This is an old revision of the document!
Installing Hyperbola GNU/Linux-libre with full-disk encryption (including /boot)
This guide covers how to install Hyperbola GNU/Linux-Libre, with full disk encryption, including /boot (the boot directory). On most systems, /boot has to be left unencrypted, while the other partition(s) are encrypted. This is so that GRUB (and therefore the kernel) can be loaded and executed, because most firmware can’t open a LUKS volume; however, with Libreboot, GRUB is already included as a payload, so even /boot can be encrypted; this protects /boot from tampering by someone with physical access to the system.
You can find the minimum requirements to run Hyperbola GNU/Linux-libre on download page.
Download the live image
For this guide we are using Milky Way version, the live image is available on download page.
Choose the installation device
Boot Hyperbola’s install environment
After downloading the ISO, and creating some kind of bootable media, you will need to boot into the live image. If you are unsure of how to do so, see how to boot a GNU/Linux installer, and move on to the next step; otherwise, just go to the next step.
Setting up keyboard layout
To begin the installation, you must first select the proper keyboard layout.
Establish an internet connection
You will also need to set up a network connection, to install packages.
Preparing the storage device for installation
You need to prepare the storage device that we will use to install the operating system. You can use same device name that you used earlier, to determine the installation device for the ISO.
Wipe storage device
You want to make sure that the device you’re using doesn’t contain any plaintext copies of your personal data. If the drive is new, then you can skip the rest of this section; if it’s not new, then there are two ways to handle it:
- If the drive were not previously encrypted, securely wipe it with the dd command; you can either choose to fill it with zeroes or random data; I chose random data (e.g., urandom), because it’s more secure. Depending on the size of the drive, this could take a while to complete:
# dd if=/dev/urandom of=/dev/sdX; sync
- If the drive were previously encrypted, all you need to do is wipe the LUKS header. The size of the header depends upon the specific model of the hard drive; you can find this information by doing some research online. Refer to this article, for more information about LUKS headers. You can either fill the header with zeroes, or with random data; again, I chose random data, using urandom:
# head -c 3145728 /dev/urandom > /dev/sdX; sync
Also, if you’re using an SSD, there are a two things you should keep in mind:
Formatting the storage device
Now that all the personal data has been deleted from the disk, it’s time to format it. We’ll begin by creating a single, large partition on it, and then encrypting it using LUKS.
Create the LUKS partition
You will need the device-mapper kernel module during the installation; this will enable us to set up our encrypted disk. To load it, use the following command:
# modprobe dm-mod
We then need to select the device name of the drive we’re installing the operating system on; see the above method, if needed, for figuring out device names.
Now that we have the name of the correct device, we need to create the partition on it. For this, we will use the cfdisk command:
# cfdisk /dev/sdX
- Use the arrow keys to select your partition, and if there is already a partition on the drive, select Delete, and then New.
- For the partition size, leave it as the default, which will be the entire drive.
- You will see an option for Primary or Logical; choose Primary, and make sure that the partition type is Linux (83).
- Select Write; it will ask you if you are sure that you want to overwrite the drive.
- Type yes, and press enter. A message at the bottom will appear, telling you that the partition table has been altered.
- Select Quit, to return you to the main terminal.
Now that you have created the partition, it’s time to create the encrypted volume on it, using the cryptsetup command, like this:
# cryptsetup -v --cipher serpent-xts-plain64 --key-size 512 --hash whirlpool \ >--iter-time 500 --use-random --verify-passphrase luksFormat /dev/sdXY
These are just recommended defaults; if you want to use anything else, or to find out what options there are, run man cryptsetup.
You will now be prompted to enter a passphrase; be sure to make it secure. For passphrase security, length is more important than complexity (e.g., correct-horse-battery-staple is more secure than bf20$3Jhy3), but it’s helpful to include several different types of characters (e.g., uppercase/lowercase letters, numbers, special characters). The password length should be as long as you are able to remember, without having to write it down, or store it anywhere.
Use of the diceware method is recommended, for generating secure passphrases (rather than passwords).
Create the volume group and logical volumes
The next step is to create two logical volumes within the LUKS-encrypted partition: one will contain your main installation, and the other will contain your swap space.
We will create this using, the Logical Volume Manager (LVM).
First, we need to open the LUKS partition, at /dev/mapper/lvm:
# cryptsetup luksOpen /dev/sdXY lvm
Then, we create LVM partition:
# pvcreate /dev/mapper/lvm
Check to make sure that the partition was created:
Next, we create the volume group, inside of which the logical volumes will be created. For this example, we will call this group matrix. You can call yours whatever you would like; just make sure that you remember its name:
# vgcreate matrix /dev/mapper/lvm
Check to make sure that the group was created:
Lastly, we need to create the logical volumes themselves, inside the volume group; one will be our swap, cleverly named swapvol, and the other will be our root partition, equally cleverly named as rootvol.
- We will create the swapvol first (again, choose your own name, if you like). Also, make sure to choose an appropriate swap size (e.g., 2G refers to two gigibytes; change this however you see fit):
# lvcreate -L 2G matrix -n swapvol
- Now, we will create a single, large partition in the rest of the space, for rootvol:
# lvcreate -l +100%FREE matrix -n rootvol
You can also be flexible here, for example you can specify a /boot, a /, a /home, a /var, or a /usr volume. For example, if you will be running a web/mail server then you want /var (where logs are stored) in its own partition, so that if it fills up with logs, it won’t crash your system. For a home/laptop system (typical use case), just a root and a swap will do.
Verify that the logical volumes were created correctly:
Make the rootvol and swapvol partitions ready for installation
The last steps of setting up the drive for installation are turning swapvol into an active swap partition, and formatting rootvol.
To make swapvol into a swap partition, we run the mkswap (i.e., make swap) command:
# mkswap /dev/mapper/matrix-swapvol
Activate the swapvol, allowing it to now be used as swap, using swapon (i.e., turn swap on) command:
# swapon /dev/matrix/swapvol
Now we have to format rootvol, to make it ready for installation; we do this with the mkfs (i.e., make file system) command. We choose the ext4 filesystem, but you could use a different one, depending on your use case:
# mkfs.ext4 /dev/mapper/matrix-rootvol
Lastly, We need to mount rootvol. Fortunately, GNU/Linux has a directory for this very purpose: /mnt:
# mount /dev/matrix/rootvol /mnt
Create the /boot and /home directories
Now that you have mounted rootvol, you need to create the two most important folders on it: /boot and /home; these folder contain your boot files, as well as each user’s personal documents, videos, etc..
Since you mounted rootvol at /mnt, this is where you must create them; you will do so using mkdir:
# mkdir -p /mnt/home
# mkdir -p /mnt/boot
You could also create two separate partitions for /boot and /home, but such a setup would be for advanced users, and is thus not covered in this guide. For more information on how to do this, refer to the Arch wiki on partitions.
The setup of the drive and partitions is now complete; it’s time to actually install Hyperbola.
Install the base system
We need to install the essential applications needed for your Hyperbola installation to run; refer to Install the base system, on the our wiki.
Generate an fstab
The next step in the process is to generate a file known as an fstab; the purpose of this file is for the operating system to identify the storage device used by your installation. On the beginner’s guide is the instruction to generate that file.
Chroot into and configure the system
Now, you need to chroot into your new installation, to complete the setup and installation process. Chrooting refers to changing the root directory of an operating system to a different one; in this instance, it means changing your root directory to the one you created in the previous steps, so that you can modify files and install software onto it, as if it were the host operating system.
To chroot into your installation, follow the instruction on the beginner’s guide.
Setting up the locale
Locale refers to the language that your operating system will use, as well as some other considerations related to the region in which you live. To set this up, follow the instructions in the beginner’s guide.
Setting up the consolefont and keymap
This will determine the keyboard layout of your new installation; follow the instructions in the beginner’s guide.
Setting up the time zone
You’ll need to set your current time zone in the operating system; this will enable applications that require accurate time to work properly (e.g., the web browser). To do this, follow the instructions the beginner’s guide.
Setting up the hardware clock
To make sure that your computer has the right time, you’ll have to set the time in your computer’s internal clock. Follow the instructions in the beginner’s guide to do that.
Setting up the kernel modules
Now we need to make sure that the kernel has all the modules that it needs to boot the operating system. To do this, we need to edit a file called mkinitcpio.conf. More information about this file can be found in the Arch wiki, but for the sake of this guide, you simply need to run the following command.
# nano /etc/mkinitcpio.conf
There are several modifications that we need to make to the file:
- Change the value of the uncommented MODULES line to i915.
- This forces the driver to load earlier, so that the console font you selected earlier isn’t wiped out after getting to login.
- If you are using a Macbook 2,1 you will also need to add hid-generic, hid, and hid-apple inside the quotation marks, in order to have a working keyboard when asked to enter the LUKS password. Make sure to separate each module by one space.
- Change the value of the uncommented HOOKS line to the following:
# nano /etc/mkinitcpio.conf “base udev autodetect modconf block keyboard keymap consolefont encrypt lvm2 filesystems fsck shutdown”
Here’s what each module does:
- keymap adds to initramfs the keymap that you specified in /etc/conf.d/keymaps
- consolefont adds to initramfs the font that you specified in /etc/conf.d/keymaps
- lvm2 adds LVM support to the initramfs - needed to mount the LVM partitions at boot time
- shutdown is needed according to Arch wiki, for unmounting devices (such as LUKS/LVM) during shutdown
After modifying the file and saving it, we need to update the kernel(s) with the new settings.
We will also install the grub package, which we will need later, to make our modifications to the GRUB configuration file:
# pacman -S grub
Then, we update both kernels like this, using the mkinitcpio command:
# mkinitcpio -p linux-libre-lts