In July 2012 a new Arch Linux image (201207) was released and, the same day, I decided to download it and reinstall my system. Throughout the process I noticed there had been several changes, both in how you install it and in how the distribution works:

There is no longer an .iso with the core, nor separate images for X86 and X64; the only version available for download is the netinstall dual;
The Arch Linux Installation Framework (AIF) is no longer used;
The migration from SysVinit to Systemd has begun (using initscripts).

The day the first image without AIF came out, there was almost no documentation explaining how to do the installation, and I had to rack my brains a bit to manage it on my own. When I finally did, I started writing this tutorial, but soon afterwards I went traveling (FISL13!) and stopped writing.

Making the most of my short end-of-year break, I decided to repartition my disk, reinstall Arch from scratch on my laptop and finish documenting the installation process on this blog.

I will use native Systemd, without rc.conf, and I will also explain how to encrypt the disk using LVM on LUKS+dmcrypt.

Note: As explained in this blog’s about, I wrote this post for myself and only covered the parts that interest me and are compatible with my system (an Acer Aspire). Do not follow this “tutorial” blindly; some things that work for me may be different for you.

Boot disk

It has been a good while since I last burned CDs to install operating systems. I normally use a flash drive as the installation medium, especially now that my new laptop does not even have a CD drive.

To make that flash drive bootable, just download the .iso and write it with dd:

sudo dd if=archlinux.iso of=/dev/sdb

That works on most computers, but apparently my laptop’s BIOS does not recognize a flash drive written that way, and the laptop freezes on the boot screen until the flash drive is unplugged.

Roughly by trial and error, I found two solutions:

Solution 1
Use unetbootin to copy the contents of the .iso and install syslinux as the bootloader, then change the partition’s label:
```
julio@acer ~> sudo mlabel -i
/dev/sdb1 ::ARCH_201212
```

Solution 2

Copy the files from the .iso to the flash drive and install syslinux by hand:

sudo fdisk /dev/sdb
sudo mkfs.vfat -n ARCH_201212 /dev/sdb1
sudo mount /dev/sdb1 /media/pendrive
sudo mount archlinux-2012.12.01-dual.iso /media/arch
sudo cp -r /media/arch/* /media/pendrive/
sudo syslinux -s /dev/sdb1
cd /media/pendrive; sudo cp isolinux/isolinux.cfg syslinux.cfg

Installation

Go into your BIOS’s Boot Manager and boot from the flash drive:

IDE 0: TOSHIBA MK5055GSX (that is the hard drive)
USB HDD: SanDisk (that is the flash drive)

A boot menu will appear. Pick the Boot Arch Linux (x86_64) option (my system is 64-bit).

Remember /arch/setup? It is gone. Since the July image, Arch has stopped using AIF in favour of a few install scripts. You are now dropped straight into a shell.

Partitioning

The most recommended format is GPT. It has some advantages over MBR, such as allowing drives larger than 2TB and more than 4 primary partitions.

I used GPT in my last installation, but I concluded that in my case it is better to stay with MBR. I only need 4 primary partitions, my disks are 2TB or smaller, and my motherboard uses BIOS, not UEFI. That last detail matters especially if you want to dual boot with Windows.

-> If your partition table uses GPT:

root@archiso ~ # cgdisk /dev/sda

Note: If your motherboard uses BIOS and your partitions use GPT, you will need a partition of at least 31KiB (2MB is recommended) to hold Grub2’s core.img (more info).

-> If your partition table uses MBR (my case):

root@archiso ~ # cfdisk /dev/sda

Initial state:

Disk Drive: /dev/sda
Size: 500.1 GiB

Part Type: Pri/Log
FS Type: Free Space
Size (MB): 500107.87

A 50GB partition for another OS:
[ New ] » [Primary] » Size (in MB): 50G » [Beginning] » [ Type ] » Enter filesystem type: 86
A partition for /boot:
[ New ] » [Logical] » Size (in MB): 100 » [Beginning] » [ Type ] » Enter filesystem type: 83
I set aside 100MB, but about 50MB would already do.
A partition for LUKS (I will use LVM on LUKS):
[ New ] » [Logical] » Size (in MB): 450007.68 » [Beginning] » [ Type ] » Enter filesystem type: 8E

Write the changes: [ Write ] » "yes" » [ Quit ] and check the partitions with fstab -l.

Shredding

For safety, fill the LUKS partition with random data:

root@archiso ~ # badblocks -c 10240 -wsvt random /dev/sda3

root@archiso ~ # dd if=/dev/urandom of=/dev/sda3 bs=4096

Note: These commands take a few hours.

Encryption: dm-crypt / LUKS

root@archiso ~ # cryptsetup -c <cipher> -y -s <key size> luksFormat /dev/<partition name>

We will use AES in XTS mode with 512 bits. It is quite secure and I did not notice a significant performance loss:

# modprobe dm_mod
root@archiso ~ # cryptsetup -c aes-xts-plain -y -s 512 luksFormat /dev/sda3

Type your password. The password’s length matters for security too.

Check it with cryptsetup luksDump /dev/sda3.

Unlock the partition

root@archiso ~ # cryptsetup luksOpen /dev/sda3 arch-luks
Enter passphrase for /dev/sda3:

Creating LVM partitions

Create a Physical Volume:

root@archiso ~ # pvcreate /dev/mapper/arch-luks
  Physical volume "/dev/mapper/arch-luks" successfully created

root@archiso ~ # pvdisplay

Create a Volume Group:

root@archiso ~ # vgcreate vg_arch /dev/mapper/arch-luks
  Volume group "vg_arch" successfully created

root@archiso ~ # vgdisplay

Create the Logical Volumes

Create an LV for /:

root@archiso ~ # lvcreate -L 25G vg_arch -n root
  Logical volume "root" created

Create an LV for /var:
It is not very common, but you can improve performance by using a file system that is good with small files, such as Reiserfs.
```
root@archiso ~ # lvcreate -L 15G vg_arch -n var
  Logical volume "var" created
```

Create an LV for swap:

root@archiso ~ # lvcreate -C y -L 4G vg_arch -n swap
  Logical volume "swap" created

Create an LV for /home, leaving some free space (25GB) at the end:

root@archiso ~ # lvcreate -L 350G vg_arch -n home
  Logical volume "home" created

or, if you know you will not need to resize the volumes later:

root@archiso ~ # lvcreate -l +100%FREE vg_arch -n home
  Logical volume "home" created

Check the volumes with lvdisplay.

Format the partitions

root@archiso ~ # mkfs.ext2 -L boot /dev/sda2
root@archiso ~ # mkfs.btrfs -L root /dev/vg_arch/root
root@archiso ~ # mkfs.ext4 -L var  /dev/vg_arch/var
root@archiso ~ # mkfs.ext4 -L home /dev/vg_arch/home
root@archiso ~ # mkswap -L swap /dev/vg_arch/swap

To save disk space:

root@archiso ~ # tune2fs -m 1.0 /dev/vg_arch/var
root@archiso ~ # tune2fs -m 0.0 /dev/vg_arch/home

Mount the partitions

root@archiso ~ # mount /dev/vg_arch/root /mnt
root@archiso ~ # mkdir /mnt/{boot,home,var}
root@archiso ~ # mount /dev/vg_arch/var /mnt/var
root@archiso ~ # mount /dev/vg_arch/home /mnt/home
root@archiso ~ # mount /dev/sda2 /mnt/boot
root@archiso ~ # swapon /dev/vg_arch/swap

Connect to the internet

Wi-Fi
If you do not have a wired network, connect to your Wi-Fi:
```
root@archiso ~ # wifi-menu wlan0
```

Cable

The command for a wired network is:

root@archiso ~ # ip link set eth0 up #(equivalent to ifconfig eth0 up)
root@archiso ~ # dhcpcd eth0

Install the base system

First check that the system date is right with the date command. This step matters so that importing the PGP keys does not go wrong.

If the date is wrong, fix it with timedatectl. Use UTC. E.g.:

timedatectl set-time "2013-01-30 18:00:00"

Download the packages with pacstrap:

root@archiso ~ # pacstrap /mnt base{,-devel}
Total Download Size: 154.83 MiB
Total Installed Size: 579.00 MiB

Install a bootloader (I chose grub2):

root@archiso ~ # pacstrap /mnt grub-bios

Note: grub-bios is for BIOS; if your motherboard uses UEFI, download grub-efi-x86_64.

Generate an /etc/fstab:

root@archiso ~ # genfstab -U -p /mnt >> /mnt/etc/fstab

Check that fstab is correct. The -U in the command is for using UUIDs

chroot into the system we have just installed:

root@archiso ~ # arch-chroot /mnt

This is a good time to install vim, since we are going to edit a few files. I am going to install gvim, since it comes compiled with “+xterm_clipboard”:

root@archiso ~ # pacman -S gvim

Systemd vs. SysV

There is some controversy over whether the move to Systemd is a good thing or not.

Reading Hacker News made it clear that a lot of people are unhappy, but if everything works the way Lennart Poettering explained in a talk I attended, and Systemd has all the advantages the Arch developers posted on the forum, then the transition really was a good thing.

In any case, if the devs are more or less forcing the change, it is better to get used to it right away. So I will do an installation without an rc.conf, using only Systemd.

Note: Create the files mentioned in the next steps if they do not exist yet.

Locale

Uncomment en_US.UTF-8 UTF-8 and pt_BR.UTF-8 UTF-8 in /etc/locale.gen and then run locale-gen as root.

Create the file /etc/locale.conf, which sets the LANG variable:

LANG=en_US.UTF-8

Keymap and font

Find out which of the files in /usr/share/kbd/keymaps/i386/qwerty/ matches your keymap and then test it with loadkeys. E.g.:

PT-BR: loadkeys br-abnt2
EN-US: loadkeys us-acentos
EN-UK: loadkeys uk

Find out which of the files in /usr/share/kbd/consolefonts/ matches the font you want and then test it with setfont. E.g.:

Terminus: setfont Lat2-Terminus16
Lat9w: setfont lat9w-16

Edit the file /etc/vconsole.conf to make the setting permanent:

KEYMAP=us-acentos
FONT=Lat2-Terminus16

There is also the FONT_MAP option, but it is not necessary.

Timezone

Find out which of the files in /usr/share/zoneinfo/ matches your region and sub-region. In my case the file is /usr/share/zoneinfo/America/Sao_Paulo.

Make the file /etc/localtime point at your timezone using a symbolic link:

sh-4.2# ln -s /usr/share/zoneinfo/America/Sao_Paulo /etc/localtime

Q: What happened to the /etc/timezone file???

Clock

Generate an /etc/adjtime with the hwclock command. I recommend using UTC.

sh-4.2# hwclock --systohc --utc

If you want to sync the clock over the internet, run ntpd -qg && hwclock -w as root.

Host

Create the file /etc/hostname containing just your host’s name:

sh-4.2# echo "acer" > /etc/hostname

Apparently we no longer need to edit the /etc/hosts file after this step.

Network

If you use a wireless network, install the files that let you connect to wireless networks. Also install your card’s firmware, if needed:

sh-4.2# pacman -S wireless_tools wpa_supplicant wpa_actiond dialog

I also recommend enabling net-auto-wireless:

sh-4.2# systemctl enable net-auto-wireless.service

If you usually connect to the network by cable, I recommend installing ifplugd and enabling net-auto-wired. That way your computer will connect automatically when you plug in a network cable:

sh-4.2# systemctl enable net-auto-wired.service

HOOKS (initial ramdisk)

On the HOOKS line of the /etc/mkinitcpio.conf file, add encrypt, lvm2 and resume before filesystems (the order matters). resume has to come after lvm2:

HOOKS="base udev autodetect modconf block encrypt lvm2 resume filesystems usbinput fsck"

Run mkinitcpio -p linux.

Configuring Grub

sh-4.2# grub-install --target=i386-pc --recheck --debug /dev/sda
sh-4.2# cp /usr/share/locale/en\@quot/LC_MESSAGES/grub.mo /boot/grub/locale/en.mo

Edit /etc/default/grub:

GRUB_CMDLINE_LINUX="root=/dev/mapper/vg_arch-root cryptdevice=/dev/sda3:arch-luks resume=/dev/mapper/vg_arch-swap"

Create a password to keep people from editing grub. Here I am redirecting the output into a file, which we will use later. Simply type your password twice after the command:

sh-4.2#  grub-mkpasswd-pbkdf2 > hash

The hash file will hold a 256-character string looking something like this: grub.pbkdf2.sha512.10000.FEDCBA987689…EDCBFEDCBA9876543210123

Copy that hash and add the following to the file /etc/grub.d/00_header:

cat << EOF

set superusers="julio"
password_pbkdf2 julio grub.pbkdf2.sha512.10000.FEDCBA987689…EDCBFEDCBA9876543210123

EOF

Then run the following command:

sh-4.2# grub-mkconfig -o /boot/grub/grub.cfg

Kernel parameters

I also like to remove quiet from the linux line in /boot/grub/grub.cfg to see whether everything goes properly during boot.

Set a password for root

sh-4.2# passwd

Restart the computer

sh-4.2# exit
root@archiso# umount /mnt/{boot,var,home,}
root@archiso# reboot

When you restart, it will ask for the Grub2 password and the password to open the arch-luks volume.

Post-installation

Connect to the internet

Wired network:
```
[root@acer ~] dhcpcd eth0
```
Wireless network:
```
[root@acer ~] wifi-menu wlan0
```

Pacman

Add the [multilib] repository. Just uncomment the following lines in /etc/pacman.conf:

[multilib]
SigLevel = PackageRequired
Include = /etc/pacman.d/mirrorlist

Also add the line ILoveCandy below # Misc options just for fun 😉.

PGP keys

[root@acer ~]# rm -r /etc/pacman.d/gnupg
[root@acer ~]# pacman-key --init
[root@acer ~]# pacman-key --populate archlinux

Mirrors

Edit the file /etc/pacman.d/mirrorlist. In vim: :%s/^[^\#]/\#S/. Then uncomment only about 3 repositories.

Install some programs

Recommendations:

root@acer ~ # pacman -S zsh sudo \
  alsa-utils pulseaudio pulseaudio-alsa pavucontrol paprefs \
  xorg-server xorg-xinit xorg-server-utils xf86-video-intel lib32-intel-dri \
  xf86-input-synaptics xf86-input-wacom libwacom xbindkeys xdotool \
  awesome vicious wmname \
  ttf-dejavu terminus-font ttf-inconsolata artwiz-fonts ttf-symbola \
  feh imagemagick geeqie gimp scrot \
  mpd ncmpcpp mplayer2 kid3 \
  wget chromium firefox flashplugin \
  acpid screen htop ntp \
  python python2 python-pip python2-pip ipython ipython2 bpython bpython2 \
  python2-psycopg2 python2-pygments python2-mechanize python2-imaging \
  python2-beautifulsoup3 python2-beautifulsoup4 pep8-python2 pep8-python3 \
  python2-lxml \
  git mercurial svn ack gdb clang clang-analyzer cppcheck \
  jdk7-openjdk irssi pidgin mutt thunderbird \
  wicd samba openssh sshfs apache php php-apache postgresql pgadmin3 \
  vidalia \
  cups hplip gtranslator \
  qalculate-gtk gnuplot texlive-most xournal \
  libreoffice-{common,pt-BR,calc,writer,impress} stardict \
  rsync mktorrent \
  rxvt-unicode urxvt-perls terminator \
  unrar zip p7zip \
  virtualbox yajl \
  vlock slock xautolock tree wireshark \
  gparted gptfdisk dosfstools ntfsprogs mtools \
  cpupower hdparm hddtemp lm_sensors hwinfo \
  pysolfc \
  ttf-symbola \
  mpdscribble \
  icedtea-web-java7 \
  wine \
  laptop-mode-tools

This is a list of some programs I always install on my laptop. Pick only the ones you think you will need (do not install the intel video drivers if your card is Nvidia, of course).

Sound

ALSA already ships with the Arch Linux kernel.

Open alsamixer, unmute Master and turn the volume up. Test the sound with speaker-test -c 2. If it worked, save the mixer settings with the following command (TODO: check whether this is really needed):

[root@acer ~]# alsactl store

Since I use more than one sound card and stream audio from another computer over the network, I also like to have Pulseaudio working (it was installed in the previous step).

Video - X11

Find out which card you have with the following command:

[root@acer ~]# lspci | grep VGA
00:02.0 VGA compatible controller: Intel Corporation Mobile 4 Series Chipset Integrated Graphics Controller (rev 07)

I already installed the Intel drivers (xf86-video-intel and lib32-intel-dri) in the previous step.

Making passwords more secure

Until recently, Linux users’ passwords were stored in the /etc/shadow file using the MD5 algorithm by default.

I consider MD5 far too weak and easy to break. Fortunately newer versions of shadow use SHA-512 with 5000 rounds, which is much better than the previous default. But if you are paranoid, you can change the algorithm or raise the number of rounds.

My favorite algorithm for protecting passwords is bcrypt, which uses Blowfish internally and, although it is not strictly a hash function, serves exactly the same purpose – from a password, it generates an irreversible string that can be used to verify the password.

I noticed that the pam manual does not mention bcrypt. Blowfish appears in the list, but since it is a symmetric cipher encryption algorithm (and not a hash function), the password would be reversible.

So I chose to use SHA-512 with far more rounds than the default, which is as good as bcrypt. To do that, change the file /etc/pam.d/passwd to:

password    required    pam_unix.so sha512 rounds=65536 shadow nullok minlen=8 retry=3

Every user created from now on will have to create passwords of at least 8 characters, whose hash will use SHA-512 with 65536 rounds. To make this take effect on existing accounts, just recreate the passwords with passwd:

[root@acer ~] passwd
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully

You can check the change in the /etc/shadow file:

[root@acer ~] cat /etc/shadow | grep root

Add a user

[root@acer ~]# useradd -m -G wheel -s /bin/zsh julio
[root@acer ~]# chfn julio
[root@acer ~]# passwd julio

An easier way is with adduser, available on the AUR:

[root@acer ~]# adduser
Login name for new user []: julio
User ID ('UID') [ defaults to next available ]:
Initial group [ users ]:
Additional groups (comma separated) []: audio,lp,optical,storage,video,wheel,games,power,scanner
Home directory [ /home/julio ]:
Shell [ /bin/bash ]: /bin/zsh
Expiry date (YYYY-MM-DD) []:

Sudo

Let users in the wheel group use the sudo command. Run visudo and uncomment the line %wheel ALL=(ALL) ALL.

Dotfiles, etc

Oh-my-zsh

acer% git clone git://github.com/robbyrussell/oh-my-zsh.git ~/.oh-my-zsh

Copy your public and private keys from the backup

Clone my dotfiles repository on Github:

acer% git clone git@github.com:jbsilva/dotfiles.git

Other dotfiles

Copy or link each of the dotfiles and scripts into their respective folders:

acer% ln -s /home/julio/dotfiles/home/julio/.vim ~/.vim
acer% ln -s /home/julio/dotfiles/home/julio/.vimrc ~/.vimrc
acer% ln -s /home/julio/dotfiles/home/julio/.zshrc ~/.zshrc
acer% ln -s /home/julio/dotfiles/home/julio/.gitconfig ~/.gitconfig

acer% mkdir ~/.config;
acer% ln -s /home/julio/dotfiles/home/julio/.config/awesome ~/.config
acer% ln -s /home/julio/dotfiles/home/julio/.config/sytemd ~/.config

acer% mkdir .mpd; touch database log pid state sticker.sql
acer% ln -s /home/julio/dotfiles/home/julio/.mpd/mpd.conf ~/.mpd
acer% ln -s /home/julio/dotfiles/home/julio/.mpd/playlists ~/.mpd

acer% mkdir .ncmpcpp
acer% ln -s /home/julio/dotfiles/home/julio/.ncmpcpp/config ~/.ncmpcpp

acer% ln -s /home/julio/dotfiles/home/julio/.xdefaults ~/.xdefaults
acer% ln -s /home/julio/dotfiles/home/julio/.xdefaults/Xdefaults ~/.Xdefaults
acer% rm .xinitrc; ln -s /home/julio/dotfiles/home/julio/.xinitrc

Done! The system is configured and ready to use. Start the graphical interface with startx.

AUR and Yaourt/Packer

Install Yaourt or Packer (pick one) to make installing AUR packages easier.

Yaourt:

julio@acer ~> wget https://aur.archlinux.org/packages/pa/package-query/package-query.tar.gz
julio@acer ~> tar xvfz package-query.tar.gz; cd package-query
julio@acer ~/package-query> makepkg
julio@acer ~/package-query> sudo pacman -U package-query-1.0.1-1-x86_64.pkg.tar.xz

julio@acer ~> wget https://aur.archlinux.org/packages/ya/yaourt/yaourt.tar.gz
julio@acer ~> tar xvfz yaourt.tar.gz; cd yaourt
julio@acer ~/yaourt> makepkg
julio@acer ~/yaourt> sudo pacman -U yaourt-1.1-1-any.pkg.tar.xz

Packer:

I only started using Packer recently, but it seems faster and to cause fewer problems than Yaourt.

julio@acer ~> wget https://aur.archlinux.org/packages/pa/packer/packer.tar.gz
julio@acer ~> tar xvfz packer.tar.gz; cd packer; makepkg
julio@acer ~/packer> sudo pacman -U packer-20121228-1-any.pkg.tar.xz

Install some AUR programs:

julio@acer ~> for p in {tofrodos,dropbox,urxvt-keyboard-select,urxvt-clipboard,rtorrent-pyro-git,otf-ipafont,mod_scgi,django-git,flexget,xtrlock,tor-browser-en}; do packer $p; done

Install other programs

Install rutorrent from svn

The command to mount the Volume Group: vgchange -a y vg_arch

Samba

Creating users for Samba

julio@acer ~> sudo useradd guest
julio@acer ~> sudo pdbedit -a -u julio
julio@acer ~> sudo pdbedit -a -u guest

Starting the daemon with systemctl:

julio@acer ~> sudo systemctl start smbd nmbd

List the shared folders

On other computers on the network, the shared folders can be listed with:

julio@acer ~> sudo smbclient -L 192.168.0.2 -U%

Reaching them from other computers:

sudo mount -t cifs //192.168.0.2/acer /media/acer -o user=guest,password=guest_password,workgroup=GROUP,ip=192.168.0.2

or better, add the following line to /etc/fstab:

//192.168.0.2/musicas   /media/rede   cifs   noauto,credentials=/etc/samba/smbcred   0 0

Where the file /etc/samb/smbcred looks something like this:

username=guest
password=guest_password
workgroup=GROUP
ip=192.168.0.2

Other recommendations

Protect your BIOS with a password for extra security.

Save a backup of the LUKS header

I have known people whose drive got a badblock at the start of the encrypted partition and ended up with no way to reach the files. With a backup of the header they would probably have recovered some files.

julio@acer ~> sudo cryptsetup luksHeaderBackup /dev/sda3 --header-backup-file /media/externo/acer-luks_header.img

Cron

julio@acer ~> sudo systemctl enable cronie

Prevent fork bombs

Add the following line at the end of the file /etc/security/limits.conf:

julio           hard    nproc           4000

(replace julio with your user name)

No results found

Installing Arch Linux

Boot disk

Installation

Partitioning

Shredding

Encryption: dm-crypt / LUKS

Unlock the partition

Creating LVM partitions

Create a Physical Volume:

Create a Volume Group:

Create the Logical Volumes

Format the partitions

To save disk space:

Mount the partitions

Connect to the internet

Install the base system

Install a bootloader (I chose grub2):

Generate an /etc/fstab:

chroot into the system we have just installed:

Systemd vs. SysV

Locale

Keymap and font

Timezone

Clock

Host

Network

HOOKS (initial ramdisk)

Configuring Grub

Kernel parameters

Set a password for root

Restart the computer

Post-installation

Connect to the internet

Pacman

PGP keys

Mirrors

Install some programs

Sound

Video - X11

Making passwords more secure

Add a user

Sudo

Dotfiles, etc

Oh-my-zsh

Other dotfiles

AUR and Yaourt/Packer

Install some AUR programs:

Install other programs

Samba

Creating users for Samba

Starting the daemon with systemctl:

List the shared folders

Reaching them from other computers:

Other recommendations

Protect your BIOS with a password for extra security.

Save a backup of the LUKS header

Cron

Prevent fork bombs

Links