/usr/bin/cryptsetup-ssh

Usage: cryptsetup-ssh [OPTION...] <action> <device>
Experimental cryptsetup plugin for unlocking LUKS2 devices with token connected
to an SSH server

 Options for the 'add' action:
      --external-tokens-path=STRING
                             Path to directory containinig libcryptsetup
                             external tokens
      --key-slot=NUM         Keyslot to assign the token to. If not specified,
                             token will be assigned to the first keyslot
                             matching provided passphrase.
      --ssh-keypath=STRING   Path to the SSH key for connecting to the remote
                             server
      --ssh-path=STRING      Path to the key file on the remote server
      --ssh-server=STRING    IP address/URL of the remote server for this token

      --ssh-user=STRING      Username used for the remote server

 Generic options:
      --debug                Show debug messages
      --debug-json           Show debug messages including JSON metadata
  -v, --verbose              Shows more detailed error messages

  -?, --help                 Give this help list
      --usage                Give a short usage message
  -V, --version              Print program version

This plugin currently allows only adding a token to an existing key slot.

Specified SSH server must contain a key file on the specified path with a
passphrase for an existing key slot on the device.
Provided credentials will be used by cryptsetup to get the password when
opening the device using the token.

Note: The information provided when adding the token (SSH server address, user
and paths) will be stored in the LUKS2 header in plaintext.