Where Is crypttab on Linux?
crypttab maps encrypted devices at boot from /etc/crypttab. The four fields plus key file dirs.
Last updated
The /etc/crypttab file lists encrypted block devices to unlock at boot, one per line as volume name, device, key file, and options. Unlocked volumes appear under /dev/mapper. systemd converts each line into cryptsetup units at boot and on daemon reload.
The key field decides the flow: a path reads a file, none or - prompts at boot, /dev/urandom randomizes swap each start. Modern setups also load volume.key files from /etc/cryptsetup-keys.d, or enroll TPM2, FIDO2, and PKCS11 tokens via systemd-cryptenroll. Prefer UUID device specs over /dev/sd names that reorder.
Where Linux crypttab stores this, by platform
/etc/crypttab
Four fields per line; comments with #. Key files in /etc/cryptsetup-keys.d/<volume>.key auto load. After edits run daemon-reload; test with systemd-cryptsetup attach before rebooting.
Frequently asked questions
crypttab or fstab for encrypted drives
Both. crypttab unlocks the device to /dev/mapper/<name>, fstab mounts that mapper path. The mapper name ties the two files together; a mismatch mounts nothing.
how do i unlock luks at boot without a password
Add a key file path in crypttab's third field, drop keys in /etc/cryptsetup-keys.d, or enroll TPM2/FIDO2 with systemd-cryptenroll and the matching option. Guard key files with root only permissions.
Notice an outdated path? Let us know.