Terminal --help (Arch Linux) equivalent?

Not sure if this is the right place to ask, but as it's an operating system feature I'll give it a shot.
I am a big fan of Arch Linux especially using the unix commands within the terminal. One feature I love is being able to simple type '--help' after a command to get a full list of options. Such as 'ls --help' will bring up the options available for displaying the contents of the directory, like informing me '-a' shows hidden files.
What I would like to know is there a mac equivalent? So I can easily see options in terminal.
Thanks,
Steve.

There's really no consistancy. It depends on the command. Some actually do accept --help (e.g., gcc, grep -- probably all the gnu derived commands). Some may look for -? and/or -h. And some give you their general syntax if you make a syntax error on the command. But to get a full description (well, hopefully a more full description), as Reed said above use the man command.

Similar Messages

Is there an Arch Linux equivalent of debconf?

I have a debian based configuration that I roll out to clients using a scripted installation. Essentially, the base system is imaged onto the box (currently RaspberryPi) then my script and an archive containing extra files I want to push is copied to the card. The script runs and performs some automated tasks like downloading firmware, updating/upgrading packages and then installing the packages I need. For some packages (e.g. mysql and phpmyadmin), I use debconf in order to set the answers to the installation questions - this allows a completely unattended installation. This script also works on a regular Debian system - I can pass parameters to switch off functionality that isn't required on a desktop (e.g. the RPi firmware update or HostAPD installation) and the same script can commission a dev environment for me to work on.
I'm now looking to support other SBCs like the HummingBoard or perhaps the BananaPi which means I need to consider a platform that would work universally across any platform. So, I am looking at the feasibility of Arch Linux. From what I have read, it would probably suit my needs a lot better as it starts off as a very minimal installation. However I'm struggling to find a definitive alternative to debconf for performing my unattended installation.
My less preferred option would be to build an image by hand and then script the package updates, but this would put me in the realms of having to maintain images for each platform I end up supporting rather than having a script that would build the config on any supported system with latest packages.

There is interaction:
* you may be be prompted to OK removing package A and installing package B - happens when renaming packages via package conflicts e.g.
:: lzo2 and lzo are in conflict. Remove lzo? [y/N]
* you are asked to pick packages from a group or which one of the packages providing the thing you want to install, e.g. when installing libgl or phonon
$ sudo pacman -S phonon
resolving dependencies...
:: There are 2 providers available for phonon-qt4-backend:
:: Repository extra
1) phonon-qt4-gstreamer 2) phonon-qt4-vlc
Enter a number (default=1):

Arch Linux review...help?

I'm working on putting together a review of AL .4 for possible web publication on any site that'll take it. But, as you may have noticed, I'm a bit of a newbie.
I'm planning on touching on the following things:
Arch's goals
Arch's install
ABS, package optimisations and pacman (maintaining an Arch system)
Running X in Arch
Then strengths, weaknesses
And a sort of verdict (ie, what Arch is best suited for, overall quality)
Now, my question for those here at the bbs: what have I left out or what do I need to touch on that I may overlook? Feel free to mention subjects that may be containted within the above headings, because I may not be grasping all the aspects of Arch's awesomeness.
The going may be a bit slow on my review, but I hope to draw a bit more attention Arch's way!

beniro wrote:I think it's gonna go up on Distrowatch, because they seem to be booming right now. I'm not totally decided on that site yet.
What I am noticing with Distrowatch, its only holding the first paragraph with a link to the full article (review) wherever you put it up. I suggest you contact Distrowatch once you decide.
Lets hope your review will help Arch Linux to rise higher on Distrowatch list. Maybe not competing Yoper, which became # 1 within two months, but to same level (or above) as CRUX Linux .
http://www.distrowatch.com/

Need help with arch linux install!

Hello, let me start off by telling you about the predicament I'm in at the moment. I've been trying to install arch linux on with a cd-drive that has been failing for a little over a year now, so you can already see where my problem starts! The cd-drive, however will work with such cd's as Windows, Ubuntu, and Slackware, which I'm happy with. Yet, archlinux doesn't work so much.
And now maybe my solution. I've got a usb cd drive, that I've had laying around that works well, just not well enough for my bios to be able to boot from; which is horrible I know. I've searched the bios for loading a usb cd drive and everything else, including google so I don't think I'm going to get anywhere with that one. Anyways what I'm thinking of doing is that when archlinux is in the terminal right before you type the "/arch/setup" command, I would like to know if there is any command that allows you to change the cd it boots the cd from to go right into the installation. I'm still working on easying my out of the newbie stage of linux at the moment, but I've never run into a command like that, that would help me out. Hopefully there is one though, because I would very much like to archlinux to work, so please respond! Right now I'm running elinks through the terminal right before you type "/arch/setup". Thanks!

loosec wrote:
So you get through the boot process just fine then on your old CD drive. The only thing you should have to do after that is to throw your CD into the USB CD drive and proceed with the installation. The installer should then ask you what CD drive you would like to use when you choose install from CD.
Another way to do it would be to switch cd like above and then manually mount your /dev/[your_usb_cd_here] on /src. The installer then has to be pointed to this place as the source of your installation. To find out what your usb cd drive is called you should unplug it, then replug it and run: dmesg
The mount command might also need to be shown that this is a cd so:
mount -t iso9660 /dev/[usb_cd_device_name] /src
should do the trick.
If you really want to learn more of what the installer does (and fail installing a few times) you should also check out the command
/arch/quickinstall
If your Internet connection is up for it, it seems like you could just choose an FTP install instead.
Goodluck!
Once the CD is removed from the drive that it was booted from. the installation will not continue, as the arch install always goes back to the boot drive to continue read the neccessary information for the install. I do not think there is a way to fool the computer into booting from one cd drive and then continueing on with another. To do this you would have to tell the computer that you are switching drives.
If you can boot up the CD kernel and get to where you type in /arch/setup then the next thing I would od is FTP install. That would limit your CD rom drie usage.
There is also a way to install arch from within another distro, EVEN ANOTHER LIVECD! <-- this may be your best bet. Check the wiki, there is tons of information there.
Last edited by rooloo (2008-08-16 12:32:00)

[Solved] Please help setting up xbmc on Arch Linux

Trying to setup Arch Linux on my Asus Chromebox to run XBMC at startup. I have installed the following packages as per a guide on another site, xorg-server xorg-xinit xf86-video-intel xbmc. Whan I try to manually start xbmc, it gives me
Error: unable to open display
XBMC needs hardware accelerated OpenGL rendering.
Install an appropriate graphics driver.
Please consult XBMC Wiki for supported hardware
[url=http://wiki.xbmc.org/?title=Supported_hardware]http://wiki.xbmc.org/?title=Supported_hardware"[/url]
When I try startx, I get the following
X.Org X Server 1.16.2
Release Date: 2014-11-10
X Protocol Version 11, Revision 0
Build Operating System: Linux 3.17.2-1-ARCH x86_64
Current Operating System: Linux bunga 3.17.4-1-ARCH #1 SMP PREEMPT Fri Nov 21 21:14:42 CET 2014 x86_64
Kernel command line: BOOT_IMAGE=/boot/vmlinuz-linux root=UUID=c20ca43d-7d5a-4335-bca3-a0224f2280c3 rw quiet
Build Date: 10 November 2014 07:52:13PM
Current version of pixman: 0.32.6
Before reporting problems, check [url]http://wiki.x.org[/url]
to make sure that you have the latest version.
Markers: (--) probed, (**) from config file, (==) default setting,
(++) from command line, (!!) notice, (II) informational,
(WW) warning, (EE) error, (NI) not implemented, (??) unknown.
(==) Log file: "/var/log/Xorg.0.log", Time: Mon Dec 8 23:23:00 2014
(==) Using system config directory "/usr/share/X11/xorg.conf.d"
/etc/X11/xinit/xinitrc: line 51: twm: command not found
/etc/X11/xinit/xinitrc: line 53: xterm: command not found
/etc/X11/xinit/xinitrc: line 54: xterm: command not found
/etc/X11/xinit/xinitrc: line 55: exec: xterm: not found
xinit: connection to X server lost
waiting for X server to shut down (EE) Server terminated successfully (0). Closing log file.
That's as far as I've been able to get, what else do I need to do?
Thanks for any help!
Last edited by regder (2014-12-13 03:49:29)

Thank you, wasn't sure how to interpret X's output. I'm just trying to start xbmc from the command line, haven't tried yet getting it to autostart. Is there another command I should be using so it invokes X?
jasonwryan wrote:
Well, the error message is pretty clear: X is starting successfully, there is just nothing for it to do.
What method are you using to start xbmc? https://wiki.archlinux.org/index.php/Xb … r_ondemand

[SOLVED] New to Arch Linux, Need help in Installation.

Hi,
I am Ubuntu user for sometime, but I want to migrate to Arch Linux. I need some help. Please note that I am not Linux Expert but I have been using Ubuntu and OpenSUSE for quite sometime now. The reason for deciding to migrate to Arch Linux is with I need speed.
My laptop configuration is
Dell Vostro 1015 - Intel Dual Core 1.8 GHz with 2 GB RAM.
I was using Ubuntu 64 bit version.
Here in Arch Linux, I find there are 3 options to download i686 CPU, x86-64 CPU, Dual Architecture
Now which one should I download among x86-64 and Dual Architecture?
Thanks.
Last edited by sanjaydelhi (2011-11-16 15:11:14)

Thank you all for welcoming me at Arch Linux!
I was bit worried at the beginning because I tried Fedora before but it has one bug because of which it does not get installed on my laptop.
http://forums.fedoraforum.org/showthread.php?t=255943
I was bit disappointed being not able to use Fedora (both 14 and 15 ) because of this bug.
The reason I got worried because I am new to Arch, as I mentioned I am not Linux expert and Arch is not for beginners( though I consider myself intermediate in Linux but certainly not expert). So I thought if I do not get community support probably I will not be able to use Arch Linux. The reason I got interest in Arch Linux is http://lifehacker.com/5680453/build-a-k … he-process this article. I am not thinking of upgrading my laptop for speed anytime sooner. So I thought of trying Arch Linux.
The reason to post the topic was in most of Linux distros we see two options (x86, AMD_64). I found 3 options at Arch. I just wanted to make sure I am downloading right download.
So I hope I clarified it.
ANOKNUSA wrote:However, just for future reference: When engaging in any discussion with anyone anywhere on the internet at any time, it's often best to just leave experience and credentials out of the discussion. I don't mean any offense myself, but claiming to be "in software development" while appearing unfamiliar with hardware architecture comes of as a bit odd.
You are right. I should not have have brought experience and credentials in discussion. I used to follow hardware architectures but now I have so many other things to follow, so I can not keep up with hardware architectures. I still do not know exact architecture of i3,i5 or i7 processor or any of AMD processors. Thats how it is.
I thank you all for support.
Looking forward to trying Arch Linux.
Thanks

I can only shutdown arch linux using the terminal.

Recently I started using SLIM to log into Arch Linux. I was having trouble with the gnome-keyring window popping up everytime I logged in while using GDM. I downloaded SLIM and changed some settings so that gnome-keyring wouldn't pop up everytime.
Here are the changes I made:
~/.xinitrc using this article https://bugs.archlinux.org/task/18930
exec ck-launch-session gnome-session
eval $(gnome-keyring-daemon -s --components=pkcs11,secrets,ssh)
And /etc/pam.d/slim
#%PAM-1.0
auth requisite pam_nologin.so
auth required pam_env.so
auth required pam_unix.so
account required pam_unix.so
password required pam_unix.so
session required pam_limits.so
session required pam_unix.so
session optional pam_loginuid.so
session optional pam_ck_connector.so
auth optional pam_gnome_keyring.so*
session optional pam_gnome_keyring.so auto_start*
*= the changes I made to the file.
I was hoping to just stop gnome-keyring from popping up everytime I log into Arch Linux (ideally I wanted to auto log in) and now I can't shutdown unless I use the $ sudo shutdown -h now command in the terminal. When I click on the "Power Off" button in Gnome 3 it basically logs me out to the SLIM log in screen. I was able to shutdown the computer before by shutting the laptop screen/lid but that doesn't do anything now for some reason. Is there a way for me to auto log into arch without the gnome-keyring popping up everytime?
Additionally, with the gnome keyring dialog I wasn't able to click the "Automatically log in....." radio button because it was grayed out for some reason.
Last edited by rg_arc (2011-09-06 19:45:05)

$ ck-list-sessions
Session2:
unix-user = '1000'
realname = 'Ricky ******'
seat = 'Seat1'
session-type = ''
active = TRUE
x11-display = ':0.0'
x11-display-device = '/dev/tty7'
display-device = ''
remote-host-name = ''
is-local = TRUE
on-since = '2011-09-06T10:32:31.899610Z'
login-session-id = '1'
Session1:
unix-user = '1000'
realname = 'Ricky *******'
seat = 'Seat2'
session-type = ''
active = FALSE
x11-display = ':0.0'
x11-display-device = ''
display-device = ''
remote-host-name = ''
is-local = TRUE
on-since = '2011-09-06T10:32:31.706583Z'
login-session-id = '1'
$
I believe everything is working smoothly after I rebooted... I think this is solved... but its good measure to double check.
thanks for the input guys
Last edited by rg_arc (2011-09-06 15:37:05)

Arch Linux help - boot up, black screen

OK, i will try to explain to the best of my ability what happened when i was done installing arch and rebooted.
Well i booted into arch core-iso and set my time [UTC] and date.
and then i made for partitions as follows,
sda 1 - 20 gb - /root, boot, type 83
sda2 - 12 gb - /var type 83
sda 3 - 8.3 gb - type 82 - /swap
sda 4 - rest of memory - type 83 - /home
then wrote it
Then went onto install the Base, base-devel + sudo, wirelesstools, ndsiwrappers, wpa - supplicant, ssh, and net - cfg,
then installed it, then went on the config the system with nano
- click - /etc/rc.conf
edited the following
hostname = "baxxan"
eth0 = "dhcp"
gateway= "dhcp"
ctrl - x, y, enter
- clicked /etc/pacman.d/mirrorlist
then uncommented the [#] next to the url
"http://mirrorit.edu/archlinux/$repolos/1000"
and the ftp to
then set the root password
Then went onto install bootloader [ the hdd was empty so not much work there]
installed it on /dev/sda
then rebooted
upon reboot i preformed system update
[pacman -Syu] as the root user
then through pacman installed xorg, gnome, gnome-extra, and alsa-utils
then configed the /etc/rc.conf files [ nano /etc/rc.conf]
and added "hal" and "gdm" to the daemons
then typed "adduser"
and completed on the required asked for information for adding that user
then went onto /etc/sudoers [nano /etc/sudoers]
and under,
root ALL= (ALL) + ALL
wrote,
username ALL = (ALL) + ALL
THEN saved and rebooted. and was happy i was done with my arch linux install!
BUT WHEN I REBOOTED, and went into arch linux through the new bootloader, NOTHING but a BLACK SCREEN, comes up with two little white lines near the top! i even tried booting into the fallback option and its the same black screen with 2 little lines near the top!
WTF IS GOING ON!
Please help
Thank you,
P.S -
dont send me the dam link to the beginners cause i READ It, believe me.
Thanks!

litemotiv wrote:
please don't put text like URGENT or HELP! in your topic titles, it will only distract people from the actual problem
about your issue, it could be a problem with [wiki]KMS[/wiki]. first thing to try is to disable it (see the wiki page and search the forums for topics concerning your specific brand/type of card and bootup problems)
k r u sure this is the problem, also the KMS link you sent me, is that the wiki?

Arch Linux has helped me learn and I am grateful.

I am going to tell you what sparked this thread first: I was reading your wiki on installing a 32bit bundled system into a 64bit system. And NO, I did not know what the heck was going on as usual. The thing is I am always curious. That is why I end up learning. Here is what sparked me... I got to the 'sed' command and did NOT understand what was going on and I dove in! What a wonderful and amazingly, useful tool. Instead of just copying commands such as:
# sed -e 's/\$arch/i686/g' /etc/pacman.d/mirrorlist > /opt/arch32/mirrorlist
# sed -e 's@/etc/pacman.d/mirrorlist@/opt/arch32/mirrorlist@g' -e '/Architecture/ s,auto,i686,' /etc/pacman.conf > /opt/arch32/pacman.conf
I took the command apart, tried it in various ways, made test files and learned what it all meant. This type of thing is happening over and over again while using Arch. Arch was extremely overwhelming at first but, I really like it that way, I tend to learn really fast this way. In the beginning it is REALLY hard though.
i have read about said and I know about substitute and global (s///g) but what through me off was -e '/Architecture/ s,auto,i686,' So I made a test file with Architecture in it.
echo "Architecture = auto" > test
then ran
cat test | sed -e '/Architecture/ s,auto,i686,'
Wow! Guys, I was so excited when I finally figured out what was going on. Through trial and error, I just learned some really cool things about said and also got better at seeing that you can use any character as the separator - like @ instead of /. See this makes me happy, when I figure something out like this. It is SO rewarding. Im like a kid at Christmas
So what is happening is I am getting this phenominal understanding of Linux by diving deep into Arch Linux. I have now swithced over my only computer to Arch Linux. I only really cared about a few windows programs and with wine I have one of them running!!
I just want to thank you all for such a great experience. I didn't know how much I love this stuff until I started with Arch Linux. Thanks again!
Last edited by AcousticBruce (2015-05-21 16:21:18)

firekage wrote:
I wanted to learn too...so i have question.
Could somebody explain this? Also, what this is exacly
'/Architecture/ s,auto,i686,'
Let me show you by example...
echo "hello world" | sed 's/world/universe/'
echo "hello world" | sed 's,world,universe,'
echo "hello world" | sed 's@world@universe@'
Notice all of these are the same result. This is because you can use any character you like in place of the separator.
So when you look at this '/Architecture/ ***s.auto,i686,*** that is replacing the word 'auto' with 'i686'
The /Architecture/ is like using grep.
so if you have a file that looks like this
color1 = red
color2 = red
Easy way to make this in one command. Make sure and use $ and ' ' instead of " "
echo $'color1 = red\ncolor2 = red' > test
and run this
cat test | sed -e '/color1/ s,red,blue,'
same thing...
cat test | sed -e '/color1/ s@red@blue@'
also to prove its like grep
cat test | grep color2 | sed -e 's/red/black/'
sed is very powerful and awesome. There is WAY more than this.
Last edited by AcousticBruce (2015-05-21 18:39:28)

[SOLVED]New Arch Linux ISO Installation Help.

Hi All,
I am trying to install Arch Linux using new ISO. For some reason I am unable to log into Arch Forums on Windows and I am writing this on my tablet. I will add more info (proper quote, etc.) as soon as I am able to log in a laptop browser. That being said I am trying to install Arch using new ISO. Here is what I did.
Partition using cfdisk /, /home , /swap and /boot.
Format all these in ext4.
Create folders in mnt - root, home, swap, boot.
mount partitions in mnt folders.
Pacstrap /mnt base base-devel
Error
ERROR: /mnt is not a mount point!
I install in /mnt/root which probably doesnt touch other partitions like home boot and swap.
I follow other steps on installation wiki and reboot takes me back to windows.
What am I doing wrong?
Thanks.
Last edited by donniezazen (2012-07-24 22:49:01)

donniezazen wrote:Partition using cfdisk /, /home , /swap and /boot.
Format all these in ext4.
Create folders in mnt - root, home, swap, boot.
You don't need a root folder. /mnt is the root mount point. Before you mount boot and home:
mount /dev/sdax /mnt
where "x" is the number of your /root partition.
then
mkdir /mnt/boot
mount /dev/sdax /mnt/boot
mkdir /mnt/home
mount /dev/sdax /mnt/home
(replace "x" in all the /dev/sdax with the correct partitions.)
Error
ERROR: /mnt is not a mount point!
you should have stopped here and posted or tried to figure out what you did wrong.
The edited Beginner's Guide is very clear about this. You should read it.
Last edited by 2ManyDogs (2012-07-24 20:09:24)

Installing Arch Linux on USB key: error while booting

Hello,
first of all, I must say I've followed the steps from this article on arch wiki to install archlinux on my USB key: https://wiki.archlinux.org/index.php/In … _a_USB_key
So what I did is to use one of my 2 usb keys to INSTALL linux, and the second one to RUN linux. I used dd to write on the 1st usb, eveything worked fine when booting, then I do install arch on the my second usb following the stept from the link above, everything works until I get this error while booting (at the middle):
Waiting 10 seconds for device /dev/sdc/
Root device '/dev/sdc' doesn't exist. Attempting to create it.
ERROR: Unable to determine major/minor number of root device '/dev/disk/by-uuid/lotsofnumbers'
You are being dropped to a recovery shell
Type 'exit' to try and continue booting
/bin/sh: Can't contact tty; job control turned off
[ramfs /]#
To summarize I'll show you my conf files that could help you to resolve my problem:
/etc/fstab.conf
/dev/sdc1 /boot ext2 defaults 0 1
/dev/sdc2 / ext3 defaults 0 1
/dev/sdc3 /home ext3 defaults 0 1
So here I've sdc1 boot 32MB partition; sdc2 root 3GB partition; sdc3 home 978MB partition for a total of 4GB USB key~
I didn't make a swap partition as in the tutorial they are writing it's unnecessary for some kind of reasons.
/etc/mkinitcpio.conf
HOOKS="base udev usb autodetect pata scsi sata filesystems"
I've added to here, "usb" to the hooks
installed GRUB on my sdc, here is the menu.ist:
# (0) Arch Linux
title Arch Linux (USB)
root (hd0,0)
kernel /vmlinuz26 root=/dev/sdc ro vga=773
initrd /kernel26.img
So, I boot GRUB without problems, start Arch Linux, but then I got this error above.
I've searched alot on some forums and read many stuffs, but sitll can't fix it and it seems complicated.
I've tried to boot with UUID, also, but didn't make difference. I tried to remove some parameter from the hooks, but unfortunately this wasn't working still. I've read somewhere to use chroot, but I didn't catch on how to do that and what was the use of chroot, I'm still noob user of arch linux and currently learning. Maybe it's the problem, as some forum were talking about creating a new image, but I still don't know how to make it. By the way, I'm not sure this could have fixed my current problem. I've also read somewhere it could be due to my lack of space, but I wrote you how I did partition my USB key, let me know if you have any suggestion please.

1. What I did is re-installing entirely from my installation disk or USB to test out different setting in my config files, because I don't know how to edit my .conf as I can't really finish to boot to the end and get in terminal mode? If there is a quicker way to edit files from any terminal to go into my current USB sdc to modify directly my file from there, I'd enjoy probably. So rebuilding the initpio, no, I just re-installed to test out different configs.
2. Yes, same error.
3. Tested out by-id/by-path and uuid = no difference
4. Didn't know about larch, it seems to be a nice tool, I'll check it out

System encryption using LUKS and GPG encrypted keys for arch linux

Update: As of 2012-03-28, arch changed from gnupg 1.4 to 2.x which uses pinentry for the password dialog. The "etwo" hook described here doesn't work with gnupg 2. Either use the openssl hook below or use a statically compiled version of gnupg 1.4.
Update: As of 2012-12-19, the mkinitcpio is not called during boot, unless the "install" file for the hook contains "add_runscript". This resulted in an unbootable system for me. Also, the method name was changed from install () to build ().
Update: 2013-01-13: Updated the hook files using the corrections by Deth.
Note: This guide is a bit dated now, in particular the arch installation might be different now. But essentially, the approach stays the same. Please also take a look at the posts further down, specifically the alternative hooks that use openssl.
I always wanted to set up a fully encrypted arch linux server that uses gpg encrypted keyfiles on an external usb stick and luks for root filesystem encryption. I already did it once in gentoo using this guide. For arch, I had to play alot with initcpio hooks and after one day of experimentation, I finally got it working. I wrote a little guide for myself which I'm going to share here for anyone that might be interested. There might be better or easier ways, like I said this is just how I did it. I hope it might help someone else. Constructive feedback is always welcome
Intro
Using arch linux mkinitcpio's encrypt hook, one can easily use encrypted root partitions with LUKS. It's also possible to use key files stored on an external drive, like an usb stick. However, if someone steals your usb stick, he can just copy the key and potentially access the system. I wanted to have a little extra security by additionally encrypting the key file with gpg using a symmetric cipher and a passphrase.
Since the encrypt hook doesn't support this scenario, I created a modifed hook called “etwo” (silly name I know, it was the first thing that came to my mind). It will simply look if the key file has the extension .gpg and, if yes, use gpg to decrypt it, then pipe the result into cryptsetup.
Conventions
In this short guide, I use the following disk/partition names:
/dev/sda: is the hard disk that will contain an encrypted swap (/dev/sda1), /var (/dev/sda2) and root (/dev/sda3) partition.
/dev/sdb is the usb stick that will contain the gpg encrypted luks keys, the kernel and grub. It will have one partition /dev/sdb1 formatted with ext2.
/dev/mapper/root, /dev/mapper/swap and /dev/mapper/var will be the encrypted devices.
Credits
Thanks to the authors of SECURITY_System_Encryption_DM-Crypt_with_LUKS (gentoo wiki), System Encryption with LUKS (arch wiki), mkinitcpio (arch wiki) and Early Userspace in Arch Linux (/dev/brain0 blog)!
Guide
1. Boot the arch live cd
I had to use a newer testing version, because the 2010.05 cd came with a broken gpg. You can download one here: http://releng.archlinux.org/isos/. I chose the “core“ version. Go ahead and boot the live cd, but don't start the setup yet.
2. Set keymap
Use km to set your keymap. This is important for non-qwerty keyboards to avoid suprises with passphrases...
3. Wipe your discs
ATTENTION: this will DELETE everything on /dev/sda and /dev/sdb forever! Do not blame me for any lost data!
Before encrypting the hard disc, it has to be completely wiped and overwritten with random data. I used shred for this. Others use badblocks or dd with /dev/urandom. Either way, this will take a long time, depending on the size of your disc. I also wiped my usb stick just to be sure.
shred -v /dev/sda
shred -v /dev/sdb
4. Partitioning
Fire up fdisk and create the following partitions:
/dev/sda1, type linux swap.
/dev/sda2: type linux
/dev/sda3: type linux
/dev/sdb1, type linux
Of course you can choose a different layout, this is just how I did it. Keep in mind that only the root filesystem will be decrypted by the initcpio. The rest will be decypted during normal init boot using /etc/crypttab, the keys being somewhere on the root filesystem.
5. Format and mount the usb stick
Create an ext2 filesystem on /dev/sdb1:
mkfs.ext2 /dev/sdb1
mkdir /root/usb
mount /dev/sdb1 /root/usb
cd /root/usb # this will be our working directory for now.
Do not mount anything to /mnt, because the arch installer will use that directory later to mount the encrypted root filesystem.
6. Configure the network (if not already done automatically)
ifconfig eth0 192.168.0.2 netmask 255.255.255.0
route add default gw 192.168.0.1
echo "nameserver 192.168.0.1" >> /etc/resolv.conf
(this is just an example, your mileage may vary)
7. Install gnupg
pacman -Sy
pacman -S gnupg
Verify that gnupg works by launching gpg.
8. Create the keys
Just to be sure, make sure swap is off:
cat /proc/swaps
should return no entries.
Create gpg encrypted keys (remember, we're still in our working dir /root/usb):
dd if=/dev/urandom bs=512 count=4 | gpg -v --cipher-algo aes256 --digest-algo sha512 -c -a > root.gpg
dd if=/dev/urandom bs=512 count=4 | gpg -v --cipher-algo aes256 --digest-algo sha512 -c -a > var.gpg
Choose a strong password!!
Don't do this in two steps, e.g don't do dd to a file and then gpg on that file. The key should never be stored in plain text on an unencrypted device, except if that device is wiped on system restart (ramfs)!
Note that the default cipher for gpg is cast5, I just chose to use a different one.
9. Create the encrypted devices with cryptsetup
Create encrypted swap:
cryptsetup -c aes-cbc-essiv:sha256 -s 256 -h whirlpool -d /dev/urandom create swap /dev/sda1
You should see /dev/mapper/swap now. Don't format nor turn it on for now. This will be done by the arch installer.
Important: From the Cryptsetup 1.1.2 Release notes:
Cryptsetup can accept passphrase on stdin (standard input). Handling of new line (\n) character is defined by input specification:
if keyfile is specified as "-" (using --key-file=- or by positional argument in luksFormat and luksAddKey, like cat file | cryptsetup --key-file=- <action> ), input is processed
as normal binary file and no new line is interpreted.
if there is no key file specification (with default input from stdin pipe like echo passphrase | cryptsetup <action> ) input is processed as input from terminal, reading will
stop after new line is detected.
If I understand this correctly, since the randomly generated key can contain a newline early on, piping the key into cryptsetup without specifying --key-file=- could result in a big part of the key to be ignored by cryptsetup. Example: if the random key was "foo\nandsomemorebaratheendofthekey", piping it directly into cryptsetup without --key-file=- would result in cryptsetup using only "foo" as key which would have big security implications. We should therefor ALWAYS pipe the key into cryptsetup using --key-file=- which ignores newlines.
gpg -q -d root.gpg 2>/dev/null | cryptsetup -v -–key-file=- -c aes-cbc-essiv:sha256 -s 256 -h whirlpool luksFormat /dev/sda3
gpg -q -d var.gpg 2>/dev/null | cryptsetup -v –-key-file=- -c aes-cbc-essiv:sha256 -s 256 -h whirlpool -v luksFormat /dev/sda2
Check for any errors.
10. Open the luks devices
gpg -d root.gpg 2>/dev/null | cryptsetup -v –-key-file=- luksOpen /dev/sda3 root
gpg -d var.gpg 2>/dev/null | cryptsetup -v –-key-file=- luksOpen /dev/sda2 var
If you see /dev/mapper/root and /dev/mapper/var now, everything is ok.
11. Start the installer /arch/setup
Follow steps 1 to 3.
At step 4 (Prepare hard drive(s), select “3 – Manually Configure block devices, filesystems and mountpoints. Choose /dev/sdb1 (the usb stick) as /boot, /dev/mapper/swap for swap, /dev/mapper/root for / and /dev/mapper/var for /var.
Format all drives (choose “yes” when asked “do you want to have this filesystem (re)created”) EXCEPT for /dev/sdb1, choose “no”. Choose the correct filesystem for /dev/sdb1, ext2 in my case. Use swap for /dev/mapper/swap. For the rest, I chose ext4.
Select DONE to start formatting.
At step 5 (Select packages), select grub as boot loader. Select the base group. Add mkinitcpio.
Start step 6 (Install packages).
Go to step 7 (Configure System).
By sure to set the correct KEYMAP, LOCALE and TIMEZONE in /etc/rc.conf.
Edit /etc/fstab:
/dev/mapper/root / ext4 defaults 0 1
/dev/mapper/swap swap swap defaults 0 0
/dev/mapper/var /var ext4 defaults 0 1
# /dev/sdb1 /boot ext2 defaults 0 1
Configure the rest normally. When you're done, setup will launch mkinitcpio. We'll manually launch this again later.
Go to step 8 (install boot loader).
Be sure to change the kernel line in menu.lst:
kernel /vmlinuz26 root=/dev/mapper/root cryptdevice=/dev/sda3:root cryptkey=/dev/sdb1:ext2:/root.gpg
Don't forget the :root suffix in cryptdevice!
Also, my root line was set to (hd1,0). Had to change that to
root (hd0,0)
Install grub to /dev/sdb (the usb stick).
Now, we can exit the installer.
12. Install mkinitcpio with the etwo hook.
Create /mnt/lib/initcpio/hooks/etwo:
#!/usr/bin/ash
run_hook() {
/sbin/modprobe -a -q dm-crypt >/dev/null 2>&1
if [ -e "/sys/class/misc/device-mapper" ]; then
if [ ! -e "/dev/mapper/control" ]; then
/bin/mknod "/dev/mapper/control" c $(cat /sys/class/misc/device-mapper/dev | sed 's|:| |')
fi
[ "${quiet}" = "y" ] && CSQUIET=">/dev/null"
# Get keyfile if specified
ckeyfile="/crypto_keyfile"
usegpg="n"
if [ "x${cryptkey}" != "x" ]; then
ckdev="$(echo "${cryptkey}" | cut -d: -f1)"
ckarg1="$(echo "${cryptkey}" | cut -d: -f2)"
ckarg2="$(echo "${cryptkey}" | cut -d: -f3)"
if poll_device "${ckdev}" ${rootdelay}; then
case ${ckarg1} in
*[!0-9]*)
# Use a file on the device
# ckarg1 is not numeric: ckarg1=filesystem, ckarg2=path
if [ "${ckarg2#*.}" = "gpg" ]; then
ckeyfile="${ckeyfile}.gpg"
usegpg="y"
fi
mkdir /ckey
mount -r -t ${ckarg1} ${ckdev} /ckey
dd if=/ckey/${ckarg2} of=${ckeyfile} >/dev/null 2>&1
umount /ckey
# Read raw data from the block device
# ckarg1 is numeric: ckarg1=offset, ckarg2=length
dd if=${ckdev} of=${ckeyfile} bs=1 skip=${ckarg1} count=${ckarg2} >/dev/null 2>&1
esac
fi
[ ! -f ${ckeyfile} ] && echo "Keyfile could not be opened. Reverting to passphrase."
fi
if [ -n "${cryptdevice}" ]; then
DEPRECATED_CRYPT=0
cryptdev="$(echo "${cryptdevice}" | cut -d: -f1)"
cryptname="$(echo "${cryptdevice}" | cut -d: -f2)"
else
DEPRECATED_CRYPT=1
cryptdev="${root}"
cryptname="root"
fi
warn_deprecated() {
echo "The syntax 'root=${root}' where '${root}' is an encrypted volume is deprecated"
echo "Use 'cryptdevice=${root}:root root=/dev/mapper/root' instead."
if poll_device "${cryptdev}" ${rootdelay}; then
if /sbin/cryptsetup isLuks ${cryptdev} >/dev/null 2>&1; then
[ ${DEPRECATED_CRYPT} -eq 1 ] && warn_deprecated
dopassphrase=1
# If keyfile exists, try to use that
if [ -f ${ckeyfile} ]; then
if [ "${usegpg}" = "y" ]; then
# gpg tty fixup
if [ -e /dev/tty ]; then mv /dev/tty /dev/tty.backup; fi
cp -a /dev/console /dev/tty
while [ ! -e /dev/mapper/${cryptname} ];
do
sleep 2
/usr/bin/gpg -d "${ckeyfile}" 2>/dev/null | cryptsetup --key-file=- luksOpen ${cryptdev} ${cryptname} ${CSQUIET}
dopassphrase=0
done
rm /dev/tty
if [ -e /dev/tty.backup ]; then mv /dev/tty.backup /dev/tty; fi
else
if eval /sbin/cryptsetup --key-file ${ckeyfile} luksOpen ${cryptdev} ${cryptname} ${CSQUIET}; then
dopassphrase=0
else
echo "Invalid keyfile. Reverting to passphrase."
fi
fi
fi
# Ask for a passphrase
if [ ${dopassphrase} -gt 0 ]; then
echo ""
echo "A password is required to access the ${cryptname} volume:"
#loop until we get a real password
while ! eval /sbin/cryptsetup luksOpen ${cryptdev} ${cryptname} ${CSQUIET}; do
sleep 2;
done
fi
if [ -e "/dev/mapper/${cryptname}" ]; then
if [ ${DEPRECATED_CRYPT} -eq 1 ]; then
export root="/dev/mapper/root"
fi
else
err "Password succeeded, but ${cryptname} creation failed, aborting..."
exit 1
fi
elif [ -n "${crypto}" ]; then
[ ${DEPRECATED_CRYPT} -eq 1 ] && warn_deprecated
msg "Non-LUKS encrypted device found..."
if [ $# -ne 5 ]; then
err "Verify parameter format: crypto=hash:cipher:keysize:offset:skip"
err "Non-LUKS decryption not attempted..."
return 1
fi
exe="/sbin/cryptsetup create ${cryptname} ${cryptdev}"
tmp=$(echo "${crypto}" | cut -d: -f1)
[ -n "${tmp}" ] && exe="${exe} --hash \"${tmp}\""
tmp=$(echo "${crypto}" | cut -d: -f2)
[ -n "${tmp}" ] && exe="${exe} --cipher \"${tmp}\""
tmp=$(echo "${crypto}" | cut -d: -f3)
[ -n "${tmp}" ] && exe="${exe} --key-size \"${tmp}\""
tmp=$(echo "${crypto}" | cut -d: -f4)
[ -n "${tmp}" ] && exe="${exe} --offset \"${tmp}\""
tmp=$(echo "${crypto}" | cut -d: -f5)
[ -n "${tmp}" ] && exe="${exe} --skip \"${tmp}\""
if [ -f ${ckeyfile} ]; then
exe="${exe} --key-file ${ckeyfile}"
else
exe="${exe} --verify-passphrase"
echo ""
echo "A password is required to access the ${cryptname} volume:"
fi
eval "${exe} ${CSQUIET}"
if [ $? -ne 0 ]; then
err "Non-LUKS device decryption failed. verify format: "
err " crypto=hash:cipher:keysize:offset:skip"
exit 1
fi
if [ -e "/dev/mapper/${cryptname}" ]; then
if [ ${DEPRECATED_CRYPT} -eq 1 ]; then
export root="/dev/mapper/root"
fi
else
err "Password succeeded, but ${cryptname} creation failed, aborting..."
exit 1
fi
else
err "Failed to open encryption mapping: The device ${cryptdev} is not a LUKS volume and the crypto= paramater was not specified."
fi
fi
rm -f ${ckeyfile}
fi
Create /mnt/lib/initcpio/install/etwo:
#!/bin/bash
build() {
local mod
add_module dm-crypt
if [[ $CRYPTO_MODULES ]]; then
for mod in $CRYPTO_MODULES; do
add_module "$mod"
done
else
add_all_modules '/crypto/'
fi
add_dir "/dev/mapper"
add_binary "cryptsetup"
add_binary "dmsetup"
add_binary "/usr/bin/gpg"
add_file "/usr/lib/udev/rules.d/10-dm.rules"
add_file "/usr/lib/udev/rules.d/13-dm-disk.rules"
add_file "/usr/lib/udev/rules.d/95-dm-notify.rules"
add_file "/usr/lib/initcpio/udev/11-dm-initramfs.rules" "/usr/lib/udev/rules.d/11-dm-initramfs.rules"
add_runscript
help ()
cat<<HELPEOF
This hook allows for an encrypted root device with support for gpg encrypted key files.
To use gpg, the key file must have the extension .gpg and you have to install gpg and add /usr/bin/gpg
to your BINARIES var in /etc/mkinitcpio.conf.
HELPEOF
Edit /mnt/etc/mkinitcpio.conf (only relevant sections displayed):
MODULES=”ext2 ext4” # not sure if this is really nessecary.
BINARIES=”/usr/bin/gpg” # this could probably be done in install/etwo...
HOOKS=”base udev usbinput keymap autodetect pata scsi sata usb etwo filesystems” # (usbinput is only needed if you have an usb keyboard)
Copy the initcpio stuff over to the live cd:
cp /mnt/lib/initcpio/hooks/etwo /lib/initcpio/hooks/
cp /mnt/lib/initcpio/install/etwo /lib/initcpio/install/
cp /mnt/etc/mkinitcpio.conf /etc/
Verify your LOCALE, KEYMAP and TIMEZONE in /etc/rc.conf!
Now reinstall the initcpio:
mkinitcpio -g /mnt/boot/kernel26.img
Make sure there were no errors and that all hooks were included.
13. Decrypt the "var" key to the encrypted root
mkdir /mnt/keys
chmod 500 /mnt/keys
gpg –output /mnt/keys/var -d /mnt/boot/var.gpg
chmod 400 /mnt/keys/var
14. Setup crypttab
Edit /mnt/etc/crypttab:
swap /dev/sda1 SWAP -c aes-cbc-essiv:sha256 -s 256 -h whirlpool
var /dev/sda2 /keys/var
15. Reboot
We're done, you may reboot. Make sure you select the usb stick as the boot device in your bios and hope for the best. . If it didn't work, play with grub's settings or boot from the live cd, mount your encrypted devices and check all settings. You might also have less trouble by using uuid's instead of device names. I chose device names to keep things as simple as possible, even though it's not the optimal way to do it.
Make backups of your data and your usb stick and do not forget your password(s)! Or you can say goodbye to your data forever...
Last edited by fabriceb (2013-01-15 22:36:23)

I'm trying to run my install script that is based on https://bbs.archlinux.org/viewtopic.php?id=129885
Decrypting the gpg key after grub works, but then "Devce root already exists." appears every second.
any idea ?
#!/bin/bash
# This script is designed to be run in conjunction with a UEFI boot using Archboot intall media.
# prereqs:
# EFI "BIOS" set to boot *only* from EFI
# successful EFI boot of Archboot USB
# mount /dev/sdb1 /src
set -o nounset
#set -o errexit
# Host specific configuration
# this whole script needs to be customized, particularly disk partitions
# and configuration, but this section contains global variables that
# are used during the system configuration phase for convenience
HOSTNAME=daniel
USERNAME=user
# Globals
# We don't need to set these here but they are used repeatedly throughout
# so it makes sense to reuse them and allow an easy, one-time change if we
# need to alter values such as the install target mount point.
INSTALL_TARGET="/install"
HR="--------------------------------------------------------------------------------"
PACMAN="pacman --noconfirm --config /tmp/pacman.conf"
TARGET_PACMAN="pacman --noconfirm --config /tmp/pacman.conf -r ${INSTALL_TARGET}"
CHROOT_PACMAN="pacman --noconfirm --cachedir /var/cache/pacman/pkg --config /tmp/pacman.conf -r ${INSTALL_TARGET}"
FILE_URL="file:///packages/core-$(uname -m)/pkg"
FTP_URL='ftp://mirrors.kernel.org/archlinux/$repo/os/$arch'
HTTP_URL='http://mirrors.kernel.org/archlinux/$repo/os/$arch'
# Functions
# I've avoided using functions in this script as they aren't required and
# I think it's more of a learning tool if you see the step-by-step
# procedures even with minor duplciations along the way, but I feel that
# these functions clarify the particular steps of setting values in config
# files.
SetValue () {
# EXAMPLE: SetValue VARIABLENAME '\"Quoted Value\"' /file/path
VALUENAME="$1" NEWVALUE="$2" FILEPATH="$3"
sed -i "s+^#\?$${VALUENAME}$=.*$+\1=${NEWVALUE}+" "${FILEPATH}"
CommentOutValue () {
VALUENAME="$1" FILEPATH="$2"
sed -i "s/^$${VALUENAME}.*$$/#\1/" "${FILEPATH}"
UncommentValue () {
VALUENAME="$1" FILEPATH="$2"
sed -i "s/^#$${VALUENAME}.*$$/\1/" "${FILEPATH}"
# Initialize
# Warn the user about impending doom, set up the network on eth0, mount
# the squashfs images (Archboot does this normally, we're just filling in
# the gaps resulting from the fact that we're doing a simple scripted
# install). We also create a temporary pacman.conf that looks for packages
# locally first before sourcing them from the network. It would be better
# to do either *all* local or *all* network but we can't for two reasons.
# 1. The Archboot installation image might have an out of date kernel
# (currently the case) which results in problems when chrooting
# into the install mount point to modprobe efivars. So we use the
# package snapshot on the Archboot media to ensure our kernel is
# the same as the one we booted with.
# 2. Ideally we'd source all local then, but some critical items,
# notably grub2-efi variants, aren't yet on the Archboot media.
# Warn
timer=9
echo -e "\n\nMAC WARNING: This script is not designed for APPLE MAC installs and will potentially misconfigure boot to your existing OS X installation. STOP NOW IF YOU ARE ON A MAC.\n\n"
echo -n "GENERAL WARNING: This procedure will completely format /dev/sda. Please cancel with ctrl-c to cancel within $timer seconds..."
while [[ $timer -gt 0 ]]
do
sleep 1
let timer-=1
echo -en "$timer seconds..."
done
echo "STARTING"
# Get Network
echo -n "Waiting for network address.."
#dhclient eth0
dhcpcd -p eth0
echo -n "Network address acquired."
# Mount packages squashfs images
umount "/packages/core-$(uname -m)"
umount "/packages/core-any"
rm -rf "/packages/core-$(uname -m)"
rm -rf "/packages/core-any"
mkdir -p "/packages/core-$(uname -m)"
mkdir -p "/packages/core-any"
modprobe -q loop
modprobe -q squashfs
mount -o ro,loop -t squashfs "/src/packages/archboot_packages_$(uname -m).squashfs" "/packages/core-$(uname -m)"
mount -o ro,loop -t squashfs "/src/packages/archboot_packages_any.squashfs" "/packages/core-any"
# Create temporary pacman.conf file
cat << PACMANEOF > /tmp/pacman.conf
[options]
Architecture = auto
CacheDir = ${INSTALL_TARGET}/var/cache/pacman/pkg
CacheDir = /packages/core-$(uname -m)/pkg
CacheDir = /packages/core-any/pkg
[core]
Server = ${FILE_URL}
Server = ${FTP_URL}
Server = ${HTTP_URL}
[extra]
Server = ${FILE_URL}
Server = ${FTP_URL}
Server = ${HTTP_URL}
#Uncomment to enable pacman -Sy yaourt
[archlinuxfr]
Server = http://repo.archlinux.fr/\$arch
PACMANEOF
# Prepare pacman
[[ ! -d "${INSTALL_TARGET}/var/cache/pacman/pkg" ]] && mkdir -m 755 -p "${INSTALL_TARGET}/var/cache/pacman/pkg"
[[ ! -d "${INSTALL_TARGET}/var/lib/pacman" ]] && mkdir -m 755 -p "${INSTALL_TARGET}/var/lib/pacman"
${PACMAN} -Sy
${TARGET_PACMAN} -Sy
# Install prereqs from network (not on archboot media)
echo -e "\nInstalling prereqs...\n$HR"
#sed -i "s/^#S/S/" /etc/pacman.d/mirrorlist # Uncomment all Server lines
UncommentValue S /etc/pacman.d/mirrorlist # Uncomment all Server lines
${PACMAN} --noconfirm -Sy gptfdisk btrfs-progs-unstable libusb-compat gnupg
# Configure Host
# Here we create three partitions:
# 1. efi and /boot (one partition does double duty)
# 2. swap
# 3. our encrypted root
# Note that all of these are on a GUID partition table scheme. This proves
# to be quite clean and simple since we're not doing anything with MBR
# boot partitions and the like.
echo -e "format\n"
# shred -v /dev/sda
# disk prep
sgdisk -Z /dev/sda # zap all on disk
#sgdisk -Z /dev/mmcb1k0 # zap all on sdcard
sgdisk -a 2048 -o /dev/sda # new gpt disk 2048 alignment
#sgdisk -a 2048 -o /dev/mmcb1k0
# create partitions
sgdisk -n 1:0:+200M /dev/sda # partition 1 (UEFI BOOT), default start block, 200MB
sgdisk -n 2:0:+4G /dev/sda # partition 2 (SWAP), default start block, 200MB
sgdisk -n 3:0:0 /dev/sda # partition 3, (LUKS), default start, remaining space
#sgdisk -n 1:0:1800M /dev/mmcb1k0 # root.gpg
# set partition types
sgdisk -t 1:ef00 /dev/sda
sgdisk -t 2:8200 /dev/sda
sgdisk -t 3:8300 /dev/sda
#sgdisk -t 1:0700 /dev/mmcb1k0
# label partitions
sgdisk -c 1:"UEFI Boot" /dev/sda
sgdisk -c 2:"Swap" /dev/sda
sgdisk -c 3:"LUKS" /dev/sda
#sgdisk -c 1:"Key" /dev/mmcb1k0
echo -e "create gpg file\n"
# create gpg file
dd if=/dev/urandom bs=512 count=4 | gpg -v --cipher-algo aes256 --digest-algo sha512 -c -a > /root/root.gpg
echo -e "format LUKS on root\n"
# format LUKS on root
gpg -q -d /root/root.gpg 2>/dev/null | cryptsetup -v --key-file=- -c aes-xts-plain -s 512 --hash sha512 luksFormat /dev/sda3
echo -e "open LUKS on root\n"
gpg -d /root/root.gpg 2>/dev/null | cryptsetup -v --key-file=- luksOpen /dev/sda3 root
# NOTE: make sure to add dm_crypt and aes_i586 to MODULES in rc.conf
# NOTE2: actually this isn't required since we're mounting an encrypted root and grub2/initramfs handles this before we even get to rc.conf
# make filesystems
# following swap related commands not used now that we're encrypting our swap partition
#mkswap /dev/sda2
#swapon /dev/sda2
#mkfs.ext4 /dev/sda3 # this is where we'd create an unencrypted root partition, but we're using luks instead
echo -e "\nCreating Filesystems...\n$HR"
# make filesystems
mkfs.ext4 /dev/mapper/root
mkfs.vfat -F32 /dev/sda1
#mkfs.vfat -F32 /dev/mmcb1k0p1
echo -e "mount targets\n"
# mount target
#mount /dev/sda3 ${INSTALL_TARGET} # this is where we'd mount the unencrypted root partition
mount /dev/mapper/root ${INSTALL_TARGET}
# mount target
mkdir ${INSTALL_TARGET}
# mkdir ${INSTALL_TARGET}/key
# mount -t vfat /dev/mmcb1k0p1 ${INSTALL_TARGET}/key
mkdir ${INSTALL_TARGET}/boot
mount -t vfat /dev/sda1 ${INSTALL_TARGET}/boot
# Install base, necessary utilities
mkdir -p ${INSTALL_TARGET}/var/lib/pacman
${TARGET_PACMAN} -Sy
${TARGET_PACMAN} -Su base
# curl could be installed later but we want it ready for rankmirrors
${TARGET_PACMAN} -S curl
${TARGET_PACMAN} -S libusb-compat gnupg
${TARGET_PACMAN} -R grub
rm -rf ${INSTALL_TARGET}/boot/grub
${TARGET_PACMAN} -S grub2-efi-x86_64
# Configure new system
SetValue HOSTNAME ${HOSTNAME} ${INSTALL_TARGET}/etc/rc.conf
sed -i "s/^$127\.0\.0\.1.*$$/\1 ${HOSTNAME}/" ${INSTALL_TARGET}/etc/hosts
SetValue CONSOLEFONT Lat2-Terminus16 ${INSTALL_TARGET}/etc/rc.conf
#following replaced due to netcfg
#SetValue interface eth0 ${INSTALL_TARGET}/etc/rc.conf
# write fstab
# You can use UUID's or whatever you want here, of course. This is just
# the simplest approach and as long as your drives aren't changing values
# randomly it should work fine.
cat > ${INSTALL_TARGET}/etc/fstab <<FSTAB_EOF
# /etc/fstab: static file system information
# <file system> <dir> <type> <options> <dump> <pass>
tmpfs /tmp tmpfs nodev,nosuid 0 0
/dev/sda1 /boot vfat defaults 0 0
/dev/mapper/cryptswap none swap defaults 0 0
/dev/mapper/root / ext4 defaults,noatime 0 1
FSTAB_EOF
# write etwo
mkdir -p /lib/initcpio/hooks/
mkdir -p /lib/initcpio/install/
cp /src/etwo_hooks /lib/initcpio/hooks/etwo
cp /src/etwo_install /lib/initcpio/install/etwo
mkdir -p ${INSTALL_TARGET}/lib/initcpio/hooks/
mkdir -p ${INSTALL_TARGET}/lib/initcpio/install/
cp /src/etwo_hooks ${INSTALL_TARGET}/lib/initcpio/hooks/etwo
cp /src/etwo_install ${INSTALL_TARGET}/lib/initcpio/install/etwo
# write crypttab
# encrypted swap (random passphrase on boot)
echo cryptswap /dev/sda2 SWAP "-c aes-xts-plain -h whirlpool -s 512" >> ${INSTALL_TARGET}/etc/crypttab
# copy configs we want to carry over to target from install environment
mv ${INSTALL_TARGET}/etc/resolv.conf ${INSTALL_TARGET}/etc/resolv.conf.orig
cp /etc/resolv.conf ${INSTALL_TARGET}/etc/resolv.conf
mkdir -p ${INSTALL_TARGET}/tmp
cp /tmp/pacman.conf ${INSTALL_TARGET}/tmp/pacman.conf
# mount proc, sys, dev in install root
mount -t proc proc ${INSTALL_TARGET}/proc
mount -t sysfs sys ${INSTALL_TARGET}/sys
mount -o bind /dev ${INSTALL_TARGET}/dev
echo -e "umount boot\n"
# we have to remount /boot from inside the chroot
umount ${INSTALL_TARGET}/boot
# Create install_efi script (to be run *after* chroot /install)
touch ${INSTALL_TARGET}/install_efi
chmod a+x ${INSTALL_TARGET}/install_efi
cat > ${INSTALL_TARGET}/install_efi <<EFI_EOF
# functions (these could be a library, but why overcomplicate things
SetValue () { VALUENAME="\$1" NEWVALUE="\$2" FILEPATH="\$3"; sed -i "s+^#\?$\${VALUENAME}$=.*\$+\1=\${NEWVALUE}+" "\${FILEPATH}"; }
CommentOutValue () { VALUENAME="\$1" FILEPATH="\$2"; sed -i "s/^$\${VALUENAME}.*$\$/#\1/" "\${FILEPATH}"; }
UncommentValue () { VALUENAME="\$1" FILEPATH="\$2"; sed -i "s/^#$\${VALUENAME}.*$\$/\1/" "\${FILEPATH}"; }
echo -e "mount boot\n"
# remount here or grub et al gets confused
mount -t vfat /dev/sda1 /boot
# mkinitcpio
# NOTE: intel_agp drm and i915 for intel graphics
SetValue MODULES '\\"dm_mod dm_crypt aes_x86_64 ext2 ext4 vfat intel_agp drm i915\\"' /etc/mkinitcpio.conf
SetValue HOOKS '\\"base udev pata scsi sata usb usbinput keymap consolefont etwo encrypt filesystems\\"' /etc/mkinitcpio.conf
SetValue BINARIES '\\"/usr/bin/gpg\\"' /etc/mkinitcpio.conf
mkinitcpio -p linux
# kernel modules for EFI install
modprobe efivars
modprobe dm-mod
# locale-gen
UncommentValue de_AT /etc/locale.gen
locale-gen
# install and configure grub2
# did this above
#${CHROOT_PACMAN} -Sy
#${CHROOT_PACMAN} -R grub
#rm -rf /boot/grub
#${CHROOT_PACMAN} -S grub2-efi-x86_64
# you can be surprisingly sloppy with the root value you give grub2 as a kernel option and
# even omit the cryptdevice altogether, though it will wag a finger at you for using
# a deprecated syntax, so we're using the correct form here
# NOTE: take out i915.modeset=1 unless you are on intel graphics
SetValue GRUB_CMDLINE_LINUX '\\"cryptdevice=/dev/sda3:root cryptkey=/dev/sda1:vfat:/root.gpg add_efi_memmap i915.i915_enable_rc6=1 i915.i915_enable_fbc=1 i915.lvds_downclock=1 pcie_aspm=force quiet\\"' /etc/default/grub
# set output to graphical
SetValue GRUB_TERMINAL_OUTPUT gfxterm /etc/default/grub
SetValue GRUB_GFXMODE 960x600x32,auto /etc/default/grub
SetValue GRUB_GFXPAYLOAD_LINUX keep /etc/default/grub # comment out this value if text only mode
# install the actual grub2. Note that despite our --boot-directory option we will still need to move
# the grub directory to /boot/grub during grub-mkconfig operations until grub2 gets patched (see below)
grub_efi_x86_64-install --bootloader-id=grub --no-floppy --recheck
# create our EFI boot entry
# bug in the HP bios firmware (F.08)
efibootmgr --create --gpt --disk /dev/sda --part 1 --write-signature --label "ARCH LINUX" --loader "\\\\grub\\\\grub.efi"
# copy font for grub2
cp /usr/share/grub/unicode.pf2 /boot/grub
# generate config file
grub-mkconfig -o /boot/grub/grub.cfg
exit
EFI_EOF
# Install EFI using script inside chroot
chroot ${INSTALL_TARGET} /install_efi
rm ${INSTALL_TARGET}/install_efi
# Post install steps
# anything you want to do post install. run the script automatically or
# manually
touch ${INSTALL_TARGET}/post_install
chmod a+x ${INSTALL_TARGET}/post_install
cat > ${INSTALL_TARGET}/post_install <<POST_EOF
set -o errexit
set -o nounset
# functions (these could be a library, but why overcomplicate things
SetValue () { VALUENAME="\$1" NEWVALUE="\$2" FILEPATH="\$3"; sed -i "s+^#\?$\${VALUENAME}$=.*\$+\1=\${NEWVALUE}+" "\${FILEPATH}"; }
CommentOutValue () { VALUENAME="\$1" FILEPATH="\$2"; sed -i "s/^$\${VALUENAME}.*$\$/#\1/" "\${FILEPATH}"; }
UncommentValue () { VALUENAME="\$1" FILEPATH="\$2"; sed -i "s/^#$\${VALUENAME}.*$\$/\1/" "\${FILEPATH}"; }
# root password
echo -e "${HR}\\nNew root user password\\n${HR}"
passwd
# add user
echo -e "${HR}\\nNew non-root user password (username:${USERNAME})\\n${HR}"
groupadd sudo
useradd -m -g users -G audio,lp,optical,storage,video,games,power,scanner,network,sudo,wheel -s /bin/bash ${USERNAME}
passwd ${USERNAME}
# mirror ranking
echo -e "${HR}\\nRanking Mirrors (this will take a while)\\n${HR}"
cp /etc/pacman.d/mirrorlist /etc/pacman.d/mirrorlist.orig
mv /etc/pacman.d/mirrorlist /etc/pacman.d/mirrorlist.all
sed -i "s/#S/S/" /etc/pacman.d/mirrorlist.all
rankmirrors -n 5 /etc/pacman.d/mirrorlist.all > /etc/pacman.d/mirrorlist
# temporary fix for locale.sh update conflict
mv /etc/profile.d/locale.sh /etc/profile.d/locale.sh.preupdate || true
# yaourt repo (add to target pacman, not tmp pacman.conf, for ongoing use)
echo -e "\\n[archlinuxfr]\\nServer = http://repo.archlinux.fr/\\\$arch" >> /etc/pacman.conf
echo -e "\\n[haskell]\\nServer = http://www.kiwilight.com/\\\$repo/\\\$arch" >> /etc/pacman.conf
# additional groups and utilities
pacman --noconfirm -Syu
pacman --noconfirm -S base-devel
pacman --noconfirm -S yaourt
# sudo
pacman --noconfirm -S sudo
cp /etc/sudoers /tmp/sudoers.edit
sed -i "s/#\s*$%wheel\s*ALL=(ALL)\s*ALL.*$$/\1/" /tmp/sudoers.edit
sed -i "s/#\s*$%sudo\s*ALL=(ALL)\s*ALL.*$$/\1/" /tmp/sudoers.edit
visudo -qcsf /tmp/sudoers.edit && cat /tmp/sudoers.edit > /etc/sudoers
# power
pacman --noconfirm -S acpi acpid acpitool cpufrequtils
yaourt --noconfirm -S powertop2
sed -i "/^DAEMONS/ s/)/ @acpid)/" /etc/rc.conf
sed -i "/^MODULES/ s/)/ acpi-cpufreq cpufreq_ondemand cpufreq_powersave coretemp)/" /etc/rc.conf
# following requires my acpi handler script
echo "/etc/acpi/handler.sh boot" > /etc/rc.local
# time
pacman --noconfirm -S ntp
sed -i "/^DAEMONS/ s/hwclock /!hwclock @ntpd /" /etc/rc.conf
# wireless (wpa supplicant should already be installed)
pacman --noconfirm -S iw wpa_supplicant rfkill
pacman --noconfirm -S netcfg wpa_actiond ifplugd
mv /etc/wpa_supplicant.conf /etc/wpa_supplicant.conf.orig
echo -e "ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=network\nupdate_config=1" > /etc/wpa_supplicant.conf
# make sure to copy /etc/network.d/examples/wireless-wpa-config to /etc/network.d/home and edit
sed -i "/^DAEMONS/ s/)/ @net-auto-wireless @net-auto-wired)/" /etc/rc.conf
sed -i "/^DAEMONS/ s/ network / /" /etc/rc.conf
echo -e "\nWIRELESS_INTERFACE=wlan0" >> /etc/rc.conf
echo -e "WIRED_INTERFACE=eth0" >> /etc/rc.conf
echo "options iwlagn led_mode=2" > /etc/modprobe.d/iwlagn.conf
# sound
pacman --noconfirm -S alsa-utils alsa-plugins
sed -i "/^DAEMONS/ s/)/ @alsa)/" /etc/rc.conf
mv /etc/asound.conf /etc/asound.conf.orig || true
#if alsamixer isn't working, try alsamixer -Dhw and speaker-test -Dhw -c 2
# video
pacman --noconfirm -S base-devel mesa mesa-demos
# x
#pacman --noconfirm -S xorg xorg-xinit xorg-utils xorg-server-utils xdotool xorg-xlsfonts
#yaourt --noconfirm -S xf86-input-wacom-git # NOT NEEDED? input-wacom-git
#TODO: cut down the install size
#pacman --noconfirm -S xorg-server xorg-xinit xorg-utils xorg-server-utils
# TODO: wacom
# environment/wm/etc.
#pacman --noconfirm -S xfce4 compiz ccsm
#pacman --noconfirm -S xcompmgr
#yaourt --noconfirm -S physlock unclutter
#pacman --noconfirm -S rxvt-unicode urxvt-url-select hsetroot
#pacman --noconfirm -S gtk2 #gtk3 # for taffybar?
#pacman --noconfirm -S ghc
# note: try installing alex and happy from cabal instead
#pacman --noconfirm -S haskell-platform haskell-hscolour
#yaourt --noconfirm -S xmonad-darcs xmonad-contrib-darcs xcompmgr
#yaourt --noconfirm -S xmobar-git
# TODO: edit xfce to use compiz
# TODO: xmonad, but deal with video tearing
# TODO: xmonad-darcs fails to install from AUR. haskell dependency hell.
# switching to cabal
# fonts
pacman --noconfirm -S terminus-font
yaourt --noconfirm -S webcore-fonts
yaourt --noconfirm -S fontforge libspiro
yaourt --noconfirm -S freetype2-git-infinality
# TODO: sed infinality and change to OSX or OSX2 mode
# and create the sym link from /etc/fonts/conf.avail to conf.d
# misc apps
#pacman --noconfirm -S htop openssh keychain bash-completion git vim
#pacman --noconfirm -S chromium flashplugin
#pacman --noconfirm -S scrot mypaint bc
#yaourt --noconfirm -S task-git stellarium googlecl
# TODO: argyll
POST_EOF
# Post install in chroot
#echo "chroot and run /post_install"
chroot /install /post_install
rm /install/post_install
# copy grub.efi file to the default HP EFI boot manager path
mkdir -p ${INSTALL_TARGET}/boot/EFI/Microsoft/BOOT/
mkdir -p ${INSTALL_TARGET}/boot/EFI/BOOT/
cp ${INSTALL_TARGET}/boot/grub/grub.efi ${INSTALL_TARGET}/boot/EFI/Microsoft/BOOT/bootmgfw.efi
cp ${INSTALL_TARGET}/boot/grub/grub.efi ${INSTALL_TARGET}/boot/EFI/BOOT/BOOTX64.EFI
cp /root/root.gpg ${INSTALL_TARGET}/boot/
# NOTES/TODO

How to setup grub2 with arch linux and xen, lvm on luks

OK, so I tried downloading this package from AUR: https://aur.archlinux.org/packages/xen-git/ , but that has patching problems as noted in the comments. It looks like the packagebuild sets up all the xen stuff for you, but I can't seem to get the package to install because of the error's while patching. If anyone can point me in the right direction on what all the extra files in the PKGBUILD are for or how to debug problems with PKGBUILDs not working because of patches.
So next I just tried to compile the latest xen from git://xenbits.xen.org/xen.git (with ./configure, make, make install) and that seemed to go fine, but I'm a bit confused:
1. Do I have to do any additional configuration for xen when working with arch linux? On ubuntu I could just compile the source, update grub, and make sure to start the x services at runtime.
2. How do I set up grub to load xen with this setup? Right now this is my /boot/grub/grub.cfg:
GRUB_DEFAULT=0
GRUB_TIMEOUT=5
GRUB_DISTRIBUTOR="Arch"
GRUB_CMDLINE_LINUX_DEFAULT="quiet"
GRUB_CMDLINE_LINUX="cryptdevice=/dev/sda3:vgStorage"
# Preload both GPT and MBR modules so that they are not missed
GRUB_PRELOAD_MODULES="part_gpt part_msdos"
# Uncomment to enable Hidden Menu, and optionally hide the timeout count
#GRUB_HIDDEN_TIMEOUT=5
#GRUB_HIDDEN_TIMEOUT_QUIET=true
# Uncomment to use basic console
GRUB_TERMINAL_INPUT=console
# Uncomment to disable graphical terminal
#GRUB_TERMINAL_OUTPUT=console
# The resolution used on graphical terminal
# note that you can use only modes which your graphic card supports via VBE
# you can see them in real GRUB with the command `vbeinfo'
GRUB_GFXMODE=auto
# Uncomment to allow the kernel use the same resolution used by grub
GRUB_GFXPAYLOAD_LINUX=keep
# Uncomment if you want GRUB to pass to the Linux kernel the old parameter
# format "root=/dev/xxx" instead of "root=/dev/disk/by-uuid/xxx"
#GRUB_DISABLE_LINUX_UUID=true
# Uncomment to disable generation of recovery mode menu entries
GRUB_DISABLE_RECOVERY=true
# Uncomment and set to the desired menu colors. Used by normal and wallpaper
# modes only. Entries specified as foreground/background.
#GRUB_COLOR_NORMAL="light-blue/black"
#GRUB_COLOR_HIGHLIGHT="light-cyan/blue"
# Uncomment one of them for the gfx desired, a image background or a gfxtheme
#GRUB_BACKGROUND="/path/to/wallpaper"
#GRUB_THEME="/path/to/gfxtheme"
# Uncomment to get a beep at GRUB start
#GRUB_INIT_TUNE="480 440 1"
#GRUB_SAVEDEFAULT="true"
~
I've tried throwing in a line like: XEN_HYPERVISOR_CMDLINE="cryptdevice=/dev/sda3:vgStorage", but nothing new shows up on the grub boot menu.
First time trying to set up a non-ubuntu system, please help!

As for XEN.... well you could always try QEMU/KVM or LXC.
As for the LVM2-on-LUKS/dm-crypt
My /etc/mkinitcpio.conf looks like this...
MODULES="aesni_intel ata_generic ata_piix nls_cp437 ext4 intel_agp i915 dm-snapshot"
BINARIES=""
FILES=""
HOOKS="base udev autodetect block keymap encrypt lvm2 filesystems keyboard fsck shutdown"
/etc/defaults/grub
GRUB_CMDLINE_LINUX="cryptdevice=/dev/sda2:root:allow-discards"
GRUB_PRELOAD_MODULES="part_gpt part_msdos"
GRUB_TERMINAL_INPUT=console
GRUB_GFXMODE=auto
GRUB_GFXPAYLOAD_LINUX=keep
GRUB_DISABLE_RECOVERY=true
The running grub config looks like this
/boot/grub/grub.cfg
9 insmod part_gpt
10 insmod part_msdos
53 if loadfont unicode ; then
54 set gfxmode=auto
55 load_video
56 insmod gfxterm
57 set locale_dir=$prefix/locale
58 set lang=en_US
59 insmod gettext
60 fi
61 terminal_input console
62 terminal_output gfxterm
63 set timeout=3
84 menuentry 'Backup, Arch Linux grsec kernel' --class arch --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-grsec kernel-true-12341234-8080-8080-8080-332200882255' {
85 load_video
86 set gfxpayload=keep
87 insmod gzio
88 insmod part_msdos
89 insmod ext2
90 set root='hd1,msdos2'
91 if [ x$feature_platform_search_hint = xy ]; then
92 search --no-floppy --fs-uuid --set=root --hint-bios=hd1,msdos2 --hint-efi=hd1,msdos2 --hint-baremetal=ahci1,msdos2 BBAAEEAA-FFCC-CCFF-FFCC-AABBCCEEBBAA
93 else
94 search --no-floppy --fs-uuid --set=root BBAAEEAA-FFCC-CCFF-FFCC-AABBCCEEBBAA
95 fi
96 echo 'Loading Linux grsec kernel ...'
97 linux /vmlinuz-linux-grsec root=/dev/mapper/VolGroup00-lvroot rw cryptdevice=/dev/sda2:root:allow-discards quiet
98 echo 'Loading initial ramdisk ...'
99 initrd /initramfs-linux-grsec.img
100 }
Things to note:
Numerical UUID is the UUID of the ROOT partition.
Alphabetical UUIS is the BOOT partition
hd1,msdos2 AND ahci1,msdos2 are how the Grub Bootloader numbers the drives not Linux.
I have my BOOT partition on a USB stick, and it is the Second partition.
So, that would make it, Device 2 and Partition 2
Device numbering starts at 0
Partition numbering starts at 1
Oh, and note that you don't need ":allow-discards" ... at all but certainly if you don't have an SSD. Also note that I included the line numbers so it is very clear that I didn't post the whole thing, but instead what I thought was relevant. Finally, I am loading modules that I don't even need, but what the hell... if it ain't broke, don't fix it
Last edited by hunterthomson (2013-12-04 08:31:45)

Why is vi (vim) so bad in Arch linux ? "nothing in register.."

Hi.
I use various linux distros - gentoo, suse, ubuntu, fedora and (obviously) arch
I am slowly coming to the decision that Arch is the distro for me and have installed it on my work desktop also.
However there is one major issue I am having with Arch linux.
vim seems pretty much completely unusable in arch linux, not in the way that it is in Debian (i.e the strange arrow keys until you apt-get install vim-enchanced)
Its much worse, I am not able to paste into vim at all ... When pressing middle button to paste the buffer is says - nothing in register.
Also (annoyingly) I am unable to right click and paste into konsole (only when using vim) - instead it gives the message ' (insert) VISUAL '
This occurs from KDE4 and LXDE so it unlikely to be the desktop settings.
I do not have vi pasting issues with any other distro.
Can anyone help me paste ?
Regards

I'm having this problem too. PuTTY WinXP, logging into Arch Linux. I used to be able to use right-click to paste from the Windows clipboard (the scroll wheel uses the wrong clipboard) but now it just changes me to (insert) VISUAL.
I put
set mouse-=a
in /etc/vimrc, but it didn't work; perhaps because I need to logout and login. But typing that incantation from within the editor works fine.
However, I would beg to differ that "In many terminal emulators the mouse works just fine, thus enable it". Should I upgrade PuTTY? (currently 0.53b)

Arch Linux System Maintenance

I have a few questions regarding maintenance of Arch Linux.
I come from Gentoo where I typically execute the following:
emerge --sync
emerge -uDNv world
emerge --depclean
revdep-rebuild
I suppose emerge --sync && emerge -uDNv world is equivalent to pacman -Syu. But as for emerge --depclean, I have not seen what command could be used to find stray/obsoleted dependencies and have them removed. Should I be using pacman -Rs <package_name> every time I want to delete a package?
revdep-rebuild probably does not apply to Arch Linux as it is binary based.
Additionally, I was wondering if there are more things I should do to ensure that my installation is healthy. Any help/tips would be appreciated.

sitquietly wrote:
John5788 wrote:
I have a few questions regarding maintenance of Arch Linux.
I come from Gentoo where I typically execute the following:
emerge --sync
emerge -uDNv world
emerge --depclean
revdep-rebuild
.....revdep-rebuild probably does not apply to Arch Linux as it is binary based.....
For most users Archlinux is not a pure binary distro in practice. We need packages from AUR for a complete system. On my Arch system today I see that that there are 182 binary packages available in abs/core, 1957 packages in abs/extra, and 2340 packages in abs/community; so there are a total of 4479 binary packages available in Archlinux. By comparison my Gentoo system has 17348 packages available in portage, and more packages available in various overlays, and they are all updated properly by emerge -auDN @world.
There are 41182 source-based packages available in my copy of Archlinux's AUR. Unfortunately pacman -Syu does not know how to update AUR packages and they may be left with dangling references to libraries that got updated out from under them.
AUR packages tend to get broken by updates. So we do need something like revdep-rebuild but so far as I know we don't have any equivalent maintenance tool. I use my own script for checking my system for AUR packages that need to be rebuilt:
#!/bin/sh
# check all binaries in /usr/bin for any with "not found"
# library links
cd /usr/bin
for file in $(find . -type f -executable -readable)
do
ldd $file | grep "not found" >/dev/null && echo -n $file " links to an missing library " && \
echo "(rebuild `pacman -Qq --owns $file`)"
done
Good luck with your new Archlinux system.
Thanks very much, I added that script to my system! I am half surprised that something like this doesn't exist natively in pacman.
ewaller wrote:
John5788 wrote:
I come from Gentoo where I typically execute the following:
emerge --sync
emerge -uDNv world
emerge --depclean
revdep-rebuild
<tear forms in ewaller's eye>I miss those commands </tear>
Welcome from a fellow Gentoo refugee ! I miss that distribution sometimes, but I love Archlinux; mostly because it does not seem to suffer the sort of bit rot with age as does Gentoo. I recall that subtle changes in use flags could come back to bite weeks later when you update something seemingly unrelated (especially +doc) Spend some time around here and you will find that housekeeping is really not an issue. I do still build custom kernels and don't use initrd; one cannot completely break old habits
Good to see some former Gentoo users here. I still use Gentoo as my desktop OS, but my new Ultrabook will have to use Arch Linux. I'd rather not kill the life of the SSD by constantly compiling packages (not to mention that the emerge times for installing something trivial could get stupid on a laptop). I've been doing as much reading as I can to get familiarized with Arch Linux and I am liking everything so far. It is a nice change to go to a binary distro that isn't Ubuntu.

Terminal --help (Arch Linux) equivalent?

Similar Messages

Maybe you are looking for