Chapter 2: DSM V6100 Hardware Appliance
Full Disk Encryption
DSM Installation and Configuration Guide
Copyright 2009 - 2020 Thales Group. All rights reserved.
42
Recovering a lost passphrase
After you set a boot passphrase, we strongly recommend that you save a copy of the encrypted passphrase in a safe
location, as well as the RSA key pair associated with that passphrase. As a best practice, we recommend that the
encrypted passphrase be stored separately from the associated private key.
To recover a lost passphrase while the system is still booted, do the following:
1. Log on to the DSM CLI and navigate to the system category of commands. Type
security boot-passphrase
recovery show
at the prompt;
0001:system$ security boot-passphrase recovery show
SUCCESS
The following passphrase recovery files are available:
0. 201710031407
2. Enter the number of the file to display contents, the encrypted passphrase and the public key used to encrypt it.
An example of the command you can use to decrypt the passphrase is also displayed.
Type the number of a file to view the contents, or 'q' to quit: 0
Encrypted passphrase (base64 encoded):
fqWOGbKe4x6R3vmWtBMFvoAauaEpOnQ9OGLmFWw1+u0LPgIGYx9e5AT5nPnPD2GAyMWM
H8GOvuJvht7UzBodMA07DHNMpyMnouWsMWhHen5JFNMXKWM9TYQ9/yr1D2cFuBsppFLV
W/2McKIYuBqgeaOefzL2jr8vyyFudq6TGgTjRJe1edLDCqTJbcK100o036U0vynEsvMucps1sq0k
Lpes6Zp1ud5usWngn2J2X6PrlAugHp4nMMDIRLQBgzX95x7Fb7VLebcb/eIGn39KJaPU9sxEiFwl
xh/f6azXhHpjahwjirzfpZl0300VFYT0P9o5xg==
Public key used for encryption:
-----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwYIf0Z04nzne9j78BY7
Q9kMTgh8YErtklECnVVhxExob/UvAWOvSBcGDVgixpeMCywWVh8OgTIbj751PVf
TI8C+gP4Rd6cdtO7fGzsYsAZxN9OCssRQlCJfCe6y6fNep3dDOh1noTFyFNTqOy
c3WW0gAlJ9ILPwn6uxVRgtXPgLnFfP9zNieyWmHTLw6He8BZAAYkWbESMgnA5Bo
mcxdpv/i/8ZODTMMo/6Ji4oYpQPa8i9Ex7qTZinl5hxjIjC8eIcUOMNdAhvslNz
T6ZPJ2BEYBU6TAQpxDPLwPAQIEw1x/NzcYUUfgaP1pZIAdhWFJUZkx4FqmEA5od
MwIDAQAB
-----END PUBLIC KEY-----
Save the encrypted passphrase in file (see recommendation in
"Recovering a lost passphrase" above
). Run the
example command on a system with OpenSSL installed that can access the file with the encrypted passphrase,
and the private key required to recover that passphrase.
If you have forgotten your password and the DSM has not booted up, you can also recover the password from the
GRUB menu, available from the IPMI Java console.
3. As the DSM reboots, open a console (direct or via IPMI). When the GRUB menu is displayed, use the arrow keys
to select the ‘Show Boot Passphrase Recovery Data’ option and press Enter, see the following figure:
