{
    "content": [
        {
            "type": "text",
            "text": "# SYSTEMD-CRYPTSETUP-GENERATOR(8) (man)\n\n**Summary:** systemd-cryptsetup-generator - Unit generator for /etc/crypttab\n\n**Synopsis:** /lib/systemd/system-generators/systemd-cryptsetup-generator\n\n## See Also\n\n- systemd(1)\n- crypttab(5)\n- .service(8)\n- systemd-cryptenroll(1)\n- cryptsetup(8)\n- systemd-fstab-generator(8)\n\n## Section Outline\n\n- **NAME** (2 lines)\n- **SYNOPSIS** (2 lines)\n- **DESCRIPTION** (6 lines)\n- **KERNEL COMMAND LINE** (103 lines)\n- **SEE ALSO** (6 lines)\n\n## Full Content\n\n### NAME\n\nsystemd-cryptsetup-generator - Unit generator for /etc/crypttab\n\n### SYNOPSIS\n\n/lib/systemd/system-generators/systemd-cryptsetup-generator\n\n### DESCRIPTION\n\nsystemd-cryptsetup-generator is a generator that translates /etc/crypttab into native systemd\nunits early at boot and when configuration of the system manager is reloaded. This will\ncreate systemd-cryptsetup@.service(8) units as necessary.\n\nsystemd-cryptsetup-generator implements systemd.generator(7).\n\n### KERNEL COMMAND LINE\n\nsystemd-cryptsetup-generator understands the following kernel command line parameters:\n\nluks=, rd.luks=\nTakes a boolean argument. Defaults to \"yes\". If \"no\", disables the generator entirely.\nrd.luks= is honored only by initial RAM disk (initrd) while luks= is honored by both the\nmain system and the initrd.\n\nluks.crypttab=, rd.luks.crypttab=\nTakes a boolean argument. Defaults to \"yes\". If \"no\", causes the generator to ignore any\ndevices configured in /etc/crypttab (luks.uuid= will still work however).\nrd.luks.crypttab= is honored only by initial RAM disk (initrd) while luks.crypttab= is\nhonored by both the main system and the initrd.\n\nluks.uuid=, rd.luks.uuid=\nTakes a LUKS superblock UUID as argument. This will activate the specified device as part\nof the boot process as if it was listed in /etc/crypttab. This option may be specified\nmore than once in order to set up multiple devices.  rd.luks.uuid= is honored only by\ninitial RAM disk (initrd) while luks.uuid= is honored by both the main system and the\ninitrd.\n\nIf /etc/crypttab contains entries with the same UUID, then the name, keyfile and options\nspecified there will be used. Otherwise, the device will have the name \"luks-UUID\".\n\nIf /etc/crypttab exists, only those UUIDs specified on the kernel command line will be\nactivated in the initrd or the real root.\n\nluks.name=, rd.luks.name=\nTakes a LUKS super block UUID followed by an \"=\" and a name. This implies rd.luks.uuid=\nor luks.uuid= and will additionally make the LUKS device given by the UUID appear under\nthe provided name.\n\nThis parameter is the analogue of the first crypttab(5) field volume-name.\n\nrd.luks.name= is honored only by initial RAM disk (initrd) while luks.name= is honored by\nboth the main system and the initrd.\n\nluks.data=, rd.luks.data=\nTakes a LUKS super block UUID followed by a \"=\" and a block device specification for\ndevice hosting encrypted data.\n\nFor those entries specified with rd.luks.uuid= or luks.uuid=, the data device will be set\nto the one specified by rd.luks.data= or luks.data= of the corresponding UUID.\n\nLUKS data device parameter is useful for specifying encrypted data devices with detached\nheaders specified in luks.options entry containing \"header=\" argument. For example,\nrd.luks.uuid=b40f1abf-2a53-400a-889a-2eccc27eaa40\nrd.luks.options=b40f1abf-2a53-400a-889a-2eccc27eaa40=header=/path/to/luks.hdr\nrd.luks.data=b40f1abf-2a53-400a-889a-2eccc27eaa40=/dev/sdx. Hence, in this case, we will\nattempt to unlock LUKS device assembled from data device \"/dev/sdx\" and LUKS header\n(metadata) put in \"/path/to/luks.hdr\" file. This syntax is for now only supported on a\nper-device basis, i.e. you have to specify LUKS device UUID.\n\nThis parameter is the analogue of the second crypttab(5) field encrypted-device.\n\nrd.luks.data= is honored only by initial RAM disk (initrd) while luks.data= is honored by\nboth the main system and the initrd.\n\nluks.key=, rd.luks.key=\nTakes a password file name as argument or a LUKS super block UUID followed by a \"=\" and a\npassword file name.\n\nFor those entries specified with rd.luks.uuid= or luks.uuid=, the password file will be\nset to the one specified by rd.luks.key= or luks.key= of the corresponding UUID, or the\npassword file that was specified without a UUID.\n\nIt is also possible to specify an external device which should be mounted before we\nattempt to unlock the LUKS device. systemd-cryptsetup will use password file stored on\nthat device. Device containing password file is specified by appending colon and a device\nidentifier to the password file path. For example,\nrd.luks.uuid=b40f1abf-2a53-400a-889a-2eccc27eaa40\nrd.luks.key=b40f1abf-2a53-400a-889a-2eccc27eaa40=/keyfile:LABEL=keydev. Hence, in this\ncase, we will attempt to mount file system residing on the block device with label\n\"keydev\". This syntax is for now only supported on a per-device basis, i.e. you have to\nspecify LUKS device UUID.\n\nThis parameter is the analogue of the third crypttab(5) field key-file.\n\nrd.luks.key= is honored only by initial RAM disk (initrd) while luks.key= is honored by\nboth the main system and the initrd.\n\nluks.options=, rd.luks.options=\nTakes a LUKS super block UUID followed by an \"=\" and a string of options separated by\ncommas as argument. This will override the options for the given UUID.\n\nIf only a list of options, without an UUID, is specified, they apply to any UUIDs not\nspecified elsewhere, and without an entry in /etc/crypttab.\n\nThis parameter is the analogue of the fourth crypttab(5) field options.\n\nIt is possible to specify an external device which should be mounted before we attempt to\nunlock the LUKS device. systemd-cryptsetup will assemble LUKS device by combining data\ndevice specified in luks.data with detached LUKS header found in \"header=\" argument. For\nexample, rd.luks.uuid=b40f1abf-2a53-400a-889a-2eccc27eaa40\nrd.luks.options=b40f1abf-2a53-400a-889a-2eccc27eaa40=header=/luks.hdr:LABEL=hdrdev\nrd.luks.data=b40f1abf-2a53-400a-889a-2eccc27eaa40=/dev/sdx. Hence, in this case, we will\nattempt to mount file system residing on the block device with label \"hdrdev\", and look\nfor \"luks.hdr\" on that file system. Said header will be used to unlock (decrypt)\nencrypted data stored on /dev/sdx. This syntax is for now only supported on a per-device\nbasis, i.e. you have to specify LUKS device UUID.\n\nrd.luks.options= is honored only by initial RAM disk (initrd) while luks.options= is\nhonored by both the main system and the initrd.\n\n### SEE ALSO\n\nsystemd(1), crypttab(5), systemd-cryptsetup@.service(8), systemd-cryptenroll(1),\ncryptsetup(8), systemd-fstab-generator(8)\n\n\n\nsystemd 249                                                          SYSTEMD-CRYPTSETUP-GENERATOR(8)\n\n"
        }
    ],
    "structuredContent": {
        "command": "SYSTEMD-CRYPTSETUP-GENERATOR",
        "section": "8",
        "mode": "man",
        "summary": "systemd-cryptsetup-generator - Unit generator for /etc/crypttab",
        "synopsis": "/lib/systemd/system-generators/systemd-cryptsetup-generator",
        "flags": [],
        "examples": [],
        "see_also": [
            {
                "name": "systemd",
                "section": "1",
                "url": "https://www.chedong.com/phpMan.php/man/systemd/1/json"
            },
            {
                "name": "crypttab",
                "section": "5",
                "url": "https://www.chedong.com/phpMan.php/man/crypttab/5/json"
            },
            {
                "name": ".service",
                "section": "8",
                "url": "https://www.chedong.com/phpMan.php/man/.service/8/json"
            },
            {
                "name": "systemd-cryptenroll",
                "section": "1",
                "url": "https://www.chedong.com/phpMan.php/man/systemd-cryptenroll/1/json"
            },
            {
                "name": "cryptsetup",
                "section": "8",
                "url": "https://www.chedong.com/phpMan.php/man/cryptsetup/8/json"
            },
            {
                "name": "systemd-fstab-generator",
                "section": "8",
                "url": "https://www.chedong.com/phpMan.php/man/systemd-fstab-generator/8/json"
            }
        ],
        "section_outline": [
            {
                "name": "NAME",
                "lines": 2,
                "subsections": []
            },
            {
                "name": "SYNOPSIS",
                "lines": 2,
                "subsections": []
            },
            {
                "name": "DESCRIPTION",
                "lines": 6,
                "subsections": []
            },
            {
                "name": "KERNEL COMMAND LINE",
                "lines": 103,
                "subsections": []
            },
            {
                "name": "SEE ALSO",
                "lines": 6,
                "subsections": []
            }
        ]
    }
}