The Ultimate Arch Linux to BlackArch Guide

Introduction: Why Arch to BlackArch?

BlackArch Linux is an elite penetration testing distribution built on top of Arch Linux, offering over 2,800 security tools. Instead of downloading the BlackArch ISO (which can be buggy or overwhelming), the recommended way by the BlackArch team is to install a minimal, stable Arch system and then convert it.

Why This Approach?

Many beginners wonder why they should go through the trouble of installing Arch Linux manually when they could just download the BlackArch ISO directly. The answer lies in stability, control, and learning. When you install Arch Linux from scratch, you build a system that you completely understand. Every package, every configuration file, every service - you know exactly what's there and why.

The BlackArch ISO, while convenient, comes with thousands of pre-installed tools that you may never use. This can lead to system bloat, longer update times, and potential conflicts between packages. By starting with a clean Arch installation, you maintain full control over what gets installed on your system.

Benefits of This Approach

• Rock-solid base: You build a stable Arch system yourself, understanding every component and configuration decision.
• Full control: You choose exactly which tools to install based on your specific needs and workflow.
• Lean system: No bloatware, only what you need. This means faster boot times, less disk usage, and quicker updates.
• Rolling release: Always get the latest tools via Arch's repositories, ensuring you have the most current security tools available.
• Learning experience: You'll gain deep knowledge of Linux system administration, which is invaluable for any security professional.

Important Prerequisites

Before we begin, it's crucial to understand the risks and requirements of this installation process. Installing an operating system involves partitioning your hard drive, which can result in data loss if done incorrectly.

What You'll Need

• A computer or virtual machine: Any modern computer with at least 4GB RAM (8GB recommended) and 40GB free disk space.
• Arch Linux ISO: Download from archlinux.org
• USB drive (8GB+): If installing on real hardware, you'll need a USB drive to create bootable media.
• Internet connection: Required for downloading packages during installation.
• Time and patience: The installation process takes 1-2 hours for beginners. Don't rush it.

Understanding the Risks

Installing an operating system is a serious operation. If you're installing on real hardware (not a VM), there's a risk of data loss if you make mistakes during partitioning. Always backup your important files before proceeding. The partitioning step is where most beginners make mistakes, so pay special attention to that section.

What is a Virtual Machine?

A Virtual Machine (VM) is like a "computer inside your computer". It uses software (like VirtualBox or QEMU) to create a fake PC where you can install and run operating systems without affecting your real machine. Think of it as a safe sandbox for learning and experimenting.

How Virtual Machines Work

Virtual machines use a technology called "virtualization" to create isolated environments that behave like separate computers. The software that creates and manages these virtual machines is called a "hypervisor". There are two types:

• Type 1 (Bare Metal): Runs directly on hardware (e.g., VMware ESXi, Proxmox). Used in enterprise environments.
• Type 2 (Hosted): Runs as an application on your existing OS (e.g., VirtualBox, VMware Workstation). This is what we'll use.

Why Use a VM for This Guide?

Using a VM provides several advantages for learning:

• Safety: If you make a mistake, you can simply delete the VM and start over. No data loss on your real computer.
• Snapshots: You can save the state of your VM at any point and restore it later if something goes wrong.
• Isolation: The VM is completely isolated from your host system, so any security tools you run won't affect your main computer.
• Portability: You can export your VM and run it on any computer with the same virtualization software.

Step 0: Setting Up a Virtual Machine

If you're installing on real hardware, skip this step. Otherwise, follow these instructions to create a safe environment for learning.

1. Choose Your VM Software

There are several virtualization options available, each with different strengths:

• VirtualBox (free, easy) - Download. This is the most beginner-friendly option with a graphical interface. It's free and works on Windows, Mac, and Linux.
• QEMU/KVM (faster, more advanced) - usually preinstalled on Linux. This offers better performance but has a steeper learning curve. It's the native virtualization solution for Linux.
• VMware Workstation Player (free for personal use) - Another popular option with good performance and features.

2. Create a New VM

For this guide, we'll use VirtualBox as it's the most accessible for beginners. Here are the recommended settings:

• Name: Arch Linux (we'll convert to BlackArch later)
• Type: Linux
• Version: Arch Linux (or Other Linux 64-bit)
• Memory (RAM): At least 4 GB (8 GB recommended for heavy tools). More RAM means better performance, especially when running multiple security tools.
• Hard disk: 40 GB or more (dynamic allocation). Dynamic allocation means the virtual disk only uses as much space as needed, up to the maximum you specify.
• Network: NAT or Bridged. NAT is simpler and works out of the box. Bridged makes the VM appear as a separate device on your network.

3. VM Settings Explained

Let's understand why these settings matter:

• RAM: BlackArch tools can be memory-intensive. 4GB is the minimum for basic operation, but 8GB will give you room to run multiple tools simultaneously.
• Disk Space: The base Arch installation takes about 2-3GB. BlackArch tools can add 10-20GB depending on what you install. 40GB gives you plenty of room to grow.
• Network: NAT is recommended for beginners because it automatically handles network configuration. The VM shares your host's internet connection without needing special setup.

Step 1: Boot from the Arch Linux ISO

This is where we actually start the installation process. The Arch Linux ISO is a live environment that lets you test Arch without installing it, and also provides the tools needed for installation.

Understanding the Boot Process

When you boot from the Arch ISO, you're loading a minimal Linux environment into RAM. This environment contains all the tools needed to partition disks, install packages, and configure your new system. It's completely separate from any operating system already installed on your computer.

Step-by-Step Instructions

1. Download the ISO: Get the latest Arch ISO from archlinux.org. The file is typically around 800MB. Verify the checksum if you want to ensure the download wasn't corrupted.
2. Create bootable media: If installing on real hardware, burn the ISO to a USB drive using a tool like Rufus (Windows), Etcher (cross-platform), or dd (Linux). For VMs, simply attach the ISO file to the virtual optical drive.
3. Boot from the media: Restart your computer and enter the BIOS/UEFI settings (usually by pressing F2, F12, or Del during startup). Change the boot order to prioritize your USB drive or optical drive. For VMs, just start the VM.
4. Select boot option: You'll see a menu. Select "Arch Linux install medium (x86_64, UEFI)" for modern systems, or the BIOS option for older systems. Most computers from the last 10 years use UEFI.
5. Wait for boot: The system will load into a command-line interface. You'll see a root shell prompt (root@archiso ~ #). This means you're logged in as the root user in the live environment.

Troubleshooting Boot Issues

If you can't boot from the ISO:

• Check that Secure Boot is disabled in your BIOS/UEFI settings. Arch Linux doesn't support Secure Boot by default.
• Ensure you're using a 64-bit version if your computer supports it.
• Try a different USB port or USB drive if the media isn't being detected.
• For VMs, make sure the ISO is properly attached to the virtual optical drive.

Step 2: Connect to the Internet

You must have an internet connection to download packages during installation. The Arch installation process downloads everything from the internet, so there's no offline installation option.

Why Internet is Required

Unlike some other Linux distributions that include all necessary packages on the installation media, Arch Linux uses a "netinstall" approach. The ISO only contains the minimal tools needed to set up your system and connect to the internet. All actual packages are downloaded from Arch's repositories during installation. This keeps the ISO small and ensures you always get the latest packages.

Wired Ethernet Connection

If you're using a wired connection (Ethernet cable), it should work automatically in most cases. The live environment includes drivers for most network cards. To test your connection:

ping -c 3 archlinux.org

This command sends 3 packets to archlinux.org and waits for responses. If you see replies, your internet is working. If not, check your cable connection or try a different network port.

WiFi Connection

For wireless connections, you'll need to use the iwctl tool, which is part of the iwd (iNet Wireless Daemon) package included in the Arch ISO. Here's the detailed process:

iwctl

This opens the interactive iwctl prompt. From here, you can manage wireless connections:

# List available wireless devices
device list

# Scan for networks (replace wlan0 with your device name)
station wlan0 scan

# List available networks
station wlan0 get-networks

# Connect to a network (replace SSID with your network name)
station wlan0 connect "SSID"

# You'll be prompted to enter your WiFi password
# After connecting, exit iwctl
exit

Verifying Your Connection

After connecting, always verify your internet works:

ping -c 3 archlinux.org

If you get responses, you're ready to proceed. If not, double-check your network credentials and signal strength.

Step 3: Update the System Clock

Before proceeding with the installation, we need to ensure the system clock is accurate. This is crucial for package verification and SSL certificate validation.

Why System Clock Matters

Arch Linux uses cryptographic signatures to verify that packages haven't been tampered with. These signatures include timestamps, and if your system clock is significantly wrong, the verification will fail. Additionally, many internet services (including package repositories) use SSL/TLS encryption, which also relies on accurate time for certificate validation.

Enabling NTP

NTP (Network Time Protocol) automatically synchronizes your clock with internet time servers. Enable it with:

timedatectl set-ntp true

This command tells systemd (the init system used by Arch) to enable and start the NTP service. The clock will automatically sync with internet time servers.

Verifying the Clock

Check that NTP is working correctly:

timedatectl status

Look for "NTP service: active" and "System clock synchronized: yes" in the output. If you see these, your clock is accurate and you can proceed.

Step 4: Partition the Disk

This is the most critical step in the installation process. Partitioning divides your hard drive into separate sections, each serving a different purpose. Getting this wrong can result in data loss, so pay close attention.

Why We Use cfdisk

Identifying Your Disk

First, identify which disk you're working with:

lsblk

Look for your main disk - it's usually the largest one. Common names:

• /dev/sda - SATA/IDE drives
• /dev/nvme0n1 - NVMe SSDs
• /dev/vda - Virtual disks in VMs

For this guide, we'll use /dev/sda as an example. Replace it with your actual disk name.

Option 1: UEFI Systems (GPT Partition Table)

For modern computers with UEFI firmware, use GPT partition table:

cfdisk /dev/sda

cfdisk will open with a visual interface. Follow these steps:

1. Select Partition Table Type: If prompted, select gpt and press Enter.
2. Create EFI System Partition (512MB):
   • Select [ New ] (use arrow keys, press Enter)
   • Enter partition size: 512M
   • Select [ Primary ] and press Enter
   • With the new partition selected, choose [ Type ]
   • Select EFI System from the list
3. Create Swap Partition (4GB):
   • Select [ New ]
   • Enter size: 4G (or match your RAM size for hibernation)
   • Select [ Primary ]
   • Choose [ Type ] and select Linux swap
4. Create Root Partition (Remaining Space):
   • Select [ New ]
   • Press Enter to use all remaining space
   • Select [ Primary ]
   • Type is already Linux filesystem (default)
5. Write Changes to Disk:
   • Select [ Write ]
   • Type yes to confirm (THIS WILL ERASE EXISTING DATA!)
6. Select [ Quit ] to exit cfdisk

Option 2: BIOS/Legacy Systems (MBR Partition Table)

For older computers with BIOS firmware, use MBR partition table:

cfdisk /dev/sda

Follow these steps in cfdisk:

1. Select Partition Table Type: If prompted, select dos (MBR) and press Enter.
2. Create Boot Partition (512MB):
   • Select [ New ]
   • Enter size: 512M
   • Select [ Primary ]
   • Choose [ Bootable ] to set the boot flag
   • Type is Linux (default)
3. Create Swap Partition (4GB):
   • Select [ New ]
   • Enter size: 4G
   • Select [ Primary ]
   • Choose [ Type ] and select Linux swap
4. Create Root Partition (Remaining Space):
   • Select [ New ]
   • Press Enter to use all remaining space
   • Select [ Primary ]
5. Write Changes:
   • Select [ Write ]
   • Type yes to confirm
6. Select [ Quit ] to exit

Verifying Partitions

After exiting cfdisk, verify your partitions were created correctly:

lsblk

For UEFI/GPT, you should see:

• /dev/sda1 - 512M (EFI System)
• /dev/sda2 - 4G (Linux swap)
• /dev/sda3 - Remaining space (Linux filesystem)

For BIOS/MBR, you should see:

• /dev/sda1 - 512M (Linux, bootable)
• /dev/sda2 - 4G (Linux swap)
• /dev/sda3 - Remaining space (Linux filesystem)

Step 5: Format the Partitions

Now that we've created partitions, we need to format them with file systems. Formatting prepares the partitions to store data in a way that the operating system can understand.

Understanding File Systems

A file system is the method an operating system uses to organize and store data on a disk. Different file systems have different characteristics:

• FAT32: Required for EFI partitions. Simple, widely compatible, but limited to files smaller than 4GB.
• ext4: The standard Linux file system. Reliable, fast, and supports large files. Good for most use cases.
• btrfs: Advanced file system with features like snapshots and compression. More complex but powerful.
• xfs: Good for large files and high performance. Often used for media storage.

For this guide, we'll use ext4 for the root partition as it's the most straightforward and well-supported option.

Formatting Commands

Format each partition with the appropriate file system:

# Format EFI partition as FAT32
mkfs.fat -F32 /dev/sda1

# Create swap space
mkswap /dev/sda2

# Enable swap (temporary, for installation)
swapon /dev/sda2

# Format root partition as ext4
mkfs.ext4 /dev/sda3

What Each Command Does

• mkfs.fat -F32 /dev/sda1: Creates a FAT32 file system on the first partition. The -F32 flag specifies FAT32 format. This partition will store bootloader files.
• mkswap /dev/sda2: Prepares the second partition for use as swap space. This doesn't create a traditional file system, but rather marks the partition for virtual memory use.
• swapon /dev/sda2: Activates the swap partition. This is temporary for the installation process. We'll make it permanent later through fstab.
• mkfs.ext4 /dev/sda3: Creates an ext4 file system on the third partition. This is where your operating system and files will live.

Step 6: Mount the File Systems

Mounting is the process of making a file system accessible at a specific location (called a mount point) in the directory tree. We need to mount our partitions so the installer can write files to them.

Understanding Mount Points

In Linux, there's no concept of "drives" like C: or D: in Windows. Instead, all file systems are connected in a single directory tree starting at / (root). Mounting attaches a file system to a specific directory in this tree.

For installation, we use /mnt as the temporary root. We'll mount our root partition there, then create subdirectories for other partitions.

Mounting Commands

# Mount the root partition to /mnt
mount /dev/sda3 /mnt

# Create the boot directory
mkdir -p /mnt/boot

# Mount the EFI partition to /mnt/boot
mount /dev/sda1 /mnt/boot

What This Achieves

• mount /dev/sda3 /mnt: Attaches the root partition to /mnt. Now when we write to /mnt, we're actually writing to the root partition.
• mkdir -p /mnt/boot: Creates the boot directory inside our mounted root. The -p flag means "create parent directories if needed" and "don't error if directory exists".
• mount /dev/sda1 /mnt/boot: Attaches the EFI partition to /mnt/boot. Bootloader files will be stored here.

Verifying Mounts

Check that everything is mounted correctly:

lsblk

You should see your partitions with MOUNTPOINTS showing /mnt, /mnt/boot, etc.

Step 7: Install the Base System

Now we're ready to install the actual Arch Linux system. We'll use pacstrap, a script that installs packages to a specified root directory.

Understanding pacstrap

pacstrap is a convenience script included in the Arch ISO. It uses pacman (Arch's package manager) to install packages to a specified directory (our mounted root at /mnt). This is how we populate our new system with the base operating system files.

Installation Command

pacstrap /mnt base linux linux-firmware base-devel vim nano networkmanager

Package Breakdown

Let's understand what each package does:

• base: The minimal Arch Linux system. Includes essential utilities like bash, coreutils, findutils, grep, sed, and other fundamental tools. This is the absolute minimum needed for a working system.
• linux: The Linux kernel. This is the core of the operating system that manages hardware, memory, processes, and provides the interface between software and hardware.
• linux-firmware: Firmware files for various hardware devices. Includes drivers for WiFi cards, graphics cards, network adapters, and other hardware. Without this, some hardware might not work.
• base-devel: Development tools including gcc (C compiler), make, pkg-config, and other tools needed to compile software from source. Many BlackArch tools require compilation, so this is essential.
• vim: A powerful text editor. While it has a learning curve, it's available on virtually every Linux system and is invaluable for editing configuration files.
• nano: A simpler text editor that's easier for beginners. We'll use this for most editing tasks in this guide.
• networkmanager: A service that manages network connections. It handles WiFi, Ethernet, VPNs, and other network types. We'll enable it later to ensure networking works after reboot.

What Happens During Installation

During this process, pacstrap will:

1. Download all packages and their dependencies from Arch repositories
2. Verify package signatures to ensure they haven't been tampered with
3. Extract and install packages to /mnt
4. Run post-installation scripts for each package
5. Generate initial configuration files

Once complete, you'll have a minimal but functional Arch Linux installation at /mnt.

Step 8: Generate the Filesystem Table (fstab)

The fstab (filesystem table) is a configuration file that tells the system which partitions to mount at boot time and where to mount them. Without this file, your system won't know how to access its own partitions after reboot.

Understanding fstab

The fstab file is located at /etc/fstab in your installed system. Each line in this file specifies:

• Device: Which partition to mount (identified by UUID, label, or device path)
• Mount point: Where to mount it in the directory tree
• File system type: ext4, fat32, swap, etc.
• Options: Mount options like read/write permissions
• Dump: Backup flag (usually 0)
• Pass: File system check order (0 = skip, 1 = root, 2 = others)

Generating fstab

genfstab -U /mnt >> /mnt/etc/fstab

This command uses genfstab (generate filesystem table) to automatically create the fstab file based on currently mounted partitions. The -U flag uses UUIDs (Universally Unique Identifiers) to identify partitions, which is more reliable than device names that can change.

Verifying fstab

Always check the generated file to ensure it's correct:

cat /mnt/etc/fstab

You should see entries for your root partition, EFI partition, and swap. Each entry should have a UUID, mount point, file system type, and options. If something looks wrong, you can edit the file manually with nano before proceeding.

Step 9: Chroot into the New System

Chroot (change root) is a operation that changes the apparent root directory for the current running process and its children. This lets us work inside our new installation as if we had booted into it.

Understanding Chroot

When we chroot into /mnt, our perspective changes. Commands we run now operate on the files in /mnt as if they were at /. This is necessary because we need to configure the new system (set timezone, locale, install bootloader, etc.) from within its own environment.

Think of it like this: we've been working on a house from the outside. Now we're going inside to arrange the furniture and set up the utilities.

Chroot Command

arch-chroot /mnt

arch-chroot is a wrapper around the standard chroot command that sets up additional things needed for Arch Linux, like mounting /proc, /sys, and /dev inside the chroot environment.

What Changes After Chroot

• Your prompt changes from root@archiso ~ # to root@archiso / # (note the / instead of ~)
• Commands now affect the installed system, not the live ISO
• You can install packages, edit configuration files, and set up services
• The installed system's /etc, /usr, /var directories are now accessible

Exiting Chroot

When you're done configuring (after all the following steps), you can exit the chroot by typing exit or pressing Ctrl+D. This returns you to the live ISO environment.

Step 10: Set the Time Zone

Setting the correct timezone ensures that your system clock displays the right time and that scheduled tasks run at the expected times.

Understanding Timezones in Linux

Linux stores time internally as UTC (Coordinated Universal Time) and converts it to your local timezone for display. The timezone is set by creating a symbolic link from /etc/localtime to the appropriate timezone file in /usr/share/zoneinfo/.

Finding Your Timezone

Timezones are organized by region and city. To see available timezones:

ls /usr/share/zoneinfo/

This shows regions like America, Europe, Asia, etc. Each region contains cities. For example, America/New_York, Europe/London, Asia/Tokyo.

Setting the Timezone

# Example for New York (replace with your timezone)
ln -sf /usr/share/zoneinfo/America/New_York /etc/localtime

The ln -sf command creates a symbolic link (-s) and forces overwriting if the file exists (-f). This tells the system to use the specified timezone.

Synchronizing Hardware Clock

hwclock --systohc

This command writes the current system time to the hardware clock (the clock on your motherboard that keeps time even when the computer is off). The --systohc flag means "system time to hardware clock". This ensures your hardware clock is set to UTC, which is the standard for Linux systems.

Step 11: Set the Locale

Locale settings determine the language, character encoding, and formatting conventions (like date and number formats) used by your system.

Understanding Locales

A locale is a set of parameters that defines the user's language, region, and any special variant preferences. It affects:

• Language of system messages and applications
• Character encoding (UTF-8 supports all languages and special characters)
• Date and time formatting
• Number formatting (decimal separators, thousands separators)
• Sorting order

Editing locale.gen

The file /etc/locale.gen contains a list of all available locales, most of which are commented out (disabled). We need to uncomment the ones we want to use:

nano /etc/locale.gen

In nano, use Ctrl+W to search for your locale. Common choices:

• en_US.UTF-8 UTF-8 - US English with UTF-8 encoding (recommended for most users)
• en_GB.UTF-8 UTF-8 - British English
• fr_FR.UTF-8 UTF-8 - French
• de_DE.UTF-8 UTF-8 - German

Remove the # at the beginning of the line to uncomment it. Save with Ctrl+O, then Enter, then exit with Ctrl+X.

Generating Locales

locale-gen

This command reads /etc/locale.gen and generates the binary locale files for all uncommented entries. This makes the locales available for use.

Setting the Default Locale

echo "LANG=en_US.UTF-8" > /etc/locale.conf

This creates the /etc/locale.conf file with the LANG variable set to your preferred locale. This file is read by the system at boot to set the default locale for all users.

Step 12: Set the Keyboard Layout

If you don't use a US English keyboard, you need to set the correct layout so that keys produce the expected characters.

Understanding Keyboard Layouts

Keyboard layouts map physical keys to characters. Different countries use different layouts (QWERTY, AZERTY, QWERTZ, etc.). The layout needs to be set for both the console (text mode) and the graphical interface.

Setting Console Keyboard Layout

echo "KEYMAP=us" > /etc/vconsole.conf

This creates /etc/vconsole.conf with the KEYMAP variable. Common values:

• us - US English (QWERTY)
• fr - French (AZERTY)
• de - German (QWERTZ)
• gb - UK English
• es - Spanish

To see all available layouts: ls /usr/share/kbd/keymaps/

Step 13: Set the Hostname

The hostname is the name of your computer on the network. It's used to identify your machine to other devices and in various system logs.

Understanding Hostnames

A hostname should be:

• Unique on your network
• 1-63 characters long
• Contain only letters, numbers, and hyphens
• Not start or end with a hyphen
• All lowercase (convention)

Examples: blackarch-box, my-laptop, pentest-station

Setting the Hostname

echo "blackarch-box" > /etc/hostname

This creates the /etc/hostname file with your chosen hostname. The system reads this file at boot to set the machine's name.

Configuring /etc/hosts

The /etc/hosts file maps hostnames to IP addresses. We need to add our hostname to this file so the system can resolve it:

nano /etc/hosts

Add these lines:

127.0.0.1   localhost
::1         localhost
127.0.1.1   blackarch-box.localdomain   blackarch-box

Explanation:

• 127.0.0.1 localhost - IPv4 loopback address (always refers to this machine)
• ::1 localhost - IPv6 loopback address
• 127.0.1.1 blackarch-box.localdomain blackarch-box - Maps our hostname to a loopback address. The .localdomain is the fully qualified domain name (FQDN), and blackarch-box is the short hostname.

Step 14: Set Root Password

The root user is the superuser account with complete control over the system. Setting a strong password is critical for security.

Understanding the Root Account

Root (also called superuser or administrator) has unrestricted access to all files, commands, and system resources. With great power comes great responsibility - a compromised root account means complete system compromise.

Setting the Password

passwd

This command prompts you to enter and confirm a new password for the root account.

Password Security Tips

• Length: At least 12 characters
• Complexity: Mix uppercase, lowercase, numbers, and symbols
• Uniqueness: Don't reuse passwords from other systems
• Memorability: Use a passphrase (multiple words) rather than a complex single word
• Storage: Consider using a password manager

Best Practices

While we're setting a root password now, in normal operation you should:

• Use a regular user account for daily tasks
• Use sudo to run specific commands as root when needed
• Never log in as root directly unless absolutely necessary
• Consider disabling root login via SSH if you set up remote access

Step 15: Network Configuration

We need to ensure networking starts automatically after reboot so you can connect to the internet without manual configuration.

Understanding NetworkManager

NetworkManager is a service that automatically manages network connections. It handles:

• Wired Ethernet connections
• WiFi connections (with GUI tools)
• VPN connections
• Mobile broadband
• Network profiles for different locations

We installed it in Step 7, now we need to enable it to start at boot.

Enabling NetworkManager

systemctl enable NetworkManager

This command creates a symbolic link in the systemd configuration to start NetworkManager automatically at boot. The service name is case-sensitive: NetworkManager (capital N and M).

Understanding systemctl

systemctl is the command-line tool for controlling systemd, the init system used by Arch Linux. Common commands:

• enable - Start service at boot
• disable - Don't start at boot
• start - Start service now
• stop - Stop service now
• restart - Restart service
• status - Show service status

Step 16: Initramfs

The initramfs (initial ram filesystem) is a temporary root file system loaded into memory during the boot process. It contains the minimal tools needed to mount the real root file system.

Understanding Initramfs

When your computer boots, the kernel needs to load drivers and mount the root file system before it can access any files on disk. But the drivers are on the disk! This is a chicken-and-egg problem.

The solution is initramfs: a small file system loaded into RAM by the bootloader. It contains essential drivers and tools to mount the real root file system. Once mounted, the initramfs is discarded and the real system takes over.

Generating Initramfs

mkinitcpio -P

mkinitcpio (make initial CPIO archive) generates the initramfs. The -P flag means "preset" - it generates initramfs for all kernel presets configured in /etc/mkinitcpio.d/.

When You Might Need Custom Configuration

For most installations, the default configuration works fine. However, you might need to edit /etc/mkinitcpio.conf if you use:

• LVM (Logical Volume Manager): Add lvm2 to the HOOKS array
• Full disk encryption: Add encrypt to the HOOKS array
• RAID arrays: Add mdadm to the HOOKS array
• Special hardware: Add specific modules to the MODULES array

Step 17: Install a Bootloader

The bootloader is the first program that runs when you start your computer. It loads the operating system kernel into memory and starts the boot process.

Understanding Bootloaders

Without a bootloader, your computer doesn't know how to start the operating system. The bootloader:

• Initializes hardware
• Presents a menu to choose which OS to boot (if dual-booting)
• Loads the kernel and initramfs into memory
• Passes control to the kernel

We'll use GRUB (GRand Unified Bootloader), the most popular Linux bootloader.

For UEFI Systems

# Install GRUB and EFI boot manager
pacman -S grub efibootmgr

# Install GRUB to the EFI directory
grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id=GRUB

# Generate GRUB configuration
grub-mkconfig -o /boot/grub/grub.cfg

Command Breakdown

• pacman -S grub efibootmgr: Installs GRUB and the EFI boot manager. The EFI boot manager is needed to add GRUB to the UEFI boot menu.
• grub-install --target=x86_64-efi: Specifies we're installing for 64-bit UEFI systems.
• --efi-directory=/boot: Tells GRUB where the EFI system partition is mounted.
• --bootloader-id=GRUB: Sets the name that appears in the UEFI boot menu.
• grub-mkconfig -o /boot/grub/grub.cfg: Generates the GRUB configuration file by scanning for installed operating systems.

For BIOS/Legacy Systems

# Install GRUB
pacman -S grub

# Install GRUB to the Master Boot Record
grub-install --target=i386-pc /dev/sda

# Generate configuration
grub-mkconfig -o /boot/grub/grub.cfg

Troubleshooting

If grub-install fails:

• Ensure you're in the correct mode (UEFI vs BIOS)
• Check that the EFI partition is mounted at /boot (for UEFI)
• Try loading the efivarfs module: modprobe efivarfs
• Verify your partition table is correct (GPT for UEFI, MBR for BIOS)

Step 18: Exit, Unmount, and Reboot

We've completed all the configuration steps. Now it's time to exit the chroot environment, unmount our partitions, and reboot into our new system.

Exiting Chroot

exit

This exits the chroot environment and returns you to the live ISO. You're now working with the ISO's file system again, not the installed system.

Unmounting Partitions

umount -R /mnt

The umount command detaches file systems. The -R flag means "recursive" - it unmounts /mnt and all file systems mounted beneath it (like /mnt/boot). This is important to ensure all data is written to disk and no files are locked.

Rebooting

reboot

This restarts the computer. The system should now boot from your hard drive into the newly installed Arch Linux.

What to Expect

After reboot, you should see:

1. GRUB boot menu (if you installed it correctly)
2. Arch Linux boot messages scrolling by
3. A login prompt: blackarch-box login:

If you see the GRUB menu, congratulations! Your bootloader is working. If you get a login prompt, your system booted successfully!

Step 19: First Boot - Login

Congratulations! You've successfully installed Arch Linux. Now it's time to log in and start using your new system.

The Login Process

After the system boots, you'll see a text-based login prompt:

blackarch-box login:

Enter root as the username, then enter the password you set in Step 14.

Understanding the Prompt

After logging in, you'll see a prompt like:

[root@blackarch-box ~]#

This shows:

• root - Current user
• @blackarch-box - Hostname
• ~ - Current directory (home directory)
• # - Indicates you're root (regular users see $)

First Commands

Let's verify everything is working:

# Check internet connection
ping -c 3 archlinux.org

# Check disk usage
df -h

# Check system information
uname -a

# Update the system
pacman -Syu

What's Next?

Right now you have a minimal command-line system. In the next steps, we'll:

• Create a regular user account (for security)
• Set up sudo (to run commands as root when needed)
• Optionally install a desktop environment
• Convert to BlackArch

Step 20: Post-Installation - User and Sudo

For security reasons, you should not use the root account for daily tasks. We'll create a regular user account and configure sudo to allow running administrative commands when needed.

Why Not Use Root?

Using root for daily tasks is dangerous because:

• A single typo can destroy your system
• Malware running as root has complete control
• It violates the principle of least privilege
• Many applications refuse to run as root for safety

Creating a User Account

# Create user with home directory, add to wheel group, set bash as shell
useradd -m -G wheel -s /bin/bash your_username

# Set password for the new user
passwd your_username

Command Breakdown

• useradd: Command to create a new user
• -m: Create home directory (/home/your_username)
• -G wheel: Add to the wheel group (used for sudo access)
• -s /bin/bash: Set bash as the default shell
• your_username: Replace with your desired username

Configuring Sudo

Sudo (superuser do) allows authorized users to run commands as root. First, install it:

pacman -S sudo

Then edit the sudoers file:

EDITOR=nano visudo

This opens the sudoers file in nano. Find this line:

# %wheel ALL=(ALL:ALL) ALL

Remove the # to uncomment it:

%wheel ALL=(ALL:ALL) ALL

Save and exit (Ctrl+O, Enter, Ctrl+X in nano).

Understanding the Sudoers Line

• %wheel: Applies to all users in the wheel group
• ALL: From any host
• (ALL:ALL): Can run commands as any user and any group
• ALL: Any command

Step 21: Install a Desktop Environment (Optional)

While Arch Linux works perfectly fine as a command-line system, many users prefer a graphical interface. This is especially useful for BlackArch, as many security tools have graphical interfaces.

Understanding Desktop Environments

A desktop environment (DE) provides:

• Graphical user interface with windows, menus, and icons
• File manager for browsing files
• Application launcher
• System settings and configuration tools
• Wallpaper and themes

Popular options for Arch Linux:

XFCE (Lightweight, Recommended for VMs)

sudo pacman -S xfce4 xfce4-goodies lightdm lightdm-gtk-greeter

XFCE is lightweight, fast, and uses minimal resources. Perfect for VMs or older hardware.

KDE Plasma (Feature-rich, Modern)

sudo pacman -S plasma-meta kde-applications-meta sddm

KDE Plasma is modern, customizable, and feature-rich. Uses more resources but offers a polished experience.

GNOME (Simple, Elegant)

sudo pacman -S gnome gnome-extra gdm

GNOME focuses on simplicity and ease of use. Has a unique workflow that some users love and others find limiting.

Enabling the Display Manager

The display manager (DM) is the graphical login screen. Enable it to start at boot:

# For LightDM (XFCE)
sudo systemctl enable lightdm

# For SDDM (KDE)
sudo systemctl enable sddm

# For GDM (GNOME)
sudo systemctl enable gdm

Post-Desktop Setup

After logging into your desktop:

• Set up WiFi using the network manager applet (if needed)
• Install additional applications you need
• Customize your desktop theme and settings
• Proceed to BlackArch conversion

Step 22: Convert to BlackArch (The Main Goal)

Now that you have a fully functional Arch Linux system, it's time to transform it into BlackArch - the ultimate penetration testing distribution.

What is BlackArch?

BlackArch Linux is an Arch Linux-based penetration testing distribution designed for security researchers and penetration testers. It is fully compatible with existing Arch installations and contains a vast collection of tools organized by category.

Key features:

• Over 2,800 security tools
• Tools organized by category (web, wireless, forensics, etc.)
• Fully compatible with Arch Linux
• Rolling release model (always up-to-date)
• Can install individual tools or entire categories

Why Convert Instead of Using BlackArch ISO?

Step-by-Step Conversion

1. Download and Run the BlackArch Strap Script

The strap script adds the BlackArch repository to your system:

# Download the strap script
curl -O https://blackarch.org/strap.sh

# Verify the SHA1 sum (security check)
echo "5ea40d49ecd00f61b0de78d19a6372d754a371c0 strap.sh" | sha1sum -c

# Make it executable
chmod +x strap.sh

# Run it with sudo
sudo ./strap.sh

What the Script Does

• Adds the BlackArch repository to /etc/pacman.conf
• Imports the BlackArch signing keys
• Updates your package database

2. Update Your System

sudo pacman -Syyu

The double y forces a refresh of all package databases, ensuring you have the latest BlackArch package list.

3. Verify the Repository

# List BlackArch packages
pacman -Sl blackarch | head -20

# List tool categories
pacman -Sg | grep blackarch

Installing BlackArch Tools

Now that the BlackArch repository is added, you can install security tools. There are three approaches, each with different trade-offs.

Option 1: Install All Tools (Not Recommended)

sudo pacman -S blackarch

This installs all 2,800+ tools. While tempting, this is discouraged because:

• Consumes ~22GB of disk space
• Many tools you'll never use
• Updates become slow and complex
• Package conflicts are more likely

Option 2: Install by Category (Recommended)

BlackArch tools are organized into categories. Install only what you need:

# List all categories
pacman -Sg | grep blackarch

# Install specific categories
sudo pacman -S blackarch-webapp      # Web application testing
sudo pacman -S blackarch-wireless    # Wireless network auditing
sudo pacman -S blackarch-exploitation # Exploitation frameworks
sudo pacman -S blackarch-forensic    # Forensics tools
sudo pacman -S blackarch-reversing   # Reverse engineering
sudo pacman -S blackarch-crypto      # Cryptography tools

Common Categories Explained

• blackarch-webapp: Tools for testing web applications (SQL injection, XSS, etc.)
• blackarch-wireless: WiFi auditing tools (aircrack-ng, reaver, etc.)
• blackarch-exploitation: Exploitation frameworks (Metasploit, etc.)
• blackarch-forensic: Digital forensics and data recovery
• blackarch-reversing: Reverse engineering tools (radare2, Ghidra)
• blackarch-crypto: Cryptanalysis and encryption tools
• blackarch-sniffer: Network sniffers (Wireshark, tcpdump)
• blackarch-fuzzer: Fuzzing tools for finding vulnerabilities

Option 3: Install Individual Tools

For maximum control, install specific tools:

# Search for a tool
pacman -Ss nmap

# Install a specific tool
sudo pacman -S nmap

Ethical Use Reminder

These tools are powerful and can be used for both good and bad purposes. Always:

• Only test systems you own or have explicit permission to test
• Follow laws and regulations in your jurisdiction
• Use your skills to improve security, not compromise it
• Report vulnerabilities responsibly

Conclusion

Congratulations! You've successfully completed one of the most comprehensive Linux installation guides available. You've not only installed Arch Linux from scratch but also transformed it into a fully functional BlackArch penetration testing environment.

What You've Learned

• How to partition and format disks
• How to install and configure a Linux system from the command line
• How bootloaders work and how to configure them
• How to manage users and permissions
• How to install and configure desktop environments
• How to add third-party repositories
• How to install and manage security tools

Next Steps

Now that you have your BlackArch system set up, consider:

• Learning about common penetration testing methodologies
• Practicing on legal platforms like HackTheBox or TryHackMe
• Studying for certifications like OSCP or CEH
• Contributing to open-source security tools
• Joining the cybersecurity community

Resources

• Arch Wiki - Comprehensive Arch Linux documentation
• BlackArch Website - Official BlackArch resources
• This Guide's Repository - Report issues or contribute

Happy Hacking (Ethically)!