arch linux installation

The steps I use to get an intial install of Arch Linux. It includes both BIOS/MBR and UEFI/GPT steps as I've got a mixture of old and new hardware.

It will create an installation with block device device encryption (aside from the boot partition) using LVM on LUKS (via dm-crypt). The boot partition can be better secured using UEFI if you're able to sign the bootloader.

Additional Files

• sshd_config - a hardened, production grade OpenSSH example config
• sysctl.conf - tweaked kernel settings for better security

Assumptions

The guide assumes that /dev/sda is the system disk

Steps

1. Boot up the arch installer

2. Change to UK keyboard (arch defaults to US)

   loadkeys uk

3. If wifi connection is needed

   iwctl
   [iwd]> station $device connect $ssid

4. BIOS/MBR based install

   1. fdisk /dev/sda

   2. Create an MBR partition table

      (fdisk) o

   3. Creates two paritions, boot and root

      (fdisk) n
      (fdisk) p
      (fdisk) 1
      (fdisk) <Enter>
      (fdisk) +500M
      (fdisk) t
      (fdisk) 83
      
      (fdisk) n
      (fdisk) p
      (fdisk) 2
      (fdisk) <Enter>
      (fdisk) <Enter>
      (fdisk) t
      (fdisk) 83
      
      (fdisk) w

   4. Format the boot partition

      mkfs.ext2 /dev/sda1

5. UEFI/GPT based install

   1. Create the partitions

      cgdisk /dev/sdx
      1 500MB EFI partition # Hex code = ef
      2 100% / partition        # Hex code = 83

   2. Format the boot partition

      mkfs.fat -F32 /dev/sda1

6. Create the encrypted partition and open it

   cryptsetup --verify-passphrase luksFormat /dev/sda2 --type luks2
   cryptsetup luksOpen /dev/sda2 cryptroot

7. Create an encryption key for grub (so the passphrase isn't prompted twice) and put it on slot 0 for added boot speed. Note this does improve convenience at the cost of security as the key becomes a point of weakness

   dd if=/dev/urandom of=/root/keyfile.bin bs=1024 count=4
   chmod 000 /root/keyfile.bin
   cryptsetup luksAddKey /dev/sda2 /root/keyfile.bin

8. Create the logical volumes inside the encrypted partition

   pvcreate /dev/mapper/cryptroot
   vgcreate system /dev/mapper/cryptroot
   lvcreate --size 16G system --name swap
   lvcreate -l +100%FREE system --name root

9. Create the filesystems on encrypted partitions

   mkfs.ext4 /dev/mapper/system-root
   mkswap /dev/mapper/system-swap

10. Mount the partitions

    mount /dev/mapper/system-root /mnt
    swapon /dev/mapper/system-swap
    # UEFI/GPT
    mkdir -p /mnt/boot/efi
    mount /dev/sda1 /mnt/boot/efi
    # BIOS/MBR
    mkdir -p /mnt/boot
    mount /dev/sda1 /mnt/boot

11. Install base system

    pacstrap /mnt \
        base \
        linux \
        linux-firmware
        bash \
        vim \
        iwd \
        sudo
    # UEFI/GPT
    pacstrap /mnt \
        efibootmgr \
    # BIOS/MBR
    pacstrap /mnt \
        grub-bios

12. Generate fstab. For SSD's change relatime on all non-boot partitions to noatime to reduce wear

    genfstab -pU /mnt >/mnt/etc/fstab

13. Copy the Grub crypto key into the root partition

    cp /keyfile.bin /mnt

14. Enter the new system

    arch-chroot /mnt /bin/bash

15. Set locale

    vim /etc/locale.gen # uncomment any locales needed, ie en_GB.UTF-8
    locale-gen
    echo LANG=en_GB.UTF-8 >/etc/locale.conf

16. Set the default paper size

    echo a4 > /etc/papersize

17. Install base packages

    pacamn-key --init
    pacman -S \
        dialog \
        gnome-terminal \
        lvm2 \
        mesa \
        xorg-server

18. mkinitcpio

    vim /etc/mkinitcpio.conf
    ## Add 'keyboard keymap' to HOOKS before 'block'
    ## Add 'encrypt lvm2' to HOOKS before 'filesystems'
    sed -i 's\^FILES=.*\FILES="/keyfile.bin"\g' /etc/mkinitcpio.conf
    mkinitcpio -p linux

19. grub

    vim /etc/default/grub
    # GRUB_HIDDEN_TIMEOUT=0
    # GRUB_HIDDEN_TIMEOUT_QUIET=true
    # GRUB_ENABLE_CRYPTODISK=y
    # GRUB_CMDLINE_LINUX="cryptdevice=/dev/sda2:cryptroot root=/dev/mapper/system-root"
    # GRUB_CMDLINE_LINUX="cryptdevice=UUID=...:cryptroot root=UUID=..."
    
    # UEFI/GPT
    grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id="Arch"
    # BIOS/MBR
    grub-install --target=i386-pc /dev/sda
    
    grub-mkconfig -o /boot/grub/grub.cfg

20. Create users

    useradd --create-home --user-group --group wheel rob
    passwd rob

21. Enable wheel group

    sed -i '/%wheel ALL=(ALL) ALL/s/^#//' /etc/sudoers

22. Set hostname

    echo "robs-machine" >/etc/hostname
    echo "127.0.1.1 robs-machine.localdomain    robs-machine" >> /etc/hosts

23. System clock

    ln -sf /usr/share/zoneinfo/Europe/London /etc/localtime
    hwclock --systohc --utc

24. NTP

    pacman -S --noconfirm ntp
    systemctl enable ntpd

25. Hardening

    # disable root password
    passwd -l root
    # reduce permissions on sensitive files
    chmod 700 /boot /etc/iptables

26. Entropy services

    pacman -S --noconfirm rng-tools haveged
    systemctl enable haveged
    systemctl enable rngd

27. Pacman

    pacman -S --noconfirm pacman-contrib
    systemctl enable paccache.timer

28. Systemd

    systemctl enable systemd-homed
    

29. Login

    pacman -S lightdm lightdm-gtk-greeter
    systemctl enable lightdm

30. Desktop

    pacman -S cinnamon nemo-fileroller nemo-preview

31. NetworkManager

    pacman -S networkmanager gnome-keyring
    pacman -S --noconfirm dnsmasq networkmanager-openvpn network-manager-applet libsecret
    echo "[main]
    dns=dnsmasq" | sudo tee /etc/NetworkManager/NetworkManager.conf
    systemctl enable NetworkManager

32. Clean up and reboot

    exit
    umount -R /mnt
    swapoff -a

Next Steps...