On 10/28/23 08:49, lejeczek via users wrote:
Hi guys.
I know this is most likely not best suited question for this list, but I'm hoping
some experts might be able to help.
I have a LUKS device which had keyslot with pass-phrase removed and token for TPM keyslot
removed too - I think this is the case, for none of my passphrase works and device is as
below:
I hope there is a way to save & bring it back to live - device is open right now and
I've access to filesystem, obviously goal would be to avoid re-format/crypt.
Is it possible to restore/recreate that lost token and/or add new Keyslot somehow? I have
no header backup for this device.
-> $ cryptsetup luksDump /dev/nvme0n1p3
...
Yes, as long as the device is currently unlocked you can recover the master key from the
kernel. You will need the name of the /dev/mapper entry for the unlocked device. If you
don't know it, you can use "lsblk" to find it. For example (since I
conveniently happen to have an encrypted nvme0n1p3):
# lsblk /dev/nvme0n1p3
nvme0n1p3 259:3 0 568G 0 part
|...
└─rl_omega3x-home 253:4 0 50G 0 lvm
└─home-luks 253:7 0 50G 0 crypt /home
Then use "dmsetup" to display the encryption key:
# dmsetup table home-luks --showkeys
That should yield a line that includes a long string of hex digits. That is the master
key. Save that temporarily in a safe place since the key will be lost forever you reboot
or the LUKS container is closed. Here is a one-liner that will use the 5th field in that
dmsetup output directly to create a new key:
# cryptsetup luksAddKey /dev/nvme0n1p3 --master-key-file <(dmsetup table home-luks
--showkeys | awk '{print $5}' | xxd -r -p)
Once you've got that recovered, do use "cryptsetup luksHeaderBackup" to save
that LUKS header somewhere so that you don't get into this position again. And do
destroy that saved master key.
--
Bob Nichols "NOSPAM" is really part of my email address.
Do NOT delete it.