|
HTML rendering created 2024-06-26 by Michael Kerrisk, author of The Linux Programming Interface. For details of in-depth Linux/UNIX system programming training courses that I teach, look here. Hosting by jambit GmbH. |
|
|
NAME | SYNOPSIS | DESCRIPTION | OPTIONS | REPORTING BUGS | SEE ALSO | CRYPTSETUP |
|
|
|
CRYPTSETUP-TOKEN(8) Maintenance Commands CRYPTSETUP-TOKEN(8)
cryptsetup-token - manage LUKS2 tokens
cryptsetup token <add|remove|import|export|unassign> [<options>]
<device>
Action add creates a new keyring token to enable auto-activation
of the device. For the auto-activation, the passphrase must be
stored in keyring with the specified description. Usually, the
passphrase should be stored in user or user-session keyring. The
token command is supported only for LUKS2.
For adding new keyring token, option --key-description is
mandatory. Also, new token is assigned to key slot specified with
--key-slot option or to all active key slots in the case
--key-slot option is omitted.
To remove existing token, specify the token ID which should be
removed with --token-id option.
WARNING: The action token remove removes any token type, not just
keyring type from token slot specified by --token-id option.
Action import can store arbitrary valid token json in LUKS2
header. It may be passed via standard input or via file passed in
--json-file option. If you specify --key-slot then successfully
imported token is also assigned to the key slot.
Action export writes requested token JSON to a file passed with
--json-file or to standard output.
Action unassign removes token binding to specified keyslot. Both
token and keyslot must be specified by --token-id and --key-slot
parameters.
If --token-id is used with action add or action import and a
token with that ID already exists, option --token-replace can be
used to replace the existing token.
<options> can be [--header, --token-id, --key-slot,
--key-description, --disable-external-tokens, --disable-locks,
--disable-keyring, --json-file, --token-replace, --unbound,
--external-tokens-path].
--batch-mode, -q
Suppresses all confirmation questions. Use with care!
If the --verify-passphrase option is not specified, this
option also switches off the passphrase verification.
--debug or --debug-json
Run in debug mode with full diagnostic logs. Debug output
lines are always prefixed by #.
If --debug-json is used, additional LUKS2 JSON data
structures are printed.
--disable-external-tokens
Disable loading of plugins for external LUKS2 tokens.
--disable-keyring
Do not load volume key in kernel keyring and store it
directly in the dm-crypt target instead. This option is
supported only for the LUKS2 type.
--disable-locks
Disable lock protection for metadata on disk. This option is
valid only for LUKS2 and ignored for other formats.
WARNING: Do not use this option unless you run cryptsetup in
a restricted environment where locking is impossible to
perform (where /run directory cannot be used).
--external-tokens-path absolute_path
Override system directory path where cryptsetup searches for
external token handlers (or token plugins). It must be
absolute path (starting with '/' character).
--header <device or file storing the LUKS header>
Use a detached (separated) metadata device or file where the
LUKS header is stored. This option allows one to store
ciphertext and LUKS header on different devices.
For commands that change the LUKS header (e.g. luksAddKey),
specify the device or file with the LUKS header directly as
the LUKS device.
--help, -?
Show help text and default parameters.
--json-file
Read token JSON from a file or write token to it.
--json-file=- reads JSON from standard input or writes it to
standard output respectively.
--key-description <text>
Set key description in keyring that will be used for
passphrase retrieval.
--key-slot, -S <0-N>
For LUKS operations that add key material, this option allows
you to specify which key slot is selected for the new key.
The maximum number of key slots depends on the LUKS version.
LUKS1 can have up to 8 key slots. LUKS2 can have up to 32 key
slots based on key slot area size and key size, but a valid
key slot ID can always be between 0 and 31 for LUKS2.
--token-id
Specify token number. If omitted, first unused token id is
used when adding or importing new token.
--token-replace
Replace an existing token when adding or importing a token
with the --token-id option.
--unbound
Creates new LUKS2 keyring token assigned to no keyslot.
Usable only with add action.
--usage
Show short option help.
--version, -V
Show the program version.
Report bugs at cryptsetup mailing list
<[email protected]> or in Issues project section
<https://gitlab.com/cryptsetup/cryptsetup/-/issues/new>.
Please attach output of the failed command with --debug option
added.
Cryptsetup FAQ
<https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions>
cryptsetup(8), integritysetup(8) and veritysetup(8)
Part of cryptsetup project
<https://gitlab.com/cryptsetup/cryptsetup/>. This page is part of
the Cryptsetup ((open-source disk encryption)) project.
Information about the project can be found at
⟨https://gitlab.com/cryptsetup/cryptsetup⟩. If you have a bug
report for this manual page, send it to [email protected]. This
page was obtained from the project's upstream Git repository
⟨https://gitlab.com/cryptsetup/cryptsetup.git⟩ on 2024-06-14. (At
that time, the date of the most recent commit that was found in
the repository was 2024-06-11.) If you discover any rendering
problems in this HTML version of the page, or you believe there
is a better or more up-to-date source for the page, or you have
corrections or improvements to the information in this COLOPHON
(which is not part of the original manual page), send a mail to
[email protected]
cryptsetup 2.8.0-git 2023-12-22 CRYPTSETUP-TOKEN(8)
Pages that refer to this page: cryptsetup(8)
|
HTML rendering created 2024-06-26 by Michael Kerrisk, author of The Linux Programming Interface. For details of in-depth Linux/UNIX system programming training courses that I teach, look here. Hosting by jambit GmbH. |
|