The setLuksPassphrase script is designed with fail-safes to prevent system corruption during the key rotation process.
Scenario
System Behavior
Invalid Current Passphrase
The script will reject the input, display Incorrect passphrase. Please try again. and prompt you to retry without locking the volume.
Audit Logging
All incomplete or cancelled operations after a partial change are securely logged to the system authentication logs (auth.warning) for auditing purposes.
Recovery from partial changes
If the script is interrupted resulting in a partial change, where some volumes have the new passphrase and others retain the old, you can simply re-run the utility.
