techWebsite/content/posts/archInstall.md

+++ title = "Archlinux install with btrfs, systemd-boot, full-disk encryption, and suspend-to-disk" date = 2021-04-11T19:19:51-05:00 draft = false +++

I've been using Arch Linux for several years now. Of course, my first installs were... blunderous, as i wanted to do full disk encryption from the get-go, and I didn't know what I was doing. After those first one or two installs, I generally settled on LVM on LUKS with a GRUB bootloader and my swap on an LVM volume, mostly because it makes it much easier to setup hibernation/suspend to disk vs, say, a swap file. (with a swap file, you have to deal with file offsets, and I have never gotten a satisfactory answer as to whether its possible for the filesystem to just move a file to a different disk sector in the process of, say, defragging with a very full hard drive.)

With my newest laptop, I decided to try out btrfs, in large part due to its snapshot system and ability to transfer those snapshots over a network. (I'm hoping to make a lightweight filesystem backup using this, on top of the data-level backups I currently use.)

However, suspend-to-disk is also quite important to me, and the Arch Wiki is really only clear on how to do that with unencrypted partitions, LVM on LUKS, and on swapfiles. The Archwiki has some info on how to do it for the encrypt hook with a custom mkinitcpio hook, or with sd-encrypt hooks by just specifying multiple devices, but I didn't want to be writing a ton of custom config for the encrypt hook, and the section on sd-encrypt was not very clear at all, so I decided to do some experimentation and write up what worked for me.

A note on security and risk profiles

The encryption schema I am setting up in this guide is only meant to protect your data from theft of your physical device when it is turned off or suspended to the disk. Full disk encryption will not protect you from anything while you laptop is powered on. After boot, the encryption is completely transparent to userspace.

Also, I did am not encrypting the boot partition, and I'm not setting up any sort of secure boot. This means that an attacker could hypothetically replace your boot partition or firmware and keylog your password, so if you suspect your computer has been tampered with, don't boot it up.

To reiterate, this setup by itself only protect your data if your powered down machine is stolen. It does not protect you data from being stolen in any scenario where your laptop is powered on during tampering or you log in after it has been tampered with.

Things you should do first

Because some things are quite dependent on your system and network, as well as the type of system you end up with, I will not be detailing some of the early setup steps, such as creating and booting from the arch ISO, or the final steps, such as setting up a graphical environment. Also, some of the middle steps require some modification depending on what sort of final setup you want, and your hardware. I will call out those modifications in the relevant steps.

All this said, I would discourage you from blindly following this guide if its your first time installing arch (or a similarly DIY distro like Gentoo). You should clearly understand what most of these commands do before typing them in.

Anyway, start by booting up the arch ISO...

Installing via ssh

Sometimes, you don't want to be switching from the computer you are installing Linux on and the computer with the documentation and a search engine on it, and I've found the best way to avoid that is to set up a simple ssh session from the arch ISO to the computer with the documentation on it.

⚠️ WARNING: On a normal, already installed machine, NEVER use just a password for SSH. ESPECIALLY if it is internet-facing or connected to a public network. We are only doing this because we are (hopefully) on a personal network, and the password-based SSH session only exists on the Arch ISO, so as soon as you boot into your fresh system, the SSH session will be gone.

On the installee, make a password for the root account

{{<highlight console "linenos=false">}} $ passwd {{}}

Enable SSH using

{{<highlight console "linenos=false">}} $ systemctl start sshd.service {{}}

Find the ip address with

{{<highlight console "linenos=false">}} $ ip addr show {{}}

You are looking for a line like

{{<highlight console "linenos=false">}} inet 192.168.1.162/24 brd 192.168.1.255 scope global dynamic enp0s25 {{}}

In this case, my LAN IP is 192.168.1.162

Now, on the pc you are going to be SSHing from,

{{<highlight console "linenos=false">}} $ ssh root@[ip we just found on installee] {{}}

And type in the password you set on the installee

Now lets continue with the installation.

initial setup

Verify you are connected to the internet

{{<highlight console "linenos=false">}} $ ping 1.1.1.1 {{}}

Turn on ntp

{{<highlight console "linenos=false">}} $ timedatectl set-ntp true {{}}

Partitioning

Create partitions using the tools of your choice. I will be using the following partition map.

An EFI partition of 512M

A swap partition with a size equal to your RAM.

A btrfs partition containing the rest of the space.

Encryption

Encrypt the btrfs partition with

{{<highlight console "linenos=false">}} $ cryptsetup luksFormat /dev/sda3

$ cryptsetup config --label="btrfs" /dev/sda3 {{}}

and enter the encryption passkey. I recommend making it a full sentence for security.

Encrypt the swap partition. Use the same password as last time.

{{<highlight console "linenos=false">}} $ cryptsetup luksFormat /dev/sda2

$ cryptsetup config --label="swap" /dev/sda2 {{}}

now open the newly encrypted partitions.

{{<highlight console "linenos=false">}} $ cryptsetup open /dev/sda2 swap

$ cryptsetup open /dev/sda3 btrfs {{}}

Filesystem creation

Format the EFI partition with FAT32 and give it the label EFI (label can be something else.)

{{<highlight console "linenos=false">}} $ mkfs.vfat -F32 -n EFI /dev/sda1 {{}}

Format the swap partition as swap

{{<highlight console "linenos=false">}} $ mkswap /dev/mapper/swap {{}}

Format the root partition with btrfs and give the label root (label can be something else.)

{{<highlight console "linenos=false">}} $ mkfs.btrfs -L btrfs /dev/mapper/btrfs {{}}

Creating and mounting subvolumes

{{<highlight console "linenos=false">}} $ mount /dev/mapper/btrfs /mnt

$ btrfs subvolume create /mnt/root

$ btrfs subvolume create /mnt/home

$ umount /mnt {{}}

Mount subvols and EFI partition

{{<highlight console "linenos=false">}} $ mount -o noatime,nodiratime,compress=zstd,ssd,discard,subvol=root /dev/mapper/btrfs /mnt

$ mkdir /mnt/home

$ mount -o noatime,nodiratime,compress=zstd,ssd,discard,subvol=home /dev/mapper/btrfs /mnt/home

$ mkdir /mnt/boot

$ mount /dev/sda1 /mnt/boot

$ swapon /dev/mapper/swap {{}}

installing base system, generating *stab

Install the base packages. Adjust the package list to suit your needs. Change intel-ucode to amd-ucode if using an AMD processor.

{{<highlight console "linenos=false">}} $ pacstrap /mnt linux linux-firmware base base-devel btrfs-progs zsh neovim git stow tmux networkmanager openvpn fzf htop rsync tree xdg-user-dirs python tree openssh w3m curl intel-ucode {{}}

Generate an fstab

{{<highlight console "linenos=false">}} $ genfstab -U /mnt > /mnt/etc/fstab {{}}

Make /mnt/etc/crypttab.initramfs containing:

{{}} #our swap device swap LABEL=swap

#our main device btrfs LABEL=btrfs {{}}

system config

Chroot into the new system

{{<highlight console "linenos=false">}} $ arch-chroot /mnt/ {{}}

Set time zone.

{{<highlight console "linenos=false">}} $ ln -sf /usr/share/zoneinfo/Region/City /etc/localtime {{}}

Run hwclock

{{<highlight console "linenos=false">}} $ hwclock --systohc {{}}

Uncomment needed locales in /etc/locale.gen (you always need to at least uncomment en_US.UTF-8 UTF-8.)

Gen locales

{{<highlight console "linenos=false">}} $ locale-gen {{}}

Set LANG variable

{{<highlight console "linenos=false">}} $ echo 'LANG=en_US.UTF-8' > /etc/locale.conf {{}}

Create the hostname file

{{<highlight console "linenos=false">}} $ echo '[myhostname]' > /etc/hostname {{}}

And add matching entries to /etc/hosts, like so (if static ip, use that. if dynamic, use 127)

{{}} 127.0.0.1 localhost ::1 localhost 127.0.1.1 myhostname.localdomain myhostname {{}}

installing the boot loader

Edit /etc/mkinitcpio.conf so the HOOKS line looks like this:

{{<highlight console "linenos=false">}} HOOKS=(base systemd udev autodetect modconf block sd-encrypt btrfs resume filesystems keyboard fsck) {{}}

And regen the initramfs

{{<highlight console "linenos=false">}} $ mkinitcpio -p linux {{}}

Install systemd-boot

{{<highlight console "linenos=false">}} $ bootctl install {{}}

Create /boot/loader/entries/arch.conf containing: (again, change intel to amd depending on processor.)

{{}} title Arch Linux linux /vmlinuz-linux initrd /intel-ucode.img initrd /initramfs-linux.img options root=/dev/mapper/btrfs rootflags=subvol=/root resume=/dev/mapper/swap {{}}

Edit /boot/loader/loader.conf and add:

{{}} default arch.conf timeout 2 console-mode max editor no {{}}

system config

Set root password

{{<highlight console "linenos=false">}} $ passwd {{}}

Exit and shutdown the system

{{<highlight console "linenos=false">}} $ exit

$ shutdown now {{}}

Remove the install media, and boot back up. Make sure everything boots. From now on, configure the system as normal.

configuring userspace

Add a non-root user

{{<highlight console "linenos=false">}} $ useradd -m -G wheel -s /bin/sh your_username $ passwd your_username {{}}

Symlink neovim to vi (assuming you installed neovim but not vi. Modify as your installed packages call for.)

{{<highlight console "linenos=false">}} $ ln -s /usr/bin/nvim /usr/bin/vi {{}}

Configure sudo

{{<highlight console "linenos=false">}} $ visudo {{}}

Uncomment the line that reads

{{<highlight console "linenos=false">}} %wheel ALL=(ALL) ALL {{}}

Enable multilib: uncomment the following lines in /etc/pacman.conf

{{<highlight console "linenos=false">}} [multilib] Include = /etc/pacman.d/mirrorlist {{}}

Congrats! You now have a barebones, but functional, encrypted arch install!