1CRYPTSETUP-LUKSDUMP(8) Maintenance Commands CRYPTSETUP-LUKSDUMP(8)
2
6 cryptsetup-luksDump - dump the header information of a LUKS device
7
9 cryptsetup luksDump [<options>] <device>
10
12 Dump the header information of a LUKS device.
13 If the --dump-volume-key option is used, the LUKS device volume key is
15 dumped instead of the keyslot info. Together with the --volume-key-file
16 option, volume key is dumped to a file instead of standard output.
17 Beware that the volume key cannot be changed without reencryption and
18 can be used to decrypt the data stored in the LUKS container without a
19 passphrase and even without the LUKS header. This means that if the
20 volume key is compromised, the whole device has to be erased or
21 reencrypted to prevent further access. Use this option carefully.
22 To dump the volume key, a passphrase has to be supplied, either
24 interactively or via --key-file.
25 To dump unbound key (LUKS2 format only), --unbound parameter, specific
27 --key-slot id and proper passphrase has to be supplied, either
28 interactively or via --key-file. Optional --volume-key-file parameter
29 enables unbound keyslot dump to a file.
30 To dump LUKS2 JSON metadata (without basic header information like
32 UUID) use --dump-json-metadata option.
33 <options> can be [--dump-volume-key, --dump-json-metadata, --key-file,
35 --keyfile-offset, --keyfile-size, --header, --disable-locks,
36 --volume-key-file, --type, --unbound, --key-slot, --timeout].
37 WARNING: If --dump-volume-key is used with --key-file and the argument
39 to --key-file is '-', no validation question will be asked and no
40 warning given.
41
43 --type <device-type>
44 Specifies required device type, for more info read BASIC ACTIONS
45 section in cryptsetup(8).
46 --key-file, -d name
48 Read the passphrase from file.
49 If the name given is "-", then the passphrase will be read from
51 stdin. In this case, reading will not stop at newline characters.
52 With LUKS, the passphrase supplied via --key-file is always the
54 existing passphrase requested by a command, except in the case of
55 luksFormat where --key-file is equivalent to the positional key
56 file argument.
57 If you want to set a new passphrase via key file, you have to use a
59 positional argument to luksAddKey.
60 See section NOTES ON PASSPHRASE PROCESSING in cryptsetup(8) for
62 more information.
63 --keyfile-offset value
65 Skip value bytes at the beginning of the key file.
66 --keyfile-size, -l value
68 Read a maximum of value bytes from the key file. The default is to
69 read the whole file up to the compiled-in maximum that can be
70 queried with --help. Supplying more data than the compiled-in
71 maximum aborts the operation.
72 This option is useful to cut trailing newlines, for example. If
74 --keyfile-offset is also given, the size count starts after the
75 offset.
76 --volume-key-file, --master-key-file (OBSOLETE alias)
78 Use a volume key stored in a file. The volume key is stored in a
79 file instead of being printed out to standard output.
80 --dump-json-metadata
82 For luksDump (LUKS2 only) this option prints content of LUKS2
83 header JSON metadata area.
84 --dump-volume-key, --dump-master-key (OBSOLETE alias)
86 Print the volume key in the displayed information. Use with care,
87 as the volume key can be used to bypass the passphrases, see also
88 option --volume-key-file.
89 --key-slot, -S <0-N>
91 For LUKS operations that add key material, this option allows you
92 to specify which key slot is selected for the new key.
93 The maximum number of key slots depends on the LUKS version. LUKS1
95 can have up to 8 key slots. LUKS2 can have up to 32 key slots based
96 on key slot area size and key size, but a valid key slot ID can
97 always be between 0 and 31 for LUKS2.
98 --timeout, -t <number of seconds>
100 The number of seconds to wait before timeout on passphrase input
101 via terminal. It is relevant every time a passphrase is asked. It
102 has no effect if used in conjunction with --key-file.
103 This option is useful when the system should not stall if the user
105 does not input a passphrase, e.g. during boot. The default is a
106 value of 0 seconds, which means to wait forever.
107 --header <device or file storing the LUKS header>
109 Use a detached (separated) metadata device or file where the LUKS
110 header is stored. This option allows one to store ciphertext and
111 LUKS header on different devices.
112 For commands that change the LUKS header (e.g. luksAddKey), specify
114 the device or file with the LUKS header directly as the LUKS
115 device.
116 --disable-locks
118 Disable lock protection for metadata on disk. This option is valid
119 only for LUKS2 and ignored for other formats.
120 WARNING: Do not use this option unless you run cryptsetup in a
122 restricted environment where locking is impossible to perform
123 (where /run directory cannot be used).
124 --unbound
126 Creates new or dumps existing LUKS2 unbound keyslot.
127 --batch-mode, -q
129 Suppresses all confirmation questions. Use with care!
130 If the --verify-passphrase option is not specified, this option
132 also switches off the passphrase verification.
133 --debug or --debug-json
135 Run in debug mode with full diagnostic logs. Debug output lines are
136 always prefixed by #.
137 If --debug-json is used, additional LUKS2 JSON data structures are
139 printed.
140 --version, -V
142 Show the program version.
143 --usage
145 Show short option help.
146 --help, -?
148 Show help text and default parameters.
149
151 Report bugs at cryptsetup mailing list <cryptsetup@lists.linux.dev> or
152 in Issues project section
153 <https://gitlab.com/cryptsetup/cryptsetup/-/issues/new>.
154 Please attach output of the failed command with --debug option added.
156
158 Cryptsetup FAQ
159 <https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions>
160 cryptsetup(8), integritysetup(8) and veritysetup(8)
162
164 Part of cryptsetup project <https://gitlab.com/cryptsetup/cryptsetup/>.
165cryptsetup 2.5.0 2022-07-28 CRYPTSETUP-LUKSDUMP(8)