Full disk encryption with Arch Linux footnotes
Pavel Kogan has an excellent guide to install Arch Linux with full disk encryption. I've taken the liberty of copying the instructions, adding a couple tweaks:
- Boot the Arch Linux installation medium.
-
Run these commands (You may want to use different sizes for swap and root
volumes):
parted -s /dev/sda mklabel msdos parted -s /dev/sda mkpart primary 2048s 100% parted -s /dev/sda set 1 boot on cryptsetup luksFormat /dev/sda1 cryptsetup luksOpen /dev/sda1 lvm pvcreate /dev/mapper/lvm vgcreate vg /dev/mapper/lvm lvcreate -L 4G vg -n swap lvcreate -L 15G vg -n root lvcreate -l +100%FREE vg -n home mkswap -L swap /dev/mapper/vg-swap mkfs.ext4 /dev/mapper/vg-root mkfs.ext4 /dev/mapper/vg-home mount /dev/mapper/vg-root /mnt mkdir /mnt/home mount /dev/mapper/vg-home /mnt/home
- Go through the software installation steps of the installation guide, skipping the Initramfs and Boot loader steps.
- Install GRUB:
pacman --sync --noconfirm grub
-
In
/etc/mkinitcpio.conf
:-
Change the line starting with
FILES=
toFILES="/crypto_keyfile.bin"
-
On the line starting with
HOOKS=
addlvm2 encrypt
just beforefilesystems
.
-
Change the line starting with
-
Find the UUID of
/dev/sda1
by runningbasename "$(find -L /dev/disk/by-uuid -samefile /dev/sda1)"
-
In
/etc/default/grub
:-
Change the line starting with
GRUB_CMDLINE_LINUX=
toGRUB_CMDLINE_LINUX="cryptdevice=UUID=[UUID]:lvm"
, replacing[UUID]
with your own. - Add a line with
GRUB_ENABLE_CRYPTODISK=y
-
Change the line starting with
-
Run these commands:
dd bs=512 count=4 if=/dev/urandom of=/crypto_keyfile.bin cryptsetup luksAddKey /dev/sda1 /crypto_keyfile.bin chmod 000 /crypto_keyfile.bin chmod -R 700 /boot mkinitcpio -p linux grub-mkconfig -o /boot/grub/grub.cfg grub-install --target=i386-pc /dev/sda
- If necessary, set up your BIOS to allow booting in CSM mode.
It also required me to enter the password using a QWERTY keymap. The instructions to add an alternative keymap to GRUB are rather involved, but I'll try to write them up if I go through with it.
No webmentions were found.