2

I've just set up a Debian system to try out a couple of projects and improve my understanding of Linux but I'm running into problems with cryptsetup straight after installation. I used the graphical installer for Debian 9 and used its baked-in encryption tool to encrypt /home and the swap space which I have set up as logical volumes.

I'm trying to change the encryption passphrase for each drive, after I stupidly left caps-lock on after setting up the partitions.

I'd hoped I'd be able to do this simply using cryptsetup luksChangeKey. However, whenever I attempt to access either the devices/containers with cryptsetup (running as root) I seem to get the error:

<device> is not a valid LUKS device.

Please find outputs from lsblk, ls /dev/mapper and cryptsetup below, which I hope give a good indication of how I'm set up and the problems I'm experiencing:

lsblk
NAME                         MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINT
sda                            8:0    0 111.8G  0 disk  
├─sda1                         8:1    0   953M  0 part  /boot/efi
├─sda2                         8:2    0   477M  0 part  /boot
└─sda3                         8:3    0 110.4G  0 part  
  ├─SSD1_LVM-LV_ROOT         254:0    0   7.5G  0 lvm   /
  ├─SSD1_LVM-LV_VAR          254:1    0  14.9G  0 lvm   /var
  ├─SSD1_LVM-LV_TMP          254:2    0   7.5G  0 lvm   /tmp
  ├─SSD1_LVM-LV_USR          254:3    0  29.8G  0 lvm   /usr
  ├─SSD1_LVM-LV_HOME         254:4    0   7.5G  0 lvm   
  │ └─SSD1_LVM-LV_HOME_crypt 254:8    0   7.5G  0 crypt /home
  ├─SSD1_LVM-LV_OPT          254:5    0  14.9G  0 lvm   /opt
  └─SSD1_LVM-LV_SWAP         254:6    0  15.9G  0 lvm   
    └─SSD1_LVM-LV_SWAP_crypt 254:7    0  15.9G  0 crypt 
ls -l /dev/mapper
total 0
crw------- 1 root root 10, 236 Sep 27 09:35 control
lrwxrwxrwx 1 root root       7 Sep 27 09:36 SSD1_LVM-LV_HOME -> ../dm-4
lrwxrwxrwx 1 root root       7 Sep 27 09:36 SSD1_LVM-LV_HOME_crypt -> ../dm-8
lrwxrwxrwx 1 root root       7 Sep 27 09:35 SSD1_LVM-LV_OPT -> ../dm-5
lrwxrwxrwx 1 root root       7 Sep 27 09:35 SSD1_LVM-LV_ROOT -> ../dm-0
lrwxrwxrwx 1 root root       7 Sep 27 09:35 SSD1_LVM-LV_SWAP -> ../dm-6
lrwxrwxrwx 1 root root       7 Sep 27 15:50 SSD1_LVM-LV_SWAP_crypt -> ../dm-7
lrwxrwxrwx 1 root root       7 Sep 27 09:35 SSD1_LVM-LV_TMP -> ../dm-2
lrwxrwxrwx 1 root root       7 Sep 27 09:35 SSD1_LVM-LV_USR -> ../dm-3
lrwxrwxrwx 1 root root       7 Sep 27 09:35 SSD1_LVM-LV_VAR -> ../dm-1
cryptsetup status /dev/dm-7
/dev/dm-7 is active.
  type:    LUKS1
  cipher:  aes-xts-plain64
  keysize: 512 bits
  device:  /dev/mapper/SSD1_LVM-LV_SWAP
  offset:  4096 sectors
  size:    33198080 sectors
  mode:    read/write
cryptsetup luksAddKey /dev/dm-7
Device /dev/dm-7 is not a valid LUKS device.

I disabled disk swap space with swapoff in case that was causing problems, which regrettably hasn't helped.

2

You have to run cryptsetup on the device that holds the LUKS header (for actions that modify the header, i.e. format, key management, dump, ...).

In your case, this is /dev/mapper/SSD1_LVM-LV_SWAP

But you tried to run it on /dev/mapper/SSD1_LVM-LV_SWAP_crypt which is the swap LV (encrypted) and presumably holds a swap header (mkswap) instead of a LUKS header (that would be luks inside luks...).

  • That's cleared it up! It's quirks like this which I'm struggling to pick out from sifting through the man and --help documentation. Thank you so much. – DJT Sep 27 '18 at 16:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.