CRYPTTAB(5) cryptsetup manual CRYPTTAB(5)
NAME
crypttab - static information about encrypted filesystems
DESCRIPTION
The file /etc/crypttab contains descriptive information about encrypted filesystems.
crypttab is only read by programs (e.g. cryptdisks_start and cryptdisks_stop), and not
written; it is the duty of the system administrator to properly create and maintain this
file. Each filesystem is described on a separate line; fields on each line are separated
by tabs or spaces. Lines starting with “#” are comments, empty lines are ignored. The
order of records in crypttab is important because the init scripts sequentially iterate
through crypttab doing their thing.
The first field, target, describes the mapped device name. It must be a plain filename
without any directory components. A mapped device which encrypts/decrypts data to/from the
source device will be created at /dev/mapper/target by cryptsetup.
The second field, source device, describes either the block special device or file that
contains the encrypted data. Instead of giving the source device explicitly, the UUID is
supported as well, using UUID=.
The third field, key file, describes the file to use as a key for decrypting the data of
the source device. Note that the entire key file will be used as the passphrase; the
passphrase must not be followed by a newline character.
It can also be a device name (e.g. /dev/urandom), note however that LUKS requires a
persistent key and therefore does not support random data keys.
If the key file is the string “none”, a passphrase will be read interactively from the
console. In this case, the options precheck, check, checkargs and tries may be useful.
The fourth field, options, describes the cryptsetup options associated with the encryption
process. At minimum, the field should contain either the string luks respectively tcrypt
or the cipher, hash and size options.
Options are in the format: key=value [,key=value ...]. The supported options are described
below.
Note that all four fields are mandatory and that a missing field will lead to unspecified
behaviour.
OPTIONS
cipher=
Encryption algorithm (ignored for LUKS and TCRYPT devices). See cryptsetup -c.
size=
Encryption key size (ignored for LUKS and TCRYPT devices). See cryptsetup -s.
hash=
Hash algorithm (ignored for LUKS and TCRYPT devices). See cryptsetup -h.
offset=
Start offset (ignored for LUKS and TCRYPT devices). Uses cryptsetup -o.
skip=
Skip sectors at the beginning (ignored for LUKS and TCRYPT devices). Uses cryptsetup
-p.
verify
Verify password. Uses cryptsetup -y.
readonly
The backing device is read-only (eg: a dvd).
discard
Allow using of discards (TRIM) requests for device.
WARNING: Assess the specific security risks carefully before enabling this option. For
example, allowing discards on encrypted devices may lead to the leak of information
about the ciphertext device (filesystem type, used space etc.) if the discarded blocks
can be located easily on the device later.
Kernel version 3.1 or more recent is required. For older versions is the option
ignored.
luks
Use device with LUKS extensions.
tcrypt
Use device with TCRYPT extensions.
swap
Run mkswap on the created device.
tmp=
Run mkfs with filesystem type on the created device. Default is ext4.
precheck=
Check the content of the source device by a suitable program; if the check fails, the
device is not created. If a program is provided as an argument, it is run, giving the
source device as argument. Cryptdisks/cryptroot searches for the given progam in
/lib/cryptsetup/checks/ first, but full path to program is supported as well.
Prechecks aren't invoked for LUKS devices, as these are checked with isLuks anyway.
Default for plain dm-crypt devices is set in /etc/default/cryptdisks, or un_blkid
otherwise. Set to /bin/true in order to disable precheck for plain dm-crypt device.
check=
Check the content of the target device by a suitable program; if the check fails, the
device is removed. If a program is provided as an argument, it is run, giving the
decrypted volume (target device) as first argument, and the value of the checkargs
option as second argument. Cryptdisks/cryptroot searches for the given program in
/lib/cryptsetup/checks/ first, but full path to program is supported as well.
Default is set in /etc/default/cryptdisks (blkid).
checkargs=
Give as the second argument to the check script. See the CHECKSCRIPTS
section for more information.
tries=
The input of the passphrase is tried times in case of failure. If you want to
disable retries, pass “tries=1”. Default is 3. Setting “tries=0” will ask for the
passphrase until a correct one has been submitted (infinitive retries).
initramfs
The initramfs hook processes the root device, any resume devices and any devices with
the initramfs option set. These devices are processed within the initramfs stage of
boot. As an example, that allows the use of remote unlocking using dropbear.
noearly
The cryptsetup init scripts are invoked twice during the boot process - once before
lvm, raid, etc. are started and once again after that. Sometimes you need to start
your encrypted disks in a special order. With this option the device is ignored during
the first invocation of the cryptsetup init scripts.
noauto
Entirely ignore the device at the boot process. It's still possible to map the device
manually using cryptdisks_start.
loud
Be loud. Print warnings if a device does not exist. This option overwrites the option
quiet.
quiet
Be quiet. Don't print warnings if a device does not exist. This option overwrites the
option loud.
keyscript=
The executable at the indicated path is executed with the key file from the third
field of the crypttab as its only argument and the output is used as the key. This
also works with encrypted root filesystems via initramfs if the executable is
self-contained (i.e. an executable which does not rely on any external program which
is not present in the initramfs environment).
LIMITATIONS: All binaries and files on which the keyscript depends must be available
at the time of execution. Special care needs to be taken for encrypted filesystems
like /usr or /var. As an example, unlocking encrypted /usr must not depend on binaries
from /usr/(s)bin.
All fields of the appropriate crypttab entry are available to the keyscript as
exported environment variables:
CRYPTTAB_NAME
The target name
CRYPTTAB_SOURCE
The source device
CRYPTTAB_KEY
The key file
CRYPTTAB_TRIED
Number of previous tries since start of cryptdisks (counts until maximum number of
tries is reached).
CRYPTTAB_OPTIONS
A list of exported crypttab options
CRYPTTAB_OPTION_