Using csfde with FileVaultMaster.keychain

After reading Allister Banks’s great post on standalone use of Cauliflower Vest’s csfde command-line tool, I wanted to see if it was possible to use csfde with Apple’s FileVaultMaster.keychain recovery key to encrypt a Mac. Good news, it is possible and appears to be scriptable. See below the jump for the details.

Enabling hidden admin accounts with Cauliflower Vest

One interesting facet of Cauliflower Vest enabling users from the command-line is that any user on the system can be enabled. This includes hidden admin users with a UID that’s lower than 500, which can’t be enabled through the FileVault preference pane. After some testing, I found that enabling hidden admin accounts is pretty straightforward for those who can use Casper and Cauliflower Vest. See below the jump for the details.

Setting up Cauliflower Vest using a Google Apps domain

Google’s Cauliflower Vest, an open-source FileVault 2 recovery key escrow solution, solves a number of problems for Mac admins in the enterprise space. These problems included:

A. Allowing individual recovery keys to be automatically generated and escrowed for each Mac

B. The ability to have FileVault 2 encryption force-enabled on a Mac

C. Providing secure access to recovery keys and delegating secure access as needed to those recovery keys

Cauliflower Vest addresses those issues, along with providing csfde, a command-line tool for FileVault 2 setups which can be used independently of the rest of Cauliflower Vest infrastructure.

I wanted to see how easy it was to stand up a Cauliflower Vest instance with a Google Apps domain while following the instructions. I figured that I was a good tester for this because:

• I’d never set up a Google Apps domain
• I’d never before worked with Google App Engine
• Python and I have a “we should really get together, but never do” relationship.

In short, hopefully the Cauliflower Vest project folks had posted good directions or this train was going to wreck pretty fast.

Fortunately, the Cauliflower Vest project folks have posted good directions on the project’s wiki and were also extremely responsive over email. With their help, I was able to get up and going. See below the jump for what I did.

Cauliflower Vest – Dumb name, brilliant solution for enterprise-manageable FileVault 2 encryption

Google’s rolled out Cauliflower Vest, an open-source FileVault 2 recovery key escrow solution, that allows enterprise management of FileVault 2 encryption to go much further than was previously possible. It leverages the strengths of Apple’s non-enterprise recovery key system while bringing in additional features that most enterprise-focused environments are looking for.

At the moment, I’m going to start poking and prodding at this but I wanted to take a moment to recognize the folks whose hard work brought this to the Mac community:

Anthony Lieuallen, Avi Drissman, Edward Marczak, Felix Gröbert, Greg Castle, John Randolph, Justin McWilliams, and Mark Mentovai

Thanks, guys.

Hiding an FileVault 2-enabled admin user with Casper

As mentioned in a prior post, it’s beneficial for Mac admins in a number of Mac environments to hide the IT administrator account so that it can’t be deleted or altered by other users on those Macs. One way you can hide the account is to create it using a UID that’s lower than 500.

However, when encrypting Macs with FileVault 2, an account needs to have a UID higher than 500 to be enabled to unlock the FileVault 2 encrypted drive. Unfortunately, that means that the account is now “visible” to the users that the Mac admin wants to hide it from.

Thanks to work by Allen Golbig, it looks like there’s an answer to this problem for Casper users. See below the jump for the procedure.

Updated FileVault 2 status scripts now available – supports 10.8 DP 1

I’ve updated the FileVault 2 status check scripts so that they’re now supporting 10.8 Developer Preview 1 in addition to 10.7.x. Without going into NDA-violating details, 10.8 has made some changes to what’s reported by the diskutil corestorage list command, which is used by my script to pull details about the current FileVault 2 encryption status. Barring any changes Apple may make in future 10.8 Developer Previews, the scripts should now report correctly on both 10.7.x and 10.8.x.

The changes are now available as part of my regular script. They have also been rolled into both the Casper Extension Attribute and the Absolute Manage Custom Info Item scripts. Use them in good health and please let me know if you find any problems with them.

Updated my Java web plug-ins setting script for Mac OS X 10.8 compatibility

Like a number of other Mac admins, I’ve started working on Mountain Lion to see a) what of my existing stuff works or breaks and b) what new functionality I need to test and build new solutions for. In the existing stuff category, I noticed that the script that I’ve been using on 10.7 to enable Java applications to work in Safari was no longer working properly on 10.8. I’ve fixed this issue and the script now works correctly on both 10.7 and 10.8.

The updated script is posted up on my GitHub repo at the following address:

https://github.com/rtrouton/rtrouton_scripts/tree/master/rtrouton_scripts/enable_java_web_plugins

Building a Grand Unified Xcode 4.3 installer

Apple has released Xcode 4.3 through the Mac App Store for all Macs running 10.7.3 and higher. In a break from the “installing an installer” method that Apple used for Xcode 4.1 and 4.2, the App Store is now installing Xcode as a self-contained application. This application, on first launch, then installs the other Xcode tools. The command line tools can be installed separately through the Xcode preferences, in the Downloads section.

For my users who are developers, I wanted to include Xcode 4.3 in their new machine builds and also install the command line tools automatically. To do this, I used a modified form of the methodology referenced in this post to repackage Xcode 4.3 for distribution without needing an Apple ID. See below the jump for the procedure.

“What Do You Mean, It’s Gone?!?” in MacTech’s February 2012 issue

For those interested in protecting their data in the event that their Mac goes missing, I have an article in MacTech’s February 2012 issue. It’s titled What Do You Mean, It’s Gone?!? – Safeguarding your Mac’s data when the Mac is lost or stolen and is a guide to help make sure that, if you and your Mac are involuntarily separated, your main worry is finding the money to replace the hardware.

Setting a text-only login banner at the FileVault 2 pre-boot login screen

I got a notification today from Apple that one of my long-standing bug reports had been closed out as fixed. The bug report was Bug ID 9226657 – Need to set login banner on pre-boot login screen for encrypted Macs. They also pointed me at a new Apple KBase article, with a publication date of February 9th, 2012.

This has been a long-standing feature request of mine, so I’m glad to see it’s now been addressed. That said, there are some limitations to be aware of. See below the jump for the details.