33 lines
1.2 KiB
Bash
Executable File
33 lines
1.2 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# blob:summary=Set a new encryption password for a drive selected.
|
|
# blob:requires-sudo=true
|
|
|
|
encrypted_drives=$(blkid -t TYPE=crypto_LUKS -o device)
|
|
|
|
if [[ -n $encrypted_drives ]]; then
|
|
if (( $(wc -l <<<"$encrypted_drives") == 1 )); then
|
|
drive_to_change="$encrypted_drives"
|
|
else
|
|
drive_to_change="$(blob-drive-select "$encrypted_drives")"
|
|
fi
|
|
|
|
if [[ -n $drive_to_change ]]; then
|
|
new_password=$(gum input --password --header "New encryption password") || exit 1
|
|
[[ -n $new_password ]] || { echo "Password cannot be empty."; exit 1; }
|
|
|
|
confirmation=$(gum input --password --header "Confirm new encryption password") || exit 1
|
|
[[ $new_password == "$confirmation" ]] || { echo "Passwords do not match."; exit 1; }
|
|
|
|
echo "Changing full-disk encryption password for $drive_to_change"
|
|
# The new key travels over stdin and reaches cryptsetup as a keyfile via
|
|
# <(cat), leaving the tty free for the current-passphrase prompt.
|
|
printf "%s" "$new_password" | sudo bash -c 'exec cryptsetup luksChangeKey --pbkdf argon2id --iter-time 2000 "$1" <(cat) </dev/tty' bash "$drive_to_change"
|
|
else
|
|
echo "No drive selected."
|
|
fi
|
|
else
|
|
echo "No encrypted drives available."
|
|
exit 1
|
|
fi
|