc
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Set the hostname in `/etc/hostname`
|
||||||
|
|
||||||
|
```test
|
||||||
|
myhostname
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Edit vconsole in `/etc/vconsole.conf`
|
||||||
|
|
||||||
|
```text
|
||||||
|
KEYMAP=pl
|
||||||
|
FONT=Lat2-Terminus16.psfu.gz
|
||||||
|
FONT_MAP=8859-2
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Setup locale
|
||||||
|
|
||||||
|
##### Uncomment pl\_PL.UTF-8 in /etc/locale.gen and then run:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
locale-gen
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Update locale in `etc/locale.conf`
|
||||||
|
|
||||||
|
```text
|
||||||
|
LANG=en_US.UTF-8
|
||||||
|
LC_COLLATE=pl_PL.UTF-8
|
||||||
|
LC_MEASUREMENT=pl_PL.UTF-8
|
||||||
|
LC_MONETARY=pl_PL.UTF-8
|
||||||
|
LC_NUMERIC=pl_PL.UTF-8
|
||||||
|
LC_TIME=pl_PL.UTF-8
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Hosts in `/etc/hosts`
|
||||||
|
|
||||||
|
```text
|
||||||
|
127.0.0.1 localhost
|
||||||
|
::1 localhost
|
||||||
|
127.0.1.1 myhostname.localdomain myhostname
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Now create empty (with 0 size) swap file:
|
||||||
|
|
||||||
|
#### Create separate subvolume for swapfile. This subvolume is needed to let you make snapshot of `/`, which would not be possible with any file in it with CoW disabled!
|
||||||
|
|
||||||
|
```
|
||||||
|
btrfs su create /swap
|
||||||
|
|
||||||
|
chattr +C /swap
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Copy on Write should always be disabled on swap file, so it will be done in the next step
|
||||||
|
|
||||||
|
```bash
|
||||||
|
touch /swap/swapfile
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Check if C attribute is enabled (should be already if created in folder with disabled CoW attribute)
|
||||||
|
|
||||||
|
```bash
|
||||||
|
lsattr /swap/swapfile'
|
||||||
|
```
|
||||||
|
|
||||||
|
#### If not then disable CoW for swapfile manually:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
chattr +C /swap/swapfile
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Expanding empty file to 4GiB swap file
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dd if=/dev/zero of=/swap/swapfile bs=1024K count=4096
|
||||||
|
|
||||||
|
chmod 600 /swap/swapfile
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Format the swap file.
|
||||||
|
|
||||||
|
```bash
|
||||||
|
mkswap /swap/swapfile
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Turn swap file on.
|
||||||
|
|
||||||
|
```bash
|
||||||
|
swapon /swap/swapfile
|
||||||
|
```
|
||||||
|
|
||||||
|
#### You also need to update `/etc/fstab` to mount swapfile on boot:
|
||||||
|
|
||||||
|
```text
|
||||||
|
/swap/swapfile none swap sw 0 0
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Set password for root
|
||||||
|
|
||||||
|
```bash
|
||||||
|
passwd
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Add real user an set password for him
|
||||||
|
|
||||||
|
```bash
|
||||||
|
useradd -m MYUSERNAME
|
||||||
|
|
||||||
|
passwd MYUSERNAME
|
||||||
|
```
|
||||||
|
|
||||||
|
### Configure mkinitcpio with modules needed for the initrd image
|
||||||
|
|
||||||
|
```bash
|
||||||
|
vim /etc/mkinitcpio.conf
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Add 'keyboard', 'keymap', 'encrypt' and 'btrfs' to HOOKS before filesystems:
|
||||||
|
|
||||||
|
```
|
||||||
|
HOOKS=(base udev autodetect keyboard keymap modconf block btrfs filesystems keyboard fsck)
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Add btrfsck to binaries:
|
||||||
|
|
||||||
|
```
|
||||||
|
BINARIES=(btrfsck)
|
||||||
|
```
|
||||||
|
|
||||||
|
#### **With encryption:** also add encrypt before btrfs:
|
||||||
|
|
||||||
|
```text
|
||||||
|
HOOKS=(... keyboard keymap block encrypt btrfs ... filesystems ...)
|
||||||
|
```
|
||||||
|
|
||||||
|
######
|
||||||
|
|
||||||
|
#### Regenerate initrd images
|
||||||
|
|
||||||
|
```bash
|
||||||
|
mkinitcpio -P
|
||||||
|
```
|
||||||
|
|
||||||
|
# 5. Install bootloader
|
||||||
|
|
||||||
|
#### Setup grub (UEFI)
|
||||||
|
|
||||||
|
```bash
|
||||||
|
pacman -S grub efibootmgr os-prober dosfstools mtools
|
||||||
|
```
|
||||||
|
|
||||||
|
#### -------------encryption only---------------------
|
||||||
|
|
||||||
|
#### edit `/etc/default/grub`
|
||||||
|
|
||||||
|
```text
|
||||||
|
GRUB_ENABLE_CRYPTODISK=y
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Find UUID (UUID for /dev/sdX2) of crypto partition so we can add it to grub config
|
||||||
|
|
||||||
|
```bash
|
||||||
|
blkid
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Now set this line including proper UUID in place of "<device-UUID>":
|
||||||
|
|
||||||
|
#### (temporarly you can use /dev/sdX2 in place of "UUID=<device-UUID>" and change it later easy in gui mode)
|
||||||
|
|
||||||
|
##### edit `/etc/default/grub`
|
||||||
|
|
||||||
|
```text
|
||||||
|
GRUB_CMDLINE_LINUX="cryptdevice=UUID=<device-UUID>:MainPart:allow-discards"
|
||||||
|
```
|
||||||
|
|
||||||
|
##### allow-discards is only for ssd to let trim work with encryption enabled
|
||||||
|
|
||||||
|
#### Generate key so grub don't ask twice for password on boot
|
||||||
|
|
||||||
|
```bash
|
||||||
|
dd bs=512 count=4 if=/dev/random of=/crypto_keyfile.bin iflag=fullblock
|
||||||
|
chmod 600 /crypto_keyfile.bin
|
||||||
|
chmod 600 /boot/initramfs-linux*
|
||||||
|
cryptsetup luksAddKey /dev/sdX2 /crypto_keyfile.bin
|
||||||
|
```
|
||||||
|
|
||||||
|
#### If you change name of key file there is need to add kernel parameter like cryptkey=rootfs:path
|
||||||
|
|
||||||
|
#### Crypto\_keyfile.bin is the default name that kernel will guess anyway
|
||||||
|
|
||||||
|
#### Now add this file to `/etc/mkinitcpio.conf`
|
||||||
|
|
||||||
|
```text
|
||||||
|
FILES=(/crypto_keyfile.bin)
|
||||||
|
```
|
||||||
|
|
||||||
|
then run:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
mkinitcpio -P
|
||||||
|
```
|
||||||
|
|
||||||
|
#### -------------encryption end---------------------
|
||||||
|
|
||||||
|
#### Install grub for
|
||||||
|
|
||||||
|
```bash
|
||||||
|
grub-install --target=x86_64-efi --efi-directory=/efi --bootloader-id=GRUB
|
||||||
|
grub-mkconfig -o /boot/grub/grub.cfg
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Exit new system
|
||||||
|
|
||||||
|
```bash
|
||||||
|
exit
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Unmount all partitions
|
||||||
|
|
||||||
|
```bash
|
||||||
|
swapoff -a
|
||||||
|
umount -R /mnt
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Reboot into the new system, don't forget to remove the pendrive
|
||||||
|
|
||||||
|
```bash
|
||||||
|
reboot
|
||||||
|
```
|
||||||
|
|
||||||
|
#### or
|
||||||
|
|
||||||
|
```bash
|
||||||
|
shutdown now
|
||||||
|
```
|
||||||
|
|
||||||
|
### 6. Addtitional tips:
|
||||||
|
|
||||||
|
#### Install AUR helper (git and base-devel packages needed to do so):
|
||||||
|
|
||||||
|
```
|
||||||
|
git clone https://aur.archlinux.org/yay.git
|
||||||
|
|
||||||
|
cd yay
|
||||||
|
|
||||||
|
makepkg -si
|
||||||
|
```
|
||||||
|
|
||||||
|
#### To get proper locale and keymap, check:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
localectl status
|
||||||
|
```
|
||||||
|
|
||||||
|
#### On KDE plasma , also set settings > ... > keyboard layout && regional settings
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue