How can I change/replace the passphrase of an encrypted eli provider in FreeBSD? Do I have to recreate the entire provider and copy data, or is there a simpler and faster way?
I've looked in the man pages (which leads me to think there may be some way of doing this through geli init) and googled it, but can't find any definite answer.
You use geli setkey. To change from an existing key + phrase to a new key + phrase, you need to specify both the old and the new pair, like so:
$ geli setkey -v -k /boot/old.key -K /boot/new.key /dev/md9
Enter passphrase: oldphrase
Enter new passphrase: newphrase
Reenter new passphrase: newphrase
Decrypted Master Key 0.
Note, that the master key encrypted with old keys and/or passphrase may still exists in a metadata backup file.
Done.
If your old key had no passphrase, add -p, and if you want your new key to be without a passphrase, add -P. You do not need to detach first, and you certainly do not need to copy all your data around. Do keep a backup of your metadata for peace of mind, and don't forget to update it after changing keys/passphrases.
Important: If you are using boottime passphrase entry (for encrypted root partitions) and are changing from a key + phrase to key without passphrase (-P above), you must also disable the boottime passphrase prompt with geli configure -B. Furthermore, if you changed keyfile locations, you need to edit /boot/loader.conf to point to the new keyfile.
Someone tried it, but failed. Don't remember who but it was some 2 years ago. If you want to be safe, do the copy and re-init.
I just read this on a dead google search result (google ddnt have it cached, but the excerpt still showed):
geli detach /dev/md9
and then
geli setkey ...
But i won't guarantee that everything will be fine.
This also seems to be the way for changing from passphrase to keyfiles.
