CRYPTSETUP-SSH

NAME

cryptsetup-ssh - manage LUKS2 SSH token

SYNOPSIS

cryptsetup-ssh <action> [<options>] <action args>

DESCRIPTION

Experimental cryptsetup plugin for unlocking LUKS2 devices with token connected to an SSH server.

This plugin currently allows only adding a token to an existing key slot. See cryptsetup(8) for instructions on how to remove, import or export the token.

Add operation

add <options> <device>

Adds the SSH token to <device>.

The specified SSH server must contain a key file on the specified path with a passphrase for an existing key slot on the device. Provided credentials will be used by cryptsetup to get the password when opening the device using the token.

Options --ssh-server, --ssh-user, --ssh-keypath and --ssh-path are required for this operation.

OPTIONS

--key-slot=NUM

Keyslot to assign the token to. If not specified, the token will be assigned to the first key slot matching provided passphrase.

--ssh-keypath=STRING

Path to the SSH key for connecting to the remote server.

--ssh-path=STRING

Path to the key file on the remote server.

--ssh-server=STRING

IP address/URL of the remote server for this token.

--ssh-user=STRING

Username used for the remote server.

--debug

Show debug messages

--debug-json

Show debug messages including JSON metadata

--verbose, -v

Shows more detailed error messages

--help, -?

Show help

--version, -V

Print program version

NOTES

The information provided when adding the token (SSH server address, user and paths) will be stored in the LUKS2 header in plaintext.

AUTHORS

The cryptsetup-ssh tool is written by Vojtech Trefny.

REPORTING BUGS

Report bugs at cryptsetup mailing list <cryptsetup@lists.linux.dev> or in Issues project section <https://gitlab.com/cryptsetup/cryptsetup/-/issues/new>.

Please attach output of the failed command with --debug option added.

SEE ALSO

Cryptsetup FAQ <https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions>

cryptsetup(8), integritysetup(8) and veritysetup(8)

CRYPTSETUP

Part of cryptsetup project <https://gitlab.com/cryptsetup/cryptsetup/>.