19.2. Using volume_key as an individual user

download PDF
As an individual user, volume_key can be used to save encryption keys by using the following procedure.


For all examples in this file, /path/to/volume is a LUKS device, not the plaintext device contained within. blkid -s type /path/to/volume should report type="crypto_LUKS".

Procedure 19.1. Using volume_key stand-alone

  1. Run:
    volume_key --save /path/to/volume -o escrow-packet
    A prompt will then appear requiring an escrow packet passphrase to protect the key.
  2. Save the generated escrow-packet file, ensuring that the passphrase is not forgotten.
If the volume passphrase is forgotten, use the saved escrow packet to restore access to the data.

Procedure 19.2. Restore access to data with escrow packet

  1. Boot the system in an environment where volume_key can be run and the escrow packet is available (a rescue mode, for example).
  2. Run:
    volume_key --restore /path/to/volume escrow-packet
    A prompt will appear for the escrow packet passphrase that was used when creating the escrow packet, and for the new passphrase for the volume.
  3. Mount the volume using the chosen passphrase.
To free up the passphrase slot in the LUKS header of the encrypted volume, remove the old, forgotten passphrase by using the command cryptsetup luksKillSlot.
Red Hat logoGithubRedditYoutubeTwitter


Try, buy, & sell


About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

© 2024 Red Hat, Inc.