My Arch Linux Build
My first dive into Linux was when I was 14 or 15 years old. I had been following a bunch of hacking forums for years and kept hearing about “BackTrack Linux” (the OG hacking distro, precursor to Kali). Back then, all I knew about Linux was that it was some alternative to Windows that hackers used. It fascinated me. I read and watched everything I could find about it. I couldn’t believe that it was free! I couldn’t believe the number of hacking tools it came with! In my young mind, all it would took to become a hacker was installing BackTrack. Following their wiki, I was able to create a persistent, live USB that I could boot to on my computer. Naturally, I immediately ran a brunch of programs and turned into the worlds wimpiest script kitty. With some practice, I managed to man-in-the-middle my dad’s computer and crack the WiFi password (that I already knew). That was about as far as my hacking career went.
After several attempted dual boots, a misaligned Windows partition, and countless broken installs, I was comfortably running BackTrack along side Windows on by crappy, high school Acer NetBook. Just like the pros! I quickly lost interest in hacking, drawn instead to the world of Linux. I became a distro hopping fiend, trying every flavor of Linux I could get my hands on. I created an insane number of live USBs and eventually learned how to use VirtualBox to avoid my computer’s minute-long reboots. I was well on my way to becoming a Linux master!
And then it happened. 11th grade rolled around and I was issued a school computer. A MacBook, filled to the brim with parental controls and monitoring software. The Acer was handed down to my sister and I was left, stuck between the confines of the school’s IT department and the Apple ecosystem. It wasn’t until the end of my senior year (when I no longer cared if my computer broke), that I took the weeks long plunge into dual booting Linux on my MacBook. I spent many hours reading through tutorials and man pages, trying to figure out how to boot to a live USB. Once I got that working, I stumbled upon rEFIt (now rEFInd), which unlocked the boot loader and allowed me to successfully install Linux!
College rolled around and I abandoned the security of Windows all together, switching to Linux as my main operating system. It has been a journey trying to keep everything running smoothly. The NVida card that came with my new Dell didn’t help. I came to favor Ubuntu’s LTS releases, since they offered stability and compatibility with most of the software my classes required.
Now that I have some solid years of Linux experience under my belt, it is time. Time for me to take the rite of passage and install Arch Linux. Below I will outline the exact steps I use for this process, partly for your benefit, dear reader, but mostly so that I can replicate them if it ever falls apart. I will detail the steps I use for customizing it in another post.
- UEFI w/ Secure Boot
- BTRFS filesystem
- LUKS encryption
- SSD support
- Swap partition
- ZSH shell with Oh-My-ZSH
- NVidia support
First thing first, we need internet. I have an Ethernet connection so I didn’t have to configure anything. If you are using WiFi, follow these steps. Now lets make sure we are connected:
Next we need to partition our hard drive(s). I will be setting up three partitions:
|/mnt/boot||/dev/sda1||EFI System||FAT32||550 MB|
|[swap]||/dev/sda2||Linux swap||SWAP||4 GB|
The first partition is going to be the boot partition. This is required for UEFI and for performance reasons, must remain unencrypted. Make sure that secure boot is enabled to ensure it is not tampered with.
Second, we have a partition that will be used for swap. This isn’t required unless you want the ability to hibernate, in which case you need a swap partition that is at least as big as the amount of RAM your system has. My system has 16 GB, so I would need a 16+ GB swap partition. Swap can also be used if your system ever runs out of RAM, by temporarily writing data from RAM to the hard drive. These days, computers have enough RAM that this will likely never happen. If it ever does, your system will slow to a crawl and it won’t do you any good anyway. Personally, I don’t care for hibernation but I am still reserving a couple of GBs for the odd program that wants to makes use of it.
The last partition will be our root partition. This will be where Linux is installed. Because we are using BTRFS, we will be dividing it into subvolumes before installing. If you ever choose to add additional hard drives to your system, BTRFS can easily be expanded to include that drive.
We will be using fdisk to create the partitions noted above. Run the following to display the available hard drives:
I only have one SSD that I will be installing to. Eventually, I will update this for installing two drives with RAID1. My drive is
/dev/sda. Replace all occurrences of this with the name of your drive below.
NOTE: Ignore any
Open the device for editing:
Create a GPT partition table:
Create the EFI partition:
n, default number, default first sector, +550M.
Create the swap partition:
n, default number, default first sector, +4G.
Create the root partition:
n, default number, default first sector, default last sector.
Now we need to set the partition types. This only sets a flag on the partition, it does not create the file systems. We’ll do that next. Set the first partition to EFI:
t, 1, 1. Set the second partition to swap:
t, 2, 19. You can see a list of partition types and their codes by running
Now that we have all of the partitions set up, run
p to print the planned partition table. Once you are satisfied that everything looks correct, run
w to write the changes.
Create File Systems
We’ll start out by creating a FAT32 file system on the boot partition. UEFI requires the partition be FAT12, FAT16 or FAT32 but I’ve never heard of anyone using anything other than FAT32.
Before we encrypt the swap and root partitions, we need to find the encryption algorithm that runs the best on our hardware. Most modern CPUs have built-in support for certain algorithms. To find this, run the following and choose the top option.
My system has runs significantly faster with
aes-xts-plain64 so I will be using it for my install. If yours is different, replace it in the commands below. Now we want to set up LUKS on the root partition. We will be using
LUKS1 since GRUB does not yet support
LUKS2. We will also be setting the alignment for better SSD support.
We are also encrypting the swap partition.
Last but not least, lets install BTRFS on the root partition:
And there you have it! We have successfully set up all of the partitions and file systems needed for our Arch install.
Now that we have BTRFS set up, we need to configure it so that it will work with snapshots. BTRFS uses subvolumes for this. At the top we have the root level. Below this, there can be any number of different subvolume trees. Only subvolumes below the root can be snapshotted. So if you want to take snapshots of the root Arch install, this needs to be installed below the BTRFS root level. To read more about this, see the SysAdmin Guild.
I will be creating three subvolume: root, home, and snapshots. Root will contain the entire Linux filesystem, except for /home, which will be in the home subvolume. This way, I can easily take snapshots of the system, without including my personal documents (recommended). It is also possible to take snapshots of the home subvolume, but these snapshots will be large, due to frequent file changes. All of these snapshots will be stored in the snapshots subvolume, for simplicity.
To do this, we mount the root partition (that we unencrypted earlier), and use the btrfs utility to create subvolumes.
In order to correctly install linux, we need to remount each subvolume to the correct path within the system. For example, we want to mount the home subvolume at /home, so that all of the linux files for home are written there. First we need to create the mount locations.
When we mount the subvolumes, we will be using the following options. We want to use lzo compression since it is the fastest. We set ssd so that it is optimized for our hard drive. And we use noatime because btrfs requires it.
Now we mount our subvolumes. We will be using /mnt as the base for our install, which is where we will mount the root subvolume. The home subvolume will be mounted to /mnt/home. The snapshot subvolume will be mounted to the hidden directory /mnt/.snapshots. And lastly, the EFI boot partition we made previously will be mounted to /mnt/boot.
We are now ready to install Arch!
To install, we are just running pacstrap. Most tutorials only list
base in the pacstrap install. These are outdated. Base no longer includes the linux package. Here we are installing base, linux and linux-firmware. We are also installing support for btrfs (btrfs-progs), my Intel CPU (intel-ucode), grub (grub and efibootmgr), networking (iproute2 and dhcpcd) and of course vim.
We need to generate /etc/fstab so that our system knows what to mount each time we boot. In our case, all of the BTRFS subvolumes and the swap partition. Luckily, a utility exists for generating this for us:
Now that everything is installed, we are going to chroot into the system to configure Arch. Chroot allows us to run commands as if we were booted into the system.
Set the timezone to your location:
Set the hardware clock:
Set your locale by editing the following file and uncommenting the correct line (in my case
Create a locale configuration file:
Set your keyboard layout:
Set your hostname:
Configure /etc/hosts as below:
Set the root password:
Fix Boot Settings
In order to get our system to boot properly with btrfs, we need to add
btrfs to initramfs HOOKS:
We also need to add our swap partition to /etc/crypttab so that it is properly decrypted during boot:
swap /dev/sda2 /dev/urandom swap,offset=2048,cipher=aes-xts-plain64,size=256
Last thing we need to do to set up our system is installing Grub. Right now, Grub is the only boot loader with support for encrypted BTRFS.
And now we reboot…
If the system booted in under a minute, then everything should be set up correctly with LUKS. Lets check that all three of our BTRFS subvolumes are mounted:
Lets also check that the swap partition unencrypted properly:
Finally, lets take a snapshot of our brand new install before we accidentally ruin it:
And we’re done! Time to configure…