17.8. Changing the LUKS passphrase by using the command line

Procedure

1. Change the existing passphrase on the LUKS encrypted device:

   # cryptsetup luksChangeKey /dev/<device_ID>

   Replace <device_ID> with the device designator, for example, sda.

   If you have multiple key slots configured, you can specify the slot to work with:

   # cryptsetup luksChangeKey /dev/<device_ID> --key-slot <slot_number>

   Replace <slot_number> with the number of the key slot you want to modify.

2. Insert the current passphrase and the new passphrase:

   Enter passphrase to be changed:
   Enter new passphrase:
   Verify passphrase:

3. Validate the new passphrase:

   # cryptsetup --verbose open --test-passphrase /dev/<device_ID>

Verification

1. Verify that the new passphrase can unlock the device:

   Enter passphrase for /dev/<device_ID>:
   Key slot <slot_number> unlocked.
   Command successful.