first, I know it is a very bad situtation and one should always have a backup of keys but the problem is not caused by me. I only was ask for help.

The drive is encrypted using cryptsetup with luks. The corresponding password got lost but the device is open (mounted). I tried to add a new key using luksAddKey but I have to enter an existing password at first.

Is there a way to get a new password to this device or do I have to copy all data to an extra drive and create a new encrypted device?

The system information are:

$ lsb_release -a                                                               
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 16.04.3 LTS
Release:    16.04
Codename:   xenial

$ cryptsetup --version                                                         
cryptsetup 1.6.6

$ cryptsetup luksDump /dev/md2                                                 
LUKS header information for /dev/md2

Version:        1
Cipher name:    aes
Cipher mode:    xts-plain64
Hash spec:      sha512
Payload offset: 4096
MK bits:        512
MK digest:      37 ee 53 b6 13 86 93 2a 13 36 41 85 ab 26 e0 7f 7f 3e 03 be 
MK salt:        ed 4e 59 fc 3e b3 42 f2 32 97 c5 95 83 eb 90 6c 
                eb 40 02 25 85 db 5c d1 68 85 3a 54 a0 9d c9 f1 
MK iterations:  62875
UUID:           a9b56d9a-fb50-4b8a-ad63-af1851c89f42

Key Slot 0: ENABLED
    Iterations:             267782
    Salt:                   25 66 7e 35 aa 55 b2 05 c3 fc 66 89 e4 2c 5c b6 
                            e3 18 25 8e 66 d8 03 c5 24 d7 a1 09 15 dc ec 78 
    Key material offset:    8
    AF stripes:             4000
Key Slot 1: DISABLED
Key Slot 2: DISABLED
Key Slot 3: DISABLED
Key Slot 4: DISABLED
Key Slot 5: DISABLED
Key Slot 6: DISABLED
Key Slot 7: DISABLED

You can find a good solution at: http://www.thegeekstuff.com/2016/03/cryptsetup-lukskey/

Here is the short version:

dmsetup table  --showkeys|grep luks

Make sure you have only one encrypted device.

cryptsetup luksAddKey /dev/sdXX --master-key-file <(dmsetup table  --showkeys|grep luks|cut -d\  -f 6|xxd -r -p)

Please change /dev/sdXX with the block device where luks is on top.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.