Skip to content

Instantly share code, notes, and snippets.

@peter-avila
Forked from mjnaderi/install-arch.md
Created May 1, 2025 10:01
Show Gist options
  • Save peter-avila/c8902fa5eb9602959f5afaed605e0116 to your computer and use it in GitHub Desktop.
Save peter-avila/c8902fa5eb9602959f5afaed605e0116 to your computer and use it in GitHub Desktop.
Installing Arch Linux with Full Disk Encryption (LVM on LUKS)

Parent Tutorial:

There are 2 choices:

  • UEFI/GPT mode: UEFI boot mode / GPT partition table
  • BIOS/MBR mode: Legacy boot mode / MBR partition table

I tried to install in UEFI mode, but my laptop (Acer E5-475-336H) had problems with it, and didn't boot after installation. This is how I installed arch linux in BIOS/MBR mode with full disk encryption (using LUKS), and LVM on LUKS.

IMPORTANT NOTE

I assume that /dev/sda is the system's disk, and /dev/sdb is usb drive.

STEPS

  1. Download arch iso image from https://www.archlinux.org/ and copy to a usb drive.

    # dd if=arch.iso of=/dev/sdb
    
  2. Set boot mode to "Legacy" in BIOS configuration, and boot from usb.

  3. Connect to internet. Useful commands:

    # supervisorctl restart dhcpcd
    # wifi-menu
    
  4. Partitioning

    A drive should first be partitioned and afterwards the partitions should be formatted with a file system. Use fdisk to create MBR partitions.

    # fdisk /dev/sda
    

    First, create an empty MBR partition table (WARNING: This will erase entire disk)

    (fdisk) o
    

    We are going to create 2 main partitions (/dev/sda1 and /dev/sda2):

    Device     Boot     Start       End   Sectors   Size Id Type
    /dev/sda1            2048    526335    524288   256M 83 Linux      /boot
    /dev/sda2          526336 765986815 765460480   365G 83 Linux      Encrypted with LUKS, 3 LVM partitions:
        swap  vg0 -wi-ao----   8.00g                                   swap
        root  vg0 -wi-ao----  80.00g                                   /
        anbar vg0 -wi-ao---- 277.00g
    /dev/sda3       765986816 976773167 210786352 100.5G 83 Linux      (Optional) Other partitions if you need... You can encrypt them separately with another password
    

    Create partitions:

    (fdisk) n
    (fdisk) p
    (fdisk) 1
    (fdisk) <Enter>
    (fdisk) +256M
    (fdisk) t
    (fdisk) 83
    
    (fdisk) n
    (fdisk) p
    (fdisk) 2
    (fdisk) <Enter>
    (fdisk) +365G
    (fdisk) t
    (fdisk) 83
    
    (fdisk) n
    (fdisk) p
    (fdisk) 3
    (fdisk) <Enter>
    (fdisk) <Enter>
    (fdisk) t
    (fdisk) 83
    
    (fdisk) w (Write Changes)
    

    Format Partitions:

    mkfs.ext2 /dev/sda1
    
  5. Setup encryption

    # cryptsetup -c aes-xts-plain64 -y --use-random luksFormat /dev/sda2
    # cryptsetup luksOpen /dev/sda2 luks
    
  6. Create LVM Partitions This creates one partions for root, modify if /home or other partitions should be on separate partitions

    # pvcreate /dev/mapper/luks
    # vgcreate vg0 /dev/mapper/luks
    # lvcreate --size 8G vg0 --name swap
    # lvcreate --size 80G vg0 --name root
    # lvcreate -l +100%FREE vg0 --name anbar
    
  7. Format LVM partitions

     # mkfs.ext4 /dev/mapper/vg0-root
     # mkfs.ext4 /dev/mapper/vg0-anbar
     # mkswap /dev/mapper/vg0-swap
    
  8. Mount the new system

     # mount /dev/mapper/vg0-root /mnt
     # mount /dev/sda1 /mnt/boot
     # swapon /dev/mapper/vg0-swap
    

mkdir /mnt/boot mount /dev/sdX2 /mnt/boot mkdir /mnt/boot/efi mount /dev/sdX1 /mnt/boot/efi

Install the system also includes stuff needed for starting wifi when first booting into the newly installed system

Unless vim and zsh are desired these can be removed from the command

pacstrap /mnt base base-devel grub-efi-x86_64 zsh vim git efibootmgr dialog wpa_supplicant

'install' fstab

genfstab -pU /mnt >> /mnt/etc/fstab

Make /tmp a ramdisk (add the following line to /mnt/etc/fstab)

tmpfs /tmp tmpfs defaults,noatime,mode=1777 0 0

Change relatime on all non-boot partitions to noatime (reduces wear if using an SSD)

Enter the new system

arch-chroot /mnt /bin/bash

Setup system clock

ln -s /usr/share/zoneinfo/Europe/Stockholm /etc/localtime hwclock --systohc --utc

Set the hostname

echo MYHOSTNAME > /etc/hostname

Update locale

echo LANG=en_US.UTF-8 >> /etc/locale.conf echo LANGUAGE=en_US >> /etc/locale.conf echo LC_ALL=C >> /etc/locale.conf

Set password for root

passwd

Add real user remove -s flag if you don't whish to use zsh

useradd -m -g users -G wheel -s /bin/zsh MYUSERNAME

passwd MYUSERNAME

Configure mkinitcpio with modules needed for the initrd image

vim /etc/mkinitcpio.conf

Add 'ext4' to MODULES

Add 'encrypt' and 'lvm2' to HOOKS before filesystems

Regenerate initrd image

mkinitcpio -p linux

Setup grub

grub-install In /etc/default/grub edit the line GRUB_CMDLINE_LINUX to GRUB_CMDLINE_LINUX="cryptdevice=/dev/sdX3:luks:allow-discards" then run: grub-mkconfig -o /boot/grub/grub.cfg

Exit new system and go into the cd shell

exit

Unmount all partitions

umount -R /mnt swapoff -a

Reboot into the new system, don't forget to remove the cd/usb

reboot

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment