Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
I would like to change a LUKS password. I want to remove my old password, but I would like to try out my new password before removing the original. I obviously know the old password. I would like to use the terminal not GUI.
I have sensitive data on the drive and would rather not have to use my backup so I need the method to be safe.
In LUKS scheme, you have 8 "slots" for passwords or key files. First, check, which of them are used:
cryptsetup luksDump /dev/<device> |grep BLED
Then you can add, change or delete chosen keys:
cryptsetup luksAddKey /dev/<device> [/path/to/<additionalkeyfile>, optional]
cryptsetup luksChangeKey /dev/<device> -S 6
As for deleting keys, you have 2 options:
a) delete any key that matches your entered password:
cryptsetup luksRemoveKey /dev/<device>
b) delete a key in specified slot:
cryptsetup luksKillSlot /dev/<device> 6
cryptsetup luksAddKey /dev/<device> [<new key file>] per the docs. The [] indicates that it's optional, which completely escaped me as written with (). I thought I was going to need to figure out how to first create the keyfile then use these instructions to add it. Turns out you don't need that at all.