From owner-freebsd-questions@freebsd.org Wed Jun 14 06:20:33 2017 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 4AD7BD86E58 for ; Wed, 14 Jun 2017 06:20:33 +0000 (UTC) (envelope-from dpchrist@holgerdanske.com) Received: from holgerdanske.com (holgerdanske.com [184.105.128.27]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "holgerdanske.com", Issuer "holgerdanske.com" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 3B6017BA8E for ; Wed, 14 Jun 2017 06:20:33 +0000 (UTC) (envelope-from dpchrist@holgerdanske.com) Received: from 99.100.19.101 ([99.100.19.101]) by holgerdanske.com with ESMTPSA (ECDHE-RSA-AES128-GCM-SHA256:TLSv1.2:Kx=ECDH:Au=RSA:Enc=AESGCM(128):Mac=AEAD) (SMTP-AUTH username dpchrist@holgerdanske.com, mechanism PLAIN) for ; Tue, 13 Jun 2017 23:20:29 -0700 To: freebsd-questions@freebsd.org From: David Christensen Subject: How to change passphrase for FreeBSD 11.0 encrypted ZFS root? Message-ID: <1fb7f3d1-dfb5-ab75-ab75-12dcc81423ca@holgerdanske.com> Date: Tue, 13 Jun 2017 23:19:53 -0700 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Jun 2017 06:20:33 -0000 FreeBSD: I have a FreeBSD 11.0 i386 machine with encrypted ZFS on root and encrypted swap as created by the FreeBSD installer. I would like to change the root password. I issued the following command: toor@freebsd:/root # geli setkey -n 0 /dev/ada0s1d Enter new passphrase: Reenter new passphrase: Note, that the master key encrypted with old keys and/or passphrase may still exists in a metadata backup file. Now when I boot, I enter the passphrase at the boot menu, a bunch of stuff scrolls by, and then I see: Enter passphrase for ada0s1d: I enter the new passphrase and I see: GEOM_ELI: Wrong key for ada0s1d. Tries left: 2. Enter passphrase for ada0s1d: I enter it again and I see: GEOM_ELI: Wrong key for ada0s1d. Tries left: 1. Enter passphrase for ada0s1d: I enter the old passphrase and I see: GEOM_ELI: Wrong key for ada0s1d. No tries left. Mounting from zfs:zroot/ROOT/default failed with error 2. I am then presented with some brief documentation and a prompt: mountroot> If I enter "?" to get a list of valid disk boot devices, I see: List of GEOM managed disk devices: ada0s1d ada0s1b ada0s1a ada0s1 ada0 cd0 I do not see ada0s1d.eli, which should be my decrypted root file system. I have rebooted and tried more than once -- same result. It would be useful to know why GELI for the root device is now broken, and if it is possible to fix it (other than re-imaging/ re-installing). What is the correct way to change the passphrase for FreeBSD 11.0 encrypted ZFS root? Is this specific use-case documented anywhere? David