---
name: "cryptsetup-config"
section: "8"
platform: "linux"
package: "cryptsetup"
version: "2.8.8-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/cryptsetup-config"
---

# cryptsetup-config(8)

set permanent configuration options (store to LUKS header)

## NAME

cryptsetup-config - set permanent configuration options (store to LUKS header)

## SYNOPSIS

**cryptsetup** *config* **\<options\> \<device\>**

## DESCRIPTION

*Set permanent configuration options (store to LUKS header).* *The config command is supported only for LUKS2.*

*The permanent options can be --priority to set priority (normal, prefer, ignore) for keyslot (specified by --key-slot) or --label and --subsystem.*

**\<options\>** *can be \[--priority, --label, --subsystem, --key-slot, --header, --disable-locks\].*

## OPTIONS

**--batch-mode***,* **-q**

*Suppresses all confirmation questions.* *Use with care!*

*If the --verify-passphrase option is not specified, this option also switches off the passphrase verification.*

**--debug** *or* **--debug-json**

*Run in debug mode with full diagnostic logs.* *Debug output lines are always prefixed by* **#***.*

*If --debug-json is used, additional LUKS2 JSON data structures are printed.*

- **--disable-locks**

  *Disable lock protection for metadata on disk.* *This option is valid only for LUKS2 and is ignored for other formats.*

  **WARNING:** *Do not use this option unless you run cryptsetup in a restricted environment where locking is impossible to perform (where /run directory cannot be used).*

**--header** *\<device or file storing the LUKS header\>*

*Use a detached (separated) metadata device or file where the LUKS header is stored.* *This option allows one to store the ciphertext and LUKS header on different devices.*

*For commands that change the LUKS header (e.g., luksAddKey), specify the device or file with the LUKS header directly as the LUKS device.*

**--help***,* **-?**

*Show help text and default parameters.*

**--key-slot***,* **-S** *\<0-N\>*

*For LUKS operations that add key material, this option allows you to specify which keyslot is selected for the new key.*

*The maximum number of keyslots depends on the LUKS version.* *LUKS1 can have up to 8 keyslots.* *LUKS2 can have up to 32 keyslots based on keyslot area size and key size, but a valid keyslot ID can always be between 0 and 31 for LUKS2.*

**--label** *\<label\>,*  **--subsystem** *\<subsystem\>*

*Set label and subsystem description for LUKS2 device.* *These are similar to filesystem labels.* *The label and subsystem are optional fields and can be later used in udev scripts to trigger user actions once the device marked by these labels is detected.*

**--priority** *\<normal\|prefer\|ignore\>*

*Set a priority for LUKS2 keyslot.* *The prefer priority marked slots are tried before the normal priority.* *The ignored priority means that the slot is never used, if not explicitly requested by --key-slot option.*

- **--usage**

  *Show short option help.*

**--version***,* **-V**

*Show the program version.*

## REPORTING BUGS

*Report bugs at* *cryptsetup mailing list \<cryptsetup@lists.linux.dev\>* *or in* *Issues project section \<https://gitlab.com/cryptsetup/cryptsetup/-/issues/new\>.*

*Please attach the output of the failed command with --debug option added.*

## SEE ALSO

*Cryptsetup FAQ \<https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions\>*

**cryptsetup***(8),* **integritysetup***(8) and* **veritysetup***(8)*

## CRYPTSETUP

*Part of* *cryptsetup project \<https://gitlab.com/cryptsetup/cryptsetup/\>.*