This is a guide for those of you who are interested in setting up a full disk encrypted Arch Linux environment on a UEFI capable system. The Arch Wiki has fantastic information on all of the procedures outlined below, but I thought it would be nice to have all of this information condensed. One thing I intentionally left out of this guide was how to securely prepare your hard drive for use before beginning. The Arch Wiki has a very straightforward article on that which you should read before proceeding.
After booting into the installation environment the first step is to get our language and locale set up.
Next we set up partitions using gdisk.
You will want to create two partitions, one with an EFI type code (ef00) and the other with the regular Linux type code (8300). Here is what my GPT looks like.
After that we will want to create and mount our LUKS container. These commands will use the defaults for dm-crypt, but there are many more options to choose from.
Next we create and mount our filesystems.
Then set up the base system. Make sure you have a working network connection before you begin this part.
At this point we have bootstrapped the environment we will boot into enough to start working within it. Some of this will look familiar from the beginning of the setup process, but that’s because we still need to configure languages within our boot environment.
The following commands set up a few more system variables such as system time, passwords, and hostname. You will want to adjust them according to your preferences.
Make sure to set up the package manager to allow the multilib repository.
Uncomment these two lines.
The next step is to update the package lists and install the gummiboot application. The last command sets up the initial gummiboot environment.
Now we will find the UUID of /dev/sda2 and insert it into the file /boot/loader/entries/arch.conf. Then edit arch.conf to include proper kernel boot parameters.
Here is the full content of my arch.conf file. The allow-discards portion enables TRIM support and is only needed if you have an SSD. There is a security trade-off for performance when using TRIM, so please read this to decide if it’s worth the trade-off for you. The resume= option will enable hibernation on the device. The nice thing about having an encrypted swap partition is that your hibernation data will be encrypted just like the rest of the at-rest data. This makes hibernation a very secure alternative to leaving your machine in stand-by mode, which is vulnerable to the cold boot attack.
Now update your your .efi boot files using the gummiboot command.
You will need to modify the mkinitcpio.conf file to include several important kernel modules.
Add keymap, encrypt, lvm2, and resume to the HOOKS paramater.
Next you will need to regenerate your ramdisk.
All that is left to do now is gracefully reboot.
If you have any comments or suggestions on how to improve the instructions here, please let me know and I will consider them. I hope this guide is as useful to you as it is to me.