Resetting LUKS password from CLI with the recovery key

For the partition which is encrypted with LUKS, you will need to get the offset for the partition as well as the logical sector size of the device. Using sfdisk together with a regex expression is useful for this. Assuming the partition number with LUKS is partition 2, and the image file is backup.img:

# set the partition number for LUKS and the image file partdev=./backup.img partnum=2 # get offset of partition, sector size, and the next free loop device partoff=$(sfdisk -d $partdev | grep -oP "$partnum : start= .*\K[0-9]*") secsize=$(stat -c %B $partdev) loopdev=$(losetup -f) # using these values, create a loop device, decrypt, and mount LUKS losetup $loopdev -o $((partoff * secsize)) $partdev cryptsetup luksOpen $loopdev backup_crypt mount /dev/mapper/backup_crypt /mnt 

You now have the decrypted filesystem available at /mnt. Do what you want with it. When you're finished, you need to unmount, close the LUKS device, and remove the loop device:

umount /mnt cryptsetup luksClose backup_crypt losetup -d $loopdev 

The the recovery key added as part of the Ubiquity update for Debian sounds similar to what's described here if it's one that is made during initial installation of the OS. If it is, in fact, similar or the same then the recovery key merely acted as another backup password taking up one of the other key slots and can thus be treated as a secondary password to add a new password.

But, if your goal was just to reset the password to access the data, you could just use the recovery key to access the data instead of using the recovery key to make a new one.

Back up

Make a backup of the LUKS header before making any changes so that if issues arise, it can easily be restored.

cryptsetup luksHeaderBackup /path/to/ddcomputer.img.dd --header-backup-file=/path/to/backupheader.luks # the filename and file type for 'backupheader.luks' can be anything you wish # and doesn't need to end in .luks 

Since it's unclear if the recovery key you have is one that you type in one you would type in through the GUI interface that's described or if it's a key file instructions for both are provided separately.

Accessing the Data

If the recovery key is created similarly to how it is in Ubiquity use cryptsetup to unlock the image and then mount it for access

sudo cryptsetup luksOpen /path/to/ddofcomputer.img.dd decrypt_dd Enter a passphrase for /path/to/ddofcomputer.img.dd: [Enter the recovery key] # The 'decrypt_dd' is just the name used for mapping and can be changed # Once decrypted, the image will be available at /dev/mapper/decrypt_dd 

Cryptsetup will ask you for a passphrase whereby you can enter the recovery password to unlock it, then mount it and access it like normal

"Resetting" the password

However, if you still prefer to add a new password, you can do so with cryptsetup by adding a new key to a keyslot

sudo cryptsetup luksAddKey /path/to/ddcomputer.img Enter any existing passphrase: [enter recovery key] Enter new passphrase for key slot: [enter desired password] Verify passphrase: [enter desired passsword again] 

This will add a new password to the next available key slot which means the old password can still be used if needed. If you wanted to replace the previously existing password, you would need to specify the default key slot zero, using adding --key-slot=0 to the above command.

If the Recovery Key is a File

However if the recovery key is a file that is saved and is not just a text file containing the recovery password insidethen you can just designate the keyfile when using cryptsetup

sudo cryptsetup luksAddkey /path/to/ddcomputer.img --key-file=/path/to/recoverykey.file Enter any existing passph... 

If you run into issues because you only needed to mount the root partition or data partition then it's possible the system didn't recognize the image file as having LVM members.

Mounting an image.dd with LVM

To access the data it may be necessary to mount the system using the previously provided answer as described by forest, but a simpler and easier method would be to utilize kpartx which saves you from having to find the offset and all that.

# Installing kpartx sudo apt-get install kpartx # Integrate the volumes after using cryptsetup luksOpen in image file sudo kpartx -a -v /path/to/ddcomputer.img.dd # Checking the volumes appear ls -l /dev/mapper # Fetch the mapped named for mounting sudo lvscan # Mount using found name of in lvscan (replacing decrypt_dd) at mountpoint /mnt sudo mount /dev/mapper/decrypt_dd/root /mnt