CRYPTSETUP-LUKSSUSPEND(8)

📦
version 2.8.8 · 17 versions
, in arch rolling, fedora 44, nixpkgs unstable

💅 CRYPTSETUP-LUKSSUSPEND(8) 💅

okay bestie, gather round, because this one is literally the maintenance-command page for cryptsetup-luksSuspend, and she is dramatic in the best way 🎀

✨ NAME ✨

cryptsetup-luksSuspend — suspends an active device and wipes the key 🔐💀

🌸 SYNOPSIS 🌸

cryptsetup luksSuspend [<options>] <name>

🦋 DESCRIPTION 🦋

So what this does is: it suspends an active device (meaning all IO operations will block and accesses to the device will wait indefinitely 🫠) and it wipes the encryption key from kernel memory. iconique. terrifying. obsessed.

Now, real talk — even though the luksSuspend operation wipes encryption keys from memory, it does not remove possible plaintext data in various caches or in-kernel metadata for mounted filesystems. so like, the key is gone but the vibes of your data may still be lingering around. no cap.

After this operation, you must use luksResume to reinstate the encryption key and unblock the device, or close to remove the mapped device. those are your only two exits, bestie, pick one 💖

WARNING: To avoid deadlock, never suspend the device on which the cryptsetup binary resides. fr fr. do not do this. that is a deadlock and a deadlock is not the vibe 💀

<options> can be [--header, --disable-locks].

🎀 OPTIONS 🎀

  • --batch-mode, -q — Suppresses all confirmation questions. Use with care! 🙈 If the --verify-passphrase option is not specified, this option also switches off the passphrase verification.
  • --debug or --debug-json — Run in debug mode with full diagnostic logs. Debug output lines are always prefixed by #. If --debug-json is used, additional LUKS2 JSON data structures are printed. (very "show me everything" of it ✨)
  • --disable-locks — Disable lock protection for metadata on disk. This option is valid only for LUKS2 and is ignored for other formats.
WARNING: Do not use this option unless you run cryptsetup in a restricted environment where locking is impossible to perform (where /run directory cannot be used). like, only if you actually have to 🫶
  • --header <device or file storing the LUKS header> — Use a detached (separated) metadata device or file where the LUKS header is stored. This option allows one to store the ciphertext and LUKS header on different devices. For commands that change the LUKS header (e.g., luksAddKey), specify the device or file with the LUKS header directly as the LUKS device. 💜
  • --help, -? — Show help text and default parameters. the "just tell me what to do" button 🌈
  • --usage — Show short option help.
  • --version, -V — Show the program version.

😭 REPORTING BUGS 😭

Report bugs at cryptsetup mailing list <cryptsetup@lists.linux.dev> or in Issues project section <https://gitlab.com/cryptsetup/cryptsetup/-/issues/new>.

Please attach the output of the failed command with --debug option added. (yes, the whole thing, they need the receipts 🧚)

👑 SEE ALSO 👑

Cryptsetup FAQ <https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions>

cryptsetup(8), integritysetup(8) and veritysetup(8)

⭐ CRYPTSETUP ⭐

Part of cryptsetup project <https://gitlab.com/cryptsetup/cryptsetup/>. main character energy, honestly.

and that's the whole page, bestie 🍓 this was cryptsetup version 2.8.8, dated 2026-09-07, from the CRYPTSETUP-LUKSSUSPEND(8) manual — slay, stay encrypted, and please don't suspend the device your cryptsetup binary lives on 💖✨

📦 where this page comes from