I have a Debian Wheezy server that's been running for a while with an encrypted drive. The password for the encrypted drive (/dev/sda5) was lost when my encrypted password file was corrupted.I'd like to be able to reboot this server, but that will of course require that password. Since the drive is clearly in a decrypted state, is there a way to change the password without knowing the old one?cryptsetup luksChangeKey /dev/sda5 requires the password of the volume.I could of course rsync everything off and rebuild, but I'd like to avoid that. I looked through memory (#cat /dev/mem | less), but was unable to find it (which is a very good thing!). 
Change password on a LUKS filesystem without knowing the password
linux;luks
Yes, you can do this by accessing the master key while the volume is decrypted.The quick and dirty to add a new passphrase:device=/dev/sda5volume_name=foocryptsetup luksAddKey $device --master-key-file <(dmsetup table --showkeys $volume_name | awk '{ print $5 }' | xxd -r -p)device and volume_name should be set appropriately.volume_name is the name of the decrypted volume, the one you see in /dev/mapper.Explanation:LUKS volumes encrypt their data with a master key. Each passphrase you add simply stores a copy of this master key encrypted with that passphrase. So if you have the master key, you simply need to use it in a new key slot.Lets tear apart the command above.$ dmsetup table --showkeys $volume_nameThis dumps a bunch of information about the actively decrypted volume. The output looks like this:0 200704 crypt aes-xts-plain64 53bb7da1f26e2a032cc9e70d6162980440bd69bb31cb64d2a4012362eeaad0ac 0 7:2 4096Field #5 is the master key. $ dmsetup table --showkeys $volume_name | awk '{ print $5 }' | xxd -r -pNot going to show the output of this as it's binary data, but what this does is grab the master key for the volume, and then convert it into raw binary data which is needed later. $ cryptsetup luksAddKey $device --master-key-file <(...)This is telling cryptsetup to add a new key to the volume. Normally this action requires an existing key, however we use --master-key-file to tell it we want to use the master key instead.The <(...) is shell command substitution & redirection. It basically executes everything inside, sends the output to a pipe, and then substitutes the <(...) with a path to that pipe. So the whole command is just a one-liner to condense several operations.