CRYPTSETUP-SSH(8) Maintenance Commands CRYPTSETUP-SSH(8)

# [NAME](#NAME)

cryptsetup-ssh - manage LUKS2 SSH token

# [SYNOPSIS](#SYNOPSIS)

**cryptsetup-ssh <action> \[<options>] <action args>**

# [DESCRIPTION](#DESCRIPTION)

Experimental cryptsetup plugin for unlocking LUKS2 devices with a token connected to an SSH server.

This plugin currently allows only adding a token to an existing keyslot. See [**cryptsetup**(8)](/man/enterprise-packages/cryptsetup-fips/cryptsetup.8) for instructions on how to remove, import or export the token.

## [Add operation](#Add_operation)

**add <options> <device>**

Adds the SSH token to **<device>**.

The specified SSH server must contain a key file on the specified path with a passphrase for an existing keyslot on the device. Provided credentials will be used by cryptsetup to get the password when opening the device using the token.

Options --ssh-server, --ssh-user, --ssh-keypath and --ssh-path are required for this operation.

# [OPTIONS](#OPTIONS)

**--debug**

Show debug messages

**--debug-json**

Show debug messages including JSON metadata

**--help**, **-?**

Show help

**--key-slot** *number*

Keyslot to assign the token to. If not specified, the token will be assigned to the first keyslot matching the provided passphrase.

**--ssh-keypath** *string*

Path to the SSH key for connecting to the remote server.

**--ssh-path** *string*

Path to the key file on the remote server.

**--ssh-server** *string*

IP address/URL of the remote server for this token.

**--ssh-user** *string*

The username used for the remote server.

**--verbose**, **-v**

Shows more detailed error messages

**--version**, **-V**

Print program version

# [NOTES](#NOTES)

The information provided when adding the token (SSH server address, user and paths) will be stored in the LUKS2 header in plaintext.

# [AUTHORS](#AUTHORS)

The cryptsetup-ssh tool is written by Vojtech Trefny.

# [REPORTING BUGS](#REPORTING_BUGS)

Report bugs at *cryptsetup mailing list* <cryptsetup@lists.linux.dev> or in *Issues project section* <https://gitlab.com/cryptsetup/cryptsetup/-/issues/new>.

Please attach the output of the failed command with --debug option added.

# [SEE ALSO](#SEE_ALSO)

*Cryptsetup FAQ* <https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions>

[**cryptsetup**(8)](/man/enterprise-packages/cryptsetup-fips/cryptsetup.8), [**integritysetup**(8)](/man/enterprise-packages/cryptsetup-fips/integritysetup.8) and [**veritysetup**(8)](/man/enterprise-packages/cryptsetup-fips/veritysetup.8)

# [CRYPTSETUP](#CRYPTSETUP)

Part of *cryptsetup project* <https://gitlab.com/cryptsetup/cryptsetup/>.

2026-10-01 cryptsetup-ssh 2.8.8

---

Document: cryptsetup-ssh(8) from cryptsetup-fips 2.8.8-r4 (Chainguard OS)
Source: https://gitlab.com/cryptsetup/cryptsetup.git