Date: Wed, 14 Jun 2017 20:35:42 +0800 From: Jov <amutu@amutu.com> To: David Christensen <dpchrist@holgerdanske.com> Cc: freebsd-questions@freebsd.org Subject: Re: How to change passphrase for FreeBSD 11.0 encrypted ZFS root? Message-ID: <CADyrUxNgfu-g24hcQA9Fc-YATTJA0tmkq%2BN9u3Rta%2B1-Cp%2B=hw@mail.gmail.com> In-Reply-To: <1fb7f3d1-dfb5-ab75-ab75-12dcc81423ca@holgerdanske.com> References: <1fb7f3d1-dfb5-ab75-ab75-12dcc81423ca@holgerdanske.com>
next in thread | previous in thread | raw e-mail | index | archive | help
You change the passphrase without key file=EF=BC=9F the default geli boot w=
ill read
key files in /boot dir=EF=BC=8Cthe key file name is set in /boot/loader.con=
f, you
shoud remove the settings if you not set it.
2017=E5=B9=B46=E6=9C=8814=E6=97=A5 2:20 PM=EF=BC=8C"David Christensen" <dpc=
hrist@holgerdanske.com>=E5=86=99=E9=81=93=EF=BC=9A
FreeBSD:
I have a FreeBSD 11.0 i386 machine with encrypted ZFS on root and encrypted
swap as created by the FreeBSD installer. I would like to change the root
password. I issued the following command:
toor@freebsd:/root # geli setkey -n 0 /dev/ada0s1d
Enter new passphrase:
Reenter new passphrase:
Note, that the master key encrypted with old keys and/or passphrase
may still exists in a metadata backup file.
Now when I boot, I enter the passphrase at the boot menu, a bunch of stuff
scrolls by, and then I see:
Enter passphrase for ada0s1d:
I enter the new passphrase and I see:
GEOM_ELI: Wrong key for ada0s1d. Tries left: 2.
Enter passphrase for ada0s1d:
I enter it again and I see:
GEOM_ELI: Wrong key for ada0s1d. Tries left: 1.
Enter passphrase for ada0s1d:
I enter the old passphrase and I see:
GEOM_ELI: Wrong key for ada0s1d. No tries left.
Mounting from zfs:zroot/ROOT/default failed with error 2.
I am then presented with some brief documentation and a prompt:
mountroot>
If I enter "?" to get a list of valid disk boot devices, I see:
List of GEOM managed disk devices:
ada0s1d ada0s1b ada0s1a ada0s1 ada0 cd0
I do not see ada0s1d.eli, which should be my decrypted root file system.
I have rebooted and tried more than once -- same result.
It would be useful to know why GELI for the root device is now broken, and
if it is possible to fix it (other than re-imaging/ re-installing).
What is the correct way to change the passphrase for FreeBSD 11.0 encrypted
ZFS root?
Is this specific use-case documented anywhere?
David
_______________________________________________
freebsd-questions@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org=
"
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CADyrUxNgfu-g24hcQA9Fc-YATTJA0tmkq%2BN9u3Rta%2B1-Cp%2B=hw>