man/systemd-cryptsetup@.service.xml

   1 <?xml version="1.0"?>
   2 <!--*-nxml-*-->
   3 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
   4   "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   5 <!-- SPDX-License-Identifier: LGPL-2.1+ -->
   6 <refentry id="systemd-cryptsetup@.service" conditional='HAVE_LIBCRYPTSETUP'>
   7
   8   <refentryinfo>
   9     <title>systemd-cryptsetup@.service</title>
  10     <productname>systemd</productname>
  11   </refentryinfo>
  12
  13   <refmeta>
  14     <refentrytitle>systemd-cryptsetup@.service</refentrytitle>
  15     <manvolnum>8</manvolnum>
  16   </refmeta>
  17
  18   <refnamediv>
  19     <refname>systemd-cryptsetup@.service</refname>
  20     <refname>systemd-cryptsetup</refname>
  21     <refpurpose>Full disk decryption logic</refpurpose>
  22   </refnamediv>
  23
  24   <refsynopsisdiv>
  25     <para><filename>systemd-cryptsetup@.service</filename></para>
  26     <para><filename>/usr/lib/systemd/systemd-cryptsetup</filename></para>
  27   </refsynopsisdiv>
  28
  29   <refsect1>
  30     <title>Description</title>
  31
  32     <para><filename>systemd-cryptsetup@.service</filename> is a
  33     service responsible for setting up encrypted block devices. It is
  34     instantiated for each device that requires decryption for
  35     access.</para>
  36
  37     <para><filename>systemd-cryptsetup@.service</filename> will ask
  38     for hard disk passwords via the <ulink
  39     url="https://systemd.io/PASSWORD_AGENTS/">password agent logic</ulink>, in
  40     order to query the user for the password using the right mechanism at boot
  41     and during runtime.</para>
  42
  43     <para>At early boot and when the system manager configuration is reloaded, <filename>/etc/crypttab</filename> is
  44     translated into <filename>systemd-cryptsetup@.service</filename> units by
  45     <citerefentry><refentrytitle>systemd-cryptsetup-generator</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
  46
  47     <para>In order to unlock a volume a password or binary key is
  48     required. <filename>systemd-cryptsetup@.service</filename> tries to acquire a suitable password or binary
  49     key via the following mechanisms, tried in order:</para>
  50
  51     <orderedlist>
  52       <listitem><para>If a key file is explicitly configured (via the third column in
  53       <filename>/etc/crypttab</filename>), a key read from it is used. If a PKCS#11 token is configured
  54       (using the <varname>pkcs11-uri=</varname> option) the key is decrypted before use.</para></listitem>
  55
  56       <listitem><para>If no key file is configured explicitly this way, a key file is automatically loaded
  57       from <filename>/etc/cryptsetup-keys.d/<replaceable>volume</replaceable>.key</filename> and
  58       <filename>/run/cryptsetup-keys.d/<replaceable>volume</replaceable>.key</filename>, if present. Here
  59       too, if a PKCS#11 token is configured, any key found this way is decrypted before
  60       use.</para></listitem>
  61
  62       <listitem><para>If the <varname>try-empty-password</varname> option is specified it is then attempted
  63       to unlock the volume with an empty password.</para></listitem>
  64
  65       <listitem><para>The kernel keyring is then checked for a suitable cached password from previous
  66       attempts.</para></listitem>
  67
  68       <listitem><para>Finally, the user is queried for a password, possibly multiple times.</para></listitem>
  69     </orderedlist>
  70
  71     <para>If no suitable key may be acquired via any of the mechanisms describes above, volume activation fails.</para>
  72   </refsect1>
  73
  74   <refsect1>
  75     <title>See Also</title>
  76     <para>
  77       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
  78       <citerefentry><refentrytitle>systemd-cryptsetup-generator</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
  79       <citerefentry><refentrytitle>crypttab</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
  80       <citerefentry project='die-net'><refentrytitle>cryptsetup</refentrytitle><manvolnum>8</manvolnum></citerefentry>
  81      </para>
  82   </refsect1>
  83
  84 </refentry>