Dieser Inhalt ist in der von Ihnen ausgewählten Sprache nicht verfügbar.
19.2. Using volume_key as an individual user
As an individual user,
volume_key
can be used to save encryption keys by using the following procedure.
Note
For all examples in this file,
/path/to/volume
is a LUKS device, not the plaintext device contained within. blkid -s type /path/to/volume
should report type="crypto_LUKS"
.
Procedure 19.1. Using volume_key
stand-alone
- Run:
A prompt will then appear requiring an escrow packet passphrase to protect the key.volume_key --save
/path/to/volume
-o escrow-packet - Save the generated
escrow-packet
file, ensuring that the passphrase is not forgotten.
If the volume passphrase is forgotten, use the saved escrow packet to restore access to the data.
Procedure 19.2. Restore access to data with escrow packet
- Boot the system in an environment where
volume_key
can be run and the escrow packet is available (a rescue mode, for example). - Run:
A prompt will appear for the escrow packet passphrase that was used when creating the escrow packet, and for the new passphrase for the volume.volume_key --restore
/path/to/volume
escrow-packet - Mount the volume using the chosen passphrase.
To free up the passphrase slot in the LUKS header of the encrypted volume, remove the old, forgotten passphrase by using the command
cryptsetup luksKillSlot
.