absent)
lsblk
systemd-cryptsetup (for tpm2 and fido2 only)
systemd-cryptsetup (for TPM2 and FIDO2 only)
Used to unlock the container, but can not be used for container creation. A hidraw device referring to the FIDO2 device (for example /dev/hidraw1). Alternatively the special value auto may be specified, in order to automatically determine the device node of a currently currently plugged in security token (of which there must be exactly one).
Note that only LUKS2 containers are supported
Note that systemd-cryptsetup (v253 or newer) is required.
-Note that user presence confirmation (e.g. touching the security token) may be required.
+Note that user presence confirmation (for example touching the security token) may be required.
Adds a FIDO2 security token that implements the “hmac-secret” extension (e.g. a YubiKey) to given container on device. Expects a hidraw device referring to the FIDO2 device (e.g. /dev/hidraw1). Alternatively the special value auto may be specified, in order to automatically determine the device node of a currently plugged in security token (of which there must be exactly one).
Note that new_keyslot does not affect the keyslot for fido2 enrollment.
Adds a FIDO2 security token that implements the hmac-secret extension (for example a YubiKey) to given container on device. Expects a hidraw device referring to the FIDO2 device (e.g. /dev/hidraw1). Alternatively the special value auto may be specified, in order to automatically determine the device node of a currently plugged in security token (of which there must be exactly one).
Note that new_keyslot does not affect the keyslot for FIDO2 enrollment.
Note that systemd-cryptsetup (v248 or newer) is required.
-Note that user presence confirmation (e.g. touching the security token) may be required.
-Note that the enrollment operation is NOT idempotent (because systemd-cryptenroll does not support idempotency).
+Note that user presence confirmation (for example touching the security token) may be required.
+Note that the enrollment operation is NOT idempotent (because systemd-cryptenroll does not support idempotency).
Adds a TPM2 security chip to given container on device. Expects a device node path referring to the TPM2 chip (e.g. /dev/tpmrm0). Alternatively the special value auto may be specified, in order to automatically determine the device node of a currently discovered TPM2 device (of which there must be exactly one). Requires new_tpm2_pcrs.
Note that new_keyslot does not affect the keyslot for tpm2 enrollment.
Note that new_keyslot does not affect the keyslot for TPM2 enrollment.
Note that only LUKS2 containers are supported.
Note that systemd-cryptsetup (v248 or newer) is required.
string
added in community.crypto 3.1.0
-TPM2 PCRs (Platform Configuration Registers) to bind to. See systemd-cryptenroll documentation for details (--tpm2-pcrs argument).
+TPM2 PCRs (Platform Configuration Registers) to bind to. See systemd-cryptenroll documentation for details (--tpm2-pcrs argument).
Removes all key slots on device that are unlocked by a fido2 device. Needs keyfile, passphrase, tpm2_device, or fido2_device for authorization.
Removes all key slots on device that are unlocked by a FIDO2 device. Needs keyfile, passphrase, tpm2_device, or fido2_device for authorization.
Note that systemd-cryptsetup (v248 or newer) is required.
Choices:
Removes all key slots on device that are unlocked by a tpm2 device. Needs keyfile, passphrase, tpm2_device, or fido2_device for authorization.
Removes all key slots on device that are unlocked by a TPM2 device. Needs keyfile, passphrase, tpm2_device, or fido2_device for authorization.
Note that systemd-cryptsetup (v248 or newer) is required.
Choices:
Desired state of the LUKS container. Based on its value creates, destroys, opens or closes the LUKS container on a given device.
present will create LUKS container unless already present. Requires device and either keyfile or passphrase options to be provided.
absent will remove existing LUKS container if it exists. Requires device or name to be specified.
opened will unlock the LUKS container. Requires device and keyfile, passphrase, tpm2_device, or fido2_device to be specified. If the container does not exist it will be created first, however tpm2_device and fido2_device can not be used for creation. Use the name option to set the name of the opened container. Otherwise the name will be generated automatically and returned as a part of the result.
opened will unlock the LUKS container. Requires device and one of keyfile, passphrase, tpm2_device, or fido2_device to be specified. If the container does not exist it will be created first, however tpm2_device and fido2_device can not be used for creation. Use the name option to set the name of the opened container. Otherwise the name will be generated automatically and returned as a part of the result.
closed will lock the LUKS container. However if the container does not exist it will be created. Requires device and either keyfile or passphrase options to be provided. If container does already exist device or name will suffice.
Choices: