#[solved] Installing Arch again - help setting up partitions securely -- archinstall

34 messages · Page 1 of 1 (latest)

smoky lotus
#

I have heard a lot of different things about partition schemes, such as encrypting your home folder or having /home/ on a separate partition, having /var/ on a separate partition, and other stuff. I've never really messed with custom partition schemes. I have installed arch manually before but not without help.

I want to have some additional security by setting up my partitions in a secure way. I found this: https://www.reddit.com/r/linux/comments/9galhz/creating_a_hardened_arch_linux_installation_with/, looks very detailed, I'm not looking to go this deep yet but I would like to do something like this eventually. For now, I just want to know how I should set up my partitions in a non-default way to provide additional security. For simplicity I want to use archinstall, I'm pretty sure it allows you to do a custom partition scheme.

I'll probably use btrfs.

white ledge
eager cedar
#

Using a VM is good practice tbh

white ledge
#

The most commonly used virtulazation suit on Linux is libvirt + QEMU/KVM. You can take snapshots of your changes to the whole system and revert to them at any time, like git commits, so you can learn by trial and error.

#

For simplicity I want to use archinstall
The guide from reddit was written in an era before Archinstall, which also hides some mechanisms like a black box. So a manual installation is recommended if this is your first attempt to follow this guide.

smoky lotus
smoky lotus
white ledge
#

Please also take into consideration what your actual threat model is and whether this type of setup is truly necessary.

smoky lotus
#

just fyi,

I have used from about november to february this year, installed it around 15 times total, about 3-4 times manually (with help), I have installed on virtual machine a bunch of times, tested hardened kernel, apparmor, and a bunch of other stuff.

smoky lotus
#

I have thorough documentation of what my threat model is.

white ledge
smoky lotus
#

Do I really need to specify exactly what I've done?

#

I could say "I'm not a beginner" but some may argue with that.

#

Anyway, still looking for help on this. I'm about to install right now.

white ledge
smoky lotus
#

I can run archinstall no problem.

#

I want to run archinstall in a more secure way than the default.

#

In other words, I want to progress to a slightly more advanced setup with archinstall.

eager cedar
smoky lotus
white ledge
#

Not many people would use that hardening setup, and even fewer would customise it the way you do. Since you already have the knowledge, experience and motivation, why don't you try to find out for yourself?

smoky lotus
#

a separate home and var partitions?

#

If I use LUKS to encrypt the disk, can you encrypt home separately?

eager cedar
#

I'd just try to copy the partition scheme that archinstall uses or even Fedora or other well built distribution. From there try to figure out what other modifications could be made like in that reddit guide.

smoky lotus
#

I guess the reason I posted this was because I didn't want to waste time installing it the way I normally do, then later on realize I should have done it a different way and reinstall.

#

I'll figure it out myself. Thanks.

white ledge
# smoky lotus I guess the reason I posted this was because I didn't want to waste time install...

I guess the reason I posted this was because I didn't want to waste time installing it the way I normally do, then later on realize I should have done it a different way and reinstall

Archinstall's documentation is currently poor (e.g. the Luks section of the doc doesn't even contain anything) and it would take a considerable amount of time to read the source. I'd say it's a draw in terms of time "wasted".

smoky lotus
#

Well I have read the arch wiki many times and I understand precisely 0 of it.