# systemd-cryptsetup-generator

## NAME



           systemd-cryptsetup-generator - Unit generator for /etc/crypttab
    


## SYNOPSIS



           /usr/lib/systemd/system-generators/systemd-cryptsetup-generator
    


## DESCRIPTION



           systemd-cryptsetup-generator is a generator that translates
           /etc/crypttab into native systemd units early at boot and when
           configuration of the system manager is reloaded. This will create
           systemd-cryptsetup@.service(8) units as necessary.
    
           systemd-cryptsetup-generator implements systemd.generator(7).
    


## KERNEL COMMAND LINE



           systemd-cryptsetup-generator understands the following kernel
           command line parameters:
    
           _luks=_ , _rd.luks=_
               Takes a boolean argument. Defaults to "yes". If "no", disables
               the generator entirely.  _rd.luks=_ is honored only in the
               initrd while _luks=_ is honored by both the main system and in
               the initrd.
    
               Added in version 186.
    
           _luks.crypttab=_ , _rd.luks.crypttab=_
               Takes a boolean argument. Defaults to "yes". If "no", causes
               the generator to ignore any devices configured in
               /etc/crypttab (_luks.uuid=_ will still work however).
               _rd.luks.crypttab=_ is honored only in initrd while
               _luks.crypttab=_ is honored by both the main system and in the
               initrd.
    
               Added in version 186.
    
           _luks.uuid=_ , _rd.luks.uuid=_
               Takes a LUKS superblock UUID as argument. This will activate
               the specified device as part of the boot process as if it was
               listed in /etc/crypttab. This option may be specified more
               than once in order to set up multiple devices.  _rd.luks.uuid=_
               is honored only in the initrd, while _luks.uuid=_ is honored by
               both the main system and in the initrd.
    
               If /etc/crypttab contains entries with the same UUID, then the
               name, keyfile and options specified there will be used.
               Otherwise, the device will have the name "luks-UUID".
    
               If /etc/crypttab exists, only those UUIDs specified on the
               kernel command line will be activated in the initrd or the
               real root.
    
               Added in version 186.
    
           _luks.name=_ , _rd.luks.name=_
               Takes a LUKS super block UUID followed by an "=" and a name.
               This implies _rd.luks.uuid=_ or _luks.uuid=_ and will additionally
               make the LUKS device given by the UUID appear under the
               provided name.
    
               This parameter is the analogue of the first crypttab(5) field
               _volume-name_.
    
               _rd.luks.name=_ is honored only in the initrd, while _luks.name=_
               is honored by both the main system and in the initrd.
    
               Added in version 218.
    
           _luks.data=_ , _rd.luks.data=_
               Takes a LUKS super block UUID followed by a "=" and a block
               device specification for device hosting encrypted data.
    
               For those entries specified with _rd.luks.uuid=_ or _luks.uuid=_ ,
               the data device will be set to the one specified by
               _rd.luks.data=_ or _luks.data=_ of the corresponding UUID.
    
               LUKS data device parameter is useful for specifying encrypted
               data devices with detached headers specified in _luks.options_
               entry containing "header=" argument. For example,
               _rd.luks.uuid=_ b40f1abf-2a53-400a-889a-2eccc27eaa40
               _rd.luks.options=_ b40f1abf-2a53-400a-889a-2eccc27eaa40=header=/path/to/luks.hdr
               _rd.luks.data=_ b40f1abf-2a53-400a-889a-2eccc27eaa40=/dev/sdx.
               Hence, in this case, we will attempt to unlock LUKS device
               assembled from data device "/dev/sdx" and LUKS header
               (metadata) put in "/path/to/luks.hdr" file. This syntax is for
               now only supported on a per-device basis, i.e. you have to
               specify LUKS device UUID.
    
               This parameter is the analogue of the second crypttab(5) field
               _encrypted-device_.
    
               _rd.luks.data=_ is honored only in the initrd, while _luks.data=_
               is honored by both the main system and in the initrd.
    
               Added in version 247.
    
           _luks.key=_ , _rd.luks.key=_
               Takes a password file name as argument or a LUKS super block
               UUID followed by a "=" and a password file name.
    
               For those entries specified with _rd.luks.uuid=_ or _luks.uuid=_ ,
               the password file will be set to the one specified by
               _rd.luks.key=_ or _luks.key=_ of the corresponding UUID, or the
               password file that was specified without a UUID.
    
               It is also possible to specify an external device which should
               be mounted before we attempt to unlock the LUKS device.
               systemd-cryptsetup will use password file stored on that
               device. Device containing password file is specified by
               appending colon and a device identifier to the password file
               path. For example,
               _rd.luks.uuid=_ b40f1abf-2a53-400a-889a-2eccc27eaa40
               _rd.luks.key=_ b40f1abf-2a53-400a-889a-2eccc27eaa40=/keyfile:LABEL=keydev.
               Hence, in this case, we will attempt to mount file system
               residing on the block device with label "keydev". This syntax
               is for now only supported on a per-device basis, i.e. you have
               to specify LUKS device UUID.
    
               This parameter is the analogue of the third crypttab(5) field
               _key-file_.
    
               _rd.luks.key=_ is honored only in the initrd, while _luks.key=_ is
               honored by both the main system and in the initrd.
    
               Added in version 202.
    
           _luks.options=_ , _rd.luks.options=_
               Takes a LUKS super block UUID followed by an "=" and a string
               of options separated by commas as argument. This will override
               the options for the given UUID.
    
               If only a list of options, without a UUID, is specified, they
               apply to any UUIDs not specified elsewhere, and without an
               entry in /etc/crypttab.
    
               This parameter is the analogue of the fourth crypttab(5) field
               _options_.
    
               It is possible to specify an external device which should be
               mounted before we attempt to unlock the LUKS device.
               systemd-cryptsetup will assemble LUKS device by combining data
               device specified in _luks.data_ with detached LUKS header found
               in "header=" argument. For example,
               _rd.luks.uuid=_ b40f1abf-2a53-400a-889a-2eccc27eaa40
               _rd.luks.options=_ b40f1abf-2a53-400a-889a-2eccc27eaa40=header=/luks.hdr:LABEL=hdrdev
               _rd.luks.data=_ b40f1abf-2a53-400a-889a-2eccc27eaa40=/dev/sdx.
               Hence, in this case, we will attempt to mount file system
               residing on the block device with label "hdrdev", and look for
               "luks.hdr" on that file system. Said header will be used to
               unlock (decrypt) encrypted data stored on /dev/sdx. This
               syntax is for now only supported on a per-device basis, i.e.
               you have to specify LUKS device UUID.
    
               _rd.luks.options=_ is honored only by initial RAM disk (initrd)
               while _luks.options=_ is honored by both the main system and in
               the initrd.
    
               Added in version 208.
    


* * *