• gdisk /dev/sda

# mkfs.ext4 /dev/sda1
# mkfs.ext4 /dev/sda3
# mount /dev/sda3 /mnt
# mkdir /mnt/boot
# mount /dev/sda1 /mnt/boot

# mkswap /dev/sda2
# swapon /dev/sda2

• /etc/pacman.d/mirrorlist を編集する。
• Japanの項目を上に持ってくる

  # vi /etc/pacman.d/mirrorlist
  

• ベースシステムのインストール

  # pacstrap /mnt base base-devel
  

• fstabの生成

  # genfstab -p /mnt >> /mnt/etc/fstab
  

• 以下は、chrootして、行う。

  # arch-chroot /mnt
  

• ホスト名の設定

  # vi /etc/hostname
  host-name
  :eq
  

• タイムゾーンの設定

  # ln -sf /usr/share/zoneinfo/Asia/Tokyo /etc/localtime
  

• ロケールの生成と設定

  # vi /etc/locale.gen
  ja_JP.UTF-8行のコメントをカットする
  :wq
  # locale-gen
  # vi /etc/locale.conf
  LANG=ja_JP.UTF-8
  :wq
  

• キーマップの設定

  # vi /etc/vconsole.conf
  KEYMAP=jp106
  

• パスワードの設定

  # passwd
  

• grubのインストール

  # pacman -S grub
  # grub-install --target=i386-pc --recheck --force /dev/sda
  # grub-mkconfig -o /boot/grub/grub.cfg
  

• インストール後、無線LANが使えるようにする

  # pacman -S wireless_tools wpa_supplicant wpa_actiond
  

• あと、ifconfigが使えるようにする

  # pacman -S net-tools
  

• 標準コンソールでは、Unicodeが対応していないため、日本語は表示できないようだ。
• (解像度は高くなっているけどダメなんだろうか)
• 昔ながらのjfbtermを使うのがスタンダード
• Kmsconというのがあるようだ。これは、Unicodeをサポートしている。

--dnssec

Validate DNS replies and cache DNSSEC data. When forwarding DNS queries, dnsmasq requests the DNSSEC records needed to validate the replies. The replies are validated and the result returned as the Authenticated Data bit in the DNS packet. In addition the DNSSEC records are stored in the cache, making validation by clients more efficient. Note that validation by clients is the most secure DNSSEC mode, but for clients unable to do validation, use of the AD bit set by dnsmasq is useful, provided that the network between the dnsmasq server and the client is trusted. Dnsmasq must be compiled with HAVE_DNSSEC enabled, and DNSSEC trust anchors provided, see --trust-anchor. Because the DNSSEC validation process uses the cache, it is not permitted to reduce the cache size below the default when DNSSEC is enabled. The nameservers upstream of dnsmasq must be DNSSEC-capable, ie capable of returning DNSSEC records with data. If they are not, then dnsmasq will not be able to determine the trusted status of answers. In the default mode, this menas that all replies will be marked as untrusted. If --dnssec-check-unsigned is set and the upstream servers don't support DNSSEC, then DNS service will be entirely broken.

--dnssec-check-unsigned

As a default, dnsmasq does not check that unsigned DNS replies are legitimate: they are assumed to be valid and passed on (without the "authentic data" bit set, of course). This does not protect against an attacker forging unsigned replies for signed DNS zones, but it is fast. If this flag is set, dnsmasq will check the zones of unsigned replies, to ensure that unsigned replies are allowed in those zones. The cost of this is more upstream queries and slower performance. See also the warning about upstream servers in the section on --dnssec

--dnssec-no-timecheck

DNSSEC signatures are only valid for specified time windows, and should be rejected outside those windows. This generates an interesting chicken-and-egg problem for machines which don't have a hardware real time clock. For these machines to determine the correct time typically requires use of NTP and therefore DNS, but validating DNS requires that the correct time is already known. Setting this flag removes the time-window checks (but not other DNSSEC validation.) only until the dnsmasq process receives SIGHUP. The intention is that dnsmasq should be started with this flag when the platform determines that reliable time is not currently available. As soon as reliable time is established, a SIGHUP should be sent to dnsmasq, which enables time checking, and purges the cache of DNS records which have not been throughly checked.

--proxy-dnssec

Copy the DNSSEC Authenticated Data bit from upstream servers to downstream clients and cache it. This is an alternative to having dnsmasq validate DNSSEC, but it depends on the security of the network between dnsmasq and the upstream servers, and the trustworthiness of the upstream servers.

--dnssec-debug

Set debugging mode for the DNSSEC validation, set the Checking Disabled bit on upstream queries, and don't convert replies which do not validate to responses with a return code of SERVFAIL. Note that setting this may affect DNS behaviour in bad ways, it is not an extra-logging flag and should not be set in production.

xterm*faceSize: 14

XTerm*VT100*font: 9x15