mirror of
https://gitlab.com/cryptsetup/cryptsetup.git
synced 2025-12-05 16:00:05 +01:00
32 lines
1.2 KiB
Plaintext
32 lines
1.2 KiB
Plaintext
= cryptsetup-luksHeaderBackup(8)
|
|
:doctype: manpage
|
|
:manmanual: Maintenance Commands
|
|
:mansource: cryptsetup {release-version}
|
|
:man-linkstyle: pass:[blue R < >]
|
|
:COMMON_OPTIONS:
|
|
:ACTION_LUKSHEADERBACKUP:
|
|
|
|
== Name
|
|
|
|
cryptsetup-luksHeaderBackup - store a binary backup of the LUKS header and keyslot area
|
|
|
|
== SYNOPSIS
|
|
|
|
*cryptsetup _luksHeaderBackup_ --header-backup-file <file> [<options>] <device>*
|
|
|
|
== DESCRIPTION
|
|
|
|
Stores a binary backup of the LUKS header and keyslot area.
|
|
|
|
*<options>* can be [--header, --header-backup-file, --disable-locks].
|
|
|
|
*NOTE:* Using '-' as a filename writes the header backup to a file named '-'.
|
|
|
|
*WARNING:* This backup file and a passphrase valid at the time of backup allow decryption of the LUKS data area, even if the passphrase was later changed or removed from the LUKS device.
|
|
Also, note that with a header backup, you lose the ability to wipe the LUKS device securely by just overwriting the header and keyslots.
|
|
You must either securely erase all header backups or overwrite the encrypted data area.
|
|
The second option is less secure, as some sectors can survive, e.g., due to defect management.
|
|
|
|
include::man/common_options.adoc[]
|
|
include::man/common_footer.adoc[]
|