Install Arch Linux encrypted fails

Started from the Bottom · 2018-01-31 13:17:11

Hello everybody

Although I already have some experience with Linux, but unfortunately I fail due to the encrypted installation of Arch Linux.

I know there are instructions for this, some of them are very different and partly, at least in my opinion, a bit confusing.

- Encrypted boot partition (/dev/sda1 with 512 MB)
- Encrypted swappable partition (/dev/sda2 with 6 GB)
- Encrypted root partition (/dev/sda3 with the leftover memory)
- Grub bootloader

The hard disk is partitioned and set up as follows

cryptsetup -c aes-xts-plain -y -s 512 luksFormat / dev / sda1 (boot partition)
cryptsetup luksFormat --type luks2 /dev/ sda2 (swap partition)
cryptsetup luksFormat --type luks2 /dev/ sda3 (root partition)

cryptsetup open /dev/sda1 boot
cryptsetup open /dev/sda2 swap
cryptsetup open /dev/sda3 root

mkfs.ext2 /dev/mapper/boot
mkswap /dev/mapper/swap
mkfs.ext4 /dev/mapper/root

I tried following the instructions below to install: https://wiki.archlinux.org/index.php/Dm … .28GRUB.29
I have entered the following in /etc /default/grub

GRUB_CMDLINE_LINUX = "cryptdevice=UUID=<device-UUID>:root "
GRUB_ENABLE_CRYPTODISK = y

It does not matter if I have entered the UUID which ls -la /dev/disk/by-uuid has entered or the UUID which ls -la /dev/disk/by-partuuid has indicated to me. I get the same error every time after grub-install /dev/sda --recheck. The error is "grub-install: error: 'cryptouuid / xxxxxxxxxxxxxxx' not found."

Where did I make a mistake? I hope I have already given all the necessary information.

Trilby · 2018-01-31 21:51:57

The instructions you linked to are for UEFI booting, is yours a UEFI system? The wiki describes a separate EFI partition, which you do not have.

Started from the Bottom · 2018-02-01 00:39:43

It’s not a UEFI System.

Trilby · 2018-02-01 00:59:34

There's your problem.

Started from the Bottom · 2018-02-01 09:24:52

Why? Does the encryption of all three partitions (boot/swap/root) only work on UEFI systems?

Last edited by Started from the Bottom (2018-02-01 09:25:16)

Trilby · 2018-02-01 12:20:56

The instructions you linked to were explicitly for a UEFI system where the EFI partition would not be encrypted. All other instructions on that page are also for unencrypted boot partitions.

I don't have the relevant experience experience to know if there is any way to have an encrypted boot (without an unencrypted efi or extra boot partition) though it does seem unlikely to me: *something* has to run the decryption process, and unless your firmware will handle that, it must be done in software which in turn must be executable before any decryption. I suppose this *might* be possible in the MBR code of a bootloader. I say *might* as this is where I lack the relevant experience on encryption.

However, I do feel adequately expereinced at reading simple instructions, and it is clear that none of the instructions in the wiki suggest that an encrypted boot partition is possible without having some unencrypted supplement (e.g. an unencrypted EFI partition).

mxfm · 2018-02-03 18:48:22

I seems you missed unencrypted UEFI partition (at least it was not mentioned in your post). If you think that 'encrypted boot' means 'encrypted UEFI', this is wrong. UEFI partition cannot be encrypted at all, because computer firmware does not support it.

By the way, you posted a link to wiki article which clearly mentions EFI partition.

mxfm · 2018-02-03 18:53:59

Started from the Bottom wrote:

Why? Does the encryption of all three partitions (boot/swap/root) only work on UEFI systems?

???

Encryption of all three partitions (boot/swap/root) can also work on grub i386 platform. You asking the wrong question.
The right question is "why my setup cannot be booted if I am using UEFI?". The answer is absence of EFI partition.

Please look carefully at the table in wiki article you pointed. The archwiki spec is quite good about grub, uefi, dm-crypt and booting stuff. I don't see what can be useful said which is not in the wiki already.

EDIT: Somehow I have misread your post. So, you do not have UEFI.

Then I would advice explicitly specify target for 'grub-install' command. It should be '--target=i386-pc' (although judging by that grub-install works with '/dev/sd...' argument it installs i386-pc platform, because this arguement is invalid for uefi platform). You can try put 'verbose' flag for grub-install and provide the output.

Last edited by mxfm (2018-02-03 21:21:12)

Trilby · 2018-02-03 19:59:44

mxfm, there is no need to double post. Also please read the thread: the OP already explicitly clarified that they do not have a UEFI system.

Arch Linux

#1 2018-01-31 13:17:11

Install Arch Linux encrypted fails

#2 2018-01-31 21:51:57

Re: Install Arch Linux encrypted fails

#3 2018-02-01 00:39:43

Re: Install Arch Linux encrypted fails

#4 2018-02-01 00:59:34

Re: Install Arch Linux encrypted fails

#5 2018-02-01 09:24:52

Re: Install Arch Linux encrypted fails

#6 2018-02-01 12:20:56

Re: Install Arch Linux encrypted fails

#7 2018-02-03 18:48:22

Re: Install Arch Linux encrypted fails

#8 2018-02-03 18:53:59

Re: Install Arch Linux encrypted fails

#9 2018-02-03 19:59:44

Re: Install Arch Linux encrypted fails

Board footer