1

I have installed Ubuntu 20.10 on ZFS with encryption enabled and now I want to change the password used to boot my computer.

How do I do this?

$ zfs get keylocation,encryption,keyformat rpool
NAME   PROPERTY     VALUE                                  SOURCE
rpool  keylocation  file:///run/keystore/rpool/system.key  local
rpool  encryption   aes-256-gcm                            -
rpool  keyformat    raw                                    -
Improve this question

3 Answers 3

Reset to default
3

as far as i can determine correct answer is

$ sudo cryptsetup luksAddKey /dev/zvol/rpool/keystore

to add new password

$ sudo cryptsetup luksRemoveKey /dev/zvol/rpool/keystore

and to remove old one

Improve this answer
3
  • 2
    OP marked this as the answer, but I don't see how it could be. OP's example shows a ZFS pool using native ZFS encryption, not LUKS encryption. LUKS can't change the password of ZFS native encryption. You would have to use an option from man zfs-load-keys for that: openzfs.github.io/openzfs-docs/man/8/zfs-load-key.8.html
    – bgibson
    Jul 31, 2021 at 22:36
  • 1
    Ubuntu while installing with encrypted zfs its use zvol with luks to store keyfile on it and on boot asks for password to luks than use kayfile to decrypt zfs
    – vonProteus
    Sep 23, 2021 at 17:05
  • This is the correct answer, ubuntu doesn't use zfs native encryption directly at boot probably because ZoL still doesn't support multiple passwords.
    – Madushan
    Oct 1, 2021 at 16:39
2

As pointed out, Ubuntu 20.04–21.10 uses luks volume on a zfs volume that is a child of rpool to store a 256-bit key which is used to unlock the zfs pool rpool


If you do have the passphrase:

cryptsetup luksChangeKey /dev/zvol/rpool/keystore 
Enter passphrase to be changed: 
Enter new passphrase: 
Verify passphrase:

If you do not have the passphrase:

What you want to do is to store this key protected by a different known passphrase

  1. If the luks volume is open, this is possible
  2. If the luks volume is not open, and you do not have a system.key file, it’s game over reinstall
  3. We cannot change or remove the passphrase, but it is possible to create a new luks container with a known passphrase and store the accessible system.key there

The key can be displayed on a running system:

od --address-radix=x --format=x1 /run/keystore/rpool/system.key
0000000 4a 19 54 d0 b6 ac 38 a7 0d 41 f3 02 c7 05 db 82
0000010 03 18 d5 d5 cb dc 3c e9 71 0e b6 a8 1b 87 25 68
0000020

basically this is what should be done:

zfs create -oencryption=off -V500m rpool/keystore2
cryptsetup luksFormat /dev/zvol/rpool/keystore2
WARNING!
This will overwrite data on /dev/zvol/rpool/keystore2 irrevocably.
Are you sure? (Type 'yes' in capital letters): YES
Enter passphrase for /dev/zvol/rpool/keystore2: 
Verify passphrase: 
cryptsetup open /dev/zvol/rpool/keystore2 k2
Enter passphrase for /dev/zvol/rpool/keystore2: 
mkfs --type ext4 /dev/mapper/k2
mkdir --parents --mode=700 /mnt/f/k
mount /dev/mapper/k2 /mnt/f/k
cp --archive --no-clobber /run/keystore/rpool/system.key /mnt/f/k
umount /mnt/f/k
cryptsetup close k2

Reboot from a different installation, like Ubuntu desktop usb media, that has the appropriate zfs command, then something like:

zpool import
   pool: rpool
    id: 2704475622193776801
# may list some useful ids if you already have an rpool
zpool import 2704475622193776801 rpool2
zfs rename rpool2/keystore rpool2/keystore-nopwd
zfs rename rpool2/keystore2 rpool2/keystore

In charge of things again

Improve this answer
1

It is much easier than this.

zfs change-key -o keyformat=passphrase rpool
Improve this answer
1
  • Hi there, thanks for your comment. Can you please provide some context for what they command you have provided does, and maybe a link to the relevant documentation so that people can decide for themselves if it's likely to work for them.
    – Jeremy
    Mar 16 at 7:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .