=====Ubuntu 18 Bionic Beaver LTS on removable SSD=====
//With Secure Boot and rootfs LUKS encryption//

**Notes:**
  * Was not able to install /boot on the encrypted partition. The signed grub loader doesn't seem to have all required modules signed. So I've installed /boot onto the ESP partition.

====Install required packages====
  * Install debootstrap:<code>apt install debootstrap</code>

====Perpare SSD====
  * First unmount (auto)mounted partitions.
  * Partition the SSD. Start at sector 65535, for correct alignment of my SSD drive. Create a 512MiB UEFI ESP and 32GiB partition for Ubuntu.<code>parted --script /dev/sdX              \
    mklabel gpt                       \
    mkpart ESP fat32 65535s 1114095s  \
    toggle 1 boot                     \
    mkpart Ubuntu 1179630s 68287470s
</code>
  * Format the ESP:<code>mkfs.fat -F32 -n ESP /dev/sdX1</code>
  * Create an encrypted partiton for Ubuntu:<code>cryptsetup luksFormat /dev/sdX2
cryptsetup open /dev/sdX2 cryptroot
mkfs.ext4 /dev/mapper/cryptroot</code>

====Install Ubuntu 18 Bionic Beaver LTS====
  * Mount root partition:<code>mount /dev/mapper/cryptroot /mnt</code>
  * Mount ESP as /boot:<code>mkdir -p /mnt/boot
mount /dev/sdX1 /mnt/boot</code>
  * Install Ubuntu.<code>debootstrap --arch amd64 bionic /mnt http://mirror.transip.net/ubuntu/ubuntu</code>
  * Enter chroot:<code>mount -t proc none /mnt/proc
mount -t sysfs none /mnt/sys
mount -o bind /dev /mnt/dev
cp -L /etc/resolv.conf /mnt/etc

XTERM=xterm-color LANG=en_US.UTF-8 PATH="$PATH:/bin:/sbin:/usr/sbin" chroot /mnt bash
export PS1="\e[0;31m\u@CHROOT:\w# \e[m"</code>
  * Create new user:<code>useradd -d /home/user -G sudo -m -s /bin/bash user
passwd user</code>
  * Configure locales and timezone:<code>dpkg-reconfigure locales tzdata</code>
  * Add root and boot filesystem to /etc/fstab:<code>
# Lookup UUID's:
#     blkid /dev/sdb1    # ESP
#     lsblk -f /dev/sdb2    # run from outside chroot, this is the UUID of the / ext4 partition, not LUKS!

/etc/fstab
UUID=<UUID root filesystem> /               ext4    errors=remount-ro 0       1
UUID=<UUID ESP>             /boot           vfat    defaults          0       2
</code>
  * Update apt repository sources:<code>cat > /etc/apt/sources.list <<EOF
deb http://nl.archive.ubuntu.com/ubuntu/ bionic main restricted
deb http://nl.archive.ubuntu.com/ubuntu/ bionic-updates main restricted
deb http://nl.archive.ubuntu.com/ubuntu/ bionic universe
deb http://nl.archive.ubuntu.com/ubuntu/ bionic-updates universe
deb http://nl.archive.ubuntu.com/ubuntu/ bionic multiverse
deb http://nl.archive.ubuntu.com/ubuntu/ bionic-updates multiverse
deb http://nl.archive.ubuntu.com/ubuntu/ bionic-backports main restricted universe multiverse
deb http://security.ubuntu.com/ubuntu bionic-security main restricted
deb http://security.ubuntu.com/ubuntu bionic-security universe
deb http://security.ubuntu.com/ubuntu bionic-security multiverse
EOF

</code>
  * Update packages:<code>apt update
apt upgrade</code>
  * Install required packages. **Don't select a disk to install grub onto! Continue without installing grub.**<code>apt install linux-image-generic efibootmgr grub-efi-amd64-signed cryptsetup initramfs-tools shim-signed</code>
  * Configure crypttab:<code># Lookup UUID with blkid
#    blkid /dev/sdb2

echo "cryptroot UUID=<UUID> none luks" >> /etc/crypttab</code>
  * Configure grub:<code>cat >> /etc/default/grub <<EOF
GRUB_ENABLE_CRYPTODISK=y
GRUB_DISABLE_OS_PROBER=true
EOF</code>
  * Configure initramfs:<code>sed -i '/^#CRYPTSETUP=/c\CRYPTSETUP=y' /etc/cryptsetup-initramfs/conf-hook

echo RESUME=none > /etc/initramfs-tools/conf.d/resume

update-initramfs -k all -u
</code>
  * Install and configure grub:<code>grub-install --uefi-secure-boot --target=x86_64-efi --boot-directory=/boot --efi-directory=/boot --recheck --no-nvram

update-grub
</code>
  * Install the default desktop:<code>apt install ubuntu-desktop</code>
  * Exit the chroot and test your new installation:<code>exit
cd
umount /mnt/boot
umount /mnt/proc
umount /mnt/sys
umount /mnt/dev
umount /mnt
cryptsetup close /dev/mapper/cryptroot

</code>


{{tag>[hardware Ubuntu linux ssd]}}