1

Using an Ubuntu 12.04 or a Red Hat Enterprise Linux Desktop 6 for Desktop, how can we force the users to change their LUKS passwords at every 90 days?

  • You'd have to write a front-end or wrapper for cryptsetup, but it sounds like a really bad idea. – frostschutz Mar 14 '14 at 16:54
  • 1
    If you think this will improve security, you're kidding yourself. If anything, it will decrease it by encouraging users to use simpler passwords or keep a written copy handy. – cjm Mar 14 '14 at 18:04
  • 1
    And, is that realy needed? It will not improve security too much and it will drastically reduce convenience. – user34720 Mar 14 '14 at 18:59
3

There's not much point in doing this. Ordinarily, the point of changing passwords regularly is that if someone else has learned your password, you limit how long they can use it. But a LUKS password is used to decrypt the LUKS volume's master key, the one that's actually used to encrypt the data, so if someone learns your password, they can use it to get that master key. Changing your password doesn't change the master key — remember, it's the key used to actually encrypt the data; changing it would require re-encrypting the entire drive — so you're not depriving the attacker of access to the drive.

(Note, this assumes a technically-sophisticated attacker, someone able to find or write a program for unlocking a LUKS volume using the master key directly rather than a keyslot passphrase. Changing passwords might help against someone who only knows how to interact with the normal LUKS password prompt — but against someone like that, you probably don't need disk encryption at all.)

| improve this answer | |
1

AFAIK there are no tools for that. You need to save the data (from the header of the LUKS partition) and compare the encrypted passwords (there should be 8) to make sure they are changed (a smart user could change the password and add the old one in one of the different slots).

A good policy is to keep the old encrypted passwords so you can check if someone flips between using password A and password B.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.