eggman64

Installation of NixOS with encrypted root

These are my notes on instaling NixOS 16.03 on a Lenovo ThinkPad X1 Carbon (4th generation) with an encrypted root file system using UEFI.

Most of this is scrambled from the following pages:

• Encrypted Root on NixOS - Nix Wiki
• Installing NixOS - Chris Martin
• Linux administration and use - Earl Douglas
• Installing NixOS on a ThinkPad W540 with encrypted root - Bluish Coder

eggman64

#!/bin/bash
chromium --user-data-dir="$HOME/tmp/proxy" --proxy-server="socks5://127.0.0.1:8080" --proxy-bypass-list='<-loopback>'  --host-resolver-rules="MAP * 0.0.0.0 , EXCLUDE localhost"

eggman64

# OBJECTIVE:  Install Arch Linux with encrypted root and swap filesystems and boot from UEFI.  Optionally, we will also encrypt
/boot and then decrypt and mount our entire encrypted system using a single LUKS passphrase entry.

# Note:  This method supports both dedicated Arch installs and those who wish to install Arch on a multi-OS-UEFI booting system.

# External USB HDD/SSD Installers Notes:  Encrypted Arch installs can be booted and run from an external USB HDD or SSD, but
# only when the installation is correctly set up.  There are several necessary changes to my standard procedure you'll want
# to make during the install process.  Read my External USB HDD/SSD Installation section below before proceeding.

eggman64

# Install ARCH Linux with encrypted file-system and UEFI
# The official installation guide (https://wiki.archlinux.org/index.php/Installation_Guide) contains a more verbose description.

# Download the archiso image from https://www.archlinux.org/
# Copy to a usb-drive
dd if=archlinux.img of=/dev/sdX bs=16M && sync # on linux

# Boot from the usb. If the usb fails to boot, make sure that secure boot is disabled in the BIOS configuration.

# Set swedish keymap

eggman64

# Encrypt

tar cz folder_to_encrypt | \
      openssl enc -aes-256-cbc -e > out.tar.gz.enc
      
# Decrypt

openssl enc -aes-256-cbc -d -in out.tar.gz.enc | tar xz

# Consider using -pbkdf2 instead of -aes-256-cbc for slower but more secure encryption

eggman64

#!/bin/bash

i3status | while :
do
    read line

    dir=$(cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd)
    spotify_status=$(dbus-send --print-reply --session --dest=org.mpris.MediaPlayer2.spotify /org/mpris/MediaPlayer2 org.freedesktop.DBus.Properties.Get string:'org.mpris.MediaPlayer2.Player' string:'PlaybackStatus' | tail -n1 | cut -d'"' -f2)
    spotify_artist=$(dbus-send --print-reply --session --dest=org.mpris.MediaPlayer2.spotify /org/mpris/MediaPlayer2 org.freedesktop.DBus.Properties.Get string:'org.mpris.MediaPlayer2.Player' string:'Metadata' | awk -f ${dir}/spotify_song.awk | head -n 1 | cut -d':' -f2)
    spotify_song=$(dbus-send --print-reply --session --dest=org.mpris.MediaPlayer2.spotify /org/mpris/MediaPlayer2 org.freedesktop.DBus.Properties.Get string:'org.mpris.MediaPlayer2.Player' string:'Metadata' | awk -f ${dir}/spotify_song.awk | tail -n 1 | cut -d':' -f2)

eggman64

navigation without arrow keys:
 C-p, C-n, C-f, C-b
 (previous, next, forward, backward)

navigating faster:
 C-a, C-e, A-f, A-b
 ("anfang" ;-), end, forward, backward)

editing without remote keys:
 C-h

eggman64

# Add to .bashrc
# Sauce: http://faq.i3wm.org/question/150/how-to-launch-a-terminal-from-here/
# Commands to be executed before the prompt is displayed
# Save current working dir
PROMPT_COMMAND='pwd > "${XDG_RUNTIME_DIR}/.cwd"'

# Change to saved working dir
[[ -f "${XDG_RUNTIME_DIR}/.cwd" ]] && cd "$(< ${XDG_RUNTIME_DIR}/.cwd)"

eggman64

On the receiving end running

nc -l -p 1234 > out.file

will begin listening on port 1234.

On the sending end running

nc -w 3 [destination] 1234 < out.file

eggman64

!^      first argument
!$      last argument
!*      all arguments
!:2     second argument

!:2-3   second to third arguments
!:2-$   second to last arguments
!:2*    second to last arguments
!:2-    second to next to last arguments
!:0     command