crypttab(5)
NAME
crypttab - static information about encrypted filesystems
DESCRIPTION
The file /etc/crypttab contains descriptive information about encrypted filesystems. crypttab is only read by programs (e.g. cryptdisks_start and cryptdisks_stop), and not written; it is the duty of the system administrator to properly create and maintain this file. Each filesystem is described on a separate line; fields on each line are separated by tabs or spaces. Lines starting with "#" are comments, empty lines are ignored. The order of records in crypttab is important because the init scripts sequentially iterate through crypttab doing their thing. The first field, target, describes the mapped device name. It must be a plain filename without any directory components. A mapped device which encrypts/decrypts data to/from the source device will be created at /dev/mapper/target by cryptsetup. The second field, source device, describes either the block special device or file that contains the encrypted data. Instead of giving the source device explicitly, the UUID is supported as well, using UUID=<luks_uuid>. The third field, key file, describes the file to use as a key for decrypting the data of the source device. Note that the entire key file will be used as the passphrase; the passphrase must not be followed by a newline character. It can also be a device name (e.g. /dev/urandom), note however that LUKS requires a persistent key and therefore does not support random data keys. If the key file is the string "none", a passphrase will be read interactively from the console. In this case, the options precheck, check, checkargs and tries may be useful. The fourth field, options, describes the cryptsetup options associated with the encryption process. At minimum, the field should contain either the string luks respectively tcrypt or the cipher, hash and size options. Options are in the format: key=value [,key=value ...]. The supported options are described below. Note that all four fields are mandatory and that a missing field will lead to unspecified behaviour.
OPTIONS
cipher=<cipher>
Encryption algorithm (ignored for LUKS and TCRYPT devices). See
cryptsetup -c.
size=<size>
Encryption key size (ignored for LUKS and TCRYPT devices). See
cryptsetup -s.
hash=<hash>
Hash algorithm (ignored for LUKS and TCRYPT devices). See
cryptsetup -h.
offset=<offset>
Start offset (ignored for LUKS and TCRYPT devices). Uses cryptsetup
-o.
skip=<skip>
Skip sectors at the beginning (ignored for LUKS and TCRYPT
devices). Uses cryptsetup -p.
verify
Verify password. Uses cryptsetup -y.
readonly
The backing device is read-only (eg: a dvd).
discard
Allow using of discards (TRIM) requests for device.
WARNING: Assess the specific security risks carefully before
enabling this option. For example, allowing discards on encrypted
devices may lead to the leak of information about the ciphertext
device (filesystem type, used space etc.) if the discarded blocks
can be located easily on the device later.
Kernel version 3.1 or more recent is required. For older versions
is the option ignored.
luks
Use device with LUKS extensions.
tcrypt
Use device with TCRYPT extensions.
veracrypt
Use VeraCrypt extension to TCRYPT device. Only useful in
conjunction with tcrypt option (ignored for non-TCRYPT devices).
swap
Run mkswap on the created device.
tmp=<tmpfs>
Run mkfs with filesystem type <tmpfs> on the created device.
Default is ext4.
precheck=<precheck>
Check the content of the source device by a suitable program; if
the check fails, the device is not created. If a program is
provided as an argument, it is run, giving the source device as
argument. Cryptdisks/cryptroot searches for the given progam in
/lib/cryptsetup/checks/ first, but full path to program is
supported as well.
Prechecks aren't invoked for LUKS devices, as these are checked
with isLuks anyway. Default for plain dm-crypt devices is set in
/etc/default/cryptdisks, or un_blkid otherwise. Set to /bin/true in
order to disable precheck for plain dm-crypt device.
check=<check>
Check the content of the target device by a suitable program; if
the check fails, the device is removed. If a program is provided as
an argument, it is run, giving the decrypted volume (target device)
as first argument, and the value of the checkargs option as second
argument. Cryptdisks/cryptroot searches for the given program in
/lib/cryptsetup/checks/ first, but full path to program is
supported as well.
Default is set in /etc/default/cryptdisks (blkid).
checkargs=<arguments>
Give <arguments> as the second argument to the check script. See
the CHECKSCRIPTS section for more information.
tries=<num>
The input of the passphrase is tried <num> times in case of
failure. If you want to disable retries, pass "tries=1". Default is
3. Setting "tries=0" will ask for the passphrase until a correct
one has been submitted (infinitive retries).
initramfs
The initramfs hook processes the root device, any resume devices
and any devices with the initramfs option set. These devices are
processed within the initramfs stage of boot. As an example, that
allows the use of remote unlocking using dropbear.
noearly
The cryptsetup init scripts are invoked twice during the boot
process - once before lvm, raid, etc. are started and once again
after that. Sometimes you need to start your encrypted disks in a
special order. With this option the device is ignored during the
first invocation of the cryptsetup init scripts.
noauto
Entirely ignore the device at the boot process. It's still possible
to map the device manually using cryptdisks_start.
loud
Be loud. Print warnings if a device does not exist. This option
overwrites the option quiet.
quiet
Be quiet. Don't print warnings if a device does not exist. This
option overwrites the option loud.
keyscript=<path>
The executable at the indicated path is executed with the key file
from the third field of the crypttab as its only argument and the
output is used as the key. This also works with encrypted root
filesystems via initramfs if the executable is self-contained (i.e.
an executable which does not rely on any external program which is
not present in the initramfs environment).
LIMITATIONS: All binaries and files on which the keyscript depends
must be available at the time of execution. Special care needs to
be taken for encrypted filesystems like /usr or /var. As an
example, unlocking encrypted /usr must not depend on binaries from
/usr/(s)bin.
All fields of the appropriate crypttab entry are available to the
keyscript as exported environment variables:
CRYPTTAB_NAME
The target name
CRYPTTAB_SOURCE
The source device
CRYPTTAB_KEY
The key file
CRYPTTAB_TRIED
Number of previous tries since start of cryptdisks (counts
until maximum number of tries is reached).
CRYPTTAB_OPTIONS
A list of exported crypttab options
CRYPTTAB_OPTION_<option>
The value of the appropriate crypttab option, with value set to
'yes' in case the option is merely a flag.
keyslot=<slot>
Key slot (ignored for non-LUKS devices). See cryptsetup -S.
header=<path>
Detached header file (ignored for plain dm-crypt devices). See
cryptsetup --header.
tcrypthidden
Use hidden TCRYPT header (ignored for non-TCRYPT devices).
CHECKSCRIPTS
blkid
Checks for any known filesystem. Supports a filesystem type as
argument via <checkargs>:
* no checkargs - succeeds if any valid filesystem is found on the
device.
* "none" - succeeds if no valid filesystem is found on the
device.
* "ext4" [or another filesystem type like xfs, swap, crypto_LUKS,
...] - succeeds if ext4 filesystem is found on the device.
un_blkid
Checks for no known filesystem. Supports a filesystem type as
argument via <checkargs>:
* no checkargs - succeeds if no valid filesystem is found on the
device.
* "ext4" [or another filesystem type like xfs, swap, crypto_LUKS,
...] - succeeds if no ext4 filesystem is found on the device.
EXAMPLES
# Encrypted swap device
cswap /dev/sda6 /dev/urandom cipher=aes-xts-plain64,size=256,hash=sha1,swap
# Encrypted LUKS disk with interactive password, identified by UUID
cdisk0 UUID=12345678-9abc-def012345-6789abcdef01 none luks
# Encrypted TCRYPT disk with interactive password
tdisk0 /dev/sr0 none tcrypt
# Encrypted ext4 disk with interactive password
# - retry 5 times if the check fails
cdisk1 /dev/sda2 none cipher=aes-xts-plain64,size=256,hash=sha1,checkargs=ext4,tries=5
# Encrypted disk with interactive password
# - use a nondefault check script
# - no retries
cdisk2 /dev/sdc1 none cipher=aes-xts-plain64,size=256,hash=sha1,check=customscript,tries=1
# Encrypted disk with interactive password
# - Twofish as the cipher, RIPEMD-160 as the hash
cdisk3 /dev/sda3 none cipher=twofish,size=256,hash=ripemd160
ENVIRONMENT
CRYPTDISKS_ENABLE
Set to yes to run cryptdisks initscripts at startup. Set to no to
disable cryptdisks initscripts. Default is yes.
CRYPTDISKS_MOUNT
Specifies the mountpoints that are mounted before cryptdisks is
invoked. Takes mountpoints configured in /etc/fstab as arguments.
Separate mountpoints by space. This is useful for keys on removable
devices, such as cdrom, usbstick, flashcard, etc. Default is unset.
CRYPTDISKS_CHECK
Specifies the default checkscript to be run against the target
device, after cryptdisks has been invoked. The target device is
passed as the first and only argument to the checkscript. Takes
effect if the check option is given in crypttab with no value. See
documentation for check option above for more information.
CRYPTDISKS_PRECHECK
Specifies the default checkscript to be run against the source
dm-crypt device, before cryptdisks has been invoked. The source
device is given as the first and only argument to the checkscript.
Takes effect if the precheck option is given in crypttab with no
value. See documentation for precheck option above for more
information.
KNOWN UPGRADE ISSUES
The upstream defaults for encryption cipher, hash and keysize have changed several times in the past, and they're expected to change again in future, for example if security issues arise. On LUKS devices, the used settings are stored in the LUKS header, and thus don't need to be configured in /etc/crypttab. For plain dm-crypt devices, no information about used cipher, hash and keysize are available at all. Therefore we strongly suggest to configure the cipher, hash and keysize in /etc/crypttab for plain dm-crypt devices, even if they match the current default.
SEE ALSO
cryptsetup(8), cryptdisks_start(8), cryptdisks_stop(8)
AUTHOR
This manual page was originally written by Bastian Kleineidam <calvin@debian.org> for the Debian distribution of cryptsetup. It has been further improved by Michael Gebetsroither <michael.geb@gmx.at>, Jonas Meurer <jonas@freesources.org> and David Hrdeman <david@hardeman.nu>.
Opportunity
Personal Opportunity - Free software gives you access to billions of dollars of software at no cost. Use this software for your business, personal use or to develop a profitable skill. Access to source code provides access to a level of capabilities/information that companies protect though copyrights. Open source is a core component of the Internet and it is available to you. Leverage the billions of dollars in resources and capabilities to build a career, establish a business or change the world. The potential is endless for those who understand the opportunity.
Business Opportunity - Goldman Sachs, IBM and countless large corporations are leveraging open source to reduce costs, develop products and increase their bottom lines. Learn what these companies know about open source and how open source can give you the advantage.
Free Software
Free Software provides computer programs and capabilities at no cost but more importantly, it provides the freedom to run, edit, contribute to, and share the software. The importance of free software is a matter of access, not price. Software at no cost is a benefit but ownership rights to the software and source code is far more significant.
Free Office Software - The Libre Office suite provides top desktop productivity tools for free. This includes, a word processor, spreadsheet, presentation engine, drawing and flowcharting, database and math applications. Libre Office is available for Linux or Windows.
Free Books
The Free Books Library is a collection of thousands of the most popular public domain books in an online readable format. The collection includes great classical literature and more recent works where the U.S. copyright has expired. These books are yours to read and use without restrictions.
Source Code - Want to change a program or know how it works? Open Source provides the source code for its programs so that anyone can use, modify or learn how to write those programs themselves. Visit the GNU source code repositories to download the source.
Education
Study at Harvard, Stanford or MIT - Open edX provides free online courses from Harvard, MIT, Columbia, UC Berkeley and other top Universities. Hundreds of courses for almost all major subjects and course levels. Open edx also offers some paid courses and selected certifications.
Linux Manual Pages - A man or manual page is a form of software documentation found on Linux/Unix operating systems. Topics covered include computer programs (including library and system calls), formal standards and conventions, and even abstract concepts.
