DEV Community

Cover image for Base Arch Linux installation
Ivan Fraixedes
Ivan Fraixedes

Posted on • Originally published at blog.fraixed.es

Base Arch Linux installation

#archlinux

I installed Arch Linux in my new laptop, an Slimbook Executive 14".
I followed the official installation guide, however, I had to quite a lot of more to installed on the way that I want.

My requirements were:

  • Encrypt the full disk with dm-crypt.
  • Use LVM to manage disk partitions.
  • Use ext4 file system.

Creating disk partitions

I've mostly followed dm-crypt/Encrypting an entire system, but I summarize here my process with the options that I chose.

The laptop has 1 TB of NVMe (Non-Volatile Memory Express) and I deliberately want to encrypt the full disk.

The dm-crypt scenario that I've chosen is LVM on LUKS with encrypted boot partition over:

I used the ancient fdisk to create in the only disk that the laptop has, which is mapped to the device /dev/nvme0n1, all the partitions indicated in the "preparing the disk" section of LVM on LUKS with encrypted boot partition. The partitions ended up as:

Disk /dev/nvme0n1: 931.51 GiB, 1000204886016 bytes, 1953525168 sectors
Disk model: Samsung SSD 980 PRO 1TB
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: <redacted>

Device           Start        End    Sectors   Size Type
/dev/nvme0n1p1    2048       4095       2048     1M BIOS boot
/dev/nvme0n1p2    4096    2101247    2097152     1G EFI System
/dev/nvme0n1p3 2101248 1953523711 1951422464 930.5G Linux filesystem
Enter fullscreen mode Exit fullscreen mode

Let's encrypt the second partition

# cyptsetup luksFormat --type luks1 /dev/nvme0n1p3
Enter fullscreen mode Exit fullscreen mode

Now let's mount it on /dev/mapper/cyrptlvm

# cryptsetup open /dev/nvme0n1p3 cryptlvm
Enter fullscreen mode Exit fullscreen mode

Now we start with the LVM ceremony

First of all, I create a physical volume because I only have one hard disk

# pvcreate /dev/mapper/cryptlvm
Enter fullscreen mode Exit fullscreen mode

Secondly, one logical groups because I don't need an extra degree of isolation between volumes and it's more storage efficient than having multiples groups

# vgcreate main /dev/mapper/cryptlvm
Enter fullscreen mode Exit fullscreen mode

And last, but not least, three logical volumes, one for swap, one for the root partition, and one for the home directory

# lvcreate -L 64G main -n swap
# lvcreate -L 430G main -n root
# lvcreate -l 100%FREE main -n home
Enter fullscreen mode Exit fullscreen mode

You may wonder why I'm booking 64 Gb for memory swap. It isn't because I'm scared of running short of RAM, this laptop has exactly 64 Gb. In the past I ran into hibernating issues because the swap partition was smaller than the size of the RAM, although nowadays, the memory image for the hibernation can be store in a file and not only in a swap partition I preferred to keep it simple and use the swap partition for hibernating because I can afford to lose 64 Gb of disk from the other two partitions and, anyway, if I need to pull up that space, I could do it resizing the LVM volumes.

Time to format the partitions, for the swap partition is a snap. For the other two, I decided to be conservative and use ext4, despite of the cool features that btrfs, I went for ensuring maturity and stability over better data integrity and error recovering and I don't need btrfs RAID, volume management, snapshots, and rollbacks because I already have LVM for them.

So the boring stuff for that is

# mkfs.ext4 /dev/main/root
# mkfs.ext4 /dev/main/home
# mkswap /dev/main/swap
# mount /dev/main/root /mnt
# mount --mkdir /dev/main/home /mnt/home
# swapon /dev/main/swap
Enter fullscreen mode Exit fullscreen mode

I chose to boot in UEFI mode, so mounted the partition in /efi for compatibility with grup-install

# mkfs.fat -F32 -n EFI /dev/nvme0n1p2
# mount --mkdir /dev/nvme0n1p2 /mnt/efi
Enter fullscreen mode Exit fullscreen mode

Preparation before installing

First of all, we need an internet connection. The Arch Linux installation image comes with iwd, and after I ensured that the Wi-FI network card was detected with ip link, I followed the iwctl commands in the connect to a network section.

I ensured that the system clock is accurate with timedateclt.

Installing essential packages 

# pacstrap -K /mnt base linux linux-firmware
Enter fullscreen mode Exit fullscreen mode

Essential configurations

I generate the fstab file from the current mounted volumes

# genfstab -U /mnt >> /mnt/etc/fstab
Enter fullscreen mode Exit fullscreen mode

Then I changed the root directory to the root mounted volume, where we are installing Arch Linux.

# arch-chroot /mnt
Enter fullscreen mode Exit fullscreen mode

I installed Neovim, which is the editor that I usually use, and I need one to be able to modify and create some configuration files

# pacman -S neovim
Enter fullscreen mode Exit fullscreen mode

Set the timezone

# ln -sf /usr/share/zoneinfo/Europe/Madrid /etc/localtime
# hwclock --systohc
Enter fullscreen mode Exit fullscreen mode

I uncommented the ca_ES.UTF-8 UTF-8, es_ES.UTF-8 UTF-8, and en_US.UTF-8 UTF-8 from /etc/locale.gen and generated the locales with

# locale-gen
Enter fullscreen mode Exit fullscreen mode

I created the file /etc/locale.conf and write inside LANG=en_US.UTF-8 to set the LANG variable accordingly.

I configured the hostname writing blacksmoke in /etc/hostname, yes the laptop is called blacksmoke.

I installed the iwd network manager

# pacman -S iwd
Enter fullscreen mode Exit fullscreen mode

I've decided to use a systemd-based initramfs, so I changed the mkinitcpio.conf (/etc/mkinitcpio.conf) from

HOOKS=(base udev autodetect microcode modconf kms keyboard keymap consolefont block filesystems fsck)
Enter fullscreen mode Exit fullscreen mode

to

HOOKS=(base systemd autodetect microcode modconf kms keyboard block sd-encrypt lvm2 filesystems fsck)
Enter fullscreen mode Exit fullscreen mode

Note I swapped udev by systemd, added sd-encrypt and lvm2 and removed keymap and consolefont because I'm fine with the US console keymap and the default console font.

and I installed LVM because it's obviously needed due to my partitions are on top of LVM volumes, besides that mkinitcpio needs is as you can see above that I added the lvm2 hook.

# pacman -S lvm2
Enter fullscreen mode Exit fullscreen mode

Right after, I regenerated the initramfs running

# mkinitcpio -P
Enter fullscreen mode Exit fullscreen mode

But I saw through the warnings printed in the console that Im missing a few firmwares. As commented in Mkinitcpio wiki page about "possible missing firmware for module XXXX, I had to install the Linux firmwares package

# pacman -S linux-firmware linux-firmware-qlogic
Enter fullscreen mode Exit fullscreen mode

however, it wasn't enough, and I had to install other firmwares from AUR packages, so let's go for them.

As you may know, installing package from AUR repositories is totally different story than doing from main stream repositories, they are several tools that simplify the process by automating several manual steps, however, and I like them, but I want to decide which one to use, once I have the OS working, not at the installation time, so I installed them manually.

First, I installed the required packages to build AUR packages

# pacman -S base-devel sudo git
Enter fullscreen mode Exit fullscreen mode

I authorized all the users in the wheel group creating the following file /etc/sudoers.d/00-wheel-users

%wheel ALL=(ALL:ALL) ALL
Enter fullscreen mode Exit fullscreen mode

And I ensured that only root can access to it

  chmod -c 0660 /etc/sudoers.d/00-wheel-users
Enter fullscreen mode Exit fullscreen mode

makepkg requires sudo, so it was the time to create my regular user and set it's password

# useradd -c "Ivan Fraixedes" -m -U -G wheel ivan
# passwd ivan
Enter fullscreen mode Exit fullscreen mode

I adjusted /etc/makepkg.conf following the tips & trics, creating /etc/makepkg.conf.d/makepkg.conf with the following content

MAKEFLAGS="-j$(nproc)"

PKGDEST=~/.local/makepkg/packages
SRCDEST=~/.local/makepkg/sources
SRCPKGDEST=~/.local/makepkg/srcpackages
LOGDEST=~/.local/makepkg/logs
Enter fullscreen mode Exit fullscreen mode

I logged with my user and created the directories that I configured for makepkg

# su ivan
# cd ~
# mkdir -p .local/makepkg
# cd .local/makepkg
# mkdir logs packages sources srcpackages
Enter fullscreen mode Exit fullscreen mode

I installed the following firmware from AUR doing (as ivan user)

# mkdir -p tmp/aur
# cd tmp/aur
# git clone https://aur.archlinux.org/upd72020x-fw.git
# cd upd72020x-fw
# makepkg -sirc
Enter fullscreen mode Exit fullscreen mode

The same package installation call mkinitcpio and I saw that there isn't a warning anymore for the xhci-pci firmware, yup!
I repeated the same process for the following AUR firmwares ast, aic94xxx, and wd719x. Cha-ching no more warning when building the initramfs with mkinitcpio.

I installed the GRUB boot loader and the efibootmgr which is required by GRUB for UEFI systems

# pacman -S grub efibootmgr
Enter fullscreen mode Exit fullscreen mode

And configure it (/etc/default/grub) to allow booting from /boot on the encrypted partition and set the kernel parameters to allow initramfs to unlock the encrypted root partition using the sd-encrypt mkinitcpio's hook.
Note these lines may not be together, some may be commented, and some may have other values that you may need to keep, in any case they will ended up with these values in a different machine (e.g. the disk UUID won't be the same), hence, check the configuring GRUB section.

GRUB_ENABLE_CRYPTODISK=y
GRUB_CMDLINE_LINUX="rd.luks.name=a199a1d7-acc0-4910-babb-e0059dec293b=cryptlvm"
Enter fullscreen mode Exit fullscreen mode

What disk UUID should you add in the above GRUB's configuration? I think that's quite obvious, but I didn't think that much at that moment and I set to the UUID of the wrong one and, for obvious reasons, GRUB wasn't able to decrypt the volumen and boot the OS :(. It took me several hours to find out my mistake and with a lot of rebooting to try to see if I was fixing the issues for every change that I was making in mkinitcpio.conf, grub, etc., so pay attention and don't waste marvelous hours with this stupid mistake.

It has to be the UUID of the LUKS partition where the /boot is placed, NOT the LVM one! In my case is /dev/nvme0n1p3 and to find out UUID, you can do ls -l /dev/disk/by-uuid and the link name that points to it is the UUID.

I installed GRUB to be mounted ESP for UEFI booting and generated the GRUB's configuration file

# grub-install --target=x86_64-efi --efi-directory=/efi --bootloader-id=GRUB --recheck
# grub-mkconfig -o /boot/grub/grub.cfg
Enter fullscreen mode Exit fullscreen mode

OK, at this point, I rebooted the computer and yes, after booting from its disk, it asked me for the LUKS password, then GRUB menu showed up, and, after selecting boot Arch, it asked me again for LUKS password. Brilliant, everything finally worked.

Last, but not least and before finishing this blog post, I want to include here 2 things as an initial setup.

I did a couple of more things which I consider that they are part of the base installation:

  1. Set a password for the root user, otherwise you cannot login with it. Yes, I want a password for it, I found sometimes useful in the past to be able to login as root rather than my regular user.
  2. Add a keyfile to the LUKS partition, so it can be used to decrypted automatically by GRUB and not having to type the LUKS passphrase twice.

After booting up, I login with my regular user ivan and then, I access as root and change its password.

# sudo su
# passwd
Enter fullscreen mode Exit fullscreen mode

Using the root login, I set up the keyfile for the LUKS volume following the "With a keyfile embedded in the initramfs" section of "dm-crypt/Device encryption" page.

First, I created the keyfile

# dd bs=512 count=4 if=/dev/random of=/root/cryptlvm.keyfile iflag=fullblock
# chmod 000 /root/cryptlvm.keyfile
# cryptsetup -v luksAddKey /dev/nvme0n1p3 /root/cryptlvm.keyfile
Enter fullscreen mode Exit fullscreen mode

I added the keyfile to the initramfs image, that's just updating the /etc/mkinicpio.conf, adding the file path to the FILES list, in my case, FILES was empty, so it changed from

FILES=()
Enter fullscreen mode Exit fullscreen mode

to

FILES=(/root/cryptlvm.keyfile)
Enter fullscreen mode Exit fullscreen mode

Recreate the initramfs

# mkinitcpio -P
Enter fullscreen mode Exit fullscreen mode

Secure the access to the embedded keyfile

# chmod 600 /boot/initramfs-linux*
Enter fullscreen mode Exit fullscreen mode

Update GRUB's configuration (i.e. /etc/default/grub) to point to the keyfile. Remember, that in my case, I'm using systemd-based initramfs (i.e. sd-encrypt hook). I my case, I added rd.luks.key=a199a1d7-acc0-4910-babb-e0059dec293b=/root/cryptlvm.key to the GRUB_CMDLINE_LINUX, so it changed from

GRUB_CMDLINE_LINUX="rd.luks.name=a199a1d7-acc0-4910-babb-e0059dec293b=cryptlvm"
Enter fullscreen mode Exit fullscreen mode

to

GRUB_CMDLINE_LINUX="rd.luks.name=a199a1d7-acc0-4910-babb-e0059dec293b=cryptlvm rd.luks.key=a199a1d7-acc0-4910-babb-e0059dec293b=/root/cryptlvm.key"
Enter fullscreen mode Exit fullscreen mode

And regenerate the GRUB's configuration

# grub-mkconfig -o /boot/grub/grub.cfg
Enter fullscreen mode Exit fullscreen mode

That's it for today, in future posts, I will cover what tools I'm installing and certain configurations that I tweaked to make my machine more comfortably usable.

Top comments (1)

Collapse
 
hendrikras profile image
Hendrik Ras •

And if you want to go really hard core, build linux from scratch: linuxfromscratch.org.

Read next

takeda1411123 profile image

Our game progress ~ User Animation ~

Akira Game -

shad0wcrawl3r profile image

Setting up a Homelab: Part 1 Proxmox and LetsEncrypt

Ashwin Belbase -

jofisaes profile image

Decoding Kotlin - Your guide to solving the mysterious in Kotlin

João Esperancinha -

arthurazr_46 profile image

Terraform Starter Boilerplate for GCP using Terragrunt

Arthur Azrieli -