19.3.3. Restoring access to a volume

过程 19.5. Restoring access to a volume

1. Get the escrow packet for the volume from the packet storage and send it to one of the designated users for decryption.
2. The designated user runs:

   volume_key --reencrypt -d /the/nss/directory escrow-packet-in -o escrow-packet-outvolume_key --reencrypt -d /the/nss/directory escrow-packet-in -o escrow-packet-outvolume_key --reencrypt -d /the/nss/directory escrow-packet-in -o escrow-packet-out

   Copy to Clipboard Toggle word wrap
   After providing the NSS database password, the designated user chooses a passphrase for encrypting escrow-packet-out. This passphrase can be different every time and only protects the encryption keys while they are moved from the designated user to the target system.
3. Obtain the escrow-packet-out file and the passphrase from the designated user.
4. Boot the target system in an environment that can run volume_key and have the escrow-packet-out file available, such as in a rescue mode.
5. Run:

   volume_key --restore /path/to/volume escrow-packet-outvolume_key --restore /path/to/volume escrow-packet-outvolume_key --restore /path/to/volume escrow-packet-out

   Copy to Clipboard Toggle word wrap
   A prompt will appear for the packet passphrase chosen by the designated user, and for a new passphrase for the volume.
6. Mount the volume using the chosen volume passphrase.