Change LUKS encryption password - Change LUKS encryption password - TUXEDO Computers

In contrast to many other encryption solutions, this is possible with LUKS. But for your better understanding: This is not a solution for a lost password. The user must know the previous password in order to enter a new one. But changing bad passwords is also a step in the right direction.

Note!
Work on LUKS drives is critical. So creating a backup before you start is certainly not wrong.

Change password

Changing the password on a LUKS drive with only one password is easy: Open Terminal and run the following command by replacing the current location of the drive with "sdX". Then enter the existing password to create a new one.

sudo cryptsetup luksChangeKey /dev/sdX

LUKS drives with multiple passwords

LUKS drives can actually have multiple passwords or key files, even up to eight. First, the drive should be checked to see how many keys there are. But chances are good that only the key position 0 is occupied - this is the first one.

sudo cryptsetup luksDump /dev/sdX | grep -i key

If free slots are open, additional passwords can be added to the drive at any time, e.g. like this:

sudo cryptsetup luksAddKey /dev/sdX

If several keys are managed on different partitions of the same drive, you should select certain keys. This is quite easy with a -S flag. Then add the slot number to select a key to change.

sudo cryptsetup luksChangeKey /dev/sdX -S 2

Removing the password

If you work with multiple keys, you will probably need to remove old keys from time to time. The easiest way is to use the built-in command to remove a key. LUKS will then ask you for a password. It automatically removes the key associated with the key you enter.

sudo cryptsetup luksRemoveKey /dev/sdX

If you prefer to specify which key to remove yourself, you can use the command KillSlot to remove the key in a specific slot. Simply enter the slot number after the drive - this is the one that will be removed.

sudo cryptsetup luksKillSlot /dev/sdX 2

Regardless of how LUKS passwords are managed, it is one of the most flexible encryption options available. Since LUKS can be used to change, manage and remove keys, new levels of security are added to the drive. LUKS also allows you to control access for a team of people, not just for yourself.

Changing crypt password in TCC

If you prefer to make the change graphically, you will find a way to do so in the TUXEDO Control Center (TCC). To do this, click on 'Tools' in the bar on the left and select the sub-item 'Change encryption password'. Here, you first enter the current password and then the new password, which you must then confirm. It must be said here that this only works in the TCC if all partitions have the same password. If that is not the case, you need to do the change in a terminal.