Installing full system encrypted arch linux

Posted on Tue 19 May 2020 in dev-journal

This is a documentation of an Arch Linux installation with luks and lvm.

The drive will use a boot partition which will remain unencrypted with a second partition which will be encrypted with luks and then use lvm to create volumes within the lux encrypted partition.


Formatting the disk

The disk will be formatted with fdisk with the following details:

  • 260 MB efi partition
  • The rest of the drive is designated for the linux filesystem
[email protected] /mnt  sudo fdisk /dev/nvme0n1

Welcome to fdisk (util-linux 2.35.1).
Changes will remain in memory only, until you decide to write them.
Be careful before using the write command.

Command (m for help): g
Created a new GPT disklabel (GUID: 67FB8DF3-A6B6-9F4C-8853-A7DF2CF3EBAD).
The device contains 'dos' signature and it will be removed by a write command. See fdisk(8) man page and --wipe option for more details.

Command (m for help): n
Partition number (1-128, default 1): 
First sector (2048-1953525134, default 2048): 

Partition type (type L to list all types): 1
Changed type of partition 'Linux filesystem' to 'EFI System'.

Command (m for help): n
Partition number (2-128, default 2): 
First sector (1050624-1953525134, default 1050624): 
Last sector, +/-sectors or +/-size{K,M,G,T,P} (1050624-1953525134, default 1953525134): 

Created a new partition 2 of type 'Linux filesystem' and of size 931 GiB.

Command (m for help): w
The partition table has been altered.
Calling ioctl() to re-read partition table.
Syncing disks.

Current partition scheme:

[email protected] /mnt  lsblk
nvme0n1     259:0    0 941.3G  0 disk 
├─nvme0n1p1 259:1    0   260M  0 part 
└─nvme0n1p2 259:3    0   941G  0 part 

install FAT 32 FS for boot partition

[email protected] /mnt  sudo mkfs.fat -F32 /dev/nvme0n1p1
mkfs.fat 4.1 (2017-01-24)

Create the luks encrypted container on the other partition

[email protected] /mnt  sudo cryptsetup luksFormat -v --type luks --cipher aes-xts-plain64 --key-size 512 --hash sha512 --iter-time 2000 --use-random --verify-passphrase /dev/nvme0n1p2

Open the container

[email protected] /mnt  sudo cryptsetup open /dev/nvme0n1p2 cryptlvm

Create physical volume

[email protected] /mnt  sudo pvcreate /dev/mapper/cryptlvm
  Physical volume "/dev/mapper/cryptlvm" successfully created.

Create volume group

[email protected] /mnt  sudo vgcreate vg0 /dev/mapper/cryptlvm
  Volume group "vg0" successfully created

Create root logical volume

[email protected] /mnt  sudo lvcreate -L 32G vg0 --name root
  Logical volume "root" created.

Create home logical volume

[email protected] /mnt  sudo lvcreate -L 100G vg0 --name home
  Logical volume "home" created.

Optional: Create swap logical volume

[email protected] ~  sudo lvcreate -L 8G vg0 --name swap 
  Logical volume "swap" created

Create filesystem on lvs

[email protected] /mnt  sudo mkfs.ext4 /dev/vg0/home
[email protected] /mnt  sudo mkfs.ext4 /dev/vg0/root 

Optional: mkswap

[email protected] ~  sudo mkswap /dev/mapper/vg0-swap 
Setting up swapspace version 1, size = 8 GiB (8589930496 bytes)

Create and mount necessary directories for chroot

[email protected] /mnt  sudo mount /dev/vg0/root /mnt/install
➜  [email protected] /mnt  sudo mkdir /mnt/install/home
➜  [email protected] /mnt  sudo mkdir /mnt/install/boot
➜  [email protected] /mnt  sudo mount /dev/vg0/home /mnt/install/home

Bootstrap the system

### bootstrap the system from live cd 
 ➜  pacstrap -i /mnt/install base base-devel vim lvm2

### bootstrap the system from live cd 
# note for -c option 
#    -c             Use the package cache on the host, rather than the target[email protected] /mnt sudo pacstrap -c -i /mnt/install base base-devel vim lvm2

modify /mnt/install/etc/mkinitcpio to add encrypt and lvm2 before filesystems

HOOKS=(base udev autodetect modconf block keyboard keymap encrypt lvm2 filesystems fsck)
[email protected] /mnt mkinitcpio -p linux

Finish install

Continue the installation as normal Arch linux installation guide

sudo pacstrap -c -i /mnt/install base base-devel vim lvm2 intel-ucode

modify /etc/mkinitcpio.conf when I first tried this the keyboard layout was still asdf so needed to add the keymap

HOOKS=(base udev autodetect keyboard keymap consolefont modconf block encrypt lvm2 filesystems fsck)