Skip to content

Instantly share code, notes, and snippets.

@michaelrinderle

michaelrinderle/Encrypted Arch Base Install

Forked from mattiaslundberg/arch-linux-install
Last active November 4, 2019 02:43
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save michaelrinderle/4ba0f66349265870ef169702348e8feb to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save michaelrinderle/4ba0f66349265870ef169702348e8feb to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. michaelrinderle revised this gist Nov 4, 2019. 1 changed file with 8 additions and 0 deletions.
    8 changes: 8 additions & 0 deletions Encrypted Arch Base Install
    View file
    Original file line number Diff line number Diff line change
    @@ -66,3 +66,11 @@ umount -R /mnt
    swapoff -a

    reboot


    # I3 w/ Gaps Tile Manager
    sudo pacman -S i3-gaps xorg-server xorg-xinit
    nvim /etc/X11/xinit/xinitrc
    Remove the final chunk of code containing twm and apps.
    Replace with: exec i3
    startx
  2. michaelrinderle revised this gist Nov 4, 2019. No changes.
  3. michaelrinderle revised this gist Nov 4, 2019. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions Encrypted Arch Base Install
    View file
    Original file line number Diff line number Diff line change
    @@ -26,8 +26,8 @@ mount /dev/nvme0n1p2 /mnt/boot
    mkdir /mnt/boot/efi
    mount /dev/nvme0n1p1 /mnt/boot/efi

    pacstrap /mnt base base-devel grub-efi-x86_64 git efibootmgr dialog wpa_supplicant dhcpd
    mkinitcpio wifi-menu lvm2 linux-hardened linux-firmware neovim
    pacstrap /mnt base base-devel grub-efi-x86_64 git efibootmgr dialog wpa_supplicant dhcpcd
    mkinitcpio lvm2 linux-hardened linux-firmware neovim

    genfstab -pU /mnt >> /mnt/etc/fstab
    # /mnt/etc/fstab
  4. michaelrinderle revised this gist Nov 4, 2019. No changes.
  5. michaelrinderle revised this gist Nov 4, 2019. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions Encrypted Arch Base Install
    View file
    Original file line number Diff line number Diff line change
    @@ -19,8 +19,8 @@ lvcreate -l +100%FREE vg --name root
    mkfs.ext4 /dev/mapper/vg-root
    mkswap /dev/mapper/vg-swap

    mount /dev/mapper/vg-root /mnt # /mnt is the installed system
    swapon /dev/mapper/vg-swap # Not needed but a good thing to test
    mount /dev/mapper/vg-root /mnt
    swapon /dev/mapper/vg-swap
    mkdir /mnt/boot
    mount /dev/nvme0n1p2 /mnt/boot
    mkdir /mnt/boot/efi
  6. michaelrinderle revised this gist Nov 4, 2019. 1 changed file with 1 addition and 3 deletions.
    4 changes: 1 addition & 3 deletions Encrypted Arch Base Install
    View file
    Original file line number Diff line number Diff line change
    @@ -26,8 +26,7 @@ mount /dev/nvme0n1p2 /mnt/boot
    mkdir /mnt/boot/efi
    mount /dev/nvme0n1p1 /mnt/boot/efi

    # Unless vim and zsh are desired these can be removed from the command
    pacstrap /mnt base base-devel grub-efi-x86_64 zsh git efibootmgr dialog wpa_supplicant dhcpd
    pacstrap /mnt base base-devel grub-efi-x86_64 git efibootmgr dialog wpa_supplicant dhcpd
    mkinitcpio wifi-menu lvm2 linux-hardened linux-firmware neovim

    genfstab -pU /mnt >> /mnt/etc/fstab
    @@ -45,7 +44,6 @@ echo LANG=en_US.UTF-8 >> /etc/locale.conf
    echo LANGUAGE=en_US >> /etc/locale.conf
    echo LC_ALL=C >> /etc/locale.conf

    # Set password for root
    passwd

    # useradd -m -g users -G wheel -s /bin/zsh MYUSERNAME
  7. michaelrinderle revised this gist Nov 4, 2019. 1 changed file with 6 additions and 35 deletions.
    41 changes: 6 additions & 35 deletions Encrypted Arch Base Install
    View file
    Original file line number Diff line number Diff line change
    @@ -1,99 +1,70 @@
    # Install ARCH Linux with encrypted file-system and UEFI
    # The official installation guide (https://wiki.archlinux.org/index.php/Installation_Guide) contains a more verbose description.

    # Download the archiso image from https://www.archlinux.org/
    # Copy to a usb-drive
    dd if=archlinux.img of=/dev/sdX bs=16M && sync # on linux

    # Boot from the usb. If the usb fails to boot, make sure that secure boot is disabled in the BIOS configuration.

    # This assumes a wifi only system...
    wifi-menu

    # Create partitions
    cgdisk /dev/nvme0n1
    1 100MB EFI partition # Hex code ef00
    2 250MB Boot partition # Hex code 8300
    3 100% size partiton # (to be encrypted) Hex code 8300
    1 - 100MB EFI partition # Hex code ef00
    2 - 250MB Boot partition # Hex code 8300
    3 - 100% size partiton # (to be encrypted) Hex code 8300

    mkfs.vfat -F32 /dev/nvme0n1p1
    mkfs.ext2 /dev/nvme0n1p2

    # Setup the encryption of the system
    cryptsetup -c aes-xts-plain64 -y --use-random luksFormat /dev/nvme0n1p3
    cryptsetup luksOpen /dev/nvme0n1p3 luks

    # Create encrypted partitions
    # This creates one partions for root, modify if /home or other partitions should be on separate partitions
    pvcreate /dev/mapper/luks
    vgcreate vg /dev/mapper/luks
    lvcreate --size 8G vg --name swap
    lvcreate -l +100%FREE vg --name root

    # Create filesystems on encrypted partitions
    mkfs.ext4 /dev/mapper/vg-root
    mkswap /dev/mapper/vg-swap

    # Mount the new system
    mount /dev/mapper/vg-root /mnt # /mnt is the installed system
    swapon /dev/mapper/vg-swap # Not needed but a good thing to test
    mkdir /mnt/boot
    mount /dev/nvme0n1p2 /mnt/boot
    mkdir /mnt/boot/efi
    mount /dev/nvme0n1p1 /mnt/boot/efi

    # Install the system also includes stuff needed for starting wifi when first booting into the newly installed system
    # Unless vim and zsh are desired these can be removed from the command
    pacstrap /mnt base base-devel grub-efi-x86_64 zsh git efibootmgr dialog wpa_supplicant dhcpd
    mkinitcpio wifi-menu lvm2 linux-hardened linux-firmware neovim

    # 'install' fstab
    genfstab -pU /mnt >> /mnt/etc/fstab
    # Make /tmp a ramdisk (add the following line to /mnt/etc/fstab)
    # /mnt/etc/fstab
    tmpfs /tmp tmpfs defaults,noatime,mode=1777 0 0
    # Change relatime on all non-boot partitions to noatime (reduces wear if using an SSD)

    # Enter the new system
    arch-chroot /mnt /bin/bash

    # Setup system clock
    ln -s /usr/share/zoneinfo/America/Chicago /etc/localtime
    hwclock --systohc --utc

    # Set the hostname
    echo sdc-xxx-01 > /etc/hostname

    # Update locale
    echo LANG=en_US.UTF-8 >> /etc/locale.conf
    echo LANGUAGE=en_US >> /etc/locale.conf
    echo LC_ALL=C >> /etc/locale.conf

    # Set password for root
    passwd

    # Add real user remove -s flag if you don't whish to use zsh
    # useradd -m -g users -G wheel -s /bin/zsh MYUSERNAME
    # passwd MYUSERNAME

    # Configure mkinitcpio with modules needed for the initrd image

    vim /etc/mkinitcpio.conf
    # Add 'ext4' to MODULES
    # Add 'encrypt' and 'lvm2' to HOOKS before filesystems

    # Regenerate initrd image
    mkinitcpio -p linux-hardened

    # Setup grub
    grub-install
    In /etc/default/grub edit the line GRUB_CMDLINE_LINUX to GRUB_CMDLINE_LINUX="cryptdevice=/dev/sdX3:luks:allow-discards" then run:
    # /etc/default/grub edit GRUB_CMDLINE_LINUX="cryptdevice=/dev/nvme0n1p3:luks:allow-discards"
    grub-mkconfig -o /boot/grub/grub.cfg

    # Exit new system and go into the cd shell
    exit

    # Unmount all partitions
    umount -R /mnt
    swapoff -a

    # Reboot into the new system, don't forget to remove the cd/usb
    reboot
  8. michaelrinderle revised this gist Nov 4, 2019. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions Encrypted Arch Base Install
    View file
    Original file line number Diff line number Diff line change
    @@ -44,7 +44,7 @@ mount /dev/nvme0n1p1 /mnt/boot/efi

    # Install the system also includes stuff needed for starting wifi when first booting into the newly installed system
    # Unless vim and zsh are desired these can be removed from the command
    pacstrap /mnt base base-devel grub-efi-x86_64 zsh vim git efibootmgr dialog wpa_supplicant dhcpd
    pacstrap /mnt base base-devel grub-efi-x86_64 zsh git efibootmgr dialog wpa_supplicant dhcpd
    mkinitcpio wifi-menu lvm2 linux-hardened linux-firmware neovim

    # 'install' fstab
    @@ -81,7 +81,7 @@ vim /etc/mkinitcpio.conf
    # Add 'encrypt' and 'lvm2' to HOOKS before filesystems

    # Regenerate initrd image
    mkinitcpio -p linux
    mkinitcpio -p linux-hardened

    # Setup grub
    grub-install
  9. michaelrinderle renamed this gist Nov 4, 2019. 1 changed file with 18 additions and 20 deletions.
    38 changes: 18 additions & 20 deletions arch-linux-install → Encrypted Arch Base Install
    View file
    Original file line number Diff line number Diff line change
    @@ -7,47 +7,45 @@ dd if=archlinux.img of=/dev/sdX bs=16M && sync # on linux

    # Boot from the usb. If the usb fails to boot, make sure that secure boot is disabled in the BIOS configuration.

    # Set swedish keymap
    loadkeys sv-latin1

    # This assumes a wifi only system...
    wifi-menu

    # Create partitions
    cgdisk /dev/sdX
    cgdisk /dev/nvme0n1
    1 100MB EFI partition # Hex code ef00
    2 250MB Boot partition # Hex code 8300
    3 100% size partiton # (to be encrypted) Hex code 8300

    mkfs.vfat -F32 /dev/sdX1
    mkfs.ext2 /dev/sdX2
    mkfs.vfat -F32 /dev/nvme0n1p1
    mkfs.ext2 /dev/nvme0n1p2

    # Setup the encryption of the system
    cryptsetup -c aes-xts-plain64 -y --use-random luksFormat /dev/sdX3
    cryptsetup luksOpen /dev/sdX3 luks
    cryptsetup -c aes-xts-plain64 -y --use-random luksFormat /dev/nvme0n1p3
    cryptsetup luksOpen /dev/nvme0n1p3 luks

    # Create encrypted partitions
    # This creates one partions for root, modify if /home or other partitions should be on separate partitions
    pvcreate /dev/mapper/luks
    vgcreate vg0 /dev/mapper/luks
    lvcreate --size 8G vg0 --name swap
    lvcreate -l +100%FREE vg0 --name root
    vgcreate vg /dev/mapper/luks
    lvcreate --size 8G vg --name swap
    lvcreate -l +100%FREE vg --name root

    # Create filesystems on encrypted partitions
    mkfs.ext4 /dev/mapper/vg0-root
    mkswap /dev/mapper/vg0-swap
    mkfs.ext4 /dev/mapper/vg-root
    mkswap /dev/mapper/vg-swap

    # Mount the new system
    mount /dev/mapper/vg0-root /mnt # /mnt is the installed system
    swapon /dev/mapper/vg0-swap # Not needed but a good thing to test
    mount /dev/mapper/vg-root /mnt # /mnt is the installed system
    swapon /dev/mapper/vg-swap # Not needed but a good thing to test
    mkdir /mnt/boot
    mount /dev/sdX2 /mnt/boot
    mount /dev/nvme0n1p2 /mnt/boot
    mkdir /mnt/boot/efi
    mount /dev/sdX1 /mnt/boot/efi
    mount /dev/nvme0n1p1 /mnt/boot/efi

    # Install the system also includes stuff needed for starting wifi when first booting into the newly installed system
    # Unless vim and zsh are desired these can be removed from the command
    pacstrap /mnt base base-devel grub-efi-x86_64 zsh vim git efibootmgr dialog wpa_supplicant
    pacstrap /mnt base base-devel grub-efi-x86_64 zsh vim git efibootmgr dialog wpa_supplicant dhcpd
    mkinitcpio wifi-menu lvm2 linux-hardened linux-firmware neovim

    # 'install' fstab
    genfstab -pU /mnt >> /mnt/etc/fstab
    @@ -59,11 +57,11 @@ tmpfs /tmp tmpfs defaults,noatime,mode=1777 0 0
    arch-chroot /mnt /bin/bash

    # Setup system clock
    ln -s /usr/share/zoneinfo/Europe/Stockholm /etc/localtime
    ln -s /usr/share/zoneinfo/America/Chicago /etc/localtime
    hwclock --systohc --utc

    # Set the hostname
    echo MYHOSTNAME > /etc/hostname
    echo sdc-xxx-01 > /etc/hostname

    # Update locale
    echo LANG=en_US.UTF-8 >> /etc/locale.conf
  10. @mattiaslundberg mattiaslundberg revised this gist Aug 21, 2016. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion arch-linux-install
    View file
    Original file line number Diff line number Diff line change
    @@ -74,7 +74,7 @@ echo LC_ALL=C >> /etc/locale.conf
    passwd

    # Add real user remove -s flag if you don't whish to use zsh
    # useradd -m -g users -G wheel,storage,power -s /bin/zsh MYUSERNAME
    # useradd -m -g users -G wheel -s /bin/zsh MYUSERNAME
    # passwd MYUSERNAME

    # Configure mkinitcpio with modules needed for the initrd image
  11. @mattiaslundberg mattiaslundberg revised this gist Jan 7, 2016. 1 changed file with 3 additions and 3 deletions.
    6 changes: 3 additions & 3 deletions arch-linux-install
    View file
    Original file line number Diff line number Diff line change
    @@ -66,9 +66,9 @@ hwclock --systohc --utc
    echo MYHOSTNAME > /etc/hostname

    # Update locale
    echo LANG=en_US.UTF-8 > /etc/locale.conf
    echo LANGUAGE=en_US > /etc/locale.conf
    echo LC_ALL=C > /etc/locale.conf
    echo LANG=en_US.UTF-8 >> /etc/locale.conf
    echo LANGUAGE=en_US >> /etc/locale.conf
    echo LC_ALL=C >> /etc/locale.conf

    # Set password for root
    passwd
  12. @mattiaslundberg mattiaslundberg revised this gist Sep 3, 2015. 1 changed file with 14 additions and 8 deletions.
    22 changes: 14 additions & 8 deletions arch-linux-install
    View file
    Original file line number Diff line number Diff line change
    @@ -3,21 +3,21 @@

    # Download the archiso image from https://www.archlinux.org/
    # Copy to a usb-drive
    dd if=archlinux.img of=/dev/sdX bs=16M # on linux
    dd if=archlinux.img of=/dev/sdX bs=16M && sync # on linux

    # Boot from the usb. If the usb fails to boot, make sure that secure boot is disabeled in the BIOS configuration.
    # Boot from the usb. If the usb fails to boot, make sure that secure boot is disabled in the BIOS configuration.

    # Set swedish keymap
    loadkeys sv-latin1

    # This assumes a wifi system...
    wifi-menu wlo1 # wlo1 is the device name, use ip link to find your actual name
    # This assumes a wifi only system...
    wifi-menu

    # Create partitions
    cgdisk /dev/sdX
    1 100MB EFI partition
    2 250MB Boot partition
    3 100% size partiton # (to be encrypted)
    1 100MB EFI partition # Hex code ef00
    2 250MB Boot partition # Hex code 8300
    3 100% size partiton # (to be encrypted) Hex code 8300

    mkfs.vfat -F32 /dev/sdX1
    mkfs.ext2 /dev/sdX2
    @@ -47,12 +47,13 @@ mount /dev/sdX1 /mnt/boot/efi

    # Install the system also includes stuff needed for starting wifi when first booting into the newly installed system
    # Unless vim and zsh are desired these can be removed from the command
    pacstrap /mnt base base-devel grub-efi-x86_64 zsh vim efibootmgr dialog wpa_supplicant
    pacstrap /mnt base base-devel grub-efi-x86_64 zsh vim git efibootmgr dialog wpa_supplicant

    # 'install' fstab
    genfstab -pU /mnt >> /mnt/etc/fstab
    # Make /tmp a ramdisk (add the following line to /mnt/etc/fstab)
    tmpfs /tmp tmpfs defaults,noatime,mode=1777 0 0
    # Change relatime on all non-boot partitions to noatime (reduces wear if using an SSD)

    # Enter the new system
    arch-chroot /mnt /bin/bash
    @@ -64,6 +65,11 @@ hwclock --systohc --utc
    # Set the hostname
    echo MYHOSTNAME > /etc/hostname

    # Update locale
    echo LANG=en_US.UTF-8 > /etc/locale.conf
    echo LANGUAGE=en_US > /etc/locale.conf
    echo LC_ALL=C > /etc/locale.conf

    # Set password for root
    passwd

  13. @mattiaslundberg mattiaslundberg revised this gist Jan 26, 2015. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion arch-linux-install
    View file
    Original file line number Diff line number Diff line change
    @@ -81,7 +81,7 @@ mkinitcpio -p linux

    # Setup grub
    grub-install
    In /etc/default/grub edit the line GRUB_CMDLINE_LINUX to GRUB_CMDLINE_LINUX="cryptdevice=/dev/sdX3:luks" then run:
    In /etc/default/grub edit the line GRUB_CMDLINE_LINUX to GRUB_CMDLINE_LINUX="cryptdevice=/dev/sdX3:luks:allow-discards" then run:
    grub-mkconfig -o /boot/grub/grub.cfg

    # Exit new system and go into the cd shell
  14. @mattiaslundberg mattiaslundberg created this gist Jan 25, 2014.
    95 changes: 95 additions & 0 deletions arch-linux-install
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,95 @@
    # Install ARCH Linux with encrypted file-system and UEFI
    # The official installation guide (https://wiki.archlinux.org/index.php/Installation_Guide) contains a more verbose description.

    # Download the archiso image from https://www.archlinux.org/
    # Copy to a usb-drive
    dd if=archlinux.img of=/dev/sdX bs=16M # on linux

    # Boot from the usb. If the usb fails to boot, make sure that secure boot is disabeled in the BIOS configuration.

    # Set swedish keymap
    loadkeys sv-latin1

    # This assumes a wifi system...
    wifi-menu wlo1 # wlo1 is the device name, use ip link to find your actual name

    # Create partitions
    cgdisk /dev/sdX
    1 100MB EFI partition
    2 250MB Boot partition
    3 100% size partiton # (to be encrypted)

    mkfs.vfat -F32 /dev/sdX1
    mkfs.ext2 /dev/sdX2

    # Setup the encryption of the system
    cryptsetup -c aes-xts-plain64 -y --use-random luksFormat /dev/sdX3
    cryptsetup luksOpen /dev/sdX3 luks

    # Create encrypted partitions
    # This creates one partions for root, modify if /home or other partitions should be on separate partitions
    pvcreate /dev/mapper/luks
    vgcreate vg0 /dev/mapper/luks
    lvcreate --size 8G vg0 --name swap
    lvcreate -l +100%FREE vg0 --name root

    # Create filesystems on encrypted partitions
    mkfs.ext4 /dev/mapper/vg0-root
    mkswap /dev/mapper/vg0-swap

    # Mount the new system
    mount /dev/mapper/vg0-root /mnt # /mnt is the installed system
    swapon /dev/mapper/vg0-swap # Not needed but a good thing to test
    mkdir /mnt/boot
    mount /dev/sdX2 /mnt/boot
    mkdir /mnt/boot/efi
    mount /dev/sdX1 /mnt/boot/efi

    # Install the system also includes stuff needed for starting wifi when first booting into the newly installed system
    # Unless vim and zsh are desired these can be removed from the command
    pacstrap /mnt base base-devel grub-efi-x86_64 zsh vim efibootmgr dialog wpa_supplicant

    # 'install' fstab
    genfstab -pU /mnt >> /mnt/etc/fstab
    # Make /tmp a ramdisk (add the following line to /mnt/etc/fstab)
    tmpfs /tmp tmpfs defaults,noatime,mode=1777 0 0

    # Enter the new system
    arch-chroot /mnt /bin/bash

    # Setup system clock
    ln -s /usr/share/zoneinfo/Europe/Stockholm /etc/localtime
    hwclock --systohc --utc

    # Set the hostname
    echo MYHOSTNAME > /etc/hostname

    # Set password for root
    passwd

    # Add real user remove -s flag if you don't whish to use zsh
    # useradd -m -g users -G wheel,storage,power -s /bin/zsh MYUSERNAME
    # passwd MYUSERNAME

    # Configure mkinitcpio with modules needed for the initrd image
    vim /etc/mkinitcpio.conf
    # Add 'ext4' to MODULES
    # Add 'encrypt' and 'lvm2' to HOOKS before filesystems

    # Regenerate initrd image
    mkinitcpio -p linux

    # Setup grub
    grub-install
    In /etc/default/grub edit the line GRUB_CMDLINE_LINUX to GRUB_CMDLINE_LINUX="cryptdevice=/dev/sdX3:luks" then run:
    grub-mkconfig -o /boot/grub/grub.cfg

    # Exit new system and go into the cd shell
    exit

    # Unmount all partitions
    umount -R /mnt
    swapoff -a

    # Reboot into the new system, don't forget to remove the cd/usb
    reboot