NAME

crypttab - static information about encrypted filesystems

DESCRIPTION

The file /etc/crypttab contains descriptive information about encrypted filesystems. crypttab is only read by programs (e.g. cryptdisks_start and cryptdisks_stop), and not written; it is the duty of the system administrator to properly create and maintain this file. Each filesystem is described on a separate line; fields on each line are separated by tabs or spaces. Lines starting with “#” are comments, empty lines are ignored. The order of records in crypttab is important because the init scripts sequentially iterate through crypttab doing their thing.

The first field, target, describes the mapped device name. It must be a plain filename without any directory components. A mapped device which encrypts/decrypts data to/from the source device will be created at /dev/mapper/target by cryptsetup.

The second field, source device, describes either the block special device or file that contains the encrypted data. Instead of giving the source device explicitly, the UUID (resp. LABEL, PARTUUID and PARTLABEL) is supported as well, using “UUID=<uuid>” (resp. “LABEL=<label>”, “PARTUUID=<partuuid>” and “PARTLABEL=<partlabel>”).

The third field, key file, describes the file to use as a key for decrypting the data of the source device. In case of a keyscript, the value of this field is given as argument to the keyscript. Values with spaces and special characters need to be escaped using octal sequences, like for fstab(5). Note that the entire key file will be used as the passphrase; the passphrase must not be followed by a newline character.

It can also be a device name (e.g. /dev/urandom), note however that LUKS requires a persistent key and therefore does not support random data keys.

If the key file is the string none, a passphrase will be read interactively from the console. In this case, the options check, checkargs and tries may be useful.

The fourth field, options, describes the cryptsetup options associated with the encryption process. At minimum, the field should contain either the string luks respectively tcrypt or the cipher, hash and size options. Some options can be changed on active devices using cryptsetup refresh [<options>] <name>. Moreover some options can be permanently written to the metada of LUKS2 headers using the --persistent option flag.

Options are in the format: key=value [,key=value ...]. The supported options are described below.

Note that all four fields are mandatory and that a missing field will lead to unspecified behaviour.

ON DIFFERENT CRYPTTAB FORMATS

Please note that there are several independent cryptsetup wrappers with their own crypttab format. This manpage covers Debian's implementation for initramfs scripts and SysVinit init scripts. systemd brings its own crypttab implementation. We try to cover the differences between the systemd and our implementation in this manpage, but if in doubt, better check the systemd crypttab(5) manpage, e.g. online at https://www.freedesktop.org/software/systemd/man/crypttab.html.

OPTIONS

cipher=<cipher>

size=<size>

sector-size=<bytes>

hash=<hash>

offset=<offset>

skip=<skip>

keyfile-offset=<keyfile-offset>

keyfile-size=<keyfile-size>

keyslot=<slot>, key-slot=<slot>

header=<path>

verify

readonly, read-only

tries=<num>

discard

luks

plain

tcrypt

veracrypt, tcrypt-veracrypt

tcrypthidden, tcrypt-hidden

swap

tmp=<tmpfs>

check=<check>

checkargs=<arguments>

initramfs

noearly

noauto

loud

quiet

keyscript=<path>

CHECKSCRIPTS

blkid

un_blkid

EXAMPLES

# Encrypted swap device
cswap /dev/sda6 /dev/urandom cipher=aes-xts-plain64,size=256,hash=sha1,swap
# Encrypted LUKS disk with interactive password, identified by its UUID, discard enabled
cdisk0 UUID=12345678-9abc-def012345-6789abcdef01 none luks,discard
# Encrypted TCRYPT disk with interactive password, discard enabled
tdisk0 /dev/sr0 none tcrypt,discard
# Encrypted ext4 disk with interactive password, discard enabled
# - retry 5 times if the check fails
cdisk1 /dev/sda2 none discard,cipher=aes-xts-plain64,size=256,hash=sha1,checkargs=ext4,tries=5
# Encrypted disk with interactive password, discard enabled
# - use a nondefault check script
# - no retries
cdisk2 /dev/sdc1 none discard,cipher=aes-xts-plain64,size=256,hash=sha1,check=customscript,tries=1
# Encrypted disk with interactive password, discard enabled
# - Twofish as the cipher, RIPEMD-160 as the hash
cdisk3 /dev/sda3 none dscard,cipher=twofish,size=256,hash=ripemd160


   

ENVIRONMENT

CRYPTDISKS_ENABLE

CRYPTDISKS_MOUNT

CRYPTDISKS_CHECK

KNOWN UPGRADE ISSUES

The upstream defaults for encryption cipher, hash and keysize have changed several times in the past, and they're expected to change again in future, for example if security issues arise. On LUKS devices, the used settings are stored in the LUKS header, and thus don't need to be configured in /etc/crypttab. For plain dm-crypt devices, no information about used cipher, hash and keysize are available at all. Therefore we strongly suggest to configure the cipher, hash and keysize in /etc/crypttab for plain dm-crypt devices, even if they match the current default.

SEE ALSO

cryptsetup(8), cryptdisks_start(8), cryptdisks_stop(8)

AUTHOR

This manual page was originally written by Bastian Kleineidam <calvin@debian.org> for the Debian distribution of cryptsetup. It has been further improved by Michael Gebetsroither <michael.geb@gmx.at>, David Härdeman <david@hardeman.nu> and Jonas Meurer <jonas@freesources.org>.