45

When a LUKS encrypted partition pops up the unlock window it gives 3 options for how to remember the password. The "Remember password until you logout" is always ticked by default. Is there a way to make "Forget password immediately" the default?

Enter a passphrase to unlock the volume:

[ ] Forget password immediately
[x] Remember password until you logout
[ ] Remember forever
N Jedidiah
  • 356
user308393
  • 1,277

1 Answers1

0

Here are a few key points regarding making "Forget password immediately" the default when opening a LUKS encrypted partition:

By default, LUKS does not automatically forget the password after opening an encrypted partition. This is a security feature to allow users to remount the partition without re-entering the password.

However, for security reasons, it is generally recommended to configure LUKS to forget the password immediately after the partition is unmounted. This prevents the password from being stored in memory and potentially accessed by unauthorized users.

To make "Forget password immediately" the default when opening a LUKS encrypted partition, you can add the --key-file=/dev/urandom option to the cryptsetup luksOpen command. This will use a random key from /dev/urandom instead of storing the password in memory.

Alternatively, you can set the issue_discards option in the /etc/crypttab file for the LUKS device. This will cause the kernel to discard the encryption key when the device is closed.

Keep in mind that making the password forget immediately may be inconvenient if you need to frequently mount and unmount the encrypted partition. You'll have to re-enter the password each time.

Mayank1
  • 3
  • 1
Mostafa Najafiyazdi
  • 384
  • 9
    For modern versions of gnome (everything from the last decade) you should use dconf-editor instead. The key is org.gnome.shell.remember-mount-password. From the description: "The shell will request a password when an encrypted device or a remote filesystem is mounted. If the password can be saved for future use a “Remember Password” checkbox will be present. This key sets the default state of the checkbox." – felinira Jun 19 '19 at 18:05
  • 2
    @felinira I'm on Arch linux with some gnome services, but that key is not present in my case. Even though I still have the dialog when mounting my LUKS drives. I figure I could probably add the key, but can't find any information to do so. – akovia Aug 09 '20 at 14:40
  • 1
    Per this: https://superuser.com/questions/1625494/how-to-default-nemo-to-forget-luks-password it is hardcoded, if you know better, what is the name of the schema key? – Alex Martian Dec 01 '22 at 09:06