Add second passphrase for FDE on Ubuntu (new luks keyslot w/ encrypted LVM)

Question

How can I add a second passphrase to decrypt my laptop on-boot when I chose to install Ubuntu with FDE at install-time.

At the time of writing, there is only one way to choose to install Ubuntu with Full Disk Encryption (FDE) with the Ubuntu install .iso GUI, and that's by choosing to create an encrypted LVM.

I know the command to add an additional keyslot to a LUKS volume is:

cryptsetup luksAddKey /dev/<device>

...but the encrypted LVM setup that Ubuntu uses is a bit more complex. It shows I have three decrypted luks devices:

user@host:$ ls /dev/mapper
control  nvme0n1p3_crypt  vgxubuntu-root  vgxubuntu-swap_1
user@host:$

What is the command(s) that I should type to add an additional luks keyslot such that I can decrypt my laptop at boot-time with either of the two passphrases?

Answer 1

Solution

The one that ends in _crypt is the luks device that you should execute cryptsetup luksAddKey against (minus the _crypt part). In your case, execute:

# inspect the drive, note that the 0th key slot is the only key slot in use
cryptsetup luksDump /dev/nvme0n1p3

# dump the existing header and make a safe backup on another encrypted system
cryptsetup --header-backup-file header_backup luksHeaderBackup /dev/nvme0n1p3

# add a second passphrase to the 1st keyslot
cryptsetup --key-slot 1 luksAddKey /dev/nvme0n1p3

After successfully adding a second passphrase to the 1st keyslot with the command above, it will be possible to boot the machine with either the first passphrase (in key slot #0) or the second passphrase (in key slot #1).

Explanation

By default, the Ubuntu installer sets-up FDE by creating three partitions:

1. An unencrypted fat32 bootloader
2. An unencrypted ext4 boot volume
3. An big encrypted luks volume

You can see this, for example, using lsblk against your disk:

root@host:~# lsblk /dev/nvme0n1
NAME                   MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINT
nvme0n1                259:0    0   477G  0 disk 
├─nvme0n1p1            259:1    0   512M  0 part  /boot/efi
├─nvme0n1p2            259:2    0   732M  0 part  /boot
└─nvme0n1p3            259:3    0 475,7G  0 part 
  └─nvme0n1p3_crypt    253:0    0 475,7G  0 crypt
    ├─vgxubuntu-root   253:1    0 474,8G  0 lvm   /
    └─vgxubuntu-swap_1 253:2    0   980M  0 lvm   [SWAP]
root@host:~#

As you can see from the above output, the nvme0n1 disk has three partitions. Inside the last partition nvme0n1p3, there is a huge decrypted volume nvme0n1p3_crypt.

Moreover, inside of nvme0n1p3_crypt, there's two lvm volume groups vgxubuntu-root & vgxubuntu-swap_1.

The device that you want to execute the luksAddKey command against is the actual luks-encrypted partition on the disk at the lowest branch level in the lsblk tree. In this case, that's /dev/nvme0n1p3.