Solution
The one that ends in _crypt
is the luks device that you should execute cryptsetup luksAddKey
against (minus the _crypt
part). In your case, execute:
# inspect the drive, note that the 0th key slot is the only key slot in use
cryptsetup luksDump /dev/nvme0n1p3
# dump the existing header and make a safe backup on another encrypted system
cryptsetup --header-backup-file header_backup luksHeaderBackup /dev/nvme0n1p3
# add a second passphrase to the 1st keyslot
cryptsetup --key-slot 1 luksAddKey /dev/nvme0n1p3
After successfully adding a second passphrase to the 1st keyslot with the command above, it will be possible to boot the machine with either the first passphrase (in key slot #0) or the second passphrase (in key slot #1).
Explanation
By default, the Ubuntu installer sets-up FDE by creating three partitions:
- An unencrypted fat32 bootloader
- An unencrypted ext4 boot volume
- An big encrypted luks volume
You can see this, for example, using lsblk
against your disk:
root@host:~# lsblk /dev/nvme0n1
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
nvme0n1 259:0 0 477G 0 disk
├─nvme0n1p1 259:1 0 512M 0 part /boot/efi
├─nvme0n1p2 259:2 0 732M 0 part /boot
└─nvme0n1p3 259:3 0 475,7G 0 part
└─nvme0n1p3_crypt 253:0 0 475,7G 0 crypt
├─vgxubuntu-root 253:1 0 474,8G 0 lvm /
└─vgxubuntu-swap_1 253:2 0 980M 0 lvm [SWAP]
root@host:~#
As you can see from the above output, the nvme0n1
disk has three partitions. Inside the last partition nvme0n1p3
, there is a huge decrypted volume nvme0n1p3_crypt
.
Moreover, inside of nvme0n1p3_crypt
, there's two lvm volume groups vgxubuntu-root
& vgxubuntu-swap_1
.
The device that you want to execute the luksAddKey
command against is the actual luks-encrypted partition on the disk at the lowest branch level in the lsblk
tree. In this case, that's /dev/nvme0n1p3
.