Ben's notes

Updated 2015-08-03: newer ISO version, updated kernel, better supported now…

• Disable Secure boot
• Disable Intel Rapid Start
• Disable Intel(R) AMT
• Disable Intel NFF Control
• Disable Computrace Module Activation
• Optional: enable Fn Sticky Key

• Download ISO, for example: archlinux-2015.08.01-dual.iso
• Create USB drive:

  dd if=archlinux-2015.08.01-dual.iso of=/dev/<usbkey> bs=1M

• Connect the ethernet adapter.
• Boot laptop, press enter to interrupt boot.
• Press F12, select USB HDD
• Boot Arch Linux (x86_64)
• If display is HiDPI, change fontsize:

  setfont sun12x22

• If you do not have IP connectivity yet, get DHCP lease:

  dhclient enp0s25

• Update packages:

  pacman -Sy

• Install gpart:

  pacman -S gpart

• Install and run OpenSSHd so that we can login remotely to complete the install.

  pacman -S openssh
  passwd root
  systemctl start sshd

• Destroy old GPT partitions:

  wipefs /dev/sda -a
  sgdisk --zap /dev/sda

• If you used the SDD before, please securely erase the drive first.
• Check with fdisk to see if the partition table is empty.
• Create 512MiB EFI partition (gpart).
• Create a new (rest of the disk) LVM partition (gpart).
• Format EFI partiton:

  mkfs.vfat -F32 /dev/sda1

• Encrypt harddrive:

  cryptsetup -c aes-xts-plain64 -h sha256 -s 512 luksFormat /dev/sda2

• Check results:

  cryptsetup luksDump /dev/sda2

• Open the device:

  cryptsetup luksOpen /dev/sda2 lvm

• Create LVM PV, VG and LVs:

  pvcreate /dev/mapper/lvm
  vgcreate ssd /dev/mapper/lvm
  lvcreate -L 8G ssd -n swapvol
  lvcreate -l +100%FREE ssd -n rootvol

• Create filesystems:

  mkfs.ext4 /dev/mapper/ssd-rootvol
  mkswap /dev/mapper/ssd-swapvol

• Mount filesystems:

  mount /dev/ssd/rootvol /mnt
  mkdir -p /mnt/boot/efi
  mount /dev/sda1 /mnt/boot/efi
  swapon /dev/ssd/swapvol

• Bootstrap base:

  pacstrap /mnt base

• Generate fstab:

  genfstab -L -p /mnt >> /mnt/etc/fstab

• chroot into installtion:

  arch-chroot /mnt

• Set hostname:

  echo yourhostname > /etc/hostname

• Configure timezone:

  ln -sf /usr/share/zoneinfo/Europe/Amsterdam /etc/localtime

• Generate locale:

  vi /etc/locale.gen # search for _US, uncomment
  locale-gen
  echo LANG=en_US.UTF-8 > /etc/locale.conf

• Create encryption key file to be able to 'login once':

  dd bs=512 count=4 if=/dev/urandom of=/crypto_keyfile.bin

• Add keyfile:

  cryptsetup luksAddKey /dev/sda2 /crypto_keyfile.bin

• Generate initrd:

  mkinitcpio -p linux

• Set root password:

  passwd

• Install grub:

  pacman -S grub freetype2 dosfstools efibootmgr

• Edit /etc/mkinitcpio.conf and add:

  HOOKS=...encrypt lvm2...
  FILES=/crypto_keyfile.bin

• Run mkinitcpio again:

  mkinitcpio -p linux

• Changes access rights to crypto key:

  chmod 000 /crypto_keyfile.bin

• Edit grub config:

  vi /etc/default/grub
  GRUB_ENABLE_CRYPTODISK=y
  GRUB_CMDLINE_LINUX="cryptdevice=/dev/sda2:root"

• Install grub boot loader:

  grub-mkconfig -o /boot/grub/grub.cfg
  grub-install /dev/sda

• Install additional needed packages:

  pacman -S iw dialog net-tools pkgfile wpa_supplicant dhclient openssh

• Enable SSHd:

  systemctl enable sshd

• Configure DHCP client:

  cp /etc/netctl/examples/ethernet-dhcp /etc/netctl
  vi /etc/netctl/ethernet-dhcp # use correct NIC name
  netctl enable ethernet-dhcp

• Reboot:

  exit
  reboot

• Configure larger font for Grub2:

  pacman -S ttf-dejavu
  grub-mkfont -s 32 -o /boot/grub/DejaVuSansMono.pf2 /usr/share/fonts/TTF/DejaVuSansMono.ttf
  
  
  vi /etc/default/grub
  #add a line saying GRUB_FONT=/boot/grub/DejaVuSansMono.pf2,
  
  grub-mkconfig -o /boot/grub/grub.cfg

• Install terminus console font (needed for HiDPI):

  pacman -S terminus-font

• Edit /etc/vconsole.conf

  FONT=ter-u32n

• Copy systemd service file:

  cp /usr/lib/systemd/system/systemd-vconsole-setup.service /etc/systemd/system/systemd-vconsole-setup.service
  
  vi /etc/systemd/system/systemd-vconsole-setup.service
  
  #Add under [Unit]
  After=systemd-udev-settle.service
  Wants=systemd-udev-settle.service

• Disable SSHd root login.
• Install chrony (NTP client):

  pacman -S chrony
  vi /etc/chrony.conf
  systemctl enable chrony
  systemctl start chrony
  
  #test
  chronyc sources

• Install vim:

  pacman -S vim

• Get KMS working by adding i915 to the modules line

  /etc/mkinitcpio.conf
  MODULES="i915"
  
  mkinitcpio -p linux

• Install X:

  pacman -S gnome gnome-extra libva-intel-driver xf86-video-intel xf86-input-evdev xf86-input-synaptics

• Enable GDM:

  systemctl enable gdm

• Install additional tools:

  pacman -S acpi acpid ethtool wireless_tools

• Switch to networkmanager:

  netctl disable ethernet-dhcp
  systemctl disable netctl
  systemctl enable NetworkManager
  systemctl start NetworkManager

• Install modemmanager (might need reboot):

  pacman -S modemmanager usb_modeswitch usbutils
  systemctl enable ModemManager
  systemctl start ModemManager
  systemctl restart NetworkManager

• Install finger print reader driver:

  pacman -S fprintd libfprint
  systemctl enable fprintd
  systemctl start fprintd