man/crypttab.html

   1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>crypttab</title><meta name="generator" content="DocBook XSL Stylesheets V1.78.1"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><style>
   2     a.headerlink {
   3       color: #c60f0f;
   4       font-size: 0.8em;
   5       padding: 0 4px 0 4px;
   6       text-decoration: none;
   7       visibility: hidden;
   8     }
   9
  10     a.headerlink:hover {
  11       background-color: #c60f0f;
  12       color: white;
  13     }
  14
  15     h1:hover > a.headerlink, h2:hover > a.headerlink, h3:hover > a.headerlink, dt:hover > a.headerlink {
  16       visibility: visible;
  17     }
  18   </style><a href="index.html">Index </a>·
  19   <a href="systemd.directives.html">Directives </a>·
  20   <a href="../python-systemd/index.html">Python </a>·
  21   <a href="../libudev/index.html">libudev </a>·
  22   <a href="../libudev/index.html">gudev </a><span style="float:right">systemd 218</span><hr><div class="refentry"><a name="crypttab"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>crypttab — Configuration for encrypted block devices</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><p><code class="filename">/etc/crypttab</code></p></div><div class="refsect1"><a name="idm140208008975968"></a><h2 id="Description">Description<a class="headerlink" title="Permalink to this headline" href="#Description">¶</a></h2><p>The <code class="filename">/etc/crypttab</code> file
  23                 describes encrypted block devices that are set up
  24                 during system boot.</p><p>Empty lines and lines starting with the "<code class="literal">#</code>"
  25                 character are ignored.  Each of the remaining lines
  26                 describes one encrypted block device, fields on the
  27                 line are delimited by white space.  The first two
  28                 fields are mandatory, the remaining two are
  29                 optional.</p><p>Setting up encrypted block devices using this file
  30                 supports three encryption modes: LUKS, TrueCrypt and plain.
  31                 See <a href="cryptsetup.html"><span class="citerefentry"><span class="refentrytitle">cryptsetup</span>(8)</span></a>
  32                 for more information about each mode. When no mode is specified
  33                 in the options field and the block device contains a LUKS
  34                 signature, it is opened as a LUKS device; otherwise, it is
  35                 assumed to be in raw dm-crypt (plain mode) format.</p><p>The first field contains the name of the
  36                 resulting encrypted block device; the device is set up
  37                 within <code class="filename">/dev/mapper/</code>.</p><p>The second field contains a path to the
  38                 underlying block device or file, or a specification of a block
  39                 device via "<code class="literal">UUID=</code>" followed by the
  40                 UUID.</p><p>The third field specifies the encryption
  41                 password.  If the field is not present or the password
  42                 is set to "<code class="literal">none</code>" or "<code class="literal">-</code>",
  43                 the password has to be manually entered during system boot.
  44                 Otherwise, the field is interpreted as a absolute path to
  45                 a file containing the encryption password. For swap encryption,
  46                 <code class="filename">/dev/urandom</code> or the hardware
  47                 device <code class="filename">/dev/hw_random</code> can be used
  48                 as the password file; using
  49                 <code class="filename">/dev/random</code> may prevent boot
  50                 completion if the system does not have enough entropy
  51                 to generate a truly random encryption key.</p><p>The fourth field, if present, is a
  52                 comma-delimited list of options.  The following
  53                 options are recognized:</p><div class="variablelist"><dl class="variablelist"><dt id="discard"><span class="term"><code class="option">discard</code></span><a class="headerlink" title="Permalink to this term" href="#discard">¶</a></dt><dd><p>Allow discard requests to be
  54                                 passed through the encrypted block device. This
  55                                 improves performance on SSD storage but has
  56                                 security implications.</p></dd><dt id="cipher="><span class="term"><code class="option">cipher=</code></span><a class="headerlink" title="Permalink to this term" href="#cipher=">¶</a></dt><dd><p>Specifies the cipher to use. See
  57                                 <a href="cryptsetup.html"><span class="citerefentry"><span class="refentrytitle">cryptsetup</span>(8)</span></a>
  58                                 for possible values and the default value of
  59                                 this option. A cipher with unpredictable IV
  60                                 values, such as "<code class="literal">aes-cbc-essiv:sha256</code>",
  61                                 is recommended.</p></dd><dt id="hash="><span class="term"><code class="option">hash=</code></span><a class="headerlink" title="Permalink to this term" href="#hash=">¶</a></dt><dd><p>Specifies the hash to use for
  62                                 password hashing. See
  63                                 <a href="cryptsetup.html"><span class="citerefentry"><span class="refentrytitle">cryptsetup</span>(8)</span></a>
  64                                 for possible values and the default value of
  65                                 this option.</p></dd><dt id="keyfile-offset="><span class="term"><code class="option">keyfile-offset=</code></span><a class="headerlink" title="Permalink to this term" href="#keyfile-offset=">¶</a></dt><dd><p>Specifies the number of bytes to
  66                                 skip at the start of the key file. See
  67                                 <a href="cryptsetup.html"><span class="citerefentry"><span class="refentrytitle">cryptsetup</span>(8)</span></a>
  68                                 for possible values and the default value of
  69                                 this option.</p></dd><dt id="keyfile-size="><span class="term"><code class="option">keyfile-size=</code></span><a class="headerlink" title="Permalink to this term" href="#keyfile-size=">¶</a></dt><dd><p>Specifies the maximum number
  70                                 of bytes to read from the key file. See
  71                                 <a href="cryptsetup.html"><span class="citerefentry"><span class="refentrytitle">cryptsetup</span>(8)</span></a>
  72                                 for possible values and the default value of
  73                                 this option. This option is ignored in plain
  74                                 encryption mode, as the key file size is then
  75                                 given by the key size.</p></dd><dt id="key-slot="><span class="term"><code class="option">key-slot=</code></span><a class="headerlink" title="Permalink to this term" href="#key-slot=">¶</a></dt><dd><p>Specifies the key slot to
  76                                 compare the passphrase or key against.
  77                                 If the key slot does not match the given
  78                                 passphrase or key, but another would, the
  79                                 setup of the device will fail regardless.
  80                                 This option implies <code class="option">luks</code>. See
  81                                 <a href="cryptsetup.html"><span class="citerefentry"><span class="refentrytitle">cryptsetup</span>(8)</span></a>
  82                                 for possible values. The default is to try
  83                                 all key slots in sequential order.</p></dd><dt id="luks"><span class="term"><code class="option">luks</code></span><a class="headerlink" title="Permalink to this term" href="#luks">¶</a></dt><dd><p>Force LUKS mode. When this mode
  84                                 is used, the following options are ignored since
  85                                 they are provided by the LUKS header on the
  86                                 device: <code class="option">cipher=</code>,
  87                                 <code class="option">hash=</code>,
  88                                 <code class="option">size=</code>.</p></dd><dt id="noauto"><span class="term"><code class="option">noauto</code></span><a class="headerlink" title="Permalink to this term" href="#noauto">¶</a></dt><dd><p>This device will not be
  89                                 automatically unlocked on boot.</p></dd><dt id="nofail"><span class="term"><code class="option">nofail</code></span><a class="headerlink" title="Permalink to this term" href="#nofail">¶</a></dt><dd><p>The system will not wait for the
  90                                 device to show up and be unlocked at boot, and
  91                                 not fail the boot if it does not show up.</p></dd><dt id="plain"><span class="term"><code class="option">plain</code></span><a class="headerlink" title="Permalink to this term" href="#plain">¶</a></dt><dd><p>Force plain encryption mode.</p></dd><dt id="read-only"><span class="term"><code class="option">read-only</code>, </span><span class="term"><code class="option">readonly</code></span><a class="headerlink" title="Permalink to this term" href="#read-only">¶</a></dt><dd><p>Set up the encrypted block
  92                                 device in read-only mode.</p></dd><dt id="size="><span class="term"><code class="option">size=</code></span><a class="headerlink" title="Permalink to this term" href="#size=">¶</a></dt><dd><p>Specifies the key size
  93                                 in bits. See
  94                                 <a href="cryptsetup.html"><span class="citerefentry"><span class="refentrytitle">cryptsetup</span>(8)</span></a>
  95                                 for possible values and the default value of
  96                                 this option.</p></dd><dt id="swap"><span class="term"><code class="option">swap</code></span><a class="headerlink" title="Permalink to this term" href="#swap">¶</a></dt><dd><p>The encrypted block device will
  97                                 be used as a swap device, and will be formatted
  98                                 accordingly after setting up the encrypted
  99                                 block device, with
 100                                 <a href="http://man7.org/linux/man-pages/man8/mkswap.8.html"><span class="citerefentry"><span class="refentrytitle">mkswap</span>(8)</span></a>.
 101                                 This option implies <code class="option">plain</code>.</p><p>WARNING: Using the <code class="option">swap</code>
 102                                 option will destroy the contents of the named
 103                                 partition during every boot, so make sure the
 104                                 underlying block device is specified correctly.</p></dd><dt id="tcrypt"><span class="term"><code class="option">tcrypt</code></span><a class="headerlink" title="Permalink to this term" href="#tcrypt">¶</a></dt><dd><p>Use TrueCrypt encryption mode.
 105                                 When this mode is used, the following options are
 106                                 ignored since they are provided by the TrueCrypt
 107                                 header on the device or do not apply:
 108                                 <code class="option">cipher=</code>,
 109                                 <code class="option">hash=</code>,
 110                                 <code class="option">keyfile-offset=</code>,
 111                                 <code class="option">keyfile-size=</code>,
 112                                 <code class="option">size=</code>.</p><p>When this mode is used, the passphrase is
 113                                 read from the key file given in the third field.
 114                                 Only the first line of this file is read,
 115                                 excluding the new line character.</p><p>Note that the TrueCrypt format uses both
 116                                 passphrase and key files to derive a password
 117                                 for the volume. Therefore, the passphrase and
 118                                 all key files need to be provided. Use
 119                                 <code class="option">tcrypt-keyfile=</code> to provide
 120                                 the absolute path to all key files. When using
 121                                 an empty passphrase in combination with one or
 122                                 more key files, use "<code class="literal">/dev/null</code>"
 123                                 as the password file in the third field.</p></dd><dt id="tcrypt-hidden"><span class="term"><code class="option">tcrypt-hidden</code></span><a class="headerlink" title="Permalink to this term" href="#tcrypt-hidden">¶</a></dt><dd><p>Use the hidden TrueCrypt volume.
 124                                 This option implies <code class="option">tcrypt</code>.</p><p>This will map the hidden volume that is
 125                                 inside of the volume provided in the second
 126                                 field. Please note that there is no protection
 127                                 for the hidden volume if the outer volume is
 128                                 mounted instead. See
 129                                 <a href="cryptsetup.html"><span class="citerefentry"><span class="refentrytitle">cryptsetup</span>(8)</span></a>
 130                                 for more information on this limitation.</p></dd><dt id="tcrypt-keyfile="><span class="term"><code class="option">tcrypt-keyfile=</code></span><a class="headerlink" title="Permalink to this term" href="#tcrypt-keyfile=">¶</a></dt><dd><p>Specifies the absolute path to a
 131                                 key file to use for a TrueCrypt volume. This
 132                                 implies <code class="option">tcrypt</code> and can be
 133                                 used more than once to provide several key
 134                                 files.</p><p>See the entry for <code class="option">tcrypt</code>
 135                                 on the behavior of the passphrase and key files
 136                                 when using TrueCrypt encryption mode.</p></dd><dt id="tcrypt-system"><span class="term"><code class="option">tcrypt-system</code></span><a class="headerlink" title="Permalink to this term" href="#tcrypt-system">¶</a></dt><dd><p>Use TrueCrypt in system
 137                                 encryption mode. This option implies
 138                                 <code class="option">tcrypt</code>.</p></dd><dt id="timeout="><span class="term"><code class="option">timeout=</code></span><a class="headerlink" title="Permalink to this term" href="#timeout=">¶</a></dt><dd><p>Specifies the timeout for
 139                                 querying for a password. If no unit is
 140                                 specified, seconds is used. Supported units are
 141                                 s, ms, us, min, h, d. A timeout of 0 waits
 142                                 indefinitely (which is the default).</p></dd><dt id="x-systemd.device-timeout="><span class="term"><code class="option">x-systemd.device-timeout=</code></span><a class="headerlink" title="Permalink to this term" href="#x-systemd.device-timeout=">¶</a></dt><dd><p>Specifies how long
 143                                 systemd should wait for a device to
 144                                 show up before giving up on the
 145                                 entry. The argument is a time in
 146                                 seconds or explicitly specifified
 147                                 units of "<code class="literal">s</code>",
 148                                 "<code class="literal">min</code>",
 149                                 "<code class="literal">h</code>",
 150                                 "<code class="literal">ms</code>".
 151                                 </p></dd><dt id="tmp"><span class="term"><code class="option">tmp</code></span><a class="headerlink" title="Permalink to this term" href="#tmp">¶</a></dt><dd><p>The encrypted block device will
 152                                 be prepared for using it as <code class="filename">/tmp</code>;
 153                                 it will be formatted using
 154                                 <a href="http://man7.org/linux/man-pages/man8/mke2fs.8.html"><span class="citerefentry"><span class="refentrytitle">mke2fs</span>(8)</span></a>.
 155                                 This option implies <code class="option">plain</code>.</p><p>WARNING: Using the <code class="option">tmp</code>
 156                                 option will destroy the contents of the named
 157                                 partition during every boot, so make sure the
 158                                 underlying block device is specified correctly.</p></dd><dt id="tries="><span class="term"><code class="option">tries=</code></span><a class="headerlink" title="Permalink to this term" href="#tries=">¶</a></dt><dd><p>Specifies the maximum number of
 159                                 times the user is queried for a password.
 160                                 The default is 3. If set to 0, the user is
 161                                 queried for a password indefinitely.</p></dd><dt id="verify"><span class="term"><code class="option">verify</code></span><a class="headerlink" title="Permalink to this term" href="#verify">¶</a></dt><dd><p> If the encryption password is
 162                                 read from console, it has to be entered twice to
 163                                 prevent typos.</p></dd></dl></div><p>At early boot and when the system manager
 164                 configuration is reloaded, this file is translated into
 165                 native systemd units
 166                 by <a href="systemd-cryptsetup-generator.html"><span class="citerefentry"><span class="refentrytitle">systemd-cryptsetup-generator</span>(8)</span></a>.</p></div><div class="refsect1"><a name="idm140208007872128"></a><h2 id="Example">Example<a class="headerlink" title="Permalink to this headline" href="#Example">¶</a></h2><div class="example"><a name="idm140208007871488"></a><p class="title"><b>Example 1. /etc/crypttab example</b></p><div class="example-contents"><p>Set up four encrypted block devices. One using
 167                         LUKS for normal storage, another one for usage as a swap
 168                         device and two TrueCrypt volumes.</p><pre class="programlisting">luks       UUID=2505567a-9e27-4efe-a4d5-15ad146c258b
 169 swap       /dev/sda7       /dev/urandom             swap
 170 truecrypt  /dev/sda2       /etc/container_password  tcrypt
 171 hidden     /mnt/tc_hidden  /dev/null                tcrypt-hidden,tcrypt-keyfile=/etc/keyfile</pre></div></div><br class="example-break"></div><div class="refsect1"><a name="idm140208007869104"></a><h2 id="See Also">See Also<a class="headerlink" title="Permalink to this headline" href="#See%20Also">¶</a></h2><p>
 172                         <a href="systemd.html"><span class="citerefentry"><span class="refentrytitle">systemd</span>(1)</span></a>,
 173                         <a href="systemd-cryptsetup@.service.html"><span class="citerefentry"><span class="refentrytitle">systemd-cryptsetup@.service</span>(8)</span></a>,
 174                         <a href="systemd-cryptsetup-generator.html"><span class="citerefentry"><span class="refentrytitle">systemd-cryptsetup-generator</span>(8)</span></a>,
 175                         <a href="cryptsetup.html"><span class="citerefentry"><span class="refentrytitle">cryptsetup</span>(8)</span></a>,
 176                         <a href="http://man7.org/linux/man-pages/man8/mkswap.8.html"><span class="citerefentry"><span class="refentrytitle">mkswap</span>(8)</span></a>,
 177                         <a href="http://man7.org/linux/man-pages/man8/mke2fs.8.html"><span class="citerefentry"><span class="refentrytitle">mke2fs</span>(8)</span></a>
 178                 </p></div></div></body></html>