How to change dm_crypt aes/256 LVM password after install?

Question

I installed Fedora 14 & Ubuntu 10.04 LTS on my PC. I used dm_crypt/LVM with aes256 in both installs (2 VolumeGroups, each encrypted, so there is 2 separated & encrypted linux distro on this machine). How can I change the passwords for the encrypted VGs?

Answer 1

I'm not aware of a way to change LUKS keys without cryptsetup. I'll edit this if I find a way. But I think I can help you with everything else.

I think you need clarity on how encryption fits into the grand scheme of things.

dm_crypt, through the cryptsetup userspace utility, works on anything that looks like a block device. This can be an entire hard drive (i.e. /dev/sda), a single partition of that hard drive (i.e. /dev/sda1), or VG (volume group, i.e. /dev/volume_group).

A VG will have previously been made a PV (physical volume) by using pvcreate on one or more real disk partitions (like /dev/sda1). Then, all of the PVs are junctioned into a VG using vgcreate, which then creates a new device representing the VG in /dev. Once you create the VG you need to format it by issuing a command such as mkfs.ext4 /dev/volume_group, and then mount /dev/volume_group to wherever. Looking at a plainmount command run as root should give you an idea of what is where currently on your system.

An encrypted volume must be created by passing a block device (doesn't matter whether it's a real disk or a VG) to cryptsetup luksFormat. At that time you can enter a passphrase or specify a keyfile. Then, to use it, you need to open that block device using cryptsetup luksOpen (which prompts you for the previously assigned passphrase, or you can specify a keyfile); this will create another "virtual" block device in /dev/mapper, i.e. /dev/mapper/encrypted. This is then what you want to give to tools like mkfs.ext4, fsck, and mount to actually use the encrypted block device.

Important: Before you do the cryptsetup luksFormat you want to overwrite the free space on your disk with random data, either with dd or the badblocks command. luksFormat doesn't do that and if you don't do that before hand an adversary can possibly tell where you've writen to the disk and where you haven't.

The point in using a volume group in combination with encryption on a single hard drive is usually to serve the same purpose as disk partitions, but since it's within an encrypted volume, your "partitioning" scheme can't be discovered unless it's unlocked. So you would take a full disk, create an encrypted volume, and use pvcreate, vgcreate, and lvcreate to create logical volumes which are then mounted as though they were partitions. (This explains it: http://linuxgazette.net/140/kapil.html)

Truly unmounting the volume will involve umount /dev/mapper/encrypted to disconnect the filesystem and then a cryptsetup luksClose encrypted to disconnect the virtual block device.

cryptsetup allows adding (luksAddKey) and removing (luksDelKey) keys. I think you can have up to 8 keys on an encrypted volume. A key is changed by adding a new key and then deleting the old key.

Specific syntax for all the cryptsetup options are here: http://linux.die.net/man/8/cryptsetup

Answer 2

If you have done crypting with cryptsetup, then you can change the key as:

cryptsetup luksChangeKey []

FYI: See this Link