How to change LUKS passphrase?












53















Having installed Ubuntu 11.10 with whole disk encryption and LVM, I need to provide a way for users to easily change LUKS passphrase.



Preferably, this should be done using GUI tools, thus, enabling novice users to perform this basic task.










share|improve this question





























    53















    Having installed Ubuntu 11.10 with whole disk encryption and LVM, I need to provide a way for users to easily change LUKS passphrase.



    Preferably, this should be done using GUI tools, thus, enabling novice users to perform this basic task.










    share|improve this question



























      53












      53








      53


      16






      Having installed Ubuntu 11.10 with whole disk encryption and LVM, I need to provide a way for users to easily change LUKS passphrase.



      Preferably, this should be done using GUI tools, thus, enabling novice users to perform this basic task.










      share|improve this question
















      Having installed Ubuntu 11.10 with whole disk encryption and LVM, I need to provide a way for users to easily change LUKS passphrase.



      Preferably, this should be done using GUI tools, thus, enabling novice users to perform this basic task.







      security lvm luks usability






      share|improve this question















      share|improve this question













      share|improve this question




      share|improve this question








      edited Jan 20 '15 at 17:10









      guntbert

      9,226133170




      9,226133170










      asked Jan 13 '12 at 10:57









      ervingsbervingsb

      461257




      461257






















          4 Answers
          4






          active

          oldest

          votes


















          33














          Tested in ubuntu 14.04: Search for the "Disks" application



          Select Device, select volume, Click cogs (more actions) -> "Change passphrase"



          screenshot:






          share|improve this answer


























          • Doesn't work with "long" passphrases...

            – Thomas
            May 30 '15 at 20:47











          • What actual application is this please? apt-get install ???

            – shadowbq
            Oct 9 '15 at 13:16











          • FYI: gnome-disk-utility / apt-get install gnome-disk-utility && gnome-disks

            – shadowbq
            Oct 9 '15 at 13:23






          • 2





            This is the built-in Disks application. No need to install anything. It works with fairly decent passwords. I haven't tried anything over 20 characters though.

            – Alain O'Dea
            Nov 26 '15 at 2:55



















          41














          I am not familiar with gui tool but cryptsetup is the tool to interact with luks.



          Basically AFAIK luks lets you add 8 passphrase slots and you can do that with:



          sudo cryptsetup -y luksAddKey ENCRYPTED_PARTITION
          sudo cryptsetup luksRemoveKey ENCRYPTED_PARTITION


          where 0 is the slot number. I guess luks stores slots as 0,1,2 etc. But I recommend you to be very careful with luks as you may lock yourself out. Please refer to manual of cryptsetup. Also I recommend you to visit other distro IRC channel just to be extra safe before you proceed.



          You may need to reboot the machine and try your new passsphrase as well before you remove the key.



          cryptsetup



          EDIT: Seems like gnome-disk-utility lets you change the passphrase.



          enter image description here



          enter image description here






          share|improve this answer


























          • cryptsetup luksRemoveKey <partition> actually takes a keyfile as the last parameter. So if you want to input the passphrase, just give the device as parameter. cryptsetup will first prompt for "Enter LUKS passphrase to be deleted:" and then "Enter any remaining LUKS passphrase:"

            – user1338062
            Apr 17 '13 at 9:30











          • Avoid the gnome utility if your passphrase is very long, it may cut your input...

            – Thomas
            May 30 '15 at 20:51











          • @Thomas or whoever else is interested: at least 14 characters are not too long for the gnome disk utility.

            – KlaymenDK
            Apr 13 '16 at 13:52











          • I just tried the gnome utility with an old password 22 characters long and a new passphrase 9 words long, and it failed enough times that I assume I typed it right at least once, and it's being truncated.

            – Glenn Willen
            Aug 13 '18 at 21:42



















          14














          cryptsetup luksChangeKey <target device> -S <target key slot number>


          This will ask you first for a valid pass-phrase (in any enabled keyslot) then will prompt you fro the new passphrase in the target keyslot






          share|improve this answer





















          • 1





            In 12.04.5 I was asked for the new password twice.

            – Devin Lane
            Sep 19 '15 at 21:00



















          1














          Tested on Ubuntu 18.04 run gnome-disks and you can point and click to change the passphrase for the encryption. In the same manner as the accepted answer above.






          share|improve this answer








          New contributor




          Greg Lever is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
          Check out our Code of Conduct.




















            Your Answer








            StackExchange.ready(function() {
            var channelOptions = {
            tags: "".split(" "),
            id: "89"
            };
            initTagRenderer("".split(" "), "".split(" "), channelOptions);

            StackExchange.using("externalEditor", function() {
            // Have to fire editor after snippets, if snippets enabled
            if (StackExchange.settings.snippets.snippetsEnabled) {
            StackExchange.using("snippets", function() {
            createEditor();
            });
            }
            else {
            createEditor();
            }
            });

            function createEditor() {
            StackExchange.prepareEditor({
            heartbeatType: 'answer',
            autoActivateHeartbeat: false,
            convertImagesToLinks: true,
            noModals: true,
            showLowRepImageUploadWarning: true,
            reputationToPostImages: 10,
            bindNavPrevention: true,
            postfix: "",
            imageUploader: {
            brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
            contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
            allowUrls: true
            },
            onDemand: true,
            discardSelector: ".discard-answer"
            ,immediatelyShowMarkdownHelp:true
            });


            }
            });














            draft saved

            draft discarded


















            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f95137%2fhow-to-change-luks-passphrase%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown

























            4 Answers
            4






            active

            oldest

            votes








            4 Answers
            4






            active

            oldest

            votes









            active

            oldest

            votes






            active

            oldest

            votes









            33














            Tested in ubuntu 14.04: Search for the "Disks" application



            Select Device, select volume, Click cogs (more actions) -> "Change passphrase"



            screenshot:






            share|improve this answer


























            • Doesn't work with "long" passphrases...

              – Thomas
              May 30 '15 at 20:47











            • What actual application is this please? apt-get install ???

              – shadowbq
              Oct 9 '15 at 13:16











            • FYI: gnome-disk-utility / apt-get install gnome-disk-utility && gnome-disks

              – shadowbq
              Oct 9 '15 at 13:23






            • 2





              This is the built-in Disks application. No need to install anything. It works with fairly decent passwords. I haven't tried anything over 20 characters though.

              – Alain O'Dea
              Nov 26 '15 at 2:55
















            33














            Tested in ubuntu 14.04: Search for the "Disks" application



            Select Device, select volume, Click cogs (more actions) -> "Change passphrase"



            screenshot:






            share|improve this answer


























            • Doesn't work with "long" passphrases...

              – Thomas
              May 30 '15 at 20:47











            • What actual application is this please? apt-get install ???

              – shadowbq
              Oct 9 '15 at 13:16











            • FYI: gnome-disk-utility / apt-get install gnome-disk-utility && gnome-disks

              – shadowbq
              Oct 9 '15 at 13:23






            • 2





              This is the built-in Disks application. No need to install anything. It works with fairly decent passwords. I haven't tried anything over 20 characters though.

              – Alain O'Dea
              Nov 26 '15 at 2:55














            33












            33








            33







            Tested in ubuntu 14.04: Search for the "Disks" application



            Select Device, select volume, Click cogs (more actions) -> "Change passphrase"



            screenshot:






            share|improve this answer















            Tested in ubuntu 14.04: Search for the "Disks" application



            Select Device, select volume, Click cogs (more actions) -> "Change passphrase"



            screenshot:







            share|improve this answer














            share|improve this answer



            share|improve this answer








            edited Jan 20 '15 at 17:06









            guntbert

            9,226133170




            9,226133170










            answered Apr 5 '14 at 6:26









            Richard PierreRichard Pierre

            45544




            45544













            • Doesn't work with "long" passphrases...

              – Thomas
              May 30 '15 at 20:47











            • What actual application is this please? apt-get install ???

              – shadowbq
              Oct 9 '15 at 13:16











            • FYI: gnome-disk-utility / apt-get install gnome-disk-utility && gnome-disks

              – shadowbq
              Oct 9 '15 at 13:23






            • 2





              This is the built-in Disks application. No need to install anything. It works with fairly decent passwords. I haven't tried anything over 20 characters though.

              – Alain O'Dea
              Nov 26 '15 at 2:55



















            • Doesn't work with "long" passphrases...

              – Thomas
              May 30 '15 at 20:47











            • What actual application is this please? apt-get install ???

              – shadowbq
              Oct 9 '15 at 13:16











            • FYI: gnome-disk-utility / apt-get install gnome-disk-utility && gnome-disks

              – shadowbq
              Oct 9 '15 at 13:23






            • 2





              This is the built-in Disks application. No need to install anything. It works with fairly decent passwords. I haven't tried anything over 20 characters though.

              – Alain O'Dea
              Nov 26 '15 at 2:55

















            Doesn't work with "long" passphrases...

            – Thomas
            May 30 '15 at 20:47





            Doesn't work with "long" passphrases...

            – Thomas
            May 30 '15 at 20:47













            What actual application is this please? apt-get install ???

            – shadowbq
            Oct 9 '15 at 13:16





            What actual application is this please? apt-get install ???

            – shadowbq
            Oct 9 '15 at 13:16













            FYI: gnome-disk-utility / apt-get install gnome-disk-utility && gnome-disks

            – shadowbq
            Oct 9 '15 at 13:23





            FYI: gnome-disk-utility / apt-get install gnome-disk-utility && gnome-disks

            – shadowbq
            Oct 9 '15 at 13:23




            2




            2





            This is the built-in Disks application. No need to install anything. It works with fairly decent passwords. I haven't tried anything over 20 characters though.

            – Alain O'Dea
            Nov 26 '15 at 2:55





            This is the built-in Disks application. No need to install anything. It works with fairly decent passwords. I haven't tried anything over 20 characters though.

            – Alain O'Dea
            Nov 26 '15 at 2:55













            41














            I am not familiar with gui tool but cryptsetup is the tool to interact with luks.



            Basically AFAIK luks lets you add 8 passphrase slots and you can do that with:



            sudo cryptsetup -y luksAddKey ENCRYPTED_PARTITION
            sudo cryptsetup luksRemoveKey ENCRYPTED_PARTITION


            where 0 is the slot number. I guess luks stores slots as 0,1,2 etc. But I recommend you to be very careful with luks as you may lock yourself out. Please refer to manual of cryptsetup. Also I recommend you to visit other distro IRC channel just to be extra safe before you proceed.



            You may need to reboot the machine and try your new passsphrase as well before you remove the key.



            cryptsetup



            EDIT: Seems like gnome-disk-utility lets you change the passphrase.



            enter image description here



            enter image description here






            share|improve this answer


























            • cryptsetup luksRemoveKey <partition> actually takes a keyfile as the last parameter. So if you want to input the passphrase, just give the device as parameter. cryptsetup will first prompt for "Enter LUKS passphrase to be deleted:" and then "Enter any remaining LUKS passphrase:"

              – user1338062
              Apr 17 '13 at 9:30











            • Avoid the gnome utility if your passphrase is very long, it may cut your input...

              – Thomas
              May 30 '15 at 20:51











            • @Thomas or whoever else is interested: at least 14 characters are not too long for the gnome disk utility.

              – KlaymenDK
              Apr 13 '16 at 13:52











            • I just tried the gnome utility with an old password 22 characters long and a new passphrase 9 words long, and it failed enough times that I assume I typed it right at least once, and it's being truncated.

              – Glenn Willen
              Aug 13 '18 at 21:42
















            41














            I am not familiar with gui tool but cryptsetup is the tool to interact with luks.



            Basically AFAIK luks lets you add 8 passphrase slots and you can do that with:



            sudo cryptsetup -y luksAddKey ENCRYPTED_PARTITION
            sudo cryptsetup luksRemoveKey ENCRYPTED_PARTITION


            where 0 is the slot number. I guess luks stores slots as 0,1,2 etc. But I recommend you to be very careful with luks as you may lock yourself out. Please refer to manual of cryptsetup. Also I recommend you to visit other distro IRC channel just to be extra safe before you proceed.



            You may need to reboot the machine and try your new passsphrase as well before you remove the key.



            cryptsetup



            EDIT: Seems like gnome-disk-utility lets you change the passphrase.



            enter image description here



            enter image description here






            share|improve this answer


























            • cryptsetup luksRemoveKey <partition> actually takes a keyfile as the last parameter. So if you want to input the passphrase, just give the device as parameter. cryptsetup will first prompt for "Enter LUKS passphrase to be deleted:" and then "Enter any remaining LUKS passphrase:"

              – user1338062
              Apr 17 '13 at 9:30











            • Avoid the gnome utility if your passphrase is very long, it may cut your input...

              – Thomas
              May 30 '15 at 20:51











            • @Thomas or whoever else is interested: at least 14 characters are not too long for the gnome disk utility.

              – KlaymenDK
              Apr 13 '16 at 13:52











            • I just tried the gnome utility with an old password 22 characters long and a new passphrase 9 words long, and it failed enough times that I assume I typed it right at least once, and it's being truncated.

              – Glenn Willen
              Aug 13 '18 at 21:42














            41












            41








            41







            I am not familiar with gui tool but cryptsetup is the tool to interact with luks.



            Basically AFAIK luks lets you add 8 passphrase slots and you can do that with:



            sudo cryptsetup -y luksAddKey ENCRYPTED_PARTITION
            sudo cryptsetup luksRemoveKey ENCRYPTED_PARTITION


            where 0 is the slot number. I guess luks stores slots as 0,1,2 etc. But I recommend you to be very careful with luks as you may lock yourself out. Please refer to manual of cryptsetup. Also I recommend you to visit other distro IRC channel just to be extra safe before you proceed.



            You may need to reboot the machine and try your new passsphrase as well before you remove the key.



            cryptsetup



            EDIT: Seems like gnome-disk-utility lets you change the passphrase.



            enter image description here



            enter image description here






            share|improve this answer















            I am not familiar with gui tool but cryptsetup is the tool to interact with luks.



            Basically AFAIK luks lets you add 8 passphrase slots and you can do that with:



            sudo cryptsetup -y luksAddKey ENCRYPTED_PARTITION
            sudo cryptsetup luksRemoveKey ENCRYPTED_PARTITION


            where 0 is the slot number. I guess luks stores slots as 0,1,2 etc. But I recommend you to be very careful with luks as you may lock yourself out. Please refer to manual of cryptsetup. Also I recommend you to visit other distro IRC channel just to be extra safe before you proceed.



            You may need to reboot the machine and try your new passsphrase as well before you remove the key.



            cryptsetup



            EDIT: Seems like gnome-disk-utility lets you change the passphrase.



            enter image description here



            enter image description here







            share|improve this answer














            share|improve this answer



            share|improve this answer








            edited Apr 17 '13 at 10:06









            user1338062

            57657




            57657










            answered Jan 13 '12 at 11:47









            sagarchalisesagarchalise

            18k105974




            18k105974













            • cryptsetup luksRemoveKey <partition> actually takes a keyfile as the last parameter. So if you want to input the passphrase, just give the device as parameter. cryptsetup will first prompt for "Enter LUKS passphrase to be deleted:" and then "Enter any remaining LUKS passphrase:"

              – user1338062
              Apr 17 '13 at 9:30











            • Avoid the gnome utility if your passphrase is very long, it may cut your input...

              – Thomas
              May 30 '15 at 20:51











            • @Thomas or whoever else is interested: at least 14 characters are not too long for the gnome disk utility.

              – KlaymenDK
              Apr 13 '16 at 13:52











            • I just tried the gnome utility with an old password 22 characters long and a new passphrase 9 words long, and it failed enough times that I assume I typed it right at least once, and it's being truncated.

              – Glenn Willen
              Aug 13 '18 at 21:42



















            • cryptsetup luksRemoveKey <partition> actually takes a keyfile as the last parameter. So if you want to input the passphrase, just give the device as parameter. cryptsetup will first prompt for "Enter LUKS passphrase to be deleted:" and then "Enter any remaining LUKS passphrase:"

              – user1338062
              Apr 17 '13 at 9:30











            • Avoid the gnome utility if your passphrase is very long, it may cut your input...

              – Thomas
              May 30 '15 at 20:51











            • @Thomas or whoever else is interested: at least 14 characters are not too long for the gnome disk utility.

              – KlaymenDK
              Apr 13 '16 at 13:52











            • I just tried the gnome utility with an old password 22 characters long and a new passphrase 9 words long, and it failed enough times that I assume I typed it right at least once, and it's being truncated.

              – Glenn Willen
              Aug 13 '18 at 21:42

















            cryptsetup luksRemoveKey <partition> actually takes a keyfile as the last parameter. So if you want to input the passphrase, just give the device as parameter. cryptsetup will first prompt for "Enter LUKS passphrase to be deleted:" and then "Enter any remaining LUKS passphrase:"

            – user1338062
            Apr 17 '13 at 9:30





            cryptsetup luksRemoveKey <partition> actually takes a keyfile as the last parameter. So if you want to input the passphrase, just give the device as parameter. cryptsetup will first prompt for "Enter LUKS passphrase to be deleted:" and then "Enter any remaining LUKS passphrase:"

            – user1338062
            Apr 17 '13 at 9:30













            Avoid the gnome utility if your passphrase is very long, it may cut your input...

            – Thomas
            May 30 '15 at 20:51





            Avoid the gnome utility if your passphrase is very long, it may cut your input...

            – Thomas
            May 30 '15 at 20:51













            @Thomas or whoever else is interested: at least 14 characters are not too long for the gnome disk utility.

            – KlaymenDK
            Apr 13 '16 at 13:52





            @Thomas or whoever else is interested: at least 14 characters are not too long for the gnome disk utility.

            – KlaymenDK
            Apr 13 '16 at 13:52













            I just tried the gnome utility with an old password 22 characters long and a new passphrase 9 words long, and it failed enough times that I assume I typed it right at least once, and it's being truncated.

            – Glenn Willen
            Aug 13 '18 at 21:42





            I just tried the gnome utility with an old password 22 characters long and a new passphrase 9 words long, and it failed enough times that I assume I typed it right at least once, and it's being truncated.

            – Glenn Willen
            Aug 13 '18 at 21:42











            14














            cryptsetup luksChangeKey <target device> -S <target key slot number>


            This will ask you first for a valid pass-phrase (in any enabled keyslot) then will prompt you fro the new passphrase in the target keyslot






            share|improve this answer





















            • 1





              In 12.04.5 I was asked for the new password twice.

              – Devin Lane
              Sep 19 '15 at 21:00
















            14














            cryptsetup luksChangeKey <target device> -S <target key slot number>


            This will ask you first for a valid pass-phrase (in any enabled keyslot) then will prompt you fro the new passphrase in the target keyslot






            share|improve this answer





















            • 1





              In 12.04.5 I was asked for the new password twice.

              – Devin Lane
              Sep 19 '15 at 21:00














            14












            14








            14







            cryptsetup luksChangeKey <target device> -S <target key slot number>


            This will ask you first for a valid pass-phrase (in any enabled keyslot) then will prompt you fro the new passphrase in the target keyslot






            share|improve this answer















            cryptsetup luksChangeKey <target device> -S <target key slot number>


            This will ask you first for a valid pass-phrase (in any enabled keyslot) then will prompt you fro the new passphrase in the target keyslot







            share|improve this answer














            share|improve this answer



            share|improve this answer








            edited Jun 2 '17 at 15:12









            tacaswell

            10316




            10316










            answered Dec 2 '13 at 11:29









            louigi600louigi600

            14112




            14112








            • 1





              In 12.04.5 I was asked for the new password twice.

              – Devin Lane
              Sep 19 '15 at 21:00














            • 1





              In 12.04.5 I was asked for the new password twice.

              – Devin Lane
              Sep 19 '15 at 21:00








            1




            1





            In 12.04.5 I was asked for the new password twice.

            – Devin Lane
            Sep 19 '15 at 21:00





            In 12.04.5 I was asked for the new password twice.

            – Devin Lane
            Sep 19 '15 at 21:00











            1














            Tested on Ubuntu 18.04 run gnome-disks and you can point and click to change the passphrase for the encryption. In the same manner as the accepted answer above.






            share|improve this answer








            New contributor




            Greg Lever is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
            Check out our Code of Conduct.

























              1














              Tested on Ubuntu 18.04 run gnome-disks and you can point and click to change the passphrase for the encryption. In the same manner as the accepted answer above.






              share|improve this answer








              New contributor




              Greg Lever is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
              Check out our Code of Conduct.























                1












                1








                1







                Tested on Ubuntu 18.04 run gnome-disks and you can point and click to change the passphrase for the encryption. In the same manner as the accepted answer above.






                share|improve this answer








                New contributor




                Greg Lever is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
                Check out our Code of Conduct.










                Tested on Ubuntu 18.04 run gnome-disks and you can point and click to change the passphrase for the encryption. In the same manner as the accepted answer above.







                share|improve this answer








                New contributor




                Greg Lever is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
                Check out our Code of Conduct.









                share|improve this answer



                share|improve this answer






                New contributor




                Greg Lever is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
                Check out our Code of Conduct.









                answered yesterday









                Greg LeverGreg Lever

                1213




                1213




                New contributor




                Greg Lever is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
                Check out our Code of Conduct.





                New contributor





                Greg Lever is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
                Check out our Code of Conduct.






                Greg Lever is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
                Check out our Code of Conduct.






























                    draft saved

                    draft discarded




















































                    Thanks for contributing an answer to Ask Ubuntu!


                    • Please be sure to answer the question. Provide details and share your research!

                    But avoid



                    • Asking for help, clarification, or responding to other answers.

                    • Making statements based on opinion; back them up with references or personal experience.


                    To learn more, see our tips on writing great answers.




                    draft saved


                    draft discarded














                    StackExchange.ready(
                    function () {
                    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f95137%2fhow-to-change-luks-passphrase%23new-answer', 'question_page');
                    }
                    );

                    Post as a guest















                    Required, but never shown





















































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown

































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown







                    Popular posts from this blog

                    Category:香港粉麵

                    List *all* the tuples!

                    Channel [V]