diff options
author | Lennart Poettering <lennart@poettering.net> | 2020-04-29 23:10:22 +0200 |
---|---|---|
committer | Lennart Poettering <lennart@poettering.net> | 2020-05-19 17:28:47 +0200 |
commit | 6e41f4dd916293f35d7d35cea7eed1807d7ea771 (patch) | |
tree | c14427215513a7fd73321c1f9e25c98dfe531737 /man/crypttab.xml | |
parent | 4eb08bdb71a5a40371de47f6ec958ff3ab279365 (diff) | |
download | systemd-6e41f4dd916293f35d7d35cea7eed1807d7ea771.tar.gz |
man: document the newly acquired cryptsetup features
Diffstat (limited to 'man/crypttab.xml')
-rw-r--r-- | man/crypttab.xml | 42 |
1 files changed, 28 insertions, 14 deletions
diff --git a/man/crypttab.xml b/man/crypttab.xml index 9b6fffd154..3942fe67f9 100644 --- a/man/crypttab.xml +++ b/man/crypttab.xml @@ -41,7 +41,7 @@ character are ignored. Each of the remaining lines describes one encrypted block device. Fields are delimited by white space.</para> - <para>Each line is in the form<programlisting><replaceable>name</replaceable> <replaceable>encrypted-device</replaceable> <replaceable>password</replaceable> <replaceable>options</replaceable></programlisting> + <para>Each line is in the form<programlisting><replaceable>volume-name</replaceable> <replaceable>encrypted-device</replaceable> <replaceable>key-file</replaceable> <replaceable>options</replaceable></programlisting> The first two fields are mandatory, the remaining two are optional.</para> @@ -53,24 +53,20 @@ it is opened as a LUKS device; otherwise, it is assumed to be in raw dm-crypt (plain mode) format.</para> - <para>The first field contains the name of the resulting encrypted - block device; the device is set up within - <filename>/dev/mapper/</filename>.</para> + <para>The first field contains the name of the resulting encrypted volume; its block device is set up + below <filename>/dev/mapper/</filename>.</para> <para>The second field contains a path to the underlying block device or file, or a specification of a block device via <literal>UUID=</literal> followed by the UUID.</para> - <para>The third field specifies the encryption password. If the - field is not present or the password is set to - <literal>none</literal> or <literal>-</literal>, the password has - to be manually entered during system boot. Otherwise, the field is - interpreted as an absolute path to a file containing the encryption - password. For swap encryption, <filename>/dev/urandom</filename> - or the hardware device <filename>/dev/hw_random</filename> can be - used as the password file; using <filename>/dev/random</filename> - may prevent boot completion if the system does not have enough - entropy to generate a truly random encryption key.</para> + <para>The third field specifies an absolute path to a file to read the encryption key from. If the field + is not present or set to <literal>none</literal> or <literal>-</literal>, a key file named after the + volume to unlock (i.e. the first column of the line), suffixed with <filename>.key</filename> is + automatically loaded from the <filename>/etc/cryptsetup-keys.d/</filename> and + <filename>/run/cryptsetup-keys.d/</filename> directories, if present. Otherwise, the password has to be + manually entered during system boot. For swap encryption, <filename>/dev/urandom</filename> may be used + as key file.</para> <para>The fourth field, if present, is a comma-delimited list of options. The following options are recognized:</para> @@ -139,6 +135,15 @@ </varlistentry> <varlistentry> + <term><option>keyfile-erase</option></term> + + <listitem><para>If enabled, the specified key file is erased after the volume is activated or when + activation fails. This is in particular useful when the key file is only acquired transiently before + activation (e.g. via a file in <filename>/run/</filename>, generated by a service running before + activation), and shall be removed after use. Defaults to off.</para></listitem> + </varlistentry> + + <varlistentry> <term><option>key-slot=</option></term> <listitem><para>Specifies the key slot to compare the @@ -432,6 +437,15 @@ </varlistentry> <varlistentry> + <term><option>try-empty-password=</option></term> + + <listitem><para>Takes a boolean argument. If enabled, right before asking the user for a password it + is first attempted to unlock the volume with an empty password. This is useful for systems that are + initialized with an encrypted volume with only an empty password set, which shall be replaced with a + suitable password during first boot, but after activation.</para></listitem> + </varlistentry> + + <varlistentry> <term><option>x-systemd.device-timeout=</option></term> <listitem><para>Specifies how long systemd should wait for a device to show up |