Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Using an Ubuntu 12.04 or a Red Hat Enterprise Linux Desktop 6 for Desktop, how can we force the users to change their LUKS passwords at every 90 days?

share|improve this question
    
You'd have to write a front-end or wrapper for cryptsetup, but it sounds like a really bad idea. –  frostschutz Mar 14 at 16:54
1  
If you think this will improve security, you're kidding yourself. If anything, it will decrease it by encouraging users to use simpler passwords or keep a written copy handy. –  cjm Mar 14 at 18:04
1  
And, is that realy needed? It will not improve security too much and it will drastically reduce convenience. –  nwildner Mar 14 at 18:59

2 Answers 2

up vote 3 down vote accepted

There's not much point in doing this. Ordinarily, the point of changing passwords regularly is that if someone else has learned your password, you limit how long they can use it. But a LUKS password is used to decrypt the LUKS volume's master key, the one that's actually used to encrypt the data, so if someone learns your password, they can use it to get that master key. Changing your password doesn't change the master key — remember, it's the key used to actually encrypt the data; changing it would require re-encrypting the entire drive — so you're not depriving the attacker of access to the drive.

(Note, this assumes a technically-sophisticated attacker, someone able to find or write a program for unlocking a LUKS volume using the master key directly rather than a keyslot passphrase. Changing passwords might help against someone who only knows how to interact with the normal LUKS password prompt — but against someone like that, you probably don't need disk encryption at all.)

share|improve this answer

AFAIK there are no tools for that. You need to save the data (from the header of the LUKS partition) and compare the encrypted passwords (there should be 8) to make sure they are changed (a smart user could change the password and add the old one in one of the different slots).

A good policy is to keep the old encrypted passwords so you can check if someone flips between using password A and password B.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.