add documentation for arch installation

2026-07-23 02:28:59 +02:00
parent 5822020b89
commit e0fad8e6ed
9 changed files with 973 additions and 73 deletions
@@ -0,0 +1,483 @@
+.docname {System Configuration}
+.include {docs}
+
+Configure the system for initial boot.
+
+## File System Table
+
+Generate the file system table.
+
+```sh
+genfstab -U /mnt >> /mnt/efc/fstab
+```
+
+Check the table that was generated in `/mnt/etc/fstab`.
+
+## Change Root
+
+Change root into the new system
+
+```sh
+arch-chroot /mnt
+```
+
+> Tip: From this point onwards you will only be able to access programs that we previously installed using the
+> `pacstrap` command. So for editing text files, you will need to use `neovim` with the `nvim` command instead of `vim`.
+> You can install additional programs with `pacman -S <package name>` at any time if you need more tools.
+
+## Time Zone
+
+Configure the correct time zone.
+
+```sh
+ln -sf /usr/sahre/zoneinfo/<Region>/<City> /etc/localtime
+```
+
+.example {Europe/Berlin}
+    ```sh
+    ln -sf /usr/share/zoneinfo/Europe/Berlin /etc/localtime
+    ```
+
+Then update the system clock with `hwclock --systohc`.
+
+## Localization
+
+Edit the file `/etc/locale.gen` and uncomment all needed locales. Generate the locales afterwards by running
+`locale-gen`.
+
+.example {Installed Localizations}
+    I usually enable the following locales onmy systems:
+    - `de_DE.UTF-8 UTF-8`
+    - `de_DE ISO-8859-1`
+    - `de_DE@euro ISO-8859-15`
+    - `en_GB.UTF-8 UTF-8`
+    - `en_GB ISO-8859-1`
+    - `en_US.UTF-8 UTF-8`
+    - `en_US ISO-8859-1`
+
+Create the file `/etc/locale.conf` and set the `LANG` variable as well as other environment variables accordingly. The
+settings depend on you rlocation and your personal preference
+
+.example {Localization}
+    ```ini
+    LANG=en_GB.UTF-8
+    LANGUAGE=en_GB.UTF-8
+    LC_CTYPE=en_GB.UTF-8
+    LC_NUMERIC=en_GB.UTF-8
+    LC_TIME=en_GB.UTF-8
+    LC_COLLATE=en_GB.UTF-8
+    LC_MONETARY=de_DE.UTF-8
+    LC_MESSAGES=en_GB.UTF-8
+    LC_PAPER=de_DE.UTF-8
+    LC_NAME=de_DE.UTF-8
+    LC_ADDRESS=de_DE.UTF-8
+    LC_TELEPHONE=de_DE.UTF-8
+    LC_MEASUREMENT=de_DE.UTF-8
+    LC_IDENTIFICATION=de_DE.UTF-8
+    ```
+
+Persist the settings of console keyboard layout and font. Create the file `/etc/vconsole.conf`:
+
+```sh
+FONT=eurlatgr
+KEYMAP=de-latin1-nodeadkeys
+```
+
+## Network Configuration
+
+### Hostname
+
+Set a hostname in `/etc/hostname`
+
+> Tip: For advice on choosing a hostname, see [RFC 1178][rfc-1178]. As explained in [hostname(7)][hostname-7], it must
+> contain from 1 to 63 characters, using only lowercase `a` to `z`, `0` to `9`, and `-`, and must not start with `-`.
+
+Install Network Manager to the network interfaces of the system
+
+```sh
+pacman -S networkmanager nm-connection-editor network-manager-applet
+```
+
+Then enable the systemd services for Network Manager
+
+```sh
+systemctl enable NetworkManager
+systemctl enable systemd-resolved
+systemctl enable systemd-timesyncd
+```
+
+Create the file `/etc/NetworkManager/conf.d/20-connectivity.conf` with the following content
+
+```ini
+[connectivity]
+uri=https://zechert.net/connectivity_check.txt
+```
+
+Create the file `/etc/NetworkManager/conf.d/10-dns.conf` with the following content
+
+```ini
+[main]
+dns=systemd-resolved
+```
+
+### Use Advertised NTP Servers
+
+To use the NTP Servers advertised by the DHCP Server, create a new network manager dispatcher script in
+`/etc/NetworkManager/dispatcher.d/10-update-timesyncd` with the following content
+
+```sh
+#!/bin/sh
+
+[ -z "$CONNECTION_UUID" ] && exit 0
+INTERFACE="$1"
+ACTION="$2"
+
+case $ACTION in
+up | dhcp4-change | dhcp6-change)
+    [ -n "$DHCP4_NTP_SERVERS" ] || exit 0
+    mkdir -p /etc/systemd/timesyncd.conf.d
+    cat <<-THE_END >"/etc/systemd/timesyncd.conf.d/ntp-${CONNECTION_UUID}.conf"
+        [Time]
+        NTP=$DHCP4_NTP_SERVERS
+    THE_END
+    systemctl restart systemd-timesyncd.service
+    ;;
+down)
+    rm -f "/etc/systemd/timesyncd.conf.d/ntp-${CONNECTION_UUID}.conf"
+    systemctl restart systemd-timesyncd.service
+    ;;
+esac
+```
+
+Make the script executable with `chmod +x /etc/NetworkManager/dispatcher.d/10-update-timesyncd`.
+
+Create the following file `/etc/systemd/system/networkdown.service`:
+
+```ini
+[Unit]
+Wants=network-online.target
+After=network.target network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/bin/true
+ExecStop=/bin/sh -c 'rm -f /etc/systemd/timesyncd.conf.d/ntp-*.conf'
+RemainAfterExit=yes
+
+[Install]
+WantedBy=suspend.target
+```
+
+Enable the service with `systemctl enable networkdown`.
+
+### Configure MAC Address Randomization
+
+MAC randomization can be used for increased privacy by not disclosing the real MAC address to the network.
+
+Create the file `/etc/NetworkManager/conf.d/10-random-mac.conf` with the following content:
+
+```ini
+[device]
+wifi.scan-rand-mac-address=yes
+
+[device-mac-randomization]
+wifi.scan-rand-mac-address=yes
+
+[connection-mac-randomization]
+ethernet.cloned-mac-address=stable
+wifi.cloned-mac-address=stable
+```
+
+### Enable IPv6 Privacy Extensions
+
+Create the file `/etc/NetworkManager/conf.d/10-ipv6-privacy.conf` with the following content:
+
+```ini
+[connection]
+ipv6.ip6-privacy=2
+```
+
+Create the file `/etc/sysctl.d/40-ipv6.conf` with the following content:
+
+```ini
+net.ipv6.conf.all.use_tempaddr=2
+net.ipv6.conf.default.use_tempaddr=2
+```
+
+### Configure a unique DUID per connection
+
+NetworkManager uses DUID-UUID from `/etc/machin-id` for all DHCPv6 connections. This might be a security breach.
+Instead, configure NetworkManager to create unique DUIDs for each connection.
+
+Create the file `/etc/NetworkManager/conf.d/02-duid.conf` with the following content
+
+```ini
+[connection]
+ipv6.dhcp-duid=stable-uuid
+```
+
+### Enable DNSSEC
+
+Create the file `/etc/systemd/resolved.conf.d/30-dnssec.conf` with the following content
+
+```ini
+[Resolve]
+DNSSEC=true
+```
+
+> Warning: This will break name resolution for all hostnames that do not offer DNSSEC or that are resolved by
+> nameservers that do not support DNSSEC. This can break resolution to internal hostnames (e.g. Company Intranet) as
+> well es some public sites.
+
+### Disable mDNS
+
+Create the file `/etc/NetworkManager/conf.d/30-mdns.conf` with the following content
+
+```ini
+[connection]
+connection.mdns=0
+```
+
+Create the file `/etc/systemd/resolved.conf.d/30-mdns.conf` with the following content
+
+```ini
+[Resolve]
+MulticastDNS=no
+```
+
+> Warning: Disabling mDNS will break nameserver-less resolution of local hostnames from the same network (DNS via
+> multicast DNS Queries). This can break auto-discovery and access to other local machines like local printers, sambda
+> network drives, other devices, etc.
+>
+> Change this to `connection.mdns=1` to fully enable mDNS, `connection.mdns=2` to enable resolution but not announcement
+> of your own machine to the network. For both of these oiptions, set `MulticastDNS=yes` to enable the functionality in
+> systemd-resolved (or delete the file).
+
+### Disabled LLMNR
+
+Create the file `/etc/NetworkManager/conf.d/30-llmnr.conf` with the following content
+
+```ini
+[connection]
+connection.llmnr=0
+```
+
+Create the file `/etc/systemd/resolved.conf.d/30-llmnr.conf` with the following content
+
+```ini
+[Resolve]
+LLMNR=no
+```
+
+## Mkinitcpio Configuration
+
+Edit the file `/etc/mkinitcpio.conf` and add the necessary hooks for the system.
+
+Add the hooks `systemd`, `keyboard`, `sd-vconsole`, `sd-encrypt` to the list of hooks as follows:
+
+```ini
+HOOKS=(base systemd autodetect microcode modconf kms keyboard sd-vconsole block sd-encrypt lvm2 filesystems fsck resume)
+```
+
+## Set Kernel Command Line
+
+Create the file `/etc/cmdline.d/01-cryptlvm.conf` with the following content
+
+```ini
+rd.luks.name=<UUID of encrypted partition>=cryptlvm
+```
+
+The UUID can be found with the command `ls -all /dev/disk/by-uuid`.
+It can be conveniently copied into the `01-cryptlvm.conf` file with the command
+
+```sh
+ls -all /dev/disk/by-uuid | grep "<encrypted partition>" | awk '{print $9}' >> /etc/cmdline.d/01-cryptlvm.conf
+```
+
+Create the file `/etc/cmdline.d/02-root.conf` with the following content
+
+```ini
+root=/dev/vgsys/lvroot
+```
+
+Create the file `/etc/cmdline.d/03-resume.conf` with the following content
+
+```ini
+resume=/dev/vgsys/lvswap
+```
+
+## Enable Unified Kernel Image Booting
+
+UKI creates a single executable that can be directly booted from the UEFI firmware without any bootloader.
+
+Modify the file `/etc/mkinitcpio.d/linux.preset`.
+
+- Un-comment (i.e. remove `#`) the `PRESET_uki=` parameter for each item in `PRESETS=`
+- Comment out (i.e. add `#`) `PRESET_image=` to avoid storing a redundant `initramfs-*.img` file
+
+Create the directory `/efi/EFI/Linux`, then create the initcpio `mkinitcpio -P`.
+
+Make sure that the generation succeeded and two files have been created (`ls /efi/EFI/Linux`), called
+`arch-linux-fallback.efi` and `arch-linux.efi` (the fallback image might be missing if it is not enabled in the PRESETS).
+
+## Create Boot Menu Entries
+
+With `efibootmgr` check for existing EFI Boot Menu Entries, remove them if required, and create new entries for
+Arch Linux.
+
+- List all entries `efibootmgr`
+- Automatically remove duplicate entries `efibootmgr -D`
+- Remove a specific boot entry `efibootmgr -b XXXX -B`
+- Change the order of boot entries with `efibootmgr -o XXXX,YYYY,ZZZZ`
+
+Create the following two new entries
+
+```sh
+efibootmgr --create \
+--disk <efi partition> \
+--loader=/EFI/Linux/arch-linux.efi \
+--label "Arch Linux" \
+--verbose
+
+efibootmgr --create \
+--disk <efi partition> \
+--loader=/EFI/Linux/arch-linux-fallback.efi \
+--label "Arch Linux Fallback" \
+--verbose
+```
+
+## Enable Secureboot
+
+Unfortunately the UEFI kernel image is not stored on an encrypted disk, and cannot be. Since the EFI firmware needs to
+be able to access the image to boot the system. Therefore, the system is at risk by an attacker that can manipulate the
+kernel image and boot partition. As a remedy to this problem, we will enable secure boot. The boot loader file will be
+cryptographically signed by a secret key that is stored on our encrypted partition.
+
+We will use the tool `sbctl` for a user friendly way to configure secure boot.
+
+First, check the current status with `sbctl status`. You should see that sbctl is not installed, and that secure boot
+setup mode is enabled.
+
+Creeate new keys: `sbctl create-keys`. Then enroll the new keys with `sbctl enroll-keys -m`.
+
+> Warning: The parameter `-m` in the command `sbctl enroll-keys -m` will enroll your own keys alongside with the default
+> microsoft keys. The microsoft keys might be required by any option roms or some firmware in the system. You can omit
+> the option `-m` to only enroll your own keys without Microsoft's. But you might create a system that can no longer
+> boot! Only do this if you know the risk and know what you are doing. If you want to do this, replace `-m` by
+> `--yes-this-might-brick-my-machine`.
+
+## Signing EFI Images
+
+`sbctl` comes with the necessary hooks pre-installed to automatically sign images when needed. Since we have created new
+and fresh keys, we need to trigger this now manually once. Run `mkinitcpio -P` to recreate images and trigger `sbctl`
+into signing the new images.
+
+## Create a User Account
+
+Set the password for the user `root`, then create a normal user account.
+Modify the sudoers file, so that the group sudo has access to the `sudo` command.
+
+```sh
+passwd root
+groupadd -r sudo
+EDITOR=nvim visudo
+useradd -c "<full user name"> -m -s /bin/bash <username>
+usermod -aG adm,log,rfkill,sys,wheel,sudo,video,input <username>
+chfn <username>
+passwd <username>
+```
+
+Confirm the new user can successfully use `sudo` to elevate permission.
+
+1. Switch to the created user account `su - <username>`. (.keybinding {ctrl+d} can be used to exit the user account and
+   go back to root)
+2. Enter `sudo whoami`, check if sudo works. The output should be `root`
+3. Exit the user account with .keybinding {ctrl+d} or `exit`.
+
+For increased security, disable login as root with `passwd --lock root`.
+
+## Configure Pacman and Yay
+
+Switch to the user account you just created with `su - <username>`.
+Run the following commands to install `yay`, a AUR package helper.
+
+```sh
+cd ~
+sudo pacman -S git base-devel go
+git clone https://aur.archlinux.org/yay.git
+cd yay
+makepkg -si
+yay -S yay
+cd ~
+rm -rf yay
+exit
+```
+
+Change the configuration of pacman in `/etc/pacman.conf`. Enable the options you want to set, e.g. `Color`,
+`VerbosePkgList`, `ParallelDownloads`.
+
+Then install the package `pacman -S pacman-contrib` and enable the service `systemctl enable paccache.timer`.
+
+## Enable TRIM
+
+For SSDs only, enable periodic trim.
+
+```sh
+systemctl enable fstrim.timer
+```
+
+> Warning: Enabling TRIM can leak some information about the encrypted system, e.g. presence of encrypted file systems,
+> or even file system types. If this is a concern to you, or you want to achieve plausable deniability, do not enable
+> TRIM on your system.
+
+## Recurring Automatic Mirror Selection
+
+Install reflector with `pacman -S reflector`
+
+Edit the options in `/etc/xdg/reflector/reflector.conf`. Then enable the timer service `systemctl enable reflector`.
+
+## Reboot the System
+
+Reboot the system into the installed Arch Linux.
+
+```sh
+# exit chroot environment with
+exit
+
+# unmount all partitions
+umount -R /mnt
+
+# reboot
+reboot
+```
+
+Remove your installation media.
+
+
+## Activate systemd-resolved Stub Resolver
+
+After the system rebooted, make sure to set the following symlink!
+
+```sh
+sudo ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
+```
+
+## Connect to the network
+
+Use `nmtui` to connect to a wireless network, if required.
+
+## Create a New Keypair
+
+Create a new ssh keyapair. Alternatively copy an existing one.
+
+```sh
+ssh-keygen -t ed25519 -C "$(whoami)@$(uname -n)-$(date -I)"
+```
+
+## Update the System#
+
+Run a full system upgrade with `pacman -Syu`.
+
+[rfc-1178]: https://tools.ietf.org/html/rfc1178
+[hostname-7]: https://man.archlinux.org/man/hostname.7
+