Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I installed Fedora 14 & Ubuntu 10.04 LTS on my PC. I used dm_crypt/LVM with aes256 in both installs (2 VolumeGroups, each encrypted, so there is 2 separated & encrypted linux distro on this machine). How can I change the passwords for the encrypted VGs?

share|improve this question
The bounty requirement go a little beyond strictly answering the question: please explain how to create an encrypted volume, create a filesystem on it, then change the passphrase. Ideally address both LUKS and non-LUKS. I'll be testing on Ubuntu 10.04, kernel 2.6.32, cryptsetup 1.1.0. – Gilles Apr 16 '11 at 16:57
up vote 5 down vote accepted

I'm not aware of a way to change LUKS keys without cryptsetup. I'll edit this if I find a way. But I think I can help you with everything else.

I think you need clarity on how encryption fits into the grand scheme of things.

dm_crypt, through the cryptsetup userspace utility, works on anything that looks like a block device. This can be an entire hard drive (i.e. /dev/sda), a single partition of that hard drive (i.e. /dev/sda1), or VG (volume group, i.e. /dev/volume_group).

A VG will have previously been made a PV (physical volume) by using pvcreate on one or more real disk partitions (like /dev/sda1). Then, all of the PVs are junctioned into a VG using vgcreate, which then creates a new device representing the VG in /dev. Once you create the VG you need to format it by issuing a command such as mkfs.ext4 /dev/volume_group, and then mount /dev/volume_group to wherever. Looking at a plainmount command run as root should give you an idea of what is where currently on your system.

An encrypted volume must be created by passing a block device (doesn't matter whether it's a real disk or a VG) to cryptsetup luksFormat. At that time you can enter a passphrase or specify a keyfile. Then, to use it, you need to open that block device using cryptsetup luksOpen (which prompts you for the previously assigned passphrase, or you can specify a keyfile); this will create another "virtual" block device in /dev/mapper, i.e. /dev/mapper/encrypted. This is then what you want to give to tools like mkfs.ext4, fsck, and mount to actually use the encrypted block device.

Important: Before you do the cryptsetup luksFormat you want to overwrite the free space on your disk with random data, either with dd or the badblocks command. luksFormat doesn't do that and if you don't do that before hand an adversary can possibly tell where you've writen to the disk and where you haven't.

The point in using a volume group in combination with encryption on a single hard drive is usually to serve the same purpose as disk partitions, but since it's within an encrypted volume, your "partitioning" scheme can't be discovered unless it's unlocked. So you would take a full disk, create an encrypted volume, and use pvcreate, vgcreate, and lvcreate to create logical volumes which are then mounted as though they were partitions. (This explains it: http://linuxgazette.net/140/kapil.html)

Truly unmounting the volume will involve umount /dev/mapper/encrypted to disconnect the filesystem and then a cryptsetup luksClose encrypted to disconnect the virtual block device.

cryptsetup allows adding (luksAddKey) and removing (luksDelKey) keys. I think you can have up to 8 keys on an encrypted volume. A key is changed by adding a new key and then deleting the old key.

Specific syntax for all the cryptsetup options are here: http://linux.die.net/man/8/cryptsetup

share|improve this answer
Thanks. So the gist for LUKS is cryptsetup luksAddKey /dev/underlying, enter old and new passphrase, cryptsetup luksRemoveKey /dev/underlying, enter old and new passphrase. Any idea about a non-LUKS volume? – Gilles Apr 20 '11 at 21:58
It's cryptsetup luksDelKey /dev/underlying, but yes. – LawrenceC Apr 21 '11 at 22:05
If I understand the documentation correctly, they do the same thing but with a different UI: with luksRemoveKey, you type the passphrase or supply the key file you want to remove; with luksDelKey, you supply the slot number. – Gilles Apr 21 '11 at 22:07
Ah yes, consulted the actual man page on my system. Then yes, you are correct. – LawrenceC Apr 22 '11 at 2:24
luksDelKey is no more. It is now luksKillSlot <device> <key slot number> Currently running cryptsetup 1.6.1 – Antony Aug 4 '15 at 16:36

If you have done crypting with cryptsetup, then you can change the key as:

cryptsetup luksChangeKey []

FYI: See this Link

share|improve this answer
cryptsetup: Unknown action. (on Ubuntu 10.04) – Gilles Apr 20 '11 at 21:56
see the package name of cryptsetup at packages.ubuntu.com/lucid/allpackages?format=txt.gz. Install it by apt-get install cryptsetup. And the please do check the command again. I am using the cryptsetup's version 1.3, where I do have the option to change the luks-key. – SHW Apr 21 '11 at 6:17
Given that error message, it's obvious that I do have the cryptsetup command. What I'm telling you is that the version on Ubuntu 10.04 (one of the two OSes this question is about) doesn't have a luksChangeKey action. – Gilles Apr 21 '11 at 6:53
@Giles, Yeah. And I also mention that, If you use the version 1.3 from source code, you will get exactly what you are looking for. Compiling a binary from source code will not harm the system, IMHO. [ FYI, I used 1.3 for LFS ] – SHW Apr 21 '11 at 7:04
linux.die.net/man/8/cryptsetup – LawrenceC Apr 21 '11 at 22:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.