37

I would like to change a LUKS password. I want to remove my old password, but I would like to try out my new password before removing the original. I obviously know the old password. I would like to use the terminal not GUI.

I have sensitive data on the drive and would rather not have to use my backup so I need the method to be safe.

1

1 Answer 1

45

In LUKS scheme, you have 8 "slots" for passwords or key files. First, check, which of them are used:

cryptsetup luksDump /dev/<device> |grep BLED

Then you can add, change or delete chosen keys:

cryptsetup luksAddKey /dev/<device> [/path/to/<additionalkeyfile>, optional] 

cryptsetup luksChangeKey /dev/<device> -S 6

As for deleting keys, you have 2 options:

a) delete any key that matches your entered password:

cryptsetup luksRemoveKey /dev/<device>

b) delete a key in specified slot:

cryptsetup luksKillSlot /dev/<device> 6
3
  • 2
    After a little checking, that should probably be cryptsetup luksAddKey /dev/<device> [<new key file>] per the docs. The [] indicates that it's optional, which completely escaped me as written with (). I thought I was going to need to figure out how to first create the keyfile then use these instructions to add it. Turns out you don't need that at all.
    – fbicknel
    Jun 28, 2019 at 14:14
  • 1
    Just a note, I've seen mention that it might be possible to mess up an ubuntu (older than 19.04) installed disk by removing the last and only key/slot, rendering the disk unbootable, see: bugs.launchpad.net/ubuntu/+source/libblockdev/+bug/1837437 . Basically ensure there is always at least 2 slots used before removing 1, for older versions of ubuntu.
    – jmunsch
    Dec 11, 2019 at 12:32
  • 1
    What grep BLED is supposed to do? Oct 24, 2022 at 22:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .