2

luks offers up to 8 password slots (=multiple passwords which are valid at the same time).
Installing Linux I face the problem

  • how to add a new password slot
  • how to remove a password slot
  • how to see how many slots are active
  • how to test if a password is valid for a container/partition
  • how to backup the header of a luks partition (=data live insurance...)

Which commands would help me do this job?

3

I assume that the partition is /dev/sda3
If you don't know the name you can list all partitions with lsblk -f.

Add a new password slot:
sudo cryptsetup luksAddKey /dev/sda3

  • The next free password slot will be used
  • First it will ask for a existing valid password, after that you have to input the new password.
    The old password will stay valid, as well.

If you want to add a keyfile (instead of a password) it would be
sudo cryptsetup luksAddKey /dev/sda3 MyKeyFile.txt

Remove a password slot:

  • Possibility 1: sudo cryptsetup luksRemoveKey /dev/sda3
    => You have to enter the password which you want to delete (it will automatically find the correct password slot)
  • Possibility 2: sudo cryptsetup luksKillSlot /dev/sda3 2
    => This will delete password slot 2 (you have to enter the password of any other password slot, but not of slot 2
    => This works even if you don't know the password of slot 2
  • Possibility 3: sudo cryptsetup luksRemoveKey --key-file MyKeyFile.txt /dev/sda3
    => Removes the key file MyKeyFile.txt if it is valid

See how many slots are active:
sudo cryptsetup luksDump /dev/sda3
This will output all settings of luks for this partition.

Test if a password is valid for the partition:
sudo cryptsetup open --verbose --test-passphrase /dev/sda3
Now you can enter a password and it will tell you if it was wrong or to which password slot it belongs.
If you want to test if a KeyFile is valid it works like this:
sudo cryptsetup open --verbose --test-passphrase --key-file MyKeyFile.txt /dev/sda3

Backup the header of a luks partition:
sudo cryptsetup luksHeaderBackup /dev/sda3 --header-backup-file MyLuksHeader.dat
sudo chmod +r MyLuksHeader.dat
It will create a file of 16MB.
This is very important to save. If the header is damaged all data is lost without a backup!

List all encrypted file systems:
sudo cat /etc/crypttab

If you need more help you can type man cryptsetup.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.