1

I would like to change my passphrase in LUKS, so I started with typing mount | grep 'on / '. The result was /dev/mapper/fedora-root on / type ext4 (rw,relatime,seclabel,data=ordered). So next as usual I typed sudo cryptsetup status fedora-root to get info about partition. But unfortunately I got no result and operation returned 1. sudo cryptsetup --verbose status fedora-root says Command failed with code 22: Invalid argument. Why the behaviour is so strange? What is the way to change LUKS password in that case?

7
  • Perhaps try to run it as root or with sudo, because that's why the error comes: it says you're running it as non-root user. – user37607 Jan 15 '14 at 20:11
  • Oh I am stupid. I am sorry for my mistake. But after sudo-ing the situation hasn't changed... Thanks for not voting down :P – pt12lol Jan 15 '14 at 20:21
  • Well, it seems a bit odd to me. I googled for the error, and in all cases I found the error 22 was due to user typed lowercase "yes" instead of uppercase when asked for confirmation, which doesn't seem to be your case. You'd try to run that command with --debug to get the full diagnostic log. – user37607 Jan 15 '14 at 20:56
  • I haven't been asked about anything. – pt12lol Jan 15 '14 at 20:57
  • Indeed. Try to run it with --debug. – user37607 Jan 15 '14 at 20:59
0

Changing the passphrase on a LUKS encrypted volume is thankfully fairly simple.

The simplest solution is as follows:

sudo cryptsetup luksChangeKey /dev/base-device

It will prompt you for the old passphrase, and then the new one.

If you have more than 1 LUKS encrypted partition, and you want to only enter your passphrase once at boot, be sure to change the passphrase for your other LUKS encrypted drives to be the same as the one you're changing now.

There are some edge cases you should be aware of. The first is that there could be an error overwriting the slot with the new passphrase. Since the possibility of total data loss in this endeavor is non-zero, take a full backup of the drive before you begin this operation. If it's a laptop, make sure the battery is fully charged just in case. If it's a desktop, it's probably worth having a UPS attached.

Alternatively, if your cryptsetup binary doesn't have the changeKey option, you could do it in 2 steps:

sudo cryptsetup luksAddKey /dev/base-device
sudo cryptsetup luksRemoveKey /dev/base-device

The caveat with this approach is that the luksAddKey operation could fail if you already had the maximum 8 key slots already used. This is unlikely, but be aware of it.

I had to do this task myself recently, and I found the following resources helpful:

https://ask.fedoraproject.org/en/question/73281/changing-the-luks-passphrase-for-entire-system/ https://ask.fedoraproject.org/en/question/44923/change-encryption-password-on-drive-fedora-20/

0

As frostschutz's comment suggested, there are a number of containers inside each other, and you'll need to point the cryptsetup command to the right one.

  • The outermost is the disk (probably /dev/sda). Since this is a system disk, it is very likely partitioned.
  • The next layer is the partition (/dev/sda[1-9]*), which is acting as the container for the encrypted volume.
  • Then there is the cryptsetup device (the name can be /dev/mapper/*, but it might commonly be named like /dev/mapper/sd[a-z][1-9]*_crypt corresponding to the name of the partition device). It appears when the encryption password is entered, and it provides access to the data inside the encryption. In this case, this device is initialized as a LVM physical volume (PV).
  • That PV is part of the LVM volume group (VG) fedora. It has no device of its own: the VG only exists as a LVM object.
  • Within the VG, there is at least one logical volume (LV): /dev/mapper/fedora-root. Based on the name, it apparently contains the root filesystem.

You need the cryptsetup device for your command, not the LVM LV device.

If /etc/crypttab exists and is not empty, look at the first word of each non-comment line in it: each non-comment line defines a cryptsetup device, and the first word on that line is the last part of the name of the cryptsetup device.

Just like you cannot access the partition table of a disk by using the partition device /dev/sda1, you cannot access the LUKS encryption metadata by accessing the LVM LV device inside the encrypted volume.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.