CRYPTTAB(5) crypttab CRYPTTAB(5) crypttab - /etc/crypttab /etc/crypttab . "#". . . -- - - . : LUKS TrueCrypt BitLocker plain. cryptsetup(8) . LUKS LUKS dm-crypt ( plain). /etc/crypttab : 1. /dev/mapper/. 2. "UUID=" (UUID). 3. . ":" /etc/fstab ( "LABEL=" ) . "none" "-" ( ) .key /etc/cryptsetup-keys.d/ /run/cryptsetup-keys.d/ . . (swap) /dev/urandom . AF_UNIX . . . 4. . . . : 1. ( ) . 2. ( ) . . 3. ( ) AF_UNIX . . 4. PKCS#11 . / AF_UNIX LUKS2 JSON. RSA . PKCS#11 RSA . (EC) . PKCS#11. . pkcs11-uri= . 5. FIDO2 ( "hmac-secret"). / AF_UNIX LUKS2 JSON. (HMAC) FIDO2 . . fido2-device= . 6. TPM2. ( ) -- TPM2 -- / AF_UNIX LUKS2 JSON. tpm2-device= . /etc/crypttab /etc/cryptsetup-keys.d/ /run/cryptsetup-keys.d/ ( ) LUKS2 JSON ( ). systemd-cryptenroll(1) PKCS#11 FIDO2 TPM2 LUKS2 . : cipher= . cryptsetup(8) . IV "aes-cbc-essiv:sha256". . 186. discard (discard) . SSD . 207. hash= (hash) . cryptsetup(8) . 186. header= () () . LUKS TrueCrypt/VeraCrypt. cryptsetup(8) . ":" /etc/fstab ( "UUID=" ) . LUKS . 219. keyfile-offset= . cryptsetup(8) . 187. keyfile-size= . cryptsetup(8) . (plain) . (salt) FIDO2 FIDO2 32 . 188. keyfile-erase . ( /run/ ) . . 246. key-slot= (key slot) . . luks. cryptsetup(8) . . 209. keyfile-timeout= . systemd-cryptsetup-generator(8) . 243. link-volume-key= ( keyrings(7)) LUKS2 . "::". "@" (: "@s" "@u" ). . . "%key_type:". "user" . keyctl(1) ( KEY IDENTIFIERS). . 256. luks LUKS. LUKS : cipher= hash= size=. 186. bitlk BitLocker. cryptsetup BitLocker. 246. _netdev cryptsetup . systemd.mount(5) _netdev. remote-fs-pre.target remote-cryptsetup.target cryptsetup-pre.target cryptsetup.target. : fstab(5) _netdev . local-fs.target . 235. noauto cryptsetup.target. . noauto. 186. nofail cryptsetup.target. . . nofail . / header cryptset . 186. offset= 512 . (plain). 220. plain (plain). 186. read-only, readonly . 186. same-cpu-crypt (CPU) . . 4.0 . 242. submit-from-crypt-cpus . . CFQ . 4.0 . 242. no-read-workqueue dm-crypt . . 5.9 . 248. no-write-workqueue dm-crypt . . 5.9 . 248. skip= 512 . offset= (IV). offset= IV . offset=n n 0 IV. skip= n IV n. (plain). 220. size= . cryptsetup(8) . 186. sector-size= . cryptsetup(8) . 240. swap (swap) mkswap(8). plain. swap . 186. tcrypt TrueCrypt. TrueCrypt : cipher= hash= keyfile-offset= keyfile-size= size=. . . TrueCrypt . . tcrypt-keyfile= . "/dev/null" . 206. tcrypt-hidden TrueCrypt . tcrypt. . . cryptsetup(8) . 206. tcrypt-keyfile= TrueCrypt. tcrypt . tcrypt TrueCrypt. 206. tcrypt-system TrueCrypt . tcrypt. 206. tcrypt-veracrypt VeraCrypt. VeraCrypt TrueCrypt . VeraCrypt TrueCrypt. tcrypt. 232. veracrypt-pim= (PIM) 0..2147468 veracrypt 0..65535 veracrypt. 0 VeraCrypt. tcrypt-veracrypt. VeraCrypt PIM veracrypt-pim= . Veracrypt Personal Iterations Multiplier[1] . 254. timeout= . . s ms us min h d. 0 ( ). 186. tmp= /tmp/ mkfs(8). "ext4" "xfs" "btrfs". "ext4". plain. tmp . 186. tries= . 3. 0 . 186. headless= false. true /PIN. . 249. verify . 186. password-echo=yes|no|masked PIN . "masked". password-echo=masked. . . "masked" ("*") . ("") ("") . 249. password-cache=yes|no|read-only PIN . "read-only". "yes". "read-only" /PIN . "yes" /PIN 2.5 . PKCS#11. PKCS#11 PIN . 257. pkcs11-uri= "auto" RFC7512 PKCS#11 URI[2] . PKCS#11 . LUKS2 YubiKey. "auto" LUKS2 PKCS#11 LUKS2 JSON . (URI) LUKS2 JSON. systemd-cryptenroll(1) PKCS#11 "auto". ( "-"). URI . . ( ). ( RSA) ( ECC) Base64 LUKS. systemd-cryptenroll --pkcs11-token-uri=list PKCS#11 URI . PKCS#11 FIDO2 . fido2-device= ( ) FIDO2 . PKCS#11 FIDO2 FIDO2 . 245. fido2-device= "auto" "hidraw" ( /dev/hidraw1) FIDO2 "hmac-secret" ( ). FIDO2. "auto" FIDO2 . FIDO2 (CID) fido2-cid= ( ) HMAC ( ) . LUKS2 CID LUKS2 JSON . systemd-cryptenroll(1) FIDO2 LUKS2. systemd-cryptenroll --fido2-device=list FIDO2 . : HMAC FIDO2 . Base64 LUKS2. -- . FIDO2 PKCS#11 pkcs11-uri= . FIDO2 . 248. fido2-cid= FIDO2 Base64 FIDO2. fido2-device= fido2-device=auto. fido2-device= fido2-cid= LUKS2 CID LUKS2 JSON. systemd-cryptenroll(1) FIDO2 LUKS2 . 248. fido2-rp= FIDO2 (rp) FIDO2. "io.systemd.cryptsetup" LUKS2 JSON . . 248. fido2-pin= PIN ( "clientPin" FIDO2). fido2-cid=. true false v248 : PIN PIN PIN. 257. fido2-up= ( "up" FIDO2) . fido2-cid=. true false v248 : UP UP UP. 257. fido2-uv= ( "uv" FIDO2) . fido2-cid=. true false v248 : UV . 257. tpm2-device= "auto" ( /dev/tpmrm0) TPM2. TPM2. tpm2-pcrs= ( ) (PCRs) TPM2 . systemd-cryptenroll(1) TPM2 LUKS2. "auto" TPM2 . systemd-cryptenroll --tpm2-device=list TPM2 . : TPM2 systemd-cryptenroll LUKS2 TPM2 "" "" TPM2. TPM2 -- . JSON LUKS2. TPM2 ( TPM2) ( TPM2) JSON LUKS2 . . PCR ( ) PCR PCR. 248. tpm2-pcrs= "+" TPM2 PCR ( " ") TPM2 . TPM2 LUKS2 JSON systemd-cryptenroll . ( LUKS2 JSON) : PCR 7. PCR PCR . 248. tpm2-pin= "false". TPM2 PIN PCR. TPM2. 251. tpm2-signature= TPM2 PCR JSON systemd-measure(1). LUKS2 PCR . systemd-cryptenroll(1) TPM2 PCR. LUKS2 TPM2 PCR tpm2-pcr-signature.json /etc/systemd/ /run/systemd/ /usr/lib/systemd/ ( ). 252. -tpm2-pcr= pcrlock TPM2 systemd-pcrlock(8). LUKS2 PCR . systemd-cryptenroll(1) pcrlock TPM2. LUKS2 pcrlock TPM2 pcrlock.json /run/systemd/ /var/lib/systemd/ ( ). 255. tpm2-measure-pcr= TPM2 PCR. "no" ( ) PCR. "yes" PCR 15. 0...23 PCR . UUID. TPM . 253. tpm2-measure-bank= TPM2 PCR tpm2-measure-pcr= . . . ( "sha1" "sha256" ...) . 253. tpm2-measure-keyslot-nvpcr= LUKS TPM2 (nvindex PCR). NvPCR. false ( ) TPM2 nvindex nvindex . true "cryptsetup" NvPCR. ( "tpm2" "fido2" "pkcs11") UUID. 259. token-timeout= ( FIDO2 PKCS#11 TPM2). ( systemd.time(7) ). 30 . . -- PIN ( ) . 0 . 250. try-empty-password= . . . 246. x-systemd.device-timeout= systemd . "s" "min" "h" "ms". 216. x-initrd.attach initrd systemd.mount(5) x-initrd.mount. x-initrd.mount x-initrd.attach systemd . . initrd . 245. fixate-volume-key= . LUKS TPM2 . fixate-volume-key= . sha256 PCR TPM2 tpm2-measure-pcr=. LUKS systemd-repart(8). EncryptedVolume= repart.d(5). 260. systemd systemd-cryptsetup-generator(8). AF_UNIX ( /etc/crypttab ) AF_UNIX . AF_UNIX unix(7) . : NUL RANDOM /cryptsetup/ VOLUME : NUL ( ) ( ) "/cryptsetup/" . "myvol": \0d7067f78d9827418/cryptsetup/myvol AF_UNIX getpeername(2) . PKCS#11 ( ) "/cryptsetup-pkcs11/". FIDO2 ("/cryptsetup-fido2-salt/") TPM2 ("/cryptsetup-tpm2/"). PKCS#11/FIDO2/TPM2 . 1. /etc/crypttab . LUKS TrueCrypt. "cipher=xchacha12,aes-adiantum-plain64" "keyfile-timeout=10s". luks UUID=2505567a-9e27-4efe-a4d5-15ad146c258b swap /dev/sda7 /dev/urandom swap truecrypt /dev/sda2 /etc/container_password tcrypt hidden /mnt/tc_hidden /dev/null tcrypt-hidden,tcrypt-keyfile=/etc/keyfile external /dev/sda3 keyfile:LABEL=keydev keyfile-timeout=10s,cipher=xchacha12\,aes-adiantum-plain64 2. PKCS#11 Yubikey PKCS#11 RSA EC . Yubikey LUKS2 ykmap(1) yubikey-manager systemd-cryptenroll(1) LUKS2: # SPDX-License-Identifier: MIT-0 # Yubikey (!) ykman piv reset # / # 'pubkey.pem'. ykman piv generate-key -a RSA2048 9d pubkey.pem # # . "" # . ykman piv generate-certificate --subject "Knobelei" 9d pubkey.pem # . # "rm" . rm pubkey.pem # LUKS2. # /dev/sdXn ( /dev/sda1). sudo systemd-cryptenroll --pkcs11-token-uri=auto /dev/sdXn # : systemd-cryptsetup . sudo systemd-cryptsetup attach mytest /dev/sdXn none pkcs11-uri=auto # /etc/crypttab # . /dev/sdX ( ) # : udevadm info -q symlink -r /dev/sdXn # uuid /etc/crypttab: sudo bash -c 'echo "mytest /dev/disk/by-uuid/... none pkcs11-uri=auto" >>/etc/crypttab' # # initramfs Yubikey / PKCS#11 # . # https://unix.stackexchange.com/a/705809. # : sudo dracut --force # : sudo update-initramfs -u : o RSA2048 Yubikeys o Yubikey 9d Yubico PIV[3]. 3. FIDO2 FIDO2 FIDO2 "hmac-secret" . FIDO2 LUKS2 systemd-cryptenroll(1): # SPDX-License-Identifier: MIT-0 # LUKS2. /dev/sdXn # ( /dev/sda1). sudo systemd-cryptenroll --fido2-device=auto /dev/sdXn # : systemd-cryptsetup . sudo systemd-cryptsetup attach mytest /dev/sdXn none fido2-device=auto # /etc/crypttab # . /dev/sdX ( ) # : udevadm info -q symlink -r /dev/sdXn # uuid /etc/crypttab: sudo bash -c 'echo "mytest /dev/disk/by-uuid/... none fido2-device=auto" >>/etc/crypttab' # # initramfs FIDO2 # . # https://unix.stackexchange.com/a/705809. # : sudo dracut --force # : sudo update-initramfs -u 4. TPM2 TPM2 TPM2 . TPM2 LUKS2 systemd-cryptenroll(1): # SPDX-License-Identifier: MIT-0 # TPM2 LUKS2 PCR 7 # . /dev/sdXn ( /dev/sda1). sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 /dev/sdXn # : systemd-cryptsetup . sudo systemd-cryptsetup attach mytest /dev/sdXn none tpm2-device=auto # /etc/crypttab # . /dev/sdX ( ) # : udevadm info -q symlink -r /dev/sdXn # uuid /etc/crypttab: sudo bash -c 'echo "mytest /dev/disk/by-uuid/... none tpm2-device=auto" >>/etc/crypttab' # : sudo systemd-cryptsetup detach mytest sudo systemctl daemon-reload sudo systemctl start cryptsetup.target systemctl is-active systemd-cryptsetup@mytest.service # . # /etc/fstab: sudo mkfs.ext4 /dev/mapper/mytest # 'Filesystem UUID' : sudo bash -c 'echo "/dev/disk/by-uuid/... /var/mytest ext4 defaults,x-systemd.mkdir 0 2" >>/etc/fstab' # : sudo systemctl daemon-reload sudo systemctl start /var/mytest systemctl status /var/mytest # # initramfs TPM2 # . # https://unix.stackexchange.com/a/705809. # : sudo dracut --force # : sudo update-initramfs -u systemd(1), systemd-cryptsetup@.service(8), systemd-cryptsetup-generator(8), systemd-cryptenroll(1), systemd-repart(8), repart.d(5), fstab(5), cryptsetup(8), mkswap(8), mke2fs(8) 1. Veracrypt https://www.veracrypt.fr/en/Personal%20Iterations%20Multiplier%20%28PIM%29.html 2. RFC7512 PKCS#11 URI https://tools.ietf.org/html/rfc7512 3. Yubico PIV https://developers.yubico.com/PIV/Introduction/Certificate_slots.html 3 . . : . systemd 260.2 CRYPTTAB(5)