Installing LMDE7 with full disk encryption using RAID (mdadm), LUKS, LVM2 and USB unlock on a computer with a UEFI bootloader

Semyon A Mironov

by Semyon A Mironov, 03.10.2025

Due to the release of the official distribution of LMDE 7 Gigi, the article is being updated...

This document describes the creation of the following scheme

Disk marking scheme

Booting from a LIVE-iso
- Select booting from a USB/CD image
Preparing a LIVE system
- Change the host name
- Time setup in a LIVE system
Preparing the disks
Installing the LMDE operating system
Configuring the LMDE operating system
Booting LMDE 7 from USB key
Booting LMDE 7 without USB key
Show the user list
Useful links

Booting from a LIVE-iso

Select booting from a USB/CD image

Select "Start LMDE 7 64-bit"

Start LMDE 7 64-bit

Press `e` to edit the commands before booting

The kernel’s command-line parameters

Add the `nomodeset` parameter and press `F10` to boot

Add the nomodeset parameter

The kernel’s command-line parameters

quiet and nomodeset

splash

LMDE 7 Desktop live

Desktop live

Preparing a LIVE system

Later in the guide, a software RAID array with LVM will be built, and in order to identify the host on which they were built in the future, you need to set the desired host name and current date to save them in metadata of the RAID array and LVM.

Change the host name

Open the terminal:
Switch to the root user:
```
sudo -s
```
Save the new hostname in a variable:
```
export HOST_NAME="ws.mgmsam.pro"
```
Change the host name:
```
hostname "$HOST_NAME"
```
Check:
```
hostname --fqdn
```
to display the new fqdn (fully qualified domain name) in the terminal:
1. Editing the PS1 variable:
```
sed '/^[[:blank:]]*PS1=/ s%\\h%\\H%' -i /home/mint/.bashrc
```
2. Switch to the root user again:
```
exit
sudo -s
```
3. Include the new .bashrc:
```
. /home/mint/.bashrc
```
4. Resave the new hostname in a variable:
```
export HOST_NAME="ws.mgmsam.pro"
```

Time setup in a LIVE system

dpkg-reconfigure tzdata

Show tzdate geographic area

Show tzdate time zone

Preparing the disks

Creating partitions

List information about block devices

lsblk

List information about block devices

Creating two partitions on `SDA` for `EFI` and mirror array

Save the disk names to variables:

export SDA="/dev/sda"
export SDB="/dev/sdb"

Run the fdisk program for the SDA disk:
```
fdisk "$SDA"
```

Create partitions on the disk by following the following list of commands:

     m # print help
     p # print the partition table
     g # create a new empty GPT partition table
     n # add a new partition No.1
     1 # partition number
       # first sector (2048)
 +100M # last sector
     p # print the partition table
     n # add a new partition No.2
     2 # partition number
       # first sector (206848)
       # last sector
     p # print the partition table
     l # list known partition types
     q # quit from list known partition types
     t # change a partition type No.1
     1 # partition number
     1 # EFI System
     t # change a partition type No.2
     2 # partition number
    42 # Linux RAID
     p # print the partition table
     x # extra functionality (experts only)
     m # print help (for GPT)
     n # change partition name No.1
     1 # partition number
   EFI # new name No.1
     n # change partition name No.2
     2 # partition number
 RAID1 # new name No.2
     p # print the partition table
     r # return to main menu
     p # print the partition table
     w # write table to disk and exit

List information about sda devices

Creating two partitions on `SDB` for `EFI` and mirror array

cat << FDISK | fdisk "$SDB"
     g # create a new empty GPT partition table
     n # add a new partition No.1
     1

 +100M
     p # print the partition table
     n # add a new partition No.2
     2


     p # print the partition table
     t # change a partition type No.1
     1
     1
     t # change a partition type No.2
     2
    42
     p # print the partition table
     x # extra functionality (experts only)
     n # change partition name No.1
     1
   EFI
     n # change partition name No.2
     2
 RAID1
     p # print the partition table
     r # return to main menu
     p # print the partition table
     w # write table to disk and exit
FDISK

Comments are allowed only when calling commands

Spaces at the beginning and end of commands and values are ignored

List information about sdb devices

Creating a mirror array with MDADM

MDADM - Multiple Disk and Device Management

Creating a mirror array

Save the name of the RAID array to a variable:
```
export RAID_ARRAY="/dev/md0"
```

Creating a array:

mdadm --verbose --create /dev/md0 --level 1 --raid-devices 2 "${SDA}2" "${SDB}2"

MDADM

Checking the RAID array status

watch --interval=1 cat /proc/mdstat

MDADM Checking mdstat

MDADM lsblk

Additional commands for MDADM

Show help
mdadm --help
Display details of an array
mdadm --verbose --detail --scan | grep '^ARRAY'
Save the array configuration
nano /etc/mdadm/mdadm.conf
Stop the array
mdadm --verbose --stop /dev/md0
Assemble a previously created array
mdadm --verbose --assemble --scan
Hotadd subsequent devices to the array
mdadm --verbose /dev/md0 --add /dev/sdc2
Subsequent devices are re-added
mdadm --verbose /dev/md0 --re-add /dev/sde2
Delete super-blocks on the disks from which the array is assembled
mdadm --verbose --zero-superblock /dev/sda2 /dev/sde2

Encryption with LUKS

LUKS - Linux Unified Key Setup

I need to encrypt the RAID (mdadm) array, but the installer has LVM-only file system encryption.

Encrypting

Save the LUKS device to a variable:

# RAID_ARRAY="/dev/md0" - the device to be encrypted.
export LUKS_DEVICE="${RAID_ARRAY:="/dev/md0"}"

Encrypting:

cryptsetup --verbose luksFormat --pbkdf pbkdf2 "$LUKS_DEVICE"

Unlocking

Save the LUKS names to variables:

# lvmlmde - is the default name when using the installer, you can specify something else.
export LUKS_NAME="lvmlmde"

Unlocking:

cryptsetup --verbose luksOpen "$LUKS_DEVICE" "$LUKS_NAME"

LUKS

LUKS lsblk

Additional commands for LUKS

Show help
cryptsetup --help
Close device (remove mapping)
cryptsetup close /dev/mapper/lvmlmde
Show device status
cryptsetup status /dev/mapper/lvmlmde
Dump LUKS partition information
cryptsetup luksDump /dev/md0
Add key to LUKS device
cryptsetup luksAddKey /dev/md0 [<new key file>]
Changes supplied key or key file of LUKS device
cryptsetup luksChangeKey /dev/md0 <key slot>
Removes supplied key or key file from LUKS device
cryptsetup luksRemoveKey /dev/md0 [<new key file>]
Wipes key with number <key slot> from LUKS device
cryptsetup luksKillSlot /dev/md0 <key slot>

Creating LVM

LVM - Logical volume manager

Initializing LVM

Save the device names to variables:

export LVM_PHYSICAL_VOLUME="/dev/mapper/${LUKS_NAME:="lvmlmde"}"

Initialize physical volume:

pvcreate --verbose "$LVM_PHYSICAL_VOLUME"

Display various attributes of physical volume(s)
pvdisplay
or display information about physical volumes
pvs

LVM pvcreate

Creating a volume group

Save the volume group names to variables:

# lvmlmde - is the default volume group name when using the installer, you can specify something else.
export LVM_VOLUME_GROUP="lvmlmde"

Create a volume group:

vgcreate --verbose "$LVM_VOLUME_GROUP" "$LVM_PHYSICAL_VOLUME"

Display volume group information
vgdisplay
or display information about volume groups
vgs

LVM vgcreate

Creating the `boot` logical volume

lvcreate --verbose --size 1G -n boot "$LVM_VOLUME_GROUP"

LVM lvcreate boot

Creating the `root` logical volume

lvcreate --verbose --size 50G -n root "$LVM_VOLUME_GROUP"

LVM lvcreate root

Creating the `home` logical volume

lvcreate --verbose --extents 100%FREE -n home "$LVM_VOLUME_GROUP"

LVM lvcreate home

Display information about a logical volume
lvdisplay
or display information about logical volumes
lvs

LVM lvs

LVM lsblk

Additional commands for LVM

Deactivation/activation LVM
Deactivating Volume Groups:
vgchange --verbose --activate n lvmlmde
Activating Volume Groups:
vgchange --verbose --activate y lvmlmde
Rename LVM
Rename a logical volume:
lvrename --verbose lvmlmde root linux
or:
lvrename --verbose /dev/lvmlmde/root linux
Rename a volume group:
vgrename --verbose lvmlmde sys
Remove LVM
Remove logical volume(s):
lvremove --verbose /dev/lvmlmde/boot
lvremove --verbose /dev/lvmlmde/root
lvremove --verbose /dev/lvmlmde/home
or remove all logical volumes in the volume group:
lvremove --verbose lvmlmde
Remove volume group(s):
vgremove --verbose lvmlmde
Remove LVM label(s) from physical volume(s):
pvremove --verbose /dev/mapper/lvmlmde

Creating a file systems

Format the EFI partition:
```
mkfs.fat -v -F 32 -n EFI "${SDA}1"
```
/dev/sdb1 - do not format

Format the boot partition:

mkfs.ext2 -v -L boot "/dev/mapper/$LVM_VOLUME_GROUP-boot"

mkfs boot

Format the root partition:

mkfs.xfs -L root "/dev/mapper/$LVM_VOLUME_GROUP-root"

mkfs root

Format the home partition:

mkfs.xfs -L home "/dev/mapper/$LVM_VOLUME_GROUP-home"

mkfs home

Additional commands for mkfs

Remove a file system
dd if=/dev/zero of=/dev/sda1 bs=2048 count=1 conv=notrunc

Installing the LMDE operating system

Mounting ISO image

Create a directory for mounting ISO image:
```
mkdir --verbose /source
```

Mount the ISO image:

mount --verbose --options loop --types squashfs /run/live/medium/live/filesystem.squashfs /source

mount source

mount source lsblk

Mounting `/target`

Create a directory to mount the root partition of the future LMDE operating system:
```
mkdir --verbose /target
```

Mount the root (/) partition:

mount --verbose "/dev/mapper/$LVM_VOLUME_GROUP-root" /target

mount target

mount target lsblk

Create directories to mount the boot and home partitions:
```
mkdir --verbose /target/{boot,home}
```

Mount the home partition:

mount --verbose "/dev/mapper/$LVM_VOLUME_GROUP-home" /target/home

mount home

mount home lsblk

Mount the boot partition:

mount --verbose "/dev/mapper/$LVM_VOLUME_GROUP-boot" /target/boot

Create a directory to mount the EFI partition:
```
mkdir --verbose /target/boot/efi
```

Mount the EFI partition:

mount --verbose "${SDA}1" /target/boot/efi

mount boot

mount boot lsblk

Copying system files

Installer copying system files

Copy the operating system files from the ISO image to the root partition:
```
rsync --verbose --archive /source/ /target/
```

Copy the local domain name system configuration file:

cp --verbose --force /etc/resolv.conf /target/etc/

Check

cat /target/etc/resolv.conf

resolv

Unmount ISO image

umount --verbose /source

umount source

Configuring the LMDE operating system

Entering the system

Installer entering the system

Mount the system directories of the LIVE system to the root partition of the future LMDE operating system:

for FS in /dev /dev/shm /dev/pts /sys /proc /run /sys/firmware/efi/efivars
do
    mount --verbose --bind "$FS" "/target$FS"
done

--bind - mount a subtree somewhere else

Make /target the root directory:

chroot /target

chroot

to display the new fqdn (fully qualified domain name) in the terminal:
Editing the PS1 variable:
sed '/[[:blank:]]*PS1=/ { s%\\h%\\u@\\H%; s%^$[[:blank:]]*$#[#[:blank:]]*$[^[:blank:]#]$%\1\2%; }' -i /root/.bashrc
Exec to the chroot user again:
exit
chroot /target

Configuring locale

Subsequent actions in the terminal do what you would do in the installer:

dpkg-reconfigure locales

Locale en_US

Locale environment

cat <<LOCALE > /etc/default/locale
#  File generated by update-locale
LC_CTYPE="en_US.UTF-8"
LC_ALL="en_US.UTF-8"
LANG="en_US.UTF-8"
LANGUAGE="en_US:en"
LOCALE

Check

cat /etc/default/locale

locale default

Configuring time

Subsequent actions in the terminal do what you would do in the installer:

dpkg-reconfigure tzdata

Show tzdate geographic area

Show tzdate time zone

Configuring keyboard

Subsequent actions in the terminal do what you would do in the installer:

dpkg-reconfigure keyboard-configuration

Keyboard

Keyboard en_US

Keyboard altgr

Keyboard compose

Keyboard x server

Editing the `/etc/hostname` file

echo "$HOST_NAME" > /etc/hostname

Check

cat /etc/hostname

hostname

Editing the `/etc/hosts` file

Save a text file that contains a database of domain names and is used when translating them to network host addresses

cat <<HOSTS > /etc/hosts
127.0.0.1   localhost
127.0.1.1   $HOST_NAME
# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts
HOSTS

Check

cat /etc/hosts

hosts

Editing the `/etc/fstab` file

Installer writing filesystem mount information to /etc/fstab

Get UUID of the system partitions:

 EFI_UUID="$(blkid --match-tag UUID --output value "${SDA}1")"
BOOT_UUID="$(blkid --match-tag UUID --output value "/dev/mapper/$LVM_VOLUME_GROUP-boot")"
ROOT_UUID="$(blkid --match-tag UUID --output value "/dev/mapper/$LVM_VOLUME_GROUP-root")"
HOME_UUID="$(blkid --match-tag UUID --output value "/dev/mapper/$LVM_VOLUME_GROUP-home")"

Check

echo " EFI_UUID: $EFI_UUID"
echo "BOOT_UUID: $BOOT_UUID"
echo "ROOT_UUID: $ROOT_UUID"
echo "HOME_UUID: $HOME_UUID"

UUIDs

Save the mounting points of the system partitions:

cat <<FSTAB > /etc/fstab
# /etc/fstab: static file system information.
#
# Use 'blkid' to print the universally unique identifier for a
# device; this may be used with UUID= as a more robust way to name devices
# that works even if disks are added and removed. See fstab(5).
#
# <file system>                           <mount point>  <type> <options> <dump> <pass>
proc                                      /proc          proc   defaults  0      0
UUID=$ROOT_UUID /              xfs    defaults  0      1
UUID=$HOME_UUID /home          xfs    defaults  0      0
UUID=$BOOT_UUID /boot          ext2   defaults  0      1
UUID=$EFI_UUID                            /boot/efi      vfat   defaults  0      1
FSTAB

Check

cat /etc/fstab

fstab

Set the root user password

It is not necessary to set a password for the root user, but then be sure to create a user in the next step.

passwd root

passwd root

Creating a user

Subsequent actions in the terminal do what you would do in the installer:

Set variables for use in subsequent commands:

USER_NAME="sam"                # name of the user to be created
REAL_NAME="Semyon A Mironov"   # full name of the user to be created

Create a user:

useradd --create-home ${REAL_NAME:+--comment "$REAL_NAME"} --shell /bin/bash -G adm,audio,bluetooth,cdrom,dialout,dip,fax,floppy,lpadmin,netdev,plugdev,scanner,sudo,tape,users,video "$USER_NAME"

useradd

The group names for the useradd command are taken from the system installed by the installer:

Delete a user

deluser --remove-home "$USER_NAME"

Set user passwords:
```
passwd "$USER_NAME"
```

passwd

Configuring LUKS with password unlock

Editing the `/etc/crypttab` file

Get UUID of LUKS device:

LUKS_UUID="$(cryptsetup luksUUID "$LUKS_DEVICE")"

Check

echo "LUKS_UUID: $LUKS_UUID"

Save configuration for encrypted block devices:

cat <<CRYPTTAB > /etc/crypttab
# <target name> <source device>                           <key file> <options>
$LUKS_NAME          UUID=$LUKS_UUID none       luks,discard
CRYPTTAB

Check

cat /etc/crypttab

LUKS crypttab

Configuring LUKS with USB unlock

Creating three partitions on a USB drive for `EFI`, `boot` and user data

Insert the USB drive into the host and define it in the lsblk output:

Set variables for use in subsequent commands:

USB_DRIVE="/dev/sdc"             # USB drive from the `lsblk` output
USB_DRIVE_MOUNT_POINT="/media"   # Specify an existing empty directory for connecting the USB drive
CRYPTTAB_KEY="my_key.lek"        # Name of the key file to create on the USB drive
LUKS_SCRIPT="/bin/luksunlockusb" # Name and path to the script to unlock using CRYPTTAB_KEY

Check

echo "            USB_DRIVE: $USB_DRIVE"
echo "USB_DRIVE_MOUNT_POINT: $USB_DRIVE_MOUNT_POINT"
echo "         CRYPTTAB_KEY: $CRYPTTAB_KEY"
echo "          LUKS_SCRIPT: $LUKS_SCRIPT"

USB vars

Creat partitions on USB drive:

cat << FDISK | fdisk "$USB_DRIVE"
     g # create a new empty GPT partition table
     n # add a new partition No.1
     1

 +100M
     p # print the partition table
     n # add a new partition No.2
     2

   +1G
     p # print the partition table
     n # add a new partition No.3
     3


     p # print the partition table
     t # change a partition type No.1
     1
     1
     p # print the partition table
     x # extra functionality (experts only)
     n # change partition name No.1
     1
EFIUSB
     p # print the partition table
     n # change partition name No.2
     2
BOOTUSB
     p # print the partition table
     n # change partition name No.3
     3
   USB
     p # print the partition table
     r # return to main menu
     p # print the partition table
     w # write table to disk and exit
FDISK

USB fdisk lsblk

Creating a file systems on USB drive

Format the EFIUSB partition:

mkfs.fat -F 32 -v -n EFIUSB "${USB_DRIVE}1"

mkfs EFIUSB

Format the BOOTUSB partition:
```
mkfs.ext2 -v -L BOOTUSB "${USB_DRIVE}2"
```

Format the USB partition:

mkfs.exfat --volume-label USB "${USB_DRIVE}3"

mkfs USB

Mounting USB drive

Mount the BOOTUSB partition:

mount --verbose "${USB_DRIVE}2" "$USB_DRIVE_MOUNT_POINT"

Create a directory to mount the EFIUSB partition:
```
mkdir --verbose "$USB_DRIVE_MOUNT_POINT/efi"
```

Mount the EFIUSB partition:

mount --verbose "${USB_DRIVE}1" "$USB_DRIVE_MOUNT_POINT/efi"

mount USB

mount USB lsblk

Creating LUKS encryption key

Change the shell working directory:
```
cd "$USB_DRIVE_MOUNT_POINT/efi"
pwd
```
Create a 256 byte key file with random data (.lek = LUKS Encryption Key):
```
dd if=/dev/urandom bs=1 count=256 > "$CRYPTTAB_KEY"
```
The contents of the key file can be anything, for example, a photo

Add key to LUKS device:

cryptsetup --verbose luksAddKey "$LUKS_DEVICE" "$CRYPTTAB_KEY"

Go back to the previous directory:
```
cd -
pwd
```

LUKS key

Creating a script to search for the LUKS encryption key

Get UUID of LUKS device:

LUKS_UUID="$(cryptsetup luksUUID "$LUKS_DEVICE")"

Check

echo "LUKS_UUID: $LUKS_UUID"

LUKS UUID

Create a script that will search for the key on USB drive during boot:

Script for any USB drive

cat <<SCRIPT > "$LUKS_SCRIPT"
#!/bin/sh
sleep 3
test -d /mnt || {
    test ! -e /mnt && mkdir /mnt 2>/dev/null
} &&
for USB_UUID in /dev/disk/by-uuid/*
do
    if mount "\$USB_UUID" /mnt
    then
        for CRYPTTAB_KEY_FILE in "\$CRYPTTAB_KEY" "\$CRYPTTAB_KEY.lek"
        do
            test -f "/mnt/\$CRYPTTAB_KEY_FILE" || continue
            cat     "/mnt/\$CRYPTTAB_KEY_FILE" || break
            umount /mnt || :
            exit
        done
        umount /mnt || :
    fi
done 2>/dev/null || :

# Please comment out this line if you don't want to ask for a password
/lib/cryptsetup/askpass "Please unlock disk (\$CRYPTTAB_NAME): "
SCRIPT

Check

cat "$LUKS_SCRIPT"

LUKS script for any USB

Script for one specific USB drive

Get UUID of USB device:

USB_UUID="$(blkid --match-tag UUID --output value "${USB_DRIVE}1")"

Check

echo "USB_UUID: $USB_UUID"

LUKS USB UUID

Save script:

cat <<SCRIPT > "$LUKS_SCRIPT"
#!/bin/sh
sleep 3
test -e "/dev/disk/by-uuid/$USB_UUID" && {
    test -d /mnt || {
        test ! -e /mnt && mkdir /mnt
    } &&
    mount "/dev/disk/by-uuid/$USB_UUID" /mnt && {
        for CRYPTTAB_KEY_FILE in "\$CRYPTTAB_KEY" "\$CRYPTTAB_KEY.lek"
        do
            test -f "/mnt/\$CRYPTTAB_KEY_FILE" || continue
            cat     "/mnt/\$CRYPTTAB_KEY_FILE" || break
            umount /mnt || :
            exit
        done
        umount /mnt || :
    }
} 2>/dev/null || :

# Please comment out this line if you don't want to ask for a password
/lib/cryptsetup/askpass "Please unlock disk (\$CRYPTTAB_NAME): "
SCRIPT

Check

cat "$LUKS_SCRIPT"

LUKS script for USB

WARNING: If you decide to comment out the password request string in the script, then make sure to perform a pre-test using a key from a USB storage device. Otherwise, you will lose access to the encrypted data.

Make the script executable:

chmod --verbose u+rwx,go+rx "$LUKS_SCRIPT"

LUKS script USB chmod

Editing the `/etc/crypttab` file to use a script

cat <<CRYPTTAB > /etc/crypttab
# <target name> <source device>                           <key file> <options>
$LUKS_NAME          UUID=$LUKS_UUID $CRYPTTAB_KEY luks,discard,keyscript=$LUKS_SCRIPT
CRYPTTAB

Check

cat /etc/crypttab

LUKS crypttab whith USB script

Configuring MDADM

Saving the array configuration

Display details of an array:

ARRAY="$(mdadm --verbose --detail --scan | grep '^ARRAY')"

Check

echo "$ARRAY"

MDADM vars

Save the array configuration:

cat <<MDADM > /etc/mdadm/mdadm.conf
# mdadm.conf
#
# !NB! Run update-initramfs -u after updating this file.
# !NB! This will ensure that initramfs has an uptodate copy.
#
# Please refer to mdadm.conf(5) for information about this file.
#

# by default (built-in), scan all partitions (/proc/partitions) and all
# containers for MD superblocks. alternatively, specify devices to scan, using
# wildcards if desired.
#DEVICE partitions containers

# automatically tag new arrays as belonging to the local system
HOMEHOST <system>

# instruct the monitoring daemon where to send mail alerts
MAILADDR root

# definitions of existing MD arrays
$ARRAY

# This configuration was auto-generated on $(date '+%a, %d %b %Y %T %z') by mkconf
MDADM

Check

cat /etc/mdadm/mdadm.conf

MDADM conf

Generate an initramfs image

If you follow the steps in Configuring LUKS with USB unlock, add some initramfs modules:

cat << MODULES >> /etc/initramfs-tools/modules
vfat
nls_cp437
nls_ascii
usb_storage
libblkid
MODULES

Check

cat /etc/initramfs-tools/modules

initramfs modules

Creating /boot/initrd.img-*:

/usr/sbin/update-initramfs.orig.initramfs-tools -t -c -k all

Create initramfs

Update list of available packages

apt update

Configuring GRUB

Installing the `grub` package

apt install grub-efi

Install grub-efi

Configure `grub` to use a encrypted disk

echo 'GRUB_ENABLE_CRYPTODISK=y' >> /etc/default/grub

Installing `grup` on `SDA`

Subsequent actions in the terminal do what you would do in the installer:

grub-install --verbose --locales=en@quot "$SDA"

Update `grub`

Re create a grub config file based on your disk partitioning schema

update-grub

update-grub on /dev/sda

Installing `grup` on USB drive

Follow this step if you have completed the steps described in step Configuring LUKS with USB unlock

Copying the /boot/* to USB drive:

cp --verbose --recursive /boot/* "$USB_DRIVE_MOUNT_POINT/"

List boot USB

Umount the EFI partition:
```
umount --verbose "${SDA}1"
```

Umount the boot partition:

umount --verbose "/dev/mapper/$LVM_VOLUME_GROUP-boot"

Umount the EFIUSB partition:
```
umount --verbose "${USB_DRIVE}1"
```
Umount the BOOTUSB partition:
```
umount --verbose "${USB_DRIVE}2"
```
Mount the BOOTUSB partition:
```
mount --verbose "${USB_DRIVE}2" /boot
```

Mount the EFIUSB partition:

mount --verbose "${USB_DRIVE}1" "/boot/efi"

Remount USB

Remount USB lsblk

Installing grup on USB drive:

grub-install --verbose --locales=en@quot "$USB_DRIVE"

Update grub on USB drive:
```
update-grub
```

Cloning of the `EFI` partition from `SDA` on `SDB`

dd if="${SDA}1" of="${SDB}1" bs=64K status=progress

Cloning sda1 to sdb1

Edit the `EFI` boot menu

Print additional information:
```
efibootmgr --verbose
```
Delete bootnum:
```
efibootmgr --delete-bootnum --bootnum 0000
```
0000 - bootloader number

Remove all unnecessary bootloaders
Add bootorder from a USB drive:

Follow this step if you have completed the steps described in step Configuring LUKS with USB unlock
```
efibootmgr --create --disk "$USB_DRIVE" --part 1 --label "usbkey" --loader /EFI/debian/shimx64.efi
```
Note: option --label "usbkey", where "usbkey" is an arbitrary bootloader name

Add bootorder from a SDA and SDB drives:

efibootmgr --create --disk "$SDA" --part 1 --label "Disk1" --loader /EFI/debian/shimx64.efi
efibootmgr --create --disk "$SDB" --part 1 --label "Disk2" --loader /EFI/debian/shimx64.efi

Note: option --label "Disk1", where "Disk1" is an arbitrary bootloader name

efibootmgr add sda1 and sdb1 bootloaders

New menu of the UEFI bootloader

Removing packages

Installer removing live configuration

Remove packages and their system-wide configuration files

apt purge live-config* live-installer* live-boot* live-tools*

Removing live configuration

Reboot the machine

Installer restart system

Exit the chroot environment:
```
exit
```
Reboot the machine:
```
shutdown --reboot now
```

Booting LMDE 7 from USB key

grub menu

LUKS set up successfully

Booting LMDE 7 without USB key

LUKS unlock disk

grub menu

LUKS Please unlock disk

LUKS set up successfully

Show the user list

Welcome

Go to system settings

Find and click the Login Window icon

Go to Users tab

Go to the "Shut Down" menu

Reset

Useful links

Installing LMDE to nvme mdadm raid

update-initramfs is disabled (live system is running without media mounted on /run/live/medium)

Using A Live CD/USB To Fix Your Current System

Best order of raid lvm and luks

Encrypted Storage with LUKS, RAID and LVM2

LVM-HOWTO

Installing LMDE7 with full disk encryption using RAID (mdadm), LUKS, LVM2 and USB unlock on a computer with a UEFI bootloader

This document describes the creation of the following scheme

Table of Contents

Booting from a LIVE-iso

Select booting from a USB/CD image

Select "Start LMDE 7 64-bit"

Press e to edit the commands before booting

Add the nomodeset parameter and press F10 to boot

LMDE 7 Desktop live

Preparing a LIVE system

Change the host name

Time setup in a LIVE system

Preparing the disks

Creating partitions

List information about block devices

Creating two partitions on SDA for EFI and mirror array

Creating two partitions on SDB for EFI and mirror array

Creating a mirror array with MDADM

Creating a mirror array

Checking the RAID array status

Encryption with LUKS

Encrypting

Unlocking

Creating LVM

Initializing LVM

Creating a volume group

Creating the boot logical volume

Creating the root logical volume

Creating the home logical volume

Creating a file systems

Installing the LMDE operating system

Mounting ISO image

Mounting /target

Copying system files

Unmount ISO image

Configuring the LMDE operating system

Entering the system

Configuring locale

Configuring time

Configuring keyboard

Editing the /etc/hostname file

Editing the /etc/hosts file

Editing the /etc/fstab file

Set the root user password

Creating a user

Configuring LUKS with password unlock

Editing the /etc/crypttab file

Configuring LUKS with USB unlock

Creating three partitions on a USB drive for EFI, boot and user data

Creating a file systems on USB drive

Mounting USB drive

Creating LUKS encryption key

Creating a script to search for the LUKS encryption key

Editing the /etc/crypttab file to use a script

Configuring MDADM

Saving the array configuration

Generate an initramfs image

Update list of available packages

Configuring GRUB

Installing the grub package

Configure grub to use a encrypted disk

Installing grup on SDA

Update grub

Installing grup on USB drive

Cloning of the EFI partition from SDA on SDB

Edit the EFI boot menu

Removing packages

Remove packages and their system-wide configuration files

Reboot the machine

Booting LMDE 7 from USB key

Booting LMDE 7 without USB key

Show the user list

Useful links

Press `e` to edit the commands before booting

Add the `nomodeset` parameter and press `F10` to boot

Creating two partitions on `SDA` for `EFI` and mirror array

Creating two partitions on `SDB` for `EFI` and mirror array

Creating the `boot` logical volume

Creating the `root` logical volume

Creating the `home` logical volume

Mounting `/target`

Editing the `/etc/hostname` file

Editing the `/etc/hosts` file

Editing the `/etc/fstab` file

Editing the `/etc/crypttab` file

Creating three partitions on a USB drive for `EFI`, `boot` and user data

Editing the `/etc/crypttab` file to use a script

Installing the `grub` package

Configure `grub` to use a encrypted disk

Installing `grup` on `SDA`

Update `grub`

Installing `grup` on USB drive

Cloning of the `EFI` partition from `SDA` on `SDB`

Edit the `EFI` boot menu