I dual boot Fedora and Windows Vista and want them to share a partition so that I can work on the same files in both Linux and Windows, and I need everything to be encrypted.

I encrypted the shared drive with VeraCrypt since TrueCrypt is out of date. Windows can mount the volume at login with ease.

I tried to do the same in Linux but with no luck since I can't figure out how to use crypttab with the veracrypt option, or even if it has one. cryptsetup works fine since it's just necessary to add the --veracrypt option, but crypttab does not seem to have that.

cryptsetup --veracrypt open --type tcrypt /dev/sdX veracrypt-volume

How do I mount a VeraCrypt volume with crypttab? Is it possible yet?


I had the same problem! Turns out systemd was lacking such an option, so I have implemented it myself. It is included in systemd 232 or later. (You also need cryptsetup 1.67 or newer for the actual cryptography support, but it sounds like you have that since the manual mount works.)

The new crypttab option is tcrypt-veracrypt; it implies tcrypt so you don't need to specify that separately. For example:

#Volume name  Device path     Crypto key file     Mounting options  
 data         /dev/sda7       /etc/volume.passwd  noauto,tcrypt-veracrypt

Of course, you need to put your crypto key (with no newline) in /etc/volume.passwd. Also note that if you're trying to decrypt a system partition you need to indicate that using the tcrypt-system option, because it won't detect the different format without it. Here's an example. I'm also demonstrating the use of the UUID= volume specifier here.

 data         UUID=your-uuid  /etc/volume.passwd  tcrypt-veracrypt,tcrypt-system

See the pull request I made for more info about tcrypt-veracrypt.

| improve this answer | |
  • 1
    The mapped device will then be available as /dev/mapper/data which you can then include in your /etc/fstab or mkdir /media/tcdata && mount /dev/mapper/data /media/tcdata – GMaster Oct 31 '16 at 0:46
  • I was unable to get this working as described on Debian 10 Buster. For some reason the password file wasn't being handled correctly by cryptdisks_start (confirmed it had no new line at the end). It eventually worked with the options tcrypt,veracrypt,keyscript=/bin/cat,noearly. Not sure why passing the passphrase through /bin/cat would make a difference, nor why tcryrpt,veracrypt worked over tcrypt-veracrypt. – JinnKo Jul 9 at 8:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.