Previously I’ve written a little here and there about using FileVault and more specifically scripting things around Filevault. The fdesetup command that enables FileVault for OS X clients from the command line got a few new options in OS X 10.9 Mavericks.
We’ve always been able to enable FileVault using scripts thanks to fdesetup but now Apple’s taken some of the difficulty out of configuring recovery keys. This comes in the form of the changerecovery, haspersonalrecoverykey, hasinstitutionalkey, usingrecoverykey and validate recovery options. These options all revolve around one idea: make it easier to deploy centrally managed keys that can be used to unlock encrypted volumes in the event that such an action is required. There’s also a -recoverykey option, which indicates the number of the key if a recovery key is being used.
To use the fdesetup command to check whether a computer has a personal recovery key use the haspersonalrecoverykey verb, as follows:
fdesetup haspersonalrecoverykey
The output will be a simple true or false exit. To use the fdesetup command to check whether a computer has an institutional recovery key, use the hasinstitutionalrecoverykey verb, as follows:
fdesetup hasinstitutionalrecoverykey
To enable a specific personal recovery key, provide it using the changerecovery verb, as follows:
fdesetup changerecovery -personal
This is an interactive command, so when prompted, provide the appropriate personal key. The removerecovery verb can also be used to remove keys. And my favorite, validaterecovery is used to check on whether or not a recovery key will work to unlock a host; which can be tied into something like an extension attribute in Casper in order to store a key and then validate the key every week or 4. This helps to make sure that systems are manageable if something happens.
The enable verb also has a new -authrestart which does an authenticated reboot after enabling FileVault. Before using the -authrestart option, check that a system can actually run it by using fdesetup with the supportsauthrestart verb and it will exit on true or false.
Defer mode is nothing new, where FileVault waits until a user password is provided; however, a new verb is available called showdeferralinfo which shows information about deferral mode. This is most helpful as a sanity check so you don’t go running commands you already ran or doing things to systems that have already been provided with tasks to perform otherwise.
Overall, there’s a lot of really enterprise-friendly options new in Mavericks that those who do larger-scale deployments of Mavericks will be interested in using!
