Home→Archive↴

Install Linux Mint Debian Edition (LMDE 7) in Expert Mode

Last edited on 2026-07-17 • Tagged under  #lmde   #debian   #linux   #encrypt 

I like to create encrypted storage space to hold the contents of my home directory that is separate from the space that contains the root filesystem. This makes it easier if I decide to re-install Linux on the target system while preserving user data.

During an install of LMDE 7 aka “Gigi” - if you select the option to automatically erase and partition the disk using LUKS (Linux Unified Key Setup) - the installer creates a single encrypted partition formatted with LVM (Logical Volume Manager) containing two “virtual partitions” (Logical Volumes or LVs): a swap LV, and a root LV that uses all remaining disk storage. There is no option to add a home LV to the automatic schema.

Previously I would resize the root LV to make room for a home LV, but in my daily use I’ve found LVM to be an extra layer of complexity whose benefits - such as resizing existing LVs and creating new ones - I never end up using. More significantly, LVM makes re-installing the OS while preserving the contents of home more complicated on LMDE (which again is different than how its done on the Ubuntu-based Linux Mint).

My preferred alternative: LMDE offers a live-installer-expert-mode option that is considerably more flexible in handling a custom partition layout and accepting user commands.

• Start Here
  • Acquire an installation image
  • Prepare the USB installation media
• Configure the Live Environment
  • Switch to root
  • Verify network connectivity
  • Verify boot mode
• Prepare the Disk
  • Define disk variables
  • Wipe the disk
  • Partition the disk
  • Encrypt the root partition
  • Encrypt the home partition
  • Create file systems
• Installation
  • Expert mode
  • Mount file systems
  • Install LMDE
  • Create a swapfile
  • Add to fstab
  • Add to crypttab
  • Finish the install
  • Mount virtual file systems
  • Re-mount boot
  • Enter chroot
  • Add packages
  • Update initramfs and GRUB
• Finish Up
  • Exit chroot
  • Unmount and close
  • Reboot
• Resources

Start Here

For the purposes of this HOWTO, LMDE is installed as the sole operating system on a single disk using a four-partition layout:

• Partition esp serves as the EFI system partition and is formatted with the fat32 file system.
• Partition boot is formatted with the ext4 file system.
• Partitions root and home use luks2 encryption and are formatted with the ext4 file system.

A few assumptions:

• Target device is 64-bit architecture using UEFI to boot.
• Secure boot is disabled on target device.
• Installation image is prepared on a Linux/BSD system.
• Network access during install uses a wired interface.
• System does not require hibernation support.

Acquire an installation image

The latest live ISO install images are available here: Torrents and download mirrors

Download the lmde-7-cinnamon-64bit.iso image and sha256sum.txt file.

Verify the image integrity:

sha256sum -c --ignore-missing sha256sum.txt

Prepare the USB installation media

Write the installer to an unmounted USB storage device running the dd command as root.

ALERT
Be very careful to note the proper device (which can be identified with the lsblk command). All contents on the device will be lost!

Example: On a Linux system, if a USB stick appears as sdx1, then write the installer to sdx (omit partition number):

dd bs=4M conv=fsync oflag=direct status=progress if=lmde-7-cinnamon-64bit.iso of=/dev/sdx

Configure the Live Environment

Boot the target device from the lmde installation media. User is automatically logged in to the Cinnamon desktop.

Switch to root

Open a terminal and switch to a root shell:

sudo -i

Verify network connectivity

Wired network interfaces should be auto-enabled and connected at boot.

Verify the network interface is active, has been assigned an address, and the internet is reachable:

ip addr
ping -c 3 linuxmint.com

Verify boot mode

Confirm target device is using UEFI boot mode:

cat /sys/firmware/efi/fw_platform_size

If the command returns 64, then system is booted in UEFI with 64-bit x64 UEFI and we are good to go.

ALERT
If the file does not exist, the device is not using UEFI and these instructions will not produce a working system.

Prepare the Disk

Set up a custom partition layout on a single disk before proceeding with the LMDE installation.

Define disk variables

Identify the disk where LMDE will be installed by listing block devices:

lsblk

Set variables for the partitions:

esp_part="1"
boot_part="2"
root_part="3"
home_part="4"
esp_part_label="esp"
boot_part_label="boot"
root_part_label="root"
home_part_label="home"

Set disk variables for either a SATA or NVMe disk:

SATA

Example disk: sda

disk="/dev/sda"
esp_device=${disk}${esp_part}
boot_device=${disk}${boot_part}
root_device=${disk}${root_part}
home_device=${disk}${home_part}
echo $esp_device && echo $boot_device && echo $root_device && echo $home_device

NVMe

Example disk: nvme0n1

disk="/dev/nvme0n1"
esp_device=${disk}p${esp_part}
boot_device=${disk}p${boot_part}
root_device=${disk}p${root_part}
home_device=${disk}p${home_part}
echo $esp_device && echo $boot_device && echo $root_device && echo $home_device

Wipe the disk

If disk was previously configured with LVM, bring down the volume group:

vgchange -an

Wipe existing file systems and partition table on disk:

wipefs -af $disk && sgdisk --zap-all --clear $disk

Notify the system of changes to the partition table:

partprobe $disk

Partition the disk

Create a GPT partition table on disk with the following layout:

Create the EFI system partition:

sgdisk -n "${esp_part}:1m:+550m" -t "${esp_part}:ef00" -c 0:${esp_part_label} $disk

Create the boot partition:

sgdisk -n "${boot_part}:0:+2g" -t "${boot_part}:8300" -c 0:${boot_part_label} $disk

Create the root partition:

sgdisk -n "${root_part}:0:+64g" -t "${root_part}:8309" -c 0:${root_part_label} $disk

Create the home partition:

sgdisk -n "${home_part}:0:0" -t "${home_part}:8309" -c 0:${home_part_label} $disk

Display layout:

partprobe $disk && sgdisk -p $disk

Encrypt the root partition

cryptsetup luksFormat --type luks2 -y $root_device

Set a variable for cryptroot:

luks_dev_root="cryptroot"

Unlock root_device:

cryptsetup open $root_device $luks_dev_root

Encrypt the home partition

NOTE
If the encryption passphrase for home is the same as for root, the home partition will be auto-unlocked at boot. Recommended.

cryptsetup luksFormat --type luks2 -y $home_device

Set a variable for crypthome:

luks_dev_home="crypthome"

Unlock home_device:

cryptsetup open $home_device $luks_dev_home

Create file systems

Labels on file systems are optional, but helpful. They are a more reliable way to identify the correct partition than simple device nodes and allow for easy mounting without a UUID.

Set file system label variables:

esp_fs_label="ESP"
boot_fs_label="bootfs"
root_fs_label="rootfs"
home_fs_label="homefs"

Create file systems:

mkfs.fat -n $esp_fs_label -F 32 $esp_device
mkfs.ext4 -L $boot_fs_label $boot_device
mkfs.ext4 -L $root_fs_label /dev/mapper/${luks_dev_root}
mkfs.ext4 -L $home_fs_label /dev/mapper/${luks_dev_home}

Installation

Expert mode

Open a new tab in the terminal.

Launch the LMDE installer in expert-mode:

sudo live-installer-expert-mode

Proceed as normal up to Installation Type. Select Manual Partitioning.

In the Partitioning window, click Expert mode.

Before continuing, we mount our file systems on /target.

Mount file systems

Switch back to the root terminal.

Mount:

mount --mkdir LABEL=${root_fs_label} /target
mount --mkdir LABEL=${home_fs_label} /target/home
mount --mkdir LABEL=${boot_fs_label} /target/boot
mount --mkdir LABEL=${esp_fs_label} /target/boot/efi

Install LMDE

Switch back to the installer window and click Next.

Proceed to Summary and confirm:

• Home encryption: disabled         # entire partition is LUKS-encrypted
• Install bootloader on /dev/[disk]   # example: /dev/sda with no partition number
• Use already mounted /target

When satisfied, click Install.

LMDE install proceeds as per usual up to Installation paused.

Do the following before continuing the install:

Create a swapfile

Create a swapfile (example size: 2G):

fallocate -l 2G /swapfile

Set correct permissions:

chmod 600 /swapfile

Format the file as swap:

mkswap /swapfile

Add to fstab

Add file systems to fstab to be mounted at boot:

echo "LABEL=${root_fs_label}  /           ext4    defaults    0 1" >> /target/etc/fstab
echo "LABEL=${boot_fs_label}  /boot       ext4    defaults    0 2" >> /target/etc/fstab
echo "LABEL=${home_fs_label}  /home       ext4    defaults    0 2" >> /target/etc/fstab
echo "LABEL=${esp_fs_label}     /boot/efi   vfat    defaults    0 0" >> /target/etc/fstab

Add swapfile:

echo "/swapfile     none        swap    sw          0 0" >> /target/etc/fstab && cat /target/etc/fstab

Add to crypttab

Set root and home to be opened at boot:

echo "$luks_dev_root    PARTLABEL=${root_part_label}  none    luks,discard" >> /target/etc/crypttab
echo "$luks_dev_home    PARTLABEL=${home_part_label}  none    luks,discard" >> /target/etc/crypttab && cat /target/etc/crypttab

Finish the install

Switch back to installer window and click Next to finish the install.

When prompted Do you want to restart your computer to use the new system? choose No.

Mount virtual file systems

Switch back to the root terminal.

Mount:

mount --bind /dev /target/dev
mount --bind /dev/pts /target/dev/pts
mount -t proc /proc /target/proc
mount -t sysfs /sys /target/sys

Re-mount boot

LMDE unmounts /boot at the end of the install. Re-mount the partitions so we can later update initramfs and GRUB:

mount --mkdir LABEL=${boot_fs_label} /target/boot
mount --mkdir LABEL=${esp_fs_label} /target/boot/efi

Enter chroot

Copy resolv.conf to enable network access inside chroot environment:

cp /etc/resolv.conf /target/etc/resolv.conf

Make changes inside the local installed system via chroot:

chroot /target/ /bin/bash

Change the prompt to highlight actions inside chroot:

PS1="(chroot) $PS1"

Add packages

Update the package repository contents and install extra packages:

apt update && LC_ALL=C.UTF-8 apt -y install systemd-cryptsetup

Update initramfs and GRUB

LC_ALL=C.UTF-8 update-initramfs -u -k all
update-grub

Finish Up

Exit chroot

exit
cd

Unmount and close

umount /target/boot/efi
umount /target/boot
umount /target/home
umount -l -n -R /target

Remove encrypted mappings:

cryptsetup close $luks_dev_home
cryptsetup close $luks_dev_root

Reboot

Reboot the system.

System boots and loads the GRUB menu then, after a brief pause, boot resumes and a password prompt appears to unlock cryptroot. Upon success, boot resumes…

Welcome to LMDE!

Resources

• Release notes for LMDE 7 and upstream Debian 13 “Trixie”. Pay particular attention to “Issues to be aware of for trixie” (especially #5).

You can like, share, or comment on this post on Mastodon 💬

» Next: NetBSD 11.0 Installation with Disk Encryption

« Previous: Zswap Makes Swap Go Zoom