Provided by:
cryptsetup_1.0.3-0ubuntu1_i386 
NAME
crypttab - static information about crypted filesystems
SYNOPSIS
crypttab
<target device> <source device> [key file] [options]
DESCRIPTION
The file crypttab (usually located at /etc/crypttab) contains
descriptive information about encrypted file systems. crypttab is only
read by programs, and not written; it is the duty of the system
administrator to properly create and maintain this file. Each file
system is described on a separate line; fields on each line are
separated by tabs or spaces. Lines starting with "#" are comments,
empty lines are ignored. The order of records in crypttab is important
because the /etc/init.d/cryptdisks script sequentially iterates through
crypttab doing its thing.
The first field target device describes the mapped device name. It must
be a plain filename without any directories. A mapped device
/dev/mapper/device name will be created by cryptsetup(8) crypting data
from and onto the source device.
The second field source device describes the block special device that
should hold the encrypted data.
The third field key file describes the file to use for decrypting the
encrypted data of the source device.
It can also be a device name (eg. /dev/random, which is useful for
encrypted swap devices). Warning: luks does not support random data
keys (like /dev/random), it requires a persistent key.
If the key file is empty or the string none, the key data (ie. a
password) will be read interactively from the console. In this case,
the options precheck, check and retry may be useful.
The fourth field options describes the cryptsetup options associated
with the encryption process. Options are in the format:
key=value[,key=value ...] The following options are supported:
OPTIONS
cipher=<cipher>
Encryption algorithm. See cryptsetup -c.
size=<size>
Encryption key size. See cryptsetup -s.
hash=<hash>
Hash algorithm. See cryptsetup -h.
verify Verify password. Uses cryptsetup -y.
readonly
The backing device is read-only (eg: a dvd).
luks Use device with luks extensions.
swap Run mkswap on the created device.
tmp Run mke2fs on the created device.
precheck=<precheck>
Check the source device by suitable program; if the check fails
the device is not created; If a program is provided as argument,
it is run, using the decrypted volume as first argument. The
program is assumed to be a script in /lib/cryptsetup/checks.
check=<check>
Check the content of the device by suitable program; if the
check fails the device is removed; if the retry option is given,
the creation is repeated. If a program is provided as argument,
it is run, using the decrypted volume as first argument.
Cryptdisks searches for the given program in
/lib/cryptsetup/checks.
retry=<num>
If the device creation fails, or if the check program fails,
remove the device, and try again to create it: if key is "none"
this will ask for the password again. This is repeated <num>
times. Default is 3.
timeout=<sec>
If key is "none", the cryptdisks script interactively prompts
for a password. The timeout option specifies the time in seconds
to wait for the password before timing out.
loud Be loud. Print warnings if a device does not exist.
ssl Decrypt the keyfile with openssl before actually using it for
cryptsetup. This requires /usr/bin/openssl to be available. Thus
it doesn’t work for encrypted root filesystems or if /usr is a
seperate filesystem.
gpg Decrypt the keyfile with gnupg before actually using it for
cryptsetup. This requires /usr/bin/gnupg to be available. Thus
it doesn’t work for encrypted root filesystems or if /usr is a
seperate filesystem.
EXAMPLES
Encrypted swap device
cswap /dev/sda6 /dev/random swap
Encrypted luks disk with interactive password
cdisk1 /dev/hda1 none luks
Encrypted ext2 disk with interactive password, retry 3 times if the
check fails
cdisk0 /dev/sda2 none check=ext2,retry=3
Encrypted disk with twofish as cipher
cdisk2 /dev/sda3 none cipher=twofish
Encrypted luks disk with a openssl-encrypted keyfile
cdisk3 /dev/hda2 /etc/keys/keyfile luks,ssl
SEE ALSO
cryptsetup(8), /etc/crypttab
AUTHOR
This manual page was converted to asciidoc from Michael Gebetsroither
<michael.geb@gmx.at>. This manual page was originally written by
Bastian Kleineidam <calvin@debian.org> for the Debian distribution of
cryptsetup (but can be used by others). It has been improved by Jonas
Meurer <jonas@freesources.org>. Parts of this manual are taken and
adapted from the fstab(5) manual page.
CRYPTTAB(5)