To jump straight to the installation steps go to Installation.
So the other day I decided to finally take the plunge and install ArchLinux. I have never really been a “distro-hopper”. For the most part, I stuck with Ubuntu. Which to be fair served me pretty well.
A few years ago, I made the switch to OSX. And for a while, it was all nice and shiny. But after about 4 years of using OSX, I started to feel that there was a lot about the internals of my machine that I did not understand. And that brings us back to the main topic of this post - Install Arch with Disk Encryption.
It came down to one simple feeling - Ubuntu felt too easy. And that’s a good thing! But I wanted a challenge. So I read up on ArchLinux for about a week and asked my friends who were Arch users for their opinions. And the more I read about it, the more I wanted to try it. By the way, I have never seen a better documentation than the Arch Wiki. I highly recommend that you give it a read, especially the introduction. Without much further ado, lets jump into the installation.
Each of the section below starts with a link to the Arch Wiki which has more details and further reading on the step.
This is not an original piece of work. I researched from a few different sources and am collating here the steps that worked for me. Please see references for the links I used as sources.
This installation assumes the following setup:
- You have UEFI
- You want full disk encryption
- You are not planning on keeping another OS on the machine
- You want to use systemd-boot as your boot manager
- You want to use GNOME as your desktop environment
Step 1: Create a bootable USB disk
- Download the current ISO image from the download page using a convenient method.
- Find out the name of your USB drive with
lsblk. Make sure that it is not mounted.
sudo dd bs=4M if=/path/to/archlinux.iso of=/dev/sdx status=progress oflag=sync
Step 2: Boot into the live media
Step 3: Setup Environment
Skip this step if you are on a wired connection. Otherwise:
# List your wifi device iw dev # setup wifi wifi-menu -o <device name>
timedatectl set-ntp true
lsblk to find your HD/SSD. Lets say its
cgdisk /dev/sdX # 1. 512MB EFI partition # Hex code ef00 # 2. 100% size partiton # (to be encrypted) Hex code 8300
mkfs.vfat -F32 /dev/sdX1 mkfs.ext4 /dev/sdX2
Create Encypted Volumes
# Setup encryption # aes - Encryption block cipher # xts - Block cipher encryption mode # plain64 - the initial vector is the 64-bit little-endian version of the sector number, padded with zeros if necessary. cryptsetup -c aes-xts-plain64 -y --use-random luksFormat /dev/sdX2 # Open newly created encrypted block cryptsetup luksOpen /dev/sdX2 cryptlvm # Create encrypted partitions # This creates one partions for root, modify if /home or other partitions should be on separate partitions pvcreate /dev/mapper/cryptlvm vgcreate vg0 /dev/mapper/cryptlvm lvcreate --size 8G vg0 --name swap lvcreate -l +100%FREE vg0 --name root # Create filesystems on encrypted partitions mkfs.ext4 /dev/mapper/vg0-root mkswap /dev/mapper/vg0-swap
mount /dev/mapper/vg0-root /mnt # /mnt is the installed system swapon /dev/mapper/vg0-swap mkdir /mnt/boot mount /dev/sdX1 /mnt/boot
Step 4: Install OS
pacstrap /mnt base base-devel grub-efi-x86_64 zsh vim git efibootmgr dialog wpa_supplicant
Step 5: Setup OS
Generate an fstab file
genfstab -U /mnt >> /mnt/etc/fstab
Its a good idea to check the contents of
/mnt/etc/fstab at this point and make sure it looks all good.
CHROOT into the new system
arch-chroot /mnt /bin/bash
Setup system clock
ln -sf /usr/share/zoneinfo/Europe/London /etc/localtime hwclock --systohc
en_GB.UTF-8 UTF-8 and other needed localizations in
/etc/locale.gen, and generate them with:
Set the LANG variable in `/etc/locale.conf accordingly, for example:
echo LANG=en_GB.UTF-8 > /etc/locale.conf
Make your keyboard layout persistent
echo KEYMAP=uk > /etc/vconsole.conf
Setup Network Configuration
MYHOSTNAME with your hostname in the command below.
echo MYHOSTNAME > /etc/hostname
Add matching entries in
127.0.0.1 localhost ::1 localhost 127.0.1.1 MYHOSTNAME.localdomain MYHOSTNAME
At this point in the setup, you will be logged in as the
root user. You should create a password for the
You should also create a regular user.
# If you would like to use a different shell than `zsh` change appropriately useradd -m -g users -G wheel -s /bin/zsh MYUSERNAME passwd MYUSERNAME
Create a new
# Add ext4 to Modules MODULES=(ext4) # Edit the `HOOKS` line to look like this HOOKS=(base udev autodetect keyboard keymap modconf block encrypt lvm2 resume filesystems fsck)
NOTE: It is important that you don’t change the order of the
HOOKS line as that is the order in which the kernel
modules will be loaded.
Generate the image.
mkinitcpio -p linux
bootctl --path=/boot install
title Arch Linux linux /vmlinuz-linux initrd /initramfs-linux.img options cryptdevice=UUID=<UUID for /dev/sdX2>:lvm:allow-discards resume=/dev/mapper/vg0-swap root=/dev/mapper/vg0-root rw quiet
You can get the UUID to your partition using
blkid (might have to use sudo).
timeout 0 default arch editor 0
Step 6: Finish installation and reboot into new system
exit umount -R /mnt reboot
At this point you have a base installation of ArchLinux. Login you created a user account, use that, or
simply use the
root credentials. It is not recommended to stick with
root credential for a prolonged period of time.
Step 7: Post Installation
In the following steps, you will have to use
sudo if you are not the
Install PulseAudio Server
pacman -Su pulseaudio pulseaudio-alsa
pacman -Su gnome
You can choose to install the
gnome-extra package as well. See link above for details.
pacman -Su xorg
systemctl enable gdm.server
pacman -Su networkmanager
Optional Step: Install Firewall
pacman -Su ufw
And that’s it. Just run
reboot to restart your system.
- Gist: Minimal instructions for installing arch linux on an UEFI system with full system encryption using dm-crypt and luks
- Gist: Installing Arch Linux on an LUKS Encrypted root and booting from UEFI
- Gist: Installing Arch with GPT, dm-crypt, LUKS, LVM and systemd-boot
- Gist: Efficient Encrypted UEFI-Booting Arch Installation
- All the Arch Wiki links mentioned during the installation steps.