How to change passphrase for FreeBSD 11.0 encrypted ZFS root?

[Jov]

You change the passphrase without key file？ the default geli boot will read
key files in /boot dir，the key file name is set in /boot/loader.conf, you
shoud remove the settings if you not set it.

2017年6月14日 2:20 PM，"David Christensen" <dpchrist at holgerdanske.com>写道：

FreeBSD:

I have a FreeBSD 11.0 i386 machine with encrypted ZFS on root and encrypted
swap as created by the FreeBSD installer.  I would like to change the root
password.  I issued the following command:

        toor at freebsd:/root # geli setkey -n 0 /dev/ada0s1d
        Enter new passphrase:
        Reenter new passphrase:
        Note, that the master key encrypted with old keys and/or passphrase
may still exists in a metadata backup file.


Now when I boot, I enter the passphrase at the boot menu, a bunch of stuff
scrolls by, and then I see:

    Enter passphrase for ada0s1d:


I enter the new passphrase and I see:

    GEOM_ELI: Wrong key for ada0s1d.  Tries left: 2.
    Enter passphrase for ada0s1d:


I enter it again and I see:

    GEOM_ELI: Wrong key for ada0s1d.  Tries left: 1.
    Enter passphrase for ada0s1d:


I enter the old passphrase and I see:

    GEOM_ELI: Wrong key for ada0s1d.  No tries left.
    Mounting from zfs:zroot/ROOT/default failed with error 2.


I am then presented with some brief documentation and a prompt:

    mountroot>


If I enter "?" to get a list of valid disk boot devices, I see:

    List of GEOM managed disk devices:
      ada0s1d ada0s1b ada0s1a ada0s1 ada0 cd0


I do not see ada0s1d.eli, which should be my decrypted root file system.


I have rebooted and tried more than once -- same result.


It would be useful to know why GELI for the root device is now broken, and
if it is possible to fix it (other than re-imaging/ re-installing).


What is the correct way to change the passphrase for FreeBSD 11.0 encrypted
ZFS root?


Is this specific use-case documented anywhere?


David
_______________________________________________
freebsd-questions at freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscribe at freebsd.org"