Collect Institutional Recovery Key Hash for OSX Encrypted Volume #594
tannevaled
started this conversation in
Ideas
Replies: 1 comment 2 replies
-
Hi @tannevaled thank you for your idea submission. What do you really need ? Just the key hash or the key itself ? And for what purpose exactly ? For example, do you just need to identify computers which don't have the right recovery key ? In that case, just the key hash is probably sufficient as it can be understood as a key identifier. |
Beta Was this translation helpful? Give feedback.
2 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Your idea
GLPI is able to report the encryption state of every OSX volumes collected using the Agent.
Sample result using a request on the REST API
Query
Response
RFE
For synthetic dashboards it would be necessary to have the state of FileVault
$ fdesetup status --verbose fdesetup: device path = / FileVault is On. FileVault master keychain appears to be installed. $ sudo fdesetup hasinstitutionalrecoverykey true
and to be sure the IRK is the one we expect (ie have the expected SHA-256)
$ security find-certificate -p -Z -c "FileVault Recovery Key" /Library/Keychains/FileVaultMaster.keychain SHA-256 hash: 675D8CECB561821B6547A26062402E6C3BB6385409CB9D36F7D85467F1B0AA5D SHA-1 hash: E1A86E53B7C3D51BC44331408C46DE5F150538B0 -----BEGIN CERTIFICATE----- MIICKjCCAZOgAwIBAgIFAMvhvcIwCwYJKoZIhvcNAQEFMEkxHzAdBgNVBAMMFkZp ... -----END CERTIFICATE-----
Could we have this information collected by the Agent?
Beta Was this translation helpful? Give feedback.
All reactions