How do I change Luks (fedora's system encryption) pasword

[AnimeFreak]

I need to change the Luks (fedora's system encryption) password.

How do I do this without reinstalling?




Thanks,

AnimeFreak

[kilgoretrout]

Basically, you just add an additional password(LUKS allows up to 8 different passwords for the same volume) and delete the original password. Here's a link that describes the process in detail:

http://www.saout.de/tikiwiki/tiki-in...eviceUsingLUKS

To add an additional password, so you can unlock your partition with a choice of different passwords (you can do this with the encrypted partition mounted, if you wish):
#cryptsetup luksAddKey /dev/sdc1
Enter any LUKS passphrase: (enter an existing password for this partition)
key slot 0 unlocked.
Enter new passphrase for key slot: (enter the extra password)
#


To delete an existing password (but don't delete the last one, your data will be lost forever, you will be warned if you try this), you need to know which slot the password is in. The first password goes in slot 0, any additional passwords go in slot 1, 2 etc. You can do this with the encrypted partition mounted, if you wish. So to delete the very first password you used, use:
#cryptsetup luksDelKey /dev/sdc1 0
#



To change the password, first add an additional password then delete the original password.

[AnimeFreak]

Thanks for the info, I will definitely use this.



I actually have one encrypted system and another encrypted drive.


Do I do this twice. Once for the encrypted system and another for the encrypted drive.



Also, can you back these entire drives up with the clonezilla live cd.


Thanks Again,

AnimeFreak

[AnimeFreak]

I actually used LVMs.


Does this change anything.

[AnimeFreak]

Well, that last post was two years ago. I guess i've come along way since then, based on how stupid a question I posted.

[dfowensby]

not stupid. this all just helped me out of a pickle. thankyou for stupid questions. %)

[stevetnz]

The tikiwiki link is now broken. And I don't have a device called /dev/sdc1. But I do have F15 installed with the file-system encryption option and I now wish to change the password that allows the system to boot up (so that other people can use the computer without knowing my favourite password).

How do I identify the encrypted device that holds my system? I have tried "cryptsetup status ..." with all the /dev/sd* devices I can see in the /dev directory, but nothing seems to identify it.

If anyone still needs this:

Originally Posted by man cryptsetup

isLuks <device>
returns true, if <device> is a LUKS partition. Otherwise, false.

luksChangeKey <device> [<new key file>]
change existing key file or passphrase. An existing passphrase or key file (via --key-file) must be supplied. The key file with the new material is supplied as a positional argument.

so, as root, enter:
# if cryptsetup isLuks /dev/sdX; then echo "yes"; else echo "no"; fi
and substitute X for whichever device you want to probe (ie: /dev/sda1, /dev/sdc3, …) to find out which is a luks enabled device. then you can use
# cryptsetup luksChangeKey /dev/sdX
where sdX is the device that is your luks device to change your passphrase.