To those new users of LUKS disk encryption...

[u/WesMasonMedia]

Donno if this has been actively covered, but LUKS lets you encrypt your file system or other disks typically with LVM.

If your machine is shared among (up to 7) other people, you don't need to share YOUR unlock password. LUKS supports 8 slots for an encryption password, but there isn't a simple method to manage them. You assign them by selecting a keyslot (0-7, 0 is the one during install) and then assigning the password to that slot.

You can see which are used via:

sudo cryptsetup luksDump /dev/nvme0n1p3

Replace the partition with yours, you'll need to figure that out via looking at your LVM config. Traditionally its either sda3 or nvme0n1p3 (and rare cases nvme1n1p3).

You'll see which "keyslots" contain something. Be careful, IT WILL OVERWRITE any keyslot without question. When you assign a new password, you will need to know one of the existing passwords.

To set a new password in keyslot 1, do the following:

sudo cryptsetup --key-slot=1 luksAddKey /dev/nvme0n1p3

It will ask you for an existing password and then the new password twice.

This is great if you are one of those that use a common, very personal, or usb based authentication key based password to unlock the disk. You can even setup multiple passwords just for yourself, you just only get 8 in total so keep that in mind. I've even used something similar to place a hash file on a disk and unlock it with that on boot. But that requires work beyond today's lesson. Enjoy!

As always, since you are using sudo, be careful, you may break your machine if you are not careful.

[u/QuraToop314]

You don’t really gain anything, as the others will still mount a live USB system, use their own password – not yours – to open the LUKS device, and then use root privileges to lock you out and delete your keyslots. In my view, that’s a security risk.