DISCLAIMER: Doing this is an unsupported configuration for Ubuntu, and may cause up-to and including boot breakage on upgrades. If possible please use the password based or TPM FDE options provided by the Ubuntu installer. |
Prerequisites
Desktop installer ISO image from http://releases.ubuntu.com/ copied to installation media (usually a USB Flash device but may be a DVD or the ISO file attached to a virtual machine hypervisor).
- Empty installation media (no existing operating systems or data, or entire device can be over-written)
Boot the Installer
Even before starting the installer it is critical to select the correct boot mode. Ubuntu (and flavours like Kubuntu, Lubuntu, Xubuntu, etc.) uses hybrid bootable images that have two alternate boot-loaders:
- GRUB (GRand Unified Bootloader)
- Syslinux
The ISO images can boot in several possible combinations of mode and partitioning:
- ISO-9660 El-Torito (the CD/DVD optical media boot mechanism - uses Syslinux)
- GPT + EFI-SP (GUID Partition Table and EFI System Partition - uses GRUB)
- MBR + EFI-SP (Master Boot Record and EFI System Partition - uses GRUB)
- GPT + PC (GUID Partition Table and BIOS boot - uses Syslinux)
- MBR + PC (Master Boot Record and BIOS boot - uses Syslinux)
Boot Modes
PCs have two boot modes: BIOS (Basic Input Output System) and UEFI (Unified Extensible Firmware Interface). BIOS was installed in IBM PCs and compatibles from the 1980s. UEFI mode has become prevalent since Microsoft introduced it in Windows 7 and later began requiring it on new PCs to meet the Windows Logo License Agreement requirements. Most PCs since 2010 have UEFI.
Apple Macintosh/iMac devices have their own EFI (Extensible Firmware Interface) which is almost, but not quite, the same as UEFI but do not have a BIOS equivalent. This guide doesn't (currently) address installation on Apple devices.
BIOS is also known as Legacy or CSM (Compatibility Support Module) when part of UEFI.
If the target system is BIOS-only you can disregard the rest of this section.
Selecting UEFI boot mode
In order to support UEFI Secure Boot, or to install alongside another operating system that uses UEFI boot mode (e.g. Windows 10), the system motherboard's firmware boot-manager has to be told to start the Ubuntu installer in UEFI mode.
Unfortunately there is no consistency between different PC manufacturers on how motherboard firmware boot-managers should indicate boot-mode so we, as users, have to figure it out from what clues we can see when the PC's boot menu is displayed and lists boot devices.
Let's assume we're using a USB Flash device. The boot menu may list that device twice (once for UEFI mode, and again for BIOS/CSM/Legacy mode). It may make it explicit that one is "UEFI" and the other not, or it may use some hard-to-spot code such as a single letter abbreviation (e.g. "U" vs "B").
If we want to guarantee UEFI mode and avoid BIOS/CSM/Legacy mode then by entering firmware Setup at power-on we should be able to find an option to disable CSM/Legacy mode.
After doing that we can be sure the installer will boot in UEFI mode.
There is a quick way to confirm the installer has started in UEFI mode - it will be using GRUB, so see the following section First Boot Screen > GRUB (UEFI mode) for what it will look like.
Detecting UEFI boot mode
Once Linux has started it is possible to check. The presence of the efivarfs file-system means the system booted in UEFI mode:
$ mount | grep efivars efivarfs on /sys/firmware/efi/efivars type efivarfs (rw,nosuid,nodev,noexec,relatime)
First Boot Screen
The options displayed will look different depending on which boot-loader is used.
GRUB (UEFI mode)
Choose Try Ubuntu without installing from the GRUB boot-loader menu:
Syslinux (BIOS mode)
The display will briefly pause for selection of the input language:
If you interrupt at this stage to choose a language Syslinux will display a menu where you can make various advanced changes to the boot options. At this point you should choose the Try Ubuntu without installing menu option.
Welcome Options
If the boot hasn't been interrupted to choose a language the Welcome dialog with start-up options will be displayed. Choose Try Ubuntu.
Live Desktop
Once the Live Desktop environment has started we need to use a Terminal shell command-line to issue a series of commands to pre-prepare the target device before executing the Installer itself.
On Ubuntu (Gnome) press the Show Applications button at lower-left corner
In the subsequent text search field type "Term" until just the Terminal icon is shown (on Kubuntu search for "Konsole")
Press the icon to launch Terminal.
Instead of these steps you can just press Ctrl+Alt+T hot-key combination.
Pre-Prepare Encrypted Partitions
You might find maximising the Terminal window is helpful for working with the command-line.
As much as is possible these manual steps will keep to the same installation layout and naming as the installer uses.
For these commands you'll need elevated privileges so switch to root user (the $ prefix indicates a regular user and # indicates root user):
$ sudo -i
A couple of later commands rely on Bourne-Again Ash Shell (BASH) specific functionally so always switch from the default shell to bash:
# bash
If at any time you wish to check which shell is in use do:
echo $SHELL
You will something like one of these:
/bin/bash /usr/bin/bash
Identify Installation Target Device
# lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT loop0 7:0 0 1.9G 1 loop /rofs loop1 7:1 0 89.3M 1 loop /snap/core/6673 loop2 7:2 0 53.7M 1 loop /snap/core18/941 loop3 7:3 0 151M 1 loop /snap/gnome-3-28-1804/31 loop4 7:4 0 4M 1 loop /snap/gnome-calculator/406 loop5 7:5 0 14.8M 1 loop /snap/gnome-characters/254 loop6 7:6 0 1008K 1 loop /snap/gnome-logs/61 loop7 7:7 0 3.7M 1 loop /snap/gnome-system-monitor/77 loop8 7:8 0 35.3M 1 loop /snap/gtk-common-themes/1198 sda 8:0 0 9G 0 disk sr0 11:0 1 2G 0 rom /cdrom
Here the installation target device is sda but yours may vary so examine the SIZE to ensure you choose the correct target. (in this example target is a 9GiB virtual machine disk image file).
We'll set an environment variable we can re-use in all future commands. Doing this will allow you to copy and paste these instructions directly into your terminal (note: do not copy and paste the "#" prefix). In this example I'm installing to /dev/sda:
# export DEV="/dev/sda"
On systems with NVME storage devices the naming scheme is /dev/nvme${CONTROLLER}n${NAMESPACE}p${PARTITION} so if there is only one device it is likely it would require:
# export DEV="/dev/nvme0n1"
Finally we'll set an environment variable for the encrypted device-mapper naming that omits the leading path "/dev/" part:
# export DM="${DEV##*/}"
And we have to cope with NVME devices needing a 'p' for partition suffix:
# export DEVP="${DEV}$( if [[ "$DEV" =~ "nvme" ]]; then echo "p"; fi )" # export DM="${DM}$( if [[ "$DM" =~ "nvme" ]]; then echo "p"; fi )"
Partitioning
We'll now create a disk label and add four partitions. We'll be creating a GPT (GUID Partition Table) so it is compatible with both UEFI and BIOS mode installations. We'll also create partitions for both modes in addition to the partitions for the encrypted /boot/ and / (root) file-systems.
We'll be using the sgdisk tool. To understand its options please read man 8 sgdisk
First check for any existing partitions on the device and if some are found consider if you wish to keep them or not. If you wish to keep them DO NOT USE sgdisk --zap-all command detailed next. Instead, consider if you need to free up disk space by shrinking or deleting individual existing partitions.
# sgdisk --print $DEV Creating new GPT entries. Disk /dev/sda: 18874368 sectors, 9.0 GiB Model: QEMU HARDDISK Sector size (logical/physical): 512/512 bytes Disk identifier (GUID): 41BCC4F5-B604-4C39-863F-C73B90B38397 Partition table holds up to 128 entries Main partition table begins at sector 2 and ends at sector 33 First usable sector is 34, last usable sector is 18874334 Partitions will be aligned on 2048-sector boundaries Total free space is 18874301 sectors (9.0 GiB) Number Start (sector) End (sector) Size Code Name
If you do need to manipulate the existing partitions use the Show Applications menu to search for GPartEd which is the graphical user interface partitioning tool (see the GPartEd manual for how to use it)
If it is safe to delete everything on this device you should wipe out the existing partitioning metadata - DO NOT DO THIS if you are installing alongside existing partitions!
# sgdisk --zap-all $DEV GPT data structures destroyed! You may now partition the disk using fdisk or other utilities.
Now we'll create the partitions. A small bios_boot (2MB) partition for BIOS-mode GRUB's core image, an 128MB EFI System Partition, a 768MB /boot/ and a final partition for the remaining space for the operating system.
Syntax: --new=<partition_number>:<start>:<end> where start and end can be relative values and when zero (0) adopt the lowest or highest possible value respectively.
Partition 4 is not created. The reason is the Ubuntu Installer would only create partitions 1 and 5. Here we create those and in addition the two boot-loader alternatives.
# sgdisk --new=1:0:+768M $DEV # sgdisk --new=2:0:+2M $DEV # sgdisk --new=3:0:+128M $DEV # sgdisk --new=5:0:0 $DEV # sgdisk --typecode=1:8301 --typecode=2:ef02 --typecode=3:ef00 --typecode=5:8301 $DEV # sgdisk --change-name=1:/boot --change-name=2:GRUB --change-name=3:EFI-SP --change-name=5:rootfs $DEV # sgdisk --hybrid 1:2:3 $DEV # sgdisk --print $DEV Disk /dev/sda: 18874368 sectors, 9.0 GiB Model: QEMU HARDDISK Sector size (logical/physical): 512/512 bytes Disk identifier (GUID): 41BCC4F5-B604-4C39-863F-C73B90B38397 Partition table holds up to 128 entries Main partition table begins at sector 2 and ends at sector 33 First usable sector is 34, last usable sector is 18874334 Partitions will be aligned on 2048-sector boundaries Total free space is 2014 sectors (1007.0 KiB) Number Start (sector) End (sector) Size Code Name 1 2048 1574911 768.0 MiB 8301 /boot 2 1574912 1579007 2.0 MiB EF02 GRUB 3 1579008 1841151 128.0 MiB EF00 EFI-SP 5 1841152 18874334 8.1 GiB 8301 rootfs
LUKS Encrypt
The default LUKS (Linux Unified Key Setup) format (version) used by the cryptsetup tool has changed since the release of 18.04 Bionic. 18.04 used version 1 ("luks1") but more recent Ubuntu releases default to version 2 ("luks2"). GRUB only supports opening version 1 so we have to explicitly set luks1 in the commands we use or else GRUB will not be able to install to, or unlock, the encrypted device.
Note: as of October 2021 and Ubuntu 21.10 GRUB still does not yet support installing to luks2 containers. It can read luks2 (although with several strict limitations, and subject to some bugs decoding UUIDs) but grub-install via grub-probe cannot recognise a luks2 device and therefore cannot correctly install into luks2 containers.
In summary, the LUKS container for /boot/ must currently use LUKS version 1 whereas the container for the operating system's root file-system can use the default LUKS version 2.
For more information see the man-pages for 18.04 Bionic or 18.10 Cosmic onwards.
First the /boot/ partition:
# cryptsetup luksFormat --type=luks1 ${DEVP}1 WARNING! ======== This will overwrite data on /dev/sda1 irrevocably. Are you sure? (Type uppercase yes): YES Enter passphrase for /dev/sda1: Verify passphrase:
Now the operating system partition:
# cryptsetup luksFormat ${DEVP}5 WARNING! ======== This will overwrite data on /dev/sda5 irrevocably. Are you sure? (Type uppercase yes): YES Enter passphrase for /dev/sda5: Verify passphrase:
LUKS unlock
Now open the encrypted devices:
# cryptsetup open ${DEVP}1 LUKS_BOOT Enter passphrase for /dev/sda1: # cryptsetup open ${DEVP}5 ${DM}5_crypt Enter passphrase for /dev/sda5: # ls /dev/mapper/ control LUKS_BOOT sda5_crypt
After the Ubuntu installation is finished we will be adding key-files to both of these devices so that you'll only have to type the pass-phrase once for GRUB and thereafter the operating system will use embedded key-files to unlock without user intervention.
Format File-systems
IMPORTANT this step must be done otherwise the Installer's partitioner will disable the ability to write a file-system to this device without it having a partition table (Man-page for mkfs.ext4):
# mkfs.ext4 -L boot /dev/mapper/LUKS_BOOT mke2fs 1.44.6 (5-Mar-2019) Creating filesystem with 196096 4k blocks and 49056 inodes Filesystem UUID: 659410fb-29a7-40af-9a5f-4dc31b72ad0a Superblock backups stored on blocks: 32768, 98304, 163840 Allocating group tables: done Writing inode tables: done Creating journal (4096 blocks): done Writing superblocks and filesystem accounting information: done
Format the EFI-SP as FAT16 (Man-page for mkfs.vfat):
# mkfs.vfat -F 16 -n EFI-SP ${DEVP}3 mkfs.fat 4.1 (2017-01-24)
LVM (Logical Volume Management)
We'll now create the operating system LVM Volume Group (VG) and a Logical Volume (LV) for the root file-system.
LVM has a wonderful facility of being able to increase the size of an LV whilst it is active. To provide for this we will only allocate 80% of the free space in the VG to the LV initially. Later, if you need space for other file-systems, or snapshots, the installed system will be ready and able to support those requirements without struggling to free up space.
I am also creating a 4GiB LV device for swap which, as well as being used to provide additional memory pages when free RAM space is low, is used to store a hibernation image of memory so the system can be completely powered off and can resume all applications where they left off. The size of the swap space to support hibernation should be equal to the amount of RAM the PC has now or is is expected to have in the future.
Note: Since the 22.04 release of codename Jammy (April 2022) the naming of the VG by the installer has changed; hyphens have been removed and the name format changed. The format is now vg${flavour} where ${flavour} might be e.g: "ubuntu" or "kubuntu"). In order to make the commands listed here-after work precisely we now add an extra step to put the VG name into a variable and use that in subsequent instructions. ToDo: I will go back over previous installers for 18.04 and 20.04 to ensure this all still works.
flavour="$( sed -n 's/.*cdrom:\[\([^ ]*\).*/\1/p' /etc/apt/sources.list )" release="$( lsb_release -sr | tr -d . )" if [ ${release} -ge 2204 ]; then VGNAME="vg${flavour,,}"; else VGNAME="${flavour}--vg"; fi export VGNAME
Man-pages for pvcreate vgcreate lvcreate.
# pvcreate /dev/mapper/${DM}5_crypt Physical volume "/dev/mapper/sda5_crypt" successfully created. # vgcreate "${VGNAME}" /dev/mapper/${DM}5_crypt Volume group "vgubuntu" successfully created # lvcreate -L 4G -n swap_1 "${VGNAME}" Logical volume "swap_1" created. # lvcreate -l 80%FREE -n root "${VGNAME}" Logical volume "root" created.
Install Ubuntu
Now minimise the Terminal window and start the Installer:
Choose the installation language and keyboard and then the software installation choices:
In the Installation Type options choose Something Else:
Manual Partitioning
The manual partitioner will start:
Select the root file-system device for formatting (e.g: /dev/mapper/ubuntu--vg-root), press the Change button, choose Use As Ext4... and Mount point /:
Select the swap device (e.g: /dev/mapper/ubuntu--vg-swap_1), press the Change button, choose Use as swap area:
Select the Boot file-system device for formatting (/dev/mapper/LUKS_BOOT), press the Change button. choose Use as Ext4... and Mount point /boot:
Select the boot-loader device (/dev/sda in my example). Boot-loader device should always be a raw disk not a partition or device-mapper node:
Press the Install Now button to write the changes to the disk and press the Continue button:
The installation process will continue in the background whilst you fill in the Where Are You? and Who Are You? forms:
Enable Encrypted GRUB
As soon as you have completed those forms switch to the Terminal to configure GRUB. These commands wait until the installer has created the GRUB directories and then adds a drop-in file telling GRUB to use an encrypted file-system. The command will not return to the shell prompt until the target directory has been created by the installer. In most cases that will have been done before this command is executed so it should instantly return:
# while [ ! -d /target/etc/default/grub.d ]; do sleep 1; done; echo "GRUB_ENABLE_CRYPTODISK=y" > /target/etc/default/grub.d/local.cfg
This has to be done before the installer reaches the Install Bootloader stage at the end of the installation process.
Note: Its not critical that this is done before the installer reaches the "Install Bootloader" stage. Check the note at the end of "Post-Installation Steps".
If installation is successful choose the Continue Testing option:
Post-Installation Steps
Return to the Terminal and create a change-root environment to work in the newly installed OS (Man-pages for mount chroot):
# mount /dev/mapper/${VGNAME}-root /target # for n in proc sys dev etc/resolv.conf; do mount --rbind /$n /target/$n; done # chroot /target # mount -a
Within the chroot install and configure the cryptsetup-initramfs package. This may already be installed. Note: this package is not available in 18.04 Bionic because the files are included in the main cryptsetup package.
# apt install -y cryptsetup-initramfs
This allows the encrypted volumes to be automatically unlocked at boot-time. The key-file and supporting scripts are added to the /boot/initrd.img-$VERSION files.
This is safe because these files are themselves stored in the encrypted /boot/ which is unlocked by the GRUB boot-loader (which asks you to type the pass-phrase) which then loads the kernel and initrd.img into RAM before handing execution over to the kernel. (Man-page for initramfs.conf):
# echo "KEYFILE_PATTERN=/etc/luks/*.keyfile" >> /etc/cryptsetup-initramfs/conf-hook # echo "UMASK=0077" >> /etc/initramfs-tools/initramfs.conf
Create a randomised key-file of 4096 bits (512 bytes), secure it, and add it to the LUKS volumes (Man-pages for dd chmod):
# mkdir /etc/luks # dd if=/dev/urandom of=/etc/luks/boot_os.keyfile bs=512 count=1 1+0 records in u=rx,go-rwx /etc/luks 1+0 records out 512 bytes (0.5 kB, 0.5 KiB) copied, 0.0002368 s, 17.3 MB/s # chmod u=rx,go-rwx /etc/luks # chmod u=r,go-rwx /etc/luks/boot_os.keyfile # cryptsetup luksAddKey ${DEVP}1 /etc/luks/boot_os.keyfile Enter any existing passphrase: # cryptsetup luksAddKey ${DEVP}5 /etc/luks/boot_os.keyfile WARNING: Locking directory /run/cryptsetup is missing! Enter any existing passphrase:
Add the keys to the crypttab (Man-pages for crypttab blkid):
# echo "LUKS_BOOT UUID=$(blkid -s UUID -o value ${DEVP}1) /etc/luks/boot_os.keyfile luks,discard" >> /etc/crypttab # echo "${DM}5_crypt UUID=$(blkid -s UUID -o value ${DEVP}5) /etc/luks/boot_os.keyfile luks,discard" >> /etc/crypttab
Finally update the initialramfs files to add the cryptsetup unlocking scripts and the key-file:
# update-initramfs -u -k all
If everything has gone well the system is now ready to reboot.
If you didn't get GRUB_ENABLE_CRYPTODISK set before the installer reached the "Install Bootloader" stage you can manually apply the change at this time, before you reboot by asking the the bootloader to be manually reconfigured with:
dpkg-reconfigure grub-efi-amd64-signed
ReBoot
Reboot the system, not forgetting to remove the installation media (otherwise it'll boot again!).
You should get a GRUB pass-phrase prompt: