{
    "content": [
        {
            "type": "text",
            "text": "# crypttab(5) (man)\n\n**Summary:** crypttab - static information about encrypted filesystems\n\n## Examples\n\n- `# Encrypted swap device`\n- `cswap /dev/sda6 /dev/urandom plain,cipher=aes-xts-plain64,size=256,hash=sha1,swap`\n- `# Encrypted LUKS disk with interactive password, identified by its UUID, discard enabled`\n- `cdisk0 UUID=12345678-9abc-def012345-6789abcdef01 none luks,discard`\n- `# Encrypted TCRYPT disk with interactive password, discard enabled`\n- `tdisk0 /dev/sr0 none tcrypt,discard`\n- `# Encrypted ext4 disk with interactive password, discard enabled`\n- `# - retry 5 times if the check fails`\n- `cdisk1 /dev/sda2 none plain,cipher=aes-xts-plain64,size=256,hash=sha1,check,checkargs=ext4,tries=5,discard`\n- `# Encrypted disk with interactive password, discard enabled`\n- `# - use a nondefault check script`\n- `# - no retries`\n- `cdisk2 /dev/sdc1 none plain,cipher=aes-xts-plain64,size=256,hash=sha1,check=customscript,tries=1,discard`\n- `# Encrypted disk with interactive password, discard enabled`\n- `# - Twofish as the cipher, RIPEMD-160 as the hash`\n- `cdisk3 /dev/sda3 none plain,cipher=twofish,size=256,hash=ripemd160,discard`\n\n## See Also\n\n- cryptsetup(8)\n- cryptdisksstart(8)\n- cryptdisksstop(8)\n\n## Section Outline\n\n- **NAME** (2 lines)\n- **DESCRIPTION** (42 lines)\n- **ON DIFFERENT CRYPTTAB FORMATS** (7 lines)\n- **OPTIONS** (206 lines)\n- **CHECKSCRIPTS** (18 lines)\n- **EXAMPLES** (24 lines)\n- **ENVIRONMENT** (16 lines)\n- **KNOWN UPGRADE ISSUES** (8 lines)\n- **SEE ALSO** (3 lines)\n- **AUTHOR** (8 lines)\n\n## Full Content\n\n### NAME\n\ncrypttab - static information about encrypted filesystems\n\n### DESCRIPTION\n\nThe file /etc/crypttab contains descriptive information about encrypted devices. crypttab is\nonly read by programs (e.g. cryptdisksstart and cryptdisksstop), and not written; it is the\nduty of the system administrator to properly create and maintain this file. crypttab entries\nare treated sequentially, so their order matters (dependencies need to listed first).\n\nEach encrypted device is described on a separate line. Fields on each line are separated by\ntabs or spaces. Lines starting with '#' are comments, and blank lines are ignored. Octal\nsequences \\0num within a field are decoded, which can be used for values containing spaces or\nspecial characters. A backslash which doesn't start an octal sequence yields undefined\nbehavior.\n\nThe first field, target, describes the mapped device name. It must be a plain filename\nwithout any directory components. A mapped device which encrypts/decrypts data to/from the\nsource device will be created at /dev/mapper/target by cryptsetup.\n\nThe second field, source device, describes either the block special device or file that\ncontains the encrypted data. Instead of giving the source device explicitly, the UUID (resp.\nLABEL, PARTUUID and PARTLABEL) is supported as well, using “UUID=<uuid>” (resp.\n“LABEL=<label>”, “PARTUUID=<partuuid>” and “PARTLABEL=<partlabel>”).\n\nThe third field, key file, describes the file to use as a key for decrypting the data of the\nsource device. In case of a keyscript, the value of this field is given as argument to the\nkeyscript. Note that the entire key file will be used as the passphrase; the passphrase must\nnot be followed by a newline character.\n\nIt can also be a device name (e.g. /dev/urandom), note however that LUKS requires a\npersistent key and therefore does not support random data keys.\n\nIf the key file is the string none, a passphrase will be read interactively from the console.\nIn this case, the options check, checkargs and tries may be useful.\n\nThe fourth field, options, is an optional comma-separated list of options and/or flags\ndescribing the device type (luks, tcrypt, bitlk, or plain which is also the default) and\ncryptsetup options associated with the encryption process. The supported options are\ndescribed below. For plain dm-crypt devices the cipher, hash and size options are required.\nSome options can be changed on active mappings using cryptsetup refresh [<options>] <name>.\nFurthermore some options can be permanently written into metadata of LUKS2 headers using\ncryptsetup's --persistent flag.\n\nNote that the first three fields are required and that a missing field will lead to\nunspecified behaviour.\n\n### ON DIFFERENT CRYPTTAB FORMATS\n\nPlease note that there are several independent cryptsetup wrappers with their own crypttab\nformat. This manpage covers Debian's implementation for initramfs scripts and SysVinit init\nscripts. systemd brings its own crypttab implementation. We try to cover the differences\nbetween the systemd and our implementation in this manpage, but if in doubt, better check the\nsystemd crypttab(5) manpage, e.g. online at\nhttps://www.freedesktop.org/software/systemd/man/crypttab.html.\n\n### OPTIONS\n\ncipher=<cipher>\nEncryption algorithm (ignored for LUKS and TCRYPT devices). See cryptsetup -c.\n\nsize=<size>\nEncryption key size (ignored for LUKS and TCRYPT devices). See cryptsetup -s.\n\nsector-size=<bytes>\nSector size. See cryptsetup(8) for possible values and the default value of this option.\n\nhash=<hash>\nHash algorithm (ignored for LUKS and TCRYPT devices). See cryptsetup -h.\n\noffset=<offset>\nStart offset (ignored for LUKS and TCRYPT devices). Uses cryptsetup -o.\n\nskip=<skip>\nSkip sectors at the beginning (ignored for LUKS and TCRYPT devices). Uses cryptsetup -p.\n\nkeyfile-offset=<keyfile-offset>\nSpecifies the number of bytes to skip at the start of the key file.\n\nkeyfile-size=<keyfile-size>\nSpecifies the maximum number of bytes to read from the key file. The default is to read\nthe whole file up to the compiled-in maximum, that can be queried with cryptsetup --help.\nThis option is ignored for plain dm-crypt devices, as the key file size is then given by\nthe encryption key size (option size).\n\nkeyslot=<slot>, key-slot=<slot>\nKey slot (ignored for non-LUKS devices). See cryptsetup -S.\n\nheader=<path>\nDetached header file (ignored for plain dm-crypt devices). See cryptsetup --header.\n\nverify\nVerify password. Uses cryptsetup -y.\n\nreadonly, read-only\nSet up a read-only mapping.\n\ntries=<num>\nTry to unlock the device <num> before failing. It's particularly useful when using a\npassphrase or a keyscript that asks for interactive input. If you want to disable\nretries, pass “tries=1”. Default is “3”. Setting “tries=0” means infinitive retries.\n\ndiscard\nAllow using of discards (TRIM) requests for device.\n\nStarting with Debian 10 (Buster), this option is added per default to new dm-crypt\ndevices by the Debian Installer. If you don't care about leaking access patterns\n(filesystem type, used space) and don't have hidden truecrypt volumes inside this volume,\nthen it should be safe to enable this option. See the following warning for further\ninformation.\n\nWARNING: Assess the specific security risks carefully before enabling this option. For\nexample, allowing discards on encrypted devices may lead to the leak of information about\nthe ciphertext device (filesystem type, used space etc.) if the discarded blocks can be\nlocated easily on the device later.\n\nluks\nForce LUKS mode. When this mode is used, the following options are ignored since they are\nprovided by the LUKS header on the device: cipher=, hash=, size=\n\nplain\nForce plain encryption mode.\n\nbitlk\nForce BITLK (Windows BitLocker-compatible) mode. WARNING: crypttab support is currently\nexperimental.\n\ntcrypt\nUse TrueCrypt encryption mode. When this mode is used, the following options are ignored\nsince they are provided by the TrueCrypt header on the device or do not apply: cipher=,\nhash=, keyfile-offset=, keyfile-size=, size=\n\nveracrypt, tcrypt-veracrypt\nUse VeraCrypt extension to TrueCrypt device. Only useful in conjunction with tcrypt\noption (ignored for non-TrueCrypt devices).\n\ntcrypthidden, tcrypt-hidden\nUse hidden TCRYPT header (ignored for non-TCRYPT devices).\n\nsame-cpu-crypt\nPerform encryption using the same cpu that IO was submitted on.\n\nsubmit-from-crypt-cpus\nDisable offloading writes to a separate thread after encryption.\n\nno-read-workqueue, no-write-workqueue\nBypass dm-crypt internal workqueue and process read or write requests synchronously.\n\nswap\nRun mkswap on the created device.\n\nThis option is ignored for initramfs devices.\n\ntmp[=<tmpfs>]\nRun mkfs with filesystem type <tmpfs> (or ext4 if omitted) on the created device.\n\nThis option is ignored for initramfs devices.\n\ncheck[=<check>]\nCheck the content of the target device by a suitable program; if the check fails, the\ndevice is closed immediately. The program is being run with decrypted volume (target\ndevice) as first positional argument and, if the checkargs option is used, its value as\nsecond argument. See the CHECKSCRIPTS section for more information.\n\nThe program is either specified by full path or relative to /lib/cryptsetup/checks/. If\nomitted, then the value of $CRYPTDISKSCHECK set in /etc/default/cryptdisks is used\n(blkid by default).\n\nThis option is specific to the Debian crypttab format. It's not supported by systemd.\n\ncheckargs=<arguments>\nGive <arguments> as the second argument to the check script. See the CHECKSCRIPTS section\nfor more information.\n\nThis option is specific to the Debian crypttab format. It's not supported by systemd.\n\ninitramfs\nThe initramfs hook processes the root device, any resume devices and any devices with the\ninitramfs option set. These devices are processed within the initramfs stage of boot. As\nan example, that allows the use of remote unlocking using dropbear.\n\nThis option is specific to the Debian crypttab format. It's not supported by systemd.\n\nnoearly\nThe cryptsetup init scripts are invoked twice during the boot process - once before lvm,\nraid, etc. are started and once again after that. Sometimes you need to start your\nencrypted disks in a special order. With this option the device is ignored during the\nfirst invocation of the cryptsetup init scripts.\n\nThis option is ignored for initramfs devices and specific to the Debian crypttab format.\nIt's not supported by systemd.\n\nnoauto\nEntirely ignore the device at the boot process. It's still possible to map the device\nmanually using cryptdisksstart.\n\nThis option is ignored for initramfs devices and specific to the Debian crypttab format.\nIt's not supported by systemd.\n\nloud\nBe loud. Print warnings if a device does not exist. This option overrides the option\nquiet.\n\nThis option is ignored for initramfs devices and specific to the Debian crypttab format.\nIt's not supported by systemd.\n\nquiet\nBe quiet. Don't print warnings if a device does not exist. This option overrides the\noption loud.\n\nThis option is ignored for initramfs devices and specific to the Debian crypttab format.\nIt's not supported by systemd.\n\nkeyscript=<path>\nThe executable at the indicated path is executed with the value of the third field as\nonly argument. The keyscript's standard output is passed to cryptsetup as decyption key.\nIts exit status is currently ignored, but no assumption should be made in that regard.\nWhen used in initramfs, the executable either needs to be self-contained (i.e. doesn't\nrely on any external program which is not present in the initramfs environment) or the\ndependencies have to added to the initramfs image by other means. The program is either\nspecified by full path or relative to /lib/cryptsetup/scripts/.\n\nLIMITATIONS: All binaries and files on which the keyscript depends must be available at\nthe time of execution. Special care needs to be taken for encrypted filesystems like /usr\nor /var. As an example, unlocking encrypted /usr must not depend on binaries from\n/usr/(s)bin.\n\nThis option is specific to the Debian crypttab format. It's not supported by systemd.\n\nWARNING: With systemd as init system, this option might be ignored. At the time this is\nwritten (December 2016), the systemd cryptsetup helper doesn't support the keyscript\noption to /etc/crypttab. For the time being, the only option to use keyscripts along with\nsystemd is to force processing of the corresponding crypto devices in the initramfs. See\nthe 'initramfs' option for further information.\n\nAll fields of the appropriate crypttab entry are available to the keyscript as exported\nenvironment variables:\n\nCRYPTTABNAME, CRYPTTABNAME\nThe target name (after resp. before octal sequence decoding).\n\nCRYPTTABSOURCE, CRYPTTABSOURCE\nThe source device (after resp. before octal sequence decoding and device resolution).\n\nCRYPTTABKEY, CRYPTTABKEY\nThe value of the third field (after resp. before octal sequence decoding).\n\nCRYPTTABOPTIONS, CRYPTTABOPTIONS\nA list of exported crypttab options (after resp. before octal sequence decoding).\n\nCRYPTTABOPTION<option>\nThe value of the appropriate crypttab option, with value set to 'yes' in case the\noption is merely a flag. For option aliases, such as 'readonly' and 'read-only', the\nvariable name refers to the first alternative listed (thus 'CRYPTTABOPTIONreadonly'\nin that case). If the crypttab option name contains '-' characters, then they are\nreplaced with '' in the exported variable name. For instance, the value of the\n'CRYPTTABOPTIONkeyfileoffset' environment variable is set to the value of the\n'keyfile-offset' crypttab option.\n\nCRYPTTABTRIED\nNumber of previous tries since start of cryptdisks (counts until maximum number of\ntries is reached).\n\n### CHECKSCRIPTS\n\nblkid\nChecks for any known filesystem. Supports a filesystem type as argument via <checkargs>:\n\n•   no checkargs - succeeds if any valid filesystem is found on the device.\n\n•   \"none\" - succeeds if no valid filesystem is found on the device.\n\n•   \"ext4\" [or another filesystem type like xfs, swap, cryptoLUKS, ...] - succeeds if\next4 filesystem is found on the device.\n\nunblkid\nChecks for no known filesystem. Supports a filesystem type as argument via <checkargs>:\n\n•   no checkargs - succeeds if no valid filesystem is found on the device.\n\n•   \"ext4\" [or another filesystem type like xfs, swap, cryptoLUKS, ...] - succeeds if no\next4 filesystem is found on the device.\n\n### EXAMPLES\n\n# Encrypted swap device\ncswap /dev/sda6 /dev/urandom plain,cipher=aes-xts-plain64,size=256,hash=sha1,swap\n\n# Encrypted LUKS disk with interactive password, identified by its UUID, discard enabled\ncdisk0 UUID=12345678-9abc-def012345-6789abcdef01 none luks,discard\n\n# Encrypted TCRYPT disk with interactive password, discard enabled\ntdisk0 /dev/sr0 none tcrypt,discard\n\n# Encrypted ext4 disk with interactive password, discard enabled\n# - retry 5 times if the check fails\ncdisk1 /dev/sda2 none plain,cipher=aes-xts-plain64,size=256,hash=sha1,check,checkargs=ext4,tries=5,discard\n\n# Encrypted disk with interactive password, discard enabled\n# - use a nondefault check script\n# - no retries\ncdisk2 /dev/sdc1 none plain,cipher=aes-xts-plain64,size=256,hash=sha1,check=customscript,tries=1,discard\n\n# Encrypted disk with interactive password, discard enabled\n# - Twofish as the cipher, RIPEMD-160 as the hash\ncdisk3 /dev/sda3 none plain,cipher=twofish,size=256,hash=ripemd160,discard\n\n### ENVIRONMENT\n\nCRYPTDISKSENABLE\nSet to yes to run cryptdisks initscripts at startup. Set to no to disable cryptdisks\ninitscripts. Default is yes.\n\nCRYPTDISKSMOUNT\nSpecifies the mountpoints that are mounted before cryptdisks is invoked. Takes\nmountpoints configured in /etc/fstab as arguments. Separate mountpoints by space. This is\nuseful for keys on removable devices, such as cdrom, usbstick, flashcard, etc. Default is\nunset.\n\nCRYPTDISKSCHECK\nSpecifies the default checkscript to be run against the target device, after cryptdisks\nhas been invoked. The target device is passed as the first and only argument to the\ncheckscript. Takes effect if the check option is given in crypttab with no value. See\ndocumentation for check option above for more information.\n\n### KNOWN UPGRADE ISSUES\n\nThe upstream defaults for encryption cipher, hash and keysize have changed several times in\nthe past, and they're expected to change again in future, for example if security issues\narise. On LUKS devices, the used settings are stored in the LUKS header, and thus don't need\nto be configured in /etc/crypttab. For plain dm-crypt devices, no information about used\ncipher, hash and keysize are available at all. Therefore we strongly suggest to configure the\ncipher, hash and keysize in /etc/crypttab for plain dm-crypt devices, even if they match the\ncurrent default.\n\n### SEE ALSO\n\ncryptsetup(8), cryptdisksstart(8), cryptdisksstop(8),\n/usr/share/doc/cryptsetup-initramfs/README.initramfs.gz\n\n### AUTHOR\n\nThis manual page was originally written by Bastian Kleineidam <calvin@debian.org> for the\nDebian distribution of cryptsetup. It has been further improved by Michael Gebetsroither\n<michael.geb@gmx.at>, David Härdeman <david@hardeman.nu> and Jonas Meurer\n<jonas@freesources.org>.\n\n\n\ncryptsetup 2:2.4.3-1ubunt                    2024-11-14                                  CRYPTTAB(5)\n\n"
        }
    ],
    "structuredContent": {
        "command": "crypttab",
        "section": "5",
        "mode": "man",
        "summary": "crypttab - static information about encrypted filesystems",
        "synopsis": null,
        "tldr_summary": null,
        "tldr_examples": [],
        "tldr_source": null,
        "flags": [],
        "examples": [
            "# Encrypted swap device",
            "cswap /dev/sda6 /dev/urandom plain,cipher=aes-xts-plain64,size=256,hash=sha1,swap",
            "# Encrypted LUKS disk with interactive password, identified by its UUID, discard enabled",
            "cdisk0 UUID=12345678-9abc-def012345-6789abcdef01 none luks,discard",
            "# Encrypted TCRYPT disk with interactive password, discard enabled",
            "tdisk0 /dev/sr0 none tcrypt,discard",
            "# Encrypted ext4 disk with interactive password, discard enabled",
            "# - retry 5 times if the check fails",
            "cdisk1 /dev/sda2 none plain,cipher=aes-xts-plain64,size=256,hash=sha1,check,checkargs=ext4,tries=5,discard",
            "# Encrypted disk with interactive password, discard enabled",
            "# - use a nondefault check script",
            "# - no retries",
            "cdisk2 /dev/sdc1 none plain,cipher=aes-xts-plain64,size=256,hash=sha1,check=customscript,tries=1,discard",
            "# Encrypted disk with interactive password, discard enabled",
            "# - Twofish as the cipher, RIPEMD-160 as the hash",
            "cdisk3 /dev/sda3 none plain,cipher=twofish,size=256,hash=ripemd160,discard"
        ],
        "see_also": [
            {
                "name": "cryptsetup",
                "section": "8",
                "url": "https://www.chedong.com/phpMan.php/man/cryptsetup/8/json"
            },
            {
                "name": "cryptdisksstart",
                "section": "8",
                "url": "https://www.chedong.com/phpMan.php/man/cryptdisksstart/8/json"
            },
            {
                "name": "cryptdisksstop",
                "section": "8",
                "url": "https://www.chedong.com/phpMan.php/man/cryptdisksstop/8/json"
            }
        ],
        "section_outline": [
            {
                "name": "NAME",
                "lines": 2,
                "subsections": []
            },
            {
                "name": "DESCRIPTION",
                "lines": 42,
                "subsections": []
            },
            {
                "name": "ON DIFFERENT CRYPTTAB FORMATS",
                "lines": 7,
                "subsections": []
            },
            {
                "name": "OPTIONS",
                "lines": 206,
                "subsections": []
            },
            {
                "name": "CHECKSCRIPTS",
                "lines": 18,
                "subsections": []
            },
            {
                "name": "EXAMPLES",
                "lines": 24,
                "subsections": []
            },
            {
                "name": "ENVIRONMENT",
                "lines": 16,
                "subsections": []
            },
            {
                "name": "KNOWN UPGRADE ISSUES",
                "lines": 8,
                "subsections": []
            },
            {
                "name": "SEE ALSO",
                "lines": 3,
                "subsections": []
            },
            {
                "name": "AUTHOR",
                "lines": 8,
                "subsections": []
            }
        ]
    }
}