When installing Ubuntu 21.04 with encrypted disk (filesystem: zfs) a 16 digit "recovery key" is automatically created, how do i get rid of/modify it?
I am looking to:
- list installed keys
- delete keys
- optionally create new keys
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It only takes a minute to sign up.Sign up to join this community
You should be able to delete it in the same way that you delete any LUKS key.
After you know the device ID of the encrypted partition (if you don't you can use the "lsblk" command) you can manage keys via the terminal with the following commands where /dev/sdXN should be replaced with the correct path to your encrypted partition on your device.
List existing key slots:
sudo cryptsetup luksDump /dev/sdXN
Delete a keyslot by password (if you know the recovery key):
sudo cryptsetup luksRemoveKey /dev/sdXN
This will prompt you for the password of the key slot you want to remove. If you didn't save the recovery key you can delete it by it's keyslot ID.
Delete a keyslot by ID (when you don't know the recovery key):
First determine the keyslot of the password you don't want to delete:
sudo cryptsetup --verbose open --test-passphrase /dev/sdXN
Entering a password with this command will return the keyslot of that password. On my installation of Ubuntu 21.04 my password was in keyslot 0 and the system generated recovery key was in keyslot 1, but you should double-check it's the same on your system.
Then to delete the unneeded keyslot:
sudo cryptsetup luksKillSlot /dev/sdXN 1
Where you can replace 1 with the keyslot you want to delete.
This will prompt you to enter a remaining good password before actually deleting the keyslot to verify that you don't accidentally delete the wrong one.
Add new luks password:
sudo cryptsetup luksAddKey /dev/sdXN
This will prompt you for an existing password and then the new one you want to add. You can have up to 8 keyslots total.