neulab/tldr huggingface dataset:
This option is useful to cut trailing newlines, for example. If --keyfile-offset is also given, the size count starts after the offset.  Works with all commands that accept key files.
--new-keyfile-offset value Skip value bytes at the start when adding a new passphrase from key file with luksAddKey.
--new-keyfile-size  value Read a maximum of value bytes when adding a new passphrase from key file with luksAddKey.  The default is to read the whole file up to the compiled-in maximum length that can be queried with --help.  Supplying more than the compiled in maximum aborts the operation.  When --new-keyfile-offset is also given, reading starts after the offset.
--master-key-file Use a master key stored in a file.
For luksFormat this allows creating a LUKS header with this specific master key. If the master key was taken from an existing LUKS header and all other parameters are the same, then the new header decrypts the data encrypted with the header the master key was taken from.
Action luksDump together with --dump-master-key option: The volume (master) key is stored in a file instead of being printed out to standard output.
WARNING: If you create your own master key, you need to make sure to do it right. Otherwise, you can end up with a low-entropy or otherwise partially predictable master key which will compromise security.
For luksAddKey this allows adding a new passphrase without having to know an existing one.
For open this allows one to open the LUKS device without giving a passphrase.
--dump-json-metadata For luksDump (LUKS2 only) this option prints content of LUKS2 header JSON metadata area.
--dump-master-key For luksDump this option includes the master key in the displayed information. Use with care, as the master key can be used to bypass the passphrases, see also option --master-key-file.
--json-file Read token json from a file or write token to it. See token action for more information. --json-file=- reads json from standard input or writes it to standard output respectively.
--use-random
--use-urandom For luksFormat these options define which kernel random number generator will be used to create the master key (which is a long- term key).
See NOTES ON RANDOM NUMBER GENERATORS for more information. Use cryptsetup --help to show the compiled-in default random number generator.
WARNING: In a low-entropy situation (e.g. in an embedded system), both selections are problematic.  Using /dev/urandom can lead to weak keys.  Using /dev/random can block a long time, potentially forever, if not enough entropy can be harvested by the kernel.
--key-slot, -S <0-N> For LUKS operations that add key material, this options allows you to specify which key slot is selected for the new key.  This option can be used for luksFormat, and luksAddKey. In addition, for open, this option selects a specific key-slot to compare the passphrase against.  If the given passphrase would only match a different key-slot, the operation fails.
Maximum number of key slots depends on LUKS version. LUKS1 can have up to 8 key slots. LUKS2 can have up to 32 key slots based on key slot area size and key size, but a valid key slot ID can always be between 0 and 31 for LUKS2.
--key-size, -s <bits> Sets key size in bits. The argument has to be a multiple of 8. The possible key-sizes are limited by the cipher and mode used.
See /proc/crypto for more information. Note that key-size in /proc/crypto is stated in bytes.
This option can be used for open --type plain or luksFormat.  All other LUKS actions will use the key-size specified in the LUKS header.  Use cryptsetup --help to show the compiled-in defaults.
--size, -b <number of 512 byte sectors> Set the size of the device in sectors of 512 bytes.  This option is only relevant for the open and resize actions.
--offset, -o <number of 512 byte sectors> Start offset in the backend device in 512-byte sectors.  This option is only relevant for the open action with plain or loopaes device types or for LUKS devices in luksFormat.
For LUKS, the --offset option sets the data offset (payload) of data device and must be be aligned to 4096-byte sectors (must be multiple of 8).  This option cannot be combined with --align-payload option.
--skip, -p <number of 512 byte sectors> Start offset used in IV calculation in 512-byte sectors (how many sectors of the encrypted data to skip at the beginning).  This option is only relevant for the open action with plain or loopaes device types.
Hence, if --offset n, and --skip s, sector n (the first sector of the encrypted device) will get a sector number of s for the IV calculation.
--device-size size[units] Instead of real device size, use specified value.
With reencrypt action it means that only specified area (from the start of the device to the specified size) will be reencrypted.
With resize action it sets new size of the device.
If no unit suffix is specified, the size is in bytes.
Unit suffix can be S for 512 byte sectors, K/M/G/T (or KiB,MiB,GiB,TiB) for units with 1024 base or KB/MB/GB/TB for 1000 base (SI scale).
WARNING: This is destructive operation when used with reencrypt command.
--readonly, -r set up a read-only mapping.
--shared Creates an additional mapping for one common ciphertext device. Arbitrary mappings are supported.  This option is only relevant for the open --type plain action. Use --offset, --size and --skip to specify the mapped area.
--pbkdf <PBKDF spec> Set Password-Based Key Derivation Function (PBKDF) algorithm for LUKS keyslot.  The PBKDF can be: pbkdf2 (for PBKDF2 according to RFC2898), argon2i for Argon2i or argon2id for Argon2id (see https://www.cryptolux.org/index.php/Argon2 for more info).
For LUKS1, only PBKDF2 is accepted (no need to use this option). The default PBKDF2 for LUKS2 is set during compilation time and is available in cryptsetup --help output.
A PBKDF is used for increasing dictionary and brute-force attack cost for keyslot passwords. The parameters can be time, memory and parallel cost.
For PBKDF2, only time cost (number of iterations) applies.  For Argon2i/id, there is also memory cost (memory required during the process of key derivation) and parallel cost (number of threads that run in parallel during the key derivation.
Note that increasing memory cost also increases time, so the final parameter values are measured by a benchmark. The benchmark tries to find iteration time (--iter-time) with required memory cost --pbkdf-memory. If it is not possible, the memory cost is decreased as well.  The parallel cost --pbkdf-parallel is constant and is checked against available CPU cores.
You can see all PBKDF parameters for particular LUKS2 keyslot with luksDump command.
NOTE: If you do not want to use benchmark and want to specify all parameters directly, use --pbkdf-force-iterations with --pbkdf-memory and --pbkdf-parallel.  This will override the values without benchmarking.  Note it can cause extremely long unlocking time. Use only in specific cases, for example, if you know that the formatted device will be used on some small embedded system.
MINIMAL AND MAXIMAL PBKDF COSTS: For PBKDF2, the minimum iteration count is 1000 and maximum is 4294967295 (maximum for 32bit unsigned integer).  Memory and parallel costs are unused for PBKDF2.  For Argon2i and Argon2id, minimum iteration count (CPU cost) is 4 and maximum is 4294967295 (maximum for 32bit unsigned integer).  Minimum memory cost is 32 KiB and maximum is 4 GiB. (Limited by addresable memory on some CPU platforms.)  If the memory cost parameter is benchmarked (not specified by a parameter) it is always in range from 64 MiB to 1 GiB.  The parallel cost minimum is 1 and maximum 4 (if enough CPUs cores are available, otherwise it is decreased).
--iter-time, -i <number of milliseconds> The number of milliseconds to spend with PBKDF passphrase processing.  This option is only relevant for LUKS operations that set or change passphrases, such as luksFormat or luksAddKey. Specifying 0 as parameter selects the compiled-in default.
--pbkdf-memory <number> Set the memory cost for PBKDF (for Argon2i/id the number represents kilobytes).  Note that it is maximal value, PBKDF benchmark or available physical memory can decrease it.  This option is not available for PBKDF2.
--pbkdf-parallel <number> Set the parallel cost for PBKDF (number of threads, up to 4). Note that it is maximal value, it is decreased automatically if CPU online count is lower.  This option is not available for PBKDF2.
--pbkdf-force-iterations <num> Avoid PBKDF benchmark and set time cost (iterations) directly.  It can be used for LUKS/LUKS2 device only.  See --pbkdf option for more info.
--batch-mode, -q Suppresses all confirmation questions. Use with care!
If the -y option is not specified, this option also switches off the passphrase verification for luksFormat.
--progress-frequency <seconds> Print separate line every <seconds> with wipe progress.
--timeout, -t <number of seconds> The number of seconds to wait before timeout on passphrase input via terminal. It is relevant every time a passphrase is asked, for example for open, luksFormat or luksAddKey.  It has no effect if used in conjunction with --key-file. This option is useful when the system should not stall if the user does not input a passphrase, e.g. during boot. The default is a value of 0 seconds, which means to wait forever.
--tries, -T How often the input of the passphrase shall be retried.  This option is relevant every time a passphrase is asked, for example for open, luksFormat or luksAddKey.  The default is 3 tries.
--align-payload <number of 512 byte sectors> Align payload at a boundary of value 512-byte sectors.  This option is relevant for luksFormat.
If not specified, cryptsetup tries to use the topology info provided by the kernel for the underlying device to get the optimal alignment.  If not available (or the calculated value is a multiple of the default) data is by default aligned to a 1MiB boundary (i.e. 2048 512-byte sectors).
For a detached LUKS header, this option specifies the offset on the data device. See also the --header option.
WARNING: This option is DEPRECATED and has often unexpected impact to the data offset and keyslot area size (for LUKS2) due to the complex rounding.  For fixed data device offset use --offset option instead.
--uuid=UUID Use the provided UUID for the luksFormat command instead of generating a new one. Changes the existing UUID when used with the luksUUID command.
The UUID must be provided in the standard UUID format, e.g. 12345678-1234-1234-1234-123456789abc.
--allow-discards Allow the use of discard (TRIM) requests for the device.  This option is only relevant for open action.  This is also not supported for LUKS2 devices with data integrity protection.
WARNING: This command can have a negative security impact because it can make filesystem-level operations visible on the physical device. For example, information leaking filesystem type, used space, etc. may be extractable from the physical device if the discarded blocks can be located later. If in doubt, do not use it.
A kernel version of 3.1 or later is needed. For earlier kernels, this option is ignored.
--perf-same_cpu_crypt Perform encryption using the same cpu that IO was submitted on. The default is to use an unbound workqueue so that encryption work is automatically balanced between available CPUs.  This option is only relevant for open action.
NOTE: This option is available only for low-level dm-crypt performance tuning, use only if you need a change to default dm- crypt behaviour. Needs kernel 4.0 or later.
--perf-submit_from_crypt_cpus Disable offloading writes to a separate thread after encryption. There are some situations where offloading write bios from the encryption threads to a single thread degrades performance significantly.  The default is to offload write bios to the same thread.  This option is only relevant for open action.
--perf-no_read_workqueue, --perf-no_write_workqueue Bypass dm-crypt internal workqueue and process read or write requests synchronously.  This option is only relevant for open action.
NOTE: These options are available only for low-level dm-crypt performance tuning, use only if you need a change to default dm- crypt behaviour. Needs kernel 5.9 or later.
--test-passphrase Do not activate the device, just verify passphrase.  This option is only relevant for open action (the device mapping name is not mandatory if this option is used).
--header <device or file storing the LUKS header> Use a detached (separated) metadata device or file where the LUKS header is stored. This option allows one to store ciphertext and LUKS header on different devices.
This option is only relevant for LUKS devices and can be used with the luksFormat, open, luksSuspend, luksResume, status and resize commands.
For luksFormat with a file name as the argument to --header, the file will be automatically created if it does not exist.  See the cryptsetup FAQ for header size calculation.
For other commands that change the LUKS header (e.g. luksAddKey), specify the device or file with the LUKS header directly as the LUKS device.
If used with luksFormat, the --align-payload option is taken as absolute sector alignment on ciphertext device and can be zero.
WARNING: There is no check whether the ciphertext device specified actually belongs to the header given. In fact, you can specify an arbitrary device as the ciphertext device for open with the --header option. Use with care.
--header-backup-file <file> Specify file with header backup for luksHeaderBackup or luksHeaderRestore actions.
--force-password Do not use password quality checking for new LUKS passwords.
This option applies only to luksFormat, luksAddKey and luksChangeKey and is ignored if cryptsetup is built without password quality checking support.
For more info about password quality check, see the manual page for pwquality.conf(5) and passwdqc.conf(5).
--deferred Defers device removal in close command until the last user closes it.
--cancel-deferred Removes a previously configured deferred device removal in close command.
--disable-external-tokens Disable loading of plugins for external LUKS2 tokens.
--disable-locks Disable lock protection for metadata on disk.  This option is valid only for LUKS2 and ignored for other formats.
WARNING: Do not use this option unless you run cryptsetup in a restricted environment where locking is impossible to perform (where /run directory cannot be used).
--disable-keyring Do not load volume key in kernel keyring and store it directly in the dm-crypt target instead.  This option is supported only for the LUKS2 format.
--key-description <text> Set key description in keyring for use with token command.
--priority <normal|prefer|ignore> Set a priority for LUKS2 keyslot.  The prefer priority marked slots are tried before normal priority.  The ignored priority means, that slot is never used, if not explicitly requested by --key-slot option.
--token-id Specify what token to use in actions token, open or resize.  If omitted, all available tokens will be checked before proceeding further with passphrase prompt.
--token-only Do not proceed further with action (any of token, open or resize) if token activation failed. Without the option, action asks for passphrase to proceed further.
--token-type Restrict tokens eligible for operation to specific token type (name). Mostly useful when no --token-id is specified.
--sector-size <bytes> Set sector size for use with disk encryption. It must be power of two and in range 512 - 4096 bytes. This option is available only in the LUKS2 or plain modes.
The default for plain mode is 512 bytes. For LUKS2 devices it's established during luksFormat operation based on parameters provided by underlying data device.  For native 4K block devices it's 4096 bytes. For 4K/512e (4K physical sector size with 512 bytes emulation) it's 4096 bytes. For drives reporting only 512 bytes block size it remains 512 bytes. If data device is regular file put in filesystem it's 4096 bytes.
Note that if sector size is higher than underlying device hardware sector and there is not integrity protection that uses data journal, using this option can increase risk on incomplete sector writes during a power fail.
If used together with --integrity option and dm-integrity journal, the atomicity of writes is guaranteed in all cases (but it cost write performance - data has to be written twice).
Increasing sector size from 512 bytes to 4096 bytes can provide better performance on most of the modern storage devices and also with some hw encryption accelerators.
--iv-large-sectors Count Initialization Vector (IV) in larger sector size (if set) instead of 512 bytes sectors. This option can be used only for open command and plain encryption type.
NOTE: This option does not have any performance or security impact, use it only for accessing incompatible existing disk images from other systems that require this option.
--persistent If used with LUKS2 devices and activation commands like open or refresh, the specified activation flags are persistently written into metadata and used next time automatically even for normal activation.  (No need to use cryptab or other system configuration files.)
If you need to remove a persistent flag, use --persistent without the flag you want to remove (e.g. to disable persistently stored discard flag, use --persistent without --allow-discards).
Only --allow-discards, --perf-same_cpu_crypt, --perf-submit_from_crypt_cpus, --perf-no_read_workqueue, --perf-no_write_workqueue and --integrity-no-journal can be stored persistently.
--refresh Refreshes an active device with new set of parameters. See action refresh description for more details.
--label <LABEL> --subsystem <SUBSYSTEM> Set label and subsystem description for LUKS2 device, can be used in config and format actions.  The label and subsystem are optional fields and can be later used in udev scripts for triggering user actions once device marked by these labels is detected.
--integrity <integrity algorithm> Specify integrity algorithm to be used for authenticated disk encryption in LUKS2.
WARNING: This extension is EXPERIMENTAL and requires dm-integrity kernel target (available since kernel version 4.12).  For native AEAD modes, also enable "User-space interface for AEAD cipher algorithms" in "Cryptographic API" section (CONFIG_CRYPTO_USER_API_AEAD .config option).
For more info, see AUTHENTICATED DISK ENCRYPTION section.
--luks2-metadata-size <size> This option can be used to enlarge the LUKS2 metadata (JSON) area. The size includes 4096 bytes for binary metadata (usable JSON area is smaller of the binary area).  According to LUKS2 specification, only these values are valid: 16, 32, 64, 128, 256, 512, 1024, 2048 and 4096 kB The <size> can be specified with unit suffix (for example 128k).
--luks2-keyslots-size <size> This option can be used to set specific size of the LUKS2 binary keyslot area (key material is encrypted there). The value must be aligned to multiple of 4096 bytes with maximum size 128MB.  The <size> can be specified with unit suffix (for example 128k).
--keyslot-cipher <cipher-spec> This option can be used to set specific cipher encryption for the LUKS2 keyslot area.
--keyslot-key-size <bits> This option can be used to set specific key size for the LUKS2 keyslot area.
--integrity-no-journal Activate device with integrity protection without using data journal (direct write of data and integrity tags).  Note that without journal power fail can cause non-atomic write and data corruption.  Use only if journalling is performed on a different storage layer.
--integrity-no-wipe Skip wiping of device authentication (integrity) tags. If you skip this step, sectors will report invalid integrity tag until an application write to the sector.
NOTE: Even some writes to the device can fail if the write is not aligned to page size and page-cache initiates read of a sector with invalid integrity tag.
--unbound
Creates new or dumps existing LUKS2 unbound keyslot. See luksAddKey or luksDump actions for more details.
--tcrypt-hidden --tcrypt-system --tcrypt-backup Specify which TrueCrypt on-disk header will be used to open the device.  See TCRYPT section for more info.
--veracrypt This option is ignored as VeraCrypt compatible mode is supported by default.
--disable-veracrypt This option can be used to disable VeraCrypt compatible mode (only TrueCrypt devices are recognized). Only for TCRYPT extension. See TCRYPT section for more info.
--veracrypt-pim --veracrypt-query-pim Use a custom Personal Iteration Multiplier (PIM) for VeraCrypt device.  See TCRYPT section for more info.
--serialize-memory-hard-pbkdf Use a global lock to serialize unlocking of keyslots using memory- hard PBKDF.
NOTE: This is (ugly) workaround for a specific situation when multiple devices are activated in parallel and system instead of reporting out of memory starts unconditionally stop processes using out-of-memory killer.
DO NOT USE this switch until you are implementing boot environment with parallel devices activation!
--encrypt Initialize (and run) device encryption (reencrypt action parameter)
--decrypt Initialize (and run) device decryption (reencrypt action parameter)
--init-only Initialize reencryption (any variant) operation in LUKS2 metadata only and exit. If any reencrypt operation is already initialized in metadata, the command with --init-only parameter fails.
--resume-only Resume reencryption (any variant) operation already described in LUKS2 metadata. If no reencrypt operation is initialized, the command with --resume-only parameter fails. Useful for resuming reencrypt operation without accidentally triggering new reencryption operation.
--resilience <mode> Reencryption resilience mode can be one of checksum, journal or none.
checksum: default mode, where individual checksums of ciphertext hotzone sectors are stored, so the recovery process can detect which sectors were already reencrypted.  It requires that the device sector write is atomic.
journal: the hotzone is journaled in the binary area (so the data are written twice).
none: performance mode. There is no protection and the only way it's safe to interrupt the reencryption is similar to old offline reencryption utility. (ctrl+c).
The option is ignored if reencryption with datashift mode is in progress.
--resilience-hash <hash> The hash algorithm used with "--resilience checksum" only.  The default hash is sha256. With other resilience modes, the hash parameter is ignored.
--hotzone-size <size> This option can be used to set an upper limit on the size of reencryption area (hotzone).  The <size> can be specified with unit suffix (for example 50M). Note that actual hotzone size may be less than specified <size> due to other limitations (free space in keyslots area or available memory).
--reduce-device-size <size> Initialize LUKS2 reencryption with data device size reduction (currently only --encrypt variant is supported).
Last <size> sectors of <device> will be used to properly initialize device reencryption.  That means any data at last <size> sectors will be lost.
It could be useful if you added some space to underlying partition or logical volume (so last <size> sectors contains no data).
Recommended minimal size is twice the default LUKS2 header size (--reduce-device-size 32M) for --encrypt use case. Be sure to have enough (at least --reduce-device-size value      of free space at the end of <device>).
WARNING: This is a destructive operation and cannot be reverted. Use with extreme care - accidentally overwritten filesystems are usually unrecoverable.
--version Show the program version.
--usage Show short option help.
--help, -? Show help text and default parameters.
Example 1: Create LUKS 2 container on block device /dev/sdX. sudo cryptsetup --type luks2 luksFormat /dev/sdX
Example 2: Add an additional passphrase to key slot 5. sudo cryptsetup luksAddKey --key-slot 5 /dev/sdX
Example 3: Create LUKS header backup and save it to file. sudo cryptsetup luksHeaderBackup /dev/sdX --header-backup-file /var/tmp/NameOfBackupFile
Example 4: Open LUKS contaner on /dev/sdX and map it to sdX_crypt. sudo cryptsetup open /dev/sdX sdX_crypt
WARNING: The command in example 5 will erase all key slots. Your cannot use your luks container afterwards anymore unless you have a backup to restore.
Example 5: Erase all key slots on /dev/sdX. sudo cryptsetup erase /dev/sdX
Example 6: Restore LUKS header from backup file. sudo cryptsetup luksHeaderRestore /dev/sdX --header-backup-file /var/tmp/NameOfBackupFile
Cryptsetup returns 0 on success and a non-zero value on error.
Error codes are: 1 wrong parameters, 2 no permission (bad passphrase), 3 out of memory, 4 wrong device specified, 5 device already exists or device is busy.
Note that no iterated hashing or salting is done in plain mode.  If hashing is done, it is a single direct hash. This means that low-entropy passphrases are easy to attack in plain mode.
From a terminal: The passphrase is read until the first newline, i.e. '\n'.  The input without the newline character is processed with the default hash or the hash specified with --hash.  The hash result will be truncated to the key size of the used cipher, or the size specified with -s.
From stdin: Reading will continue until a newline (or until the maximum input size is reached), with the trailing newline stripped. The maximum input size is defined by the same compiled-in default as for the maximum key file size and can be overwritten using --keyfile-size option.
The data read will be hashed with the default hash or the hash specified with --hash.  The hash result will be truncated to the key size of the used cipher, or the size specified with -s.
Note that if --key-file=- is used for reading the key from stdin, trailing newlines are not stripped from the input.
If "plain" is used as argument to --hash, the input data will not be hashed. Instead, it will be zero padded (if shorter than the key size) or truncated (if longer than the key size) and used directly as the binary key. This is useful for directly specifying a binary key.  No warning will be given if the amount of data read from stdin is less than the key size.
From a key file: It will be truncated to the key size of the used cipher or the size given by -s and directly used as a binary key.
WARNING: The --hash argument is being ignored.  The --hash option is usable only for stdin input in plain mode.
If the key file is shorter than the key, cryptsetup will quit with an error.  The maximum input size is defined by the same compiled-in default as for the maximum key file size and can be overwritten using --keyfile- size option.
LUKS uses PBKDF2 to protect against dictionary attacks and to give some protection to low-entropy passphrases (see RFC 2898 and the cryptsetup FAQ).
From a terminal: The passphrase is read until the first newline and then processed by PBKDF2 without the newline character.
From stdin: LUKS will read passphrases from stdin up to the first newline character or the compiled-in maximum key file length. If --keyfile-size is given, it is ignored.
From key file: The complete keyfile is read up to the compiled-in maximum size. Newline characters do not terminate the input. The --keyfile-size option can be used to limit what is read.
Passphrase processing: Whenever a passphrase is added to a LUKS header (luksAddKey, luksFormat), the user may specify how much the time the passphrase processing should consume. The time is used to determine the iteration count for PBKDF2 and higher times will offer better protection for low-entropy passphrases, but open will take longer to complete. For passphrases that have entropy higher than the used key length, higher iteration times will not increase security.
The default setting of one or two seconds is sufficient for most practical cases. The only exception is a low-entropy passphrase used on a device with a slow CPU, as this will result in a low iteration count. On a slow device, it may be advisable to increase the iteration time using the --iter-time option in order to obtain a higher iteration count. This does slow down all later luksOpen operations accordingly.
INCOHERENT BEHAVIOR FOR INVALID PASSPHRASES/KEYS LUKS checks for a valid passphrase when an encrypted partition is unlocked. The behavior of plain dm-crypt is different.  It will always decrypt with the passphrase given. If the given passphrase is wrong, the device mapped by plain dm-crypt will essentially still contain encrypted data and will be unreadable.
NOTES ON SUPPORTED CIPHERS, MODES, HASHES AND KEY SIZES The available combinations of ciphers, modes, hashes and key sizes depend on kernel support. See /proc/crypto for a list of available options. You might need to load additional kernel crypto modules in order to get more options.
For the --hash option, if the crypto backend is libgcrypt, then all algorithms supported by the gcrypt library are available.  For other crypto backends, some algorithms may be missing.
Mathematics can't be bribed. Make sure you keep your passphrases safe. There are a few nice tricks for constructing a fallback, when suddenly out of the blue, your brain refuses to cooperate.  These fallbacks need LUKS, as it's only possible with LUKS to have multiple passphrases. Still, if your attacker model does not prevent it, storing your passphrase in a sealed envelope somewhere may be a good idea as well.
Random Number Generators (RNG) used in cryptsetup are always the kernel RNGs without any modifications or additions to data stream produced.
There are two types of randomness cryptsetup/LUKS needs. One type (which always uses /dev/urandom) is used for salts, the AF splitter and for wiping deleted keyslots.
The second type is used for the volume (master) key. You can switch between using /dev/random and /dev/urandom  here, see --use-random and --use-urandom options. Using /dev/random on a system without enough entropy sources can cause luksFormat to block until the requested amount of random data is gathered. In a low-entropy situation (embedded system), this can take a very long time and potentially forever. At the same time, using /dev/urandom in a low-entropy situation will produce low-quality keys. This is a serious problem, but solving it is out of scope for a mere man-page.  See urandom(4) for more information.
AUTHENTICATED DISK ENCRYPTION (EXPERIMENTAL) Since Linux kernel version 4.12 dm-crypt supports authenticated disk encryption.
Normal disk encryption modes are length-preserving (plaintext sector is of the same size as a ciphertext sector) and can provide only confidentiality protection, but not cryptographically sound data integrity protection.
Authenticated modes require additional space per-sector for authentication tag and use Authenticated Encryption with Additional Data (AEAD) algorithms.
If you configure LUKS2 device with data integrity protection, there will be an underlying dm-integrity device, which provides additional per- sector metadata space and also provide data journal protection to ensure atomicity of data and metadata update.  Because there must be additional space for metadata and journal, the available space for the device will be smaller than for length-preserving modes.
The dm-crypt device then resides on top of such a dm-integrity device. All activation and deactivation of this device stack is performed by cryptsetup, there is no difference in using luksOpen for integrity protected devices.  If you want to format LUKS2 device with data integrity protection, use --integrity option.
Since dm-integrity doesn't support discards (TRIM), dm-crypt device on top of it inherits this, so integrity protection mode doesn't support discards either.
Some integrity modes requires two independent keys (key for encryption and for authentication). Both these keys are stored in one LUKS keyslot.
WARNING: All support for authenticated modes is experimental and there are only some modes available for now. Note that there are a very few authenticated encryption algorithms that are suitable for disk encryption. You also cannot use CRC32 or any other non-cryptographic checksums (other than the special integrity mode "none"). If for some reason you want to have integrity control without using authentication mode, then you should separately configure dm-integrity independently of LUKS2.
Cryptsetup is usually used directly on a block device (disk partition or LVM volume). However, if the device argument is a file, cryptsetup tries to allocate a loopback device and map it into this file. This mode requires Linux kernel 2.6.25 or more recent which supports the loop autoclear flag (loop device is cleared on the last close automatically). Of course, you can always map a file to a loop-device manually. See the cryptsetup FAQ for an example.
When device mapping is active, you can see the loop backing file in the status command output. Also see losetup(8).
LUKS2 header locking The LUKS2 on-disk metadata is updated in several steps and to achieve proper atomic update, there is a locking mechanism.  For an image in file, code uses flock(2) system call.  For a block device, lock is performed over a special file stored in a locking directory (by default /run/lock/cryptsetup).  The locking directory should be created with the proper security context by the distribution during the boot-up phase. Only LUKS2 uses locks, other formats do not use this mechanism.
The reload action is no longer supported.  Please use dmsetup(8) if you need to directly manipulate with the device mapping table.
The luksDelKey was replaced with luksKillSlot.
Report bugs, including ones in the documentation, on the cryptsetup mailing list at <dm-crypt@saout.de> or in the 'Issues' section on LUKS website.  Please attach the output of the failed command with the --debug option added.
cryptsetup originally written by Jana Saout <jana@saout.de> The LUKS extensions and original man page were written by Clemens Fruhwirth <clemens@endorphin.org>. Man page extensions by Milan Broz <gmazyland@gmail.com>. Man page rewrite and extension by Arno Wagner <arno@wagner.name>.
Copyright © 2004 Jana Saout Copyright © 2004-2006 Clemens Fruhwirth Copyright © 2012-2014 Arno Wagner Copyright © 2009-2021 Red Hat, Inc. Copyright © 2009-2021 Milan Broz
The LUKS website at https://gitlab.com/cryptsetup/cryptsetup/
The cryptsetup FAQ, contained in the distribution package and online at https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions
The cryptsetup mailing list and list archive, see FAQ entry 1.6.
The LUKS version 1 on-disk format specification available at https://gitlab.com/cryptsetup/cryptsetup/wikis/Specification and LUKS version 2 at https://gitlab.com/cryptsetup/LUKS2-docs.
JOSM(1)                      General Commands Manual                     JOSM(1)
josm - Java OpenStreetMap Editor
JOSM is an editor for OpenStreetMap written in Java 8.
OpenStreetMap is a project aimed squarely at creating and providing free geographic data such as street maps to anyone who wants them. It allows you to view, edit and use geographical data in a collaborative way from anywhere on earth.  The project was started because most maps you think of as free actually have legal or technical restrictions on their use, holding back people from using them in creative, productive or unexpected ways.
-h, -?, --help Show help
--geometry=<width>x<height>(+|-)x(+|-)y Standard X geometry argument
[--download=]minlat,minlon,maxlat,maxlon Download the bounding box
[--download=]<url> Download the location at the url (with lat=x&lon=y&zoom=z)
[--download=]<filename> Open file (any file type that can be opened with File/Open)
--downloadgps=minlat,minlon,maxlat,maxlon Download the bounding box as raw gps
--selection=<searchstring> Select with the given search
--[no-]maximize Do [not] launch in maximized mode
--reset-preferences Reset the preferences to the default
--load-preferences=<url-to-xml> Change preferences according to the XML file
--set=<key>=<value> Set preference key to value
--language=<language> Set the language
--version Display the JOSM version
--status-report Show status report with useful information that can be attached to bugs
--debug Print debugging messages to console
--offline=<OSM_API|JOSM_WEBSITE|CACHE_UPDATES|CERTIFICATES|ALL> Disable access to the given resource(s), separated by comma
JOSM files are saved according to the XDG Base Directory Specification:
$HOME/.config/JOSM Preferences
$HOME/.local/share/JOSM User data
$HOME/.cache/JOSM Cache
If the directory $HOME/.josm exists, all files are stored there.
The following options can be set by using Java system properties (i.e. -Dkey=value passed to java, or specified inside JAVA_OPTS).
josm.pref=<path> Set the JOSM preferences directory.
josm.userdata=<path> Set the JOSM user data directory.
josm.cache=<path> Set the JOSM cache directory.
josm.home=<homedir> Relocate all 3 directories to homedir. Cache directory will be in <homedir>/cache.
josm.dir.name=<JOSM> Change the JOSM directory name.
JAVA_HOME Specify an alternate Java environment.
JAVA_OPTS Specify Java options.  For example, to use a HTTP proxy server with this program, set this environment variable to something like JAVA_OPTS="-Dhttp.proxyHost=yourProxyURL" before starting josm.
JOSM was originally designed and coded by Immanuel Scholz, and is now maintained by the OpenStreetMap community.
The current JOSM maintainer is Dirk Stöcker.  A lot of administration work is done by Paul Hartmann and Vincent Privat.
Major code contributions from (in alphabetical order):
Stefan Breunig David Earl Gabriel Ebner Dave Hansen Paul Hartmann Karl Guggisberg Matthias Julius Alexei Kasatkin Jiri Klement Ulf Lamping Simon Legner Raphael Mack Upliner Mikhalych Vincent Privat Frederik Ramm Dirk Stöcker
Many minor contributions and patches by others; see SVN history at https://josm.openstreetmap.de/svn/ for details. Use "josm-dev AT openstreetmap.org" to contact still active authors.  The logo has been designed by Ilya Palikov.
This manual page was initially written by Andreas Putzo <andreas@putzo.net>, for the Debian project (but may be used by others).
RBASH(1)                     General Commands Manual                    RBASH(1)
rbash - restricted bash, see bash(1)
When a command that is found to be a shell script is executed, rbash turns off any restrictions in the shell spawned to execute the script.
GNOMON()                                                                GNOMON()
gnomon
A command line utility, a bit like moreutils's ts https://joeyh.name/code/moreutils/, to prepend timestamp information to the standard output of another command. Useful for long-running processes where you'd like a historical record of what's taking so long.
Example basic https://cloud.githubusercontent.com/assets/1643758/13685018/17b4f76c-e6d4-11e5-8838-40fa52346ae8.gif
Piping anything to gnomon will prepend a timestamp to each line, indicating how long that line was the last line in the buffer--that is, how long it took the next line to appear. By default, gnomon will display the seconds elapsed between each line, but that is configurable.
You can display total time elapsed since the process began: total https://cloud.githubusercontent.com/assets/1643758/13685020/199b78b2-e6d4-11e5-9083-05de6c52cc60.gif
You can display an absolute timestamp: absolute https://cloud.githubusercontent.com/assets/1643758/13685022/1ab3a5bc-e6d4-11e5-9ccf-3a5c68f9ea0c.gif
You can also use the --high and/or --medium options to specify a length threshold in seconds, over which gnomon will highlight the timestamp in red or yellow. And you can do a few other things, too.
fancy https://cloud.githubusercontent.com/assets/1643758/13685025/1bbf6ad6-e6d4-11e5-8806-e90a6e852bf7.gif
If the realtime timestamp updating is distracting or incompatible with your terminal, it can be disabled:
norealtime https://cloud.githubusercontent.com/assets/1643758/13685027/1cfd823e-e6d4-11e5-9f90-c047d67a35e0.gif
Options --type=<elapsed-line|elapsed-total|absolute>        [default: elapsed-line] -t <elapsed-line|elapsed-total|absolute>
Type of timestamp to display. elapsed-line: Number of seconds that displayed line was the last line. elapsed-total: Number of seconds since the start of the process. absolute: An absolute timestamp in UTC.
--format="format"                                   [default: "H:i:s.u O"] -f "format"
Format the absolute timestamp, using PHP date format strings. If the type is elapsed-line or elapsed-total, this option is ignored.
--ignore-blank                                      [default: false] --quiet -q -i
Do not prepend a timestamp to blank lines; just pass them through. When this option is active, blank lines will not trigger an update of elapsed time. Therefore, if a lot of blank lines appear, the prior timestamp will display the total time between that line and the next non-blank line (if the type is elapsed-time was selected).
--real-time=<number|false>                          [default: 500] -r                                                  [non-tty default: false]
Time increment to use when updating timestamp for the current line, in milliseconds. Pass `false` to this option to disable realtime entirely, if you need an extra performance boost or you find it distracting. When realtime is disabled, the log will always appear one line "behind" the original piped output, since it can't display the line until it's finished timing it.
--high=seconds -h seconds
High threshold. If the elapsed time for a line is equal to or higher than this value in seconds, then the timestamp will be colored bright red. This works for all timestamp types, including elapsed-total and absolute, where the elapsed line time is not actually displayed.
--medium=seconds -m seconds
Medium threshold. Works just like the high threshold described above, but colors the timestamp bright yellow instead. Can be used in conjunction with a high threshold for three levels.
Notes • If a high and/or a medium threshold are specified, then all timestamps not meeting that threshold will be colored bright green.
• If you pipe the output of gnomon into another command or a file (that is, not a tty) then the real-time option will be disabled by default and each line will appear only after it has been timed. You can force realtime by sending a --real-time=<ms> argument explicitly, but the ANSI codes would probably interfere with whatever you were trying to do. The sane default is to omit fancy stuff, like colors and escape sequences, when logging text directly to a file.
Installation with npm do:
npm install -g gnomon
License gnomon uses the MIT license.
WHO(1P)                     POSIX Programmer's Manual                    WHO(1P)
who — display who is on the system
who [-mTu] [-abdHlprt] [file]
who [-mu] -s [-bHlprt] [file]
who -q [file]
The who utility shall list various pieces of information about accessible users. The domain of accessibility is implementation-defined.
Based on the options given, who can also list the user's name, terminal line, login time, elapsed time since activity occurred on the line, and the process ID of the command interpreter for each current system user.
The who utility shall conform to the Base Definitions volume of POSIX.1‐2017, Section 12.2, Utility Syntax Guidelines.
The following options shall be supported. The metavariables, such as <line>, refer to fields described in the STDOUT section.
-a        Process the implementation-defined database or named file with the -b, -d, -l, -p, -r, -t, -T and -u options turned on.
-b        Write the time and date of the last system reboot. The system reboot time is the time at which the implementation is able to commence running processes.
-d        Write a list of all processes that have expired and not been respawned by the init system process. The <exit> field shall appear for dead processes and contain the termination and exit values of the dead process. This can be useful in determining why a process terminated.
-H        Write column headings above the regular output.
-l        (The letter ell.) List only those lines on which the system is waiting for someone to login. The <name> field shall be LOGIN in such cases. Other fields shall be the same as for user entries except that the <state> field does not exist.
-m        Output only information about the current terminal.
-p        List any other process that is currently active and has been previously spawned by init.
-q        (Quick.) List only the names and the number of users currently logged on. When this option is used, all other options shall be ignored.
-r        Write the current run-level of the init process.
-s        List only the <name>, <line>, and <time> fields.  This is the default case.
-t        Indicate the last change to the system clock.
-T        Show the state of each terminal, as described in the STDOUT section.
-u        Write ``idle time'' for each displayed user in addition to any other information. The idle time is the time since any activity occurred on the user's terminal. The method of determining this is unspecified.  This option shall list only those users who are currently logged in.  The <name> is the user's login name. The <line> is the name of the line as found in the directory /dev.  The <time> is the time that the user logged in. The <activity> is the number of hours and minutes since activity last occurred on that particular line. A dot indicates that the terminal has seen activity in the last minute and is therefore ``current''. If more than twenty-four hours have elapsed or the line has not been used since boot time, the entry shall be marked <old>. This field is useful when trying to determine whether a person is working at the terminal or not. The <pid> is the process ID of the user's login process.
am i, am I In the POSIX locale, limit the output to describing the invoking user, equivalent to the -m option. The am and i or I must be separate arguments.
file      Specify a pathname of a file to substitute for the implementation-defined database of logged-on users that who uses by default.
The following environment variables shall affect the execution of who:
LC_TIME   Determine the locale used for the format and contents of the date and time strings.
TZ        Determine the timezone used when writing date and time information. If TZ is unset or null, an unspecified default timezone shall be used.
The who utility shall write its default format to the standard output in an implementation-defined format, subject only to the requirement of containing the information described above.
XSI-conformant systems shall write the default information to the standard output in the following general format:
<name>[<state>]<line><time>[<activity>][<pid>][<comment>][<exit>]
For the -b option, <line> shall be "systemboot".  The <name> is unspecified.
The following format shall be used for the -T option:
"%s %c %s %s\n" <name>, <terminal state>, <terminal name>, <time of login>
where <terminal state> is one of the following characters:
+       The terminal allows write access to other users.
-       The terminal denies write access to other users.
?       The terminal write-access state cannot be determined.
<space> This entry is not associated with a terminal.
In the POSIX locale, the <time of login> shall be equivalent in format to the output of:
date +"%b %e %H:%M"
If the -u option is used with -T, the idle time shall be added to the end of the previous format in an unspecified format.
The name init used for the system process is the most commonly used on historical systems, but it may vary.
The ``domain of accessibility'' referred to is a broad concept that permits interpretation either on a very secure basis or even to allow a network-wide implementation like the historical rwho.
Due to differences between historical implementations, the base options provided were a compromise to allow users to work with those functions. The standard developers also considered removing all the options, but felt that these options offered users valuable functionality. Additional options to match historical systems are available on XSI-conformant systems.
It is recognized that the who command may be of limited usefulness, especially in a multi-level secure environment. The standard developers considered, however, that having some standard method of determining the ``accessibility'' of other users would aid user portability.
No format was specified for the default who output for systems not supporting the XSI option. In such a user-oriented command, designed only for human use, this was not considered to be a deficiency.
The format of the terminal name is unspecified, but the descriptions of ps, talk, and write require that they use the same format.
It is acceptable for an implementation to produce no output for an invocation of who mil.