Changing a (known) LUKS passphrase
This is one for me, as I have to look this up Every Single Time I want to change a LUKS passphrase.
Note to self: it might be safer to add a new passphrase, and verify that works, and then - and only then - delete the old passphrase. If you overwrite the existing passphrase with a passphrase you cannot remember (or you mistype twice), you’re stuck.
Identify the encrypted device
sudo cat /etc/crypttab
If this gives you a UUID, use
sudo fdisk -l /dev/[devicename]
to work out the partition structure.
Check which key slot(s) is used
When you know the device name and partition (e.g. /dev/mmcblk0p2
), check which key slot(s) is in use:
sudo cryptsetup luksDump /dev/mmcblk0p2
If you’ve only set up one passphrase, it’s likely to be key slot 0.
Whatever your answer, attempt to unlock the device:
sudo cryptsetup --verbose open --test-passphrase /dev/mmcblk0p2
The output should say:
Key slot 0 unlocked.
Make a note of the key slot, as you’ll need it to change the passphrase for that key slot.
Change the passphrase
Using the devicename and the slot (-S
) that you’ve identified, issue the command to change the passphrase:
sudo cryptsetup luksChangeKey /dev/mmcblk0p2 -S 0
(If it is slot 1, change it to -S 1
.)
Test it
Issue
sudo cryptsetup --verbose open --test-passphrase /dev/mmcblk0p2
and use your new passphrase.
You may also like:
- Raspberry Pi 4 with the PoE+ HAT: LUKS and a working fan
- Unlocking a LUKS-encrypted partition via ssh on Debian 10 and Debian 11
- There is no i in Teams. And rarely a Neil
- Moving from macOS to Debian 11 Bullseye Linux: applications
- Aztine 15.6 Portable Monitor with Debian 11 on a Surface Pro 6
- Auto-unlocking a LUKS volume on an SD card on boot with Debian 11 Bullseye
- Making a Mac Mini power up when power is restored: Debian 11 version
- Installing Debian Bullseye and VirtualBox on a Mac Mini
- Installing Debian 10 Linux on a Microsoft Surface Pro 6
- Installing vanilla Debian 11 on a Raspberry Pi 4
- Fixing a font which shows in macOS Font Book but not in macOS LibreOffice
- Gemini PDA running Debian: a properly portable computer
- Brave browser: less privacy-respectful than I was expecting
- YouTube (and other video sites) without the irritations: integrating yt-dlp and jellyfin, with a web interface
- Making [vulnerable group] safe online: unpicking those who spin a line to sell their proposal