table of contents
- stretch 2:1.7.3-4
- testing 2:2.1.0-5
- unstable 2:2.1.0-5
- experimental 2:2.2.0~rc1-1
CRYPTTAB(5) | cryptsetup manual | CRYPTTAB(5) |
NAME¶
crypttab - static information about encrypted filesystemsDESCRIPTION¶
The file /etc/crypttab contains descriptive information about encrypted filesystems. crypttab is only read by programs (e.g. cryptdisks_start and cryptdisks_stop), and not written; it is the duty of the system administrator to properly create and maintain this file. Each filesystem is described on a separate line; fields on each line are separated by tabs or spaces. Lines starting with “#” are comments, empty lines are ignored. The order of records in crypttab is important because the init scripts sequentially iterate through crypttab doing their thing.The first field, target, describes the mapped device name. It must be a plain filename without any directory components. A mapped device which encrypts/decrypts data to/from the source device will be created at /dev/mapper/target by cryptsetup.
The second field, source device, describes either the block special device or file that contains the encrypted data. Instead of giving the source device explicitly, the UUID is supported as well, using UUID=<luks_uuid>.
The third field, key file, describes the file to use as a key for decrypting the data of the source device. Note that the entire key file will be used as the passphrase; the passphrase must not be followed by a newline character.
It can also be a device name (e.g. /dev/urandom), note however that LUKS requires a persistent key and therefore does not support random data keys.
If the key file is the string “none”, a passphrase will be read interactively from the console. In this case, the options precheck, check, checkargs and tries may be useful.
The fourth field, options, describes the cryptsetup options associated with the encryption process. At minimum, the field should contain either the string luks respectively tcrypt or the cipher, hash and size options.
Options are in the format: key=value [,key=value ...]. The supported options are described below.
Note that all four fields are mandatory and that a missing field will lead to unspecified behaviour.
OPTIONS¶
cipher=<cipher>size=<size>
hash=<hash>
offset=<offset>
skip=<skip>
verify
readonly
discard
WARNING: Assess the specific security risks carefully before enabling this option. For example, allowing discards on encrypted devices may lead to the leak of information about the ciphertext device (filesystem type, used space etc.) if the discarded blocks can be located easily on the device later.
Kernel version 3.1 or more recent is required. For older versions is the option ignored.
luks
tcrypt
veracrypt
swap
tmp=<tmpfs>
precheck=<precheck>
Prechecks aren't invoked for LUKS devices, as these are checked with isLuks anyway. Default for plain dm-crypt devices is set in /etc/default/cryptdisks, or un_blkid otherwise. Set to /bin/true in order to disable precheck for plain dm-crypt device.
check=<check>
Default is set in /etc/default/cryptdisks (blkid).
checkargs=<arguments>
tries=<num>
initramfs
noearly
noauto
loud
quiet
keyscript=<path>
LIMITATIONS: All binaries and files on which the keyscript depends must be available at the time of execution. Special care needs to be taken for encrypted filesystems like /usr or /var. As an example, unlocking encrypted /usr must not depend on binaries from /usr/(s)bin.
WARNING: With systemd as init system, this option might be ignored. At the time this is written (December 2016), the systemd cryptsetup helper doesn't support the keyscript option to /etc/crypttab. For the time being, the only option to use keyscripts along with systemd is to force processing of the corresponding crypto devices in the initramfs. See the 'initramfs' option for further information.
All fields of the appropriate crypttab entry are available to the keyscript as exported environment variables:
CRYPTTAB_NAME
CRYPTTAB_SOURCE
CRYPTTAB_KEY
CRYPTTAB_TRIED
CRYPTTAB_OPTIONS
CRYPTTAB_OPTION_<option>
keyslot=<slot>
header=<path>
tcrypthidden
CHECKSCRIPTS¶
blkidun_blkid
EXAMPLES¶
# Encrypted swap device cswap /dev/sda6 /dev/urandom cipher=aes-xts-plain64,size=256,hash=sha1,swap # Encrypted LUKS disk with interactive password, identified by UUID cdisk0 UUID=12345678-9abc-def012345-6789abcdef01 none luks # Encrypted TCRYPT disk with interactive password tdisk0 /dev/sr0 none tcrypt # Encrypted ext4 disk with interactive password # - retry 5 times if the check fails cdisk1 /dev/sda2 none cipher=aes-xts-plain64,size=256,hash=sha1,checkargs=ext4,tries=5 # Encrypted disk with interactive password # - use a nondefault check script # - no retries cdisk2 /dev/sdc1 none cipher=aes-xts-plain64,size=256,hash=sha1,check=customscript,tries=1 # Encrypted disk with interactive password # - Twofish as the cipher, RIPEMD-160 as the hash cdisk3 /dev/sda3 none cipher=twofish,size=256,hash=ripemd160
ENVIRONMENT¶
CRYPTDISKS_ENABLECRYPTDISKS_MOUNT
CRYPTDISKS_CHECK
CRYPTDISKS_PRECHECK
KNOWN UPGRADE ISSUES¶
The upstream defaults for encryption cipher, hash and keysize have changed several times in the past, and they're expected to change again in future, for example if security issues arise. On LUKS devices, the used settings are stored in the LUKS header, and thus don't need to be configured in /etc/crypttab. For plain dm-crypt devices, no information about used cipher, hash and keysize are available at all. Therefore we strongly suggest to configure the cipher, hash and keysize in /etc/crypttab for plain dm-crypt devices, even if they match the current default.SEE ALSO¶
cryptsetup(8), cryptdisks_start(8), cryptdisks_stop(8)AUTHOR¶
This manual page was originally written by Bastian Kleineidam <calvin@debian.org> for the Debian distribution of cryptsetup. It has been further improved by Michael Gebetsroither <michael.geb@gmx.at>, Jonas Meurer <jonas@freesources.org> and David Härdeman <david@hardeman.nu>.2017-05-09 | cryptsetup 2:1.7.3-4 |