Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I change/replace the passphrase of an encrypted eli provider in FreeBSD? Do I have to recreate the entire provider and copy data, or is there a simpler and faster way?

I've looked in the man pages (which leads me to think there may be some way of doing this through geli init) and googled it, but can't find any definite answer.

share|improve this question
up vote 2 down vote accepted

You use geli setkey. To change from an existing key + phrase to a new key + phrase, you need to specify both the old and the new pair, like so:

$ geli setkey -v -k /boot/old.key -K /boot/new.key /dev/md9
Enter passphrase: oldphrase
Enter new passphrase: newphrase
Reenter new passphrase: newphrase
Decrypted Master Key 0.
Note, that the master key encrypted with old keys and/or passphrase may still exists in a metadata backup file.

If your old key had no passphrase, add -p, and if you want your new key to be without a passphrase, add -P. You do not need to detach first, and you certainly do not need to copy all your data around. Do keep a backup of your metadata for peace of mind, and don't forget to update it after changing keys/passphrases.

Important: If you are using boottime passphrase entry (for encrypted root partitions) and are changing from a key + phrase to key without passphrase (-P above), you must also disable the boottime passphrase prompt with geli configure -B. Furthermore, if you changed keyfile locations, you need to edit /boot/loader.conf to point to the new keyfile.

share|improve this answer

Someone tried it, but failed. Don't remember who but it was some 2 years ago. If you want to be safe, do the copy and re-init.

I just read this on a dead google search result (google ddnt have it cached, but the excerpt still showed):

geli detach /dev/md9

and then

geli setkey ...

But i won't guarantee that everything will be fine.

This also seems to be the way for changing from passphrase to keyfiles.

share|improve this answer
Hmmmm, I hope there's another answer out there, because that's rather timeconsuming with big volumes. But thanks anyway. – poplitea Oct 9 '11 at 2:05
Thank you, that's it. Tested, and it works -- at least for me in this test-instance. – poplitea Oct 9 '11 at 3:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.