Introduction

In this guide we will show you how you can install arch-linux with full disk encryption and using Logical Volume Manager (LVM) under EFI. We will use LUKS as a disk encryption. Basically we need to setup our hard drive and then we can follow pretty much the standard installation method.

Step 1 – HDD Partition

Run  lsblk  command to see the partition structure of the hard drive on which you want to install Arch. In my case it’s sda .

To start partitioning, run this command:

Example output:

Create boot

Remember we are setting a system with EFI. Use keyboard to select the free space

• Hit New -> Enter
• First Sector -> Enter
• Now it will ask you how much space you want to allocate to that partition. In my case I will give boot  1GB
• Size in Sector -> 1GiB –> Enter
• Hex Code of GUID (L to show pres, Enter = 8300) –> EF00 Enter
• Enter partition name – > boot –>Enter

You will notice a 1007.0 KiB BIOS boot partition has also been created. This is normal and needed!

Create LVM Partition

To use encryption on top of LVM, the LVM volumes are set up first and then used as the base for the encrypted partitions. This way, a mixture of encrypted and non-encrypted volumes/partitions is possible as well.

Now here we are going to create only one partition – the LVM partition.
Use keyboard to select the free space

• Hit New -> Enter
• First Sector -> Enter
• Now it will ask you how much space you want to allocate to that partition
  Size in Sector -> xGB -> Enter
• Hex Code of GUID (L to show pres, Enter = 8300) -> Enter
• Enter partition name – > Enter

Now if you run  lsblk  you will see the structure:

Step 2 – Preparing the logical volumes

Now create the LVM partitions root, swap and home. Here sda2  is the second partition we created, the LVM partition.

Now encrypt the partition, format it and mount it:

Important!! We need to format the boot  partition as well! It has to be FAT32 (EFI requirement):

Finally mount all partitions:

Note here that we are not mounting home and swap yet!

Step 3 – Install Arch Linux

Well, here you need to follow the standard arch-linux installation guide! You can find one here:

Step 4 – Post Installation config

Configuring mkinitcpio

Add the keyboard , keymap , lvm2 and  encrypt hooks to mkinitcpio.conf:

Generate the initial ramdisk

Configure Boot-loader

Encrypting logical volume home

Since this scenario uses LVM as the primary and dm-crypt as secondary mapper, each encrypted logical volume requires its own encryption. We are going to encrypt home with both a password and a keyfile.

Let’s generate the keyfile first:

Encrypt home first using a password and then add the generated keyfile:

Open, format and mount home:

Configuring fstab and crypttab

Both crypttab and fstab entries are required to both unlock the device and mount the filesystems, respectively. The temporary swap filesystem will be re-encrypted on each reboot.

crypttab

fstab

Reboot! You are done! Now you can continue installing your favorite desktop environment!

References

• Arch Wiki: Luks on LVM
• 2016 Arch Linux EFI Install Guide Part 1 – Preparation and Disk Partitioning (YouTube)