[VIDEO] Arch Linux with full disk encryption in (about) 15 minutes August 18, 2016 on Drew DeVault's blog

After my blog post emphasizing the importance of taking control of your privacy, I’ve decided to make a few more posts going over detailed instructions on how to actually do so. Today we have a video that goes over the process of installing Arch Linux with full disk encryption.

This is my first go at publishing videos on my blog, so please provide some feedback in the comments of this article. I’d prefer to use my blog instead of YouTube for publishing technical videos, since it’s all open source, ad-free, and DRM-free. Let me know if you’d like to see more content like this on my blog and which topics you’d like covered - I intend to at least release another video going over this process for Ubuntu as well.

Download video (WEBM)

The video goes into detail on each of these steps, but here’s the high level overview of how to do this. Always check the latest version of the Install Guide and the dm-crypt page on the Arch Wiki for the latest procedure.

  1. Partition your disks with gdisk and be sure to set aside a partition for /boot
  2. Create a filesystem on /boot
  3. (optional) Securely erase all of the existing data on your disks with dd if=/dev/zero of=/dev/sdXY bs=4096 - note: this is a correction from the command mentioned in the video
  4. Set up encryption for your encrypted partitions with cryptsetup luksFormat /dev/sdXX
  5. Open the encrypted volumes with cryptsetup open /dev/sdXX [name]
  6. Create filesystems on /dev/mapper/[names]
  7. Mount all of the filesystems on /mnt
  8. Perform the base install with pacstrap /mnt base [extra packages...]
  9. genfstab -p /mnt >> /mnt/etc/fstab
  10. arch-chroot /mnt /usr/bin/bash
  11. ln -s /usr/share/zoneinfo/[region]/[zone] /etc/localtime
  12. hwclock --systohc --utc
  13. Edit /etc/locale.gen to your liking and run locale-gen
  14. locale > /etc/locale.conf - note this only works for en_US users, adjust if necessary
  15. Edit /etc/hostname to your liking
  16. Reconfigure the network
  17. Edit /etc/mkinitcpio.conf and ensure that the keyboard and encrypt hooks run before the filesystems hook
  18. mkinitcpio -p linux
  19. Set the root password with passwd
  20. Configure /etc/crypttab with any non-root encrypted disks you need. You can get partition UUIDs with ls -l /dev/disk/by-partuuid
  21. Configure your kernel command line to include cryptdevice=PARTUUID=[...]:[name] root=/dev/mapper/[name] rw
  22. Install your bootloader and reboot!

Have a comment on one of my posts? Start a discussion in my public inbox by sending an email to ~sircmpwn/public-inbox@lists.sr.ht [mailing list etiquette]

Articles from blogs I read Generated by openring

Summary of changes for November

Hey everyone! This is the list of all the changes we've done to our projects and apps during the month of November. We'll also be reporting in our on position in the world, and on our future plans. Summary Of Changes Donsol, designed a donsol tu…

via Hundred Rabbits December 1, 2021

Announcing chat.sr.ht: a persistent IRC session for sourcehut users

About one month ago, we began a private beta for chat.sr.ht, the next flagship sourcehut product. Starting today, this service is now available to all paid sourcehut users. chat.sr.ht is a hosted IRC bouncer service, which maintains a persistent IRC connectio…

via Blogs on Sourcehut November 29, 2021

Major errors on this blog (and their corrections)

Here's a list of errors on this blog that I think were fairly serious. While what I think of as serious is, of course, subjective, I don't think there's any reasonable way to avoid that because, e.g., I make a huge number of typos, so many tha…

via danluu.com November 22, 2021