Reissuing FileVault keys with the Casper Suite

Presented by Elliot Jordan, Senior Consultant, Linde Group
MacBrained - January 27, 2015 - San Francisco, CA

Deprecation Notice

Escrow Buddy is a tool for reissuing and escrowing FileVault keys is available which does NOT require prompting users for their passwords. As such, I don't plan to make any further updates to the workflow below. Please consider switching to Escrow Buddy. Read more below:

• Netflix Tech Blog: Escrow Buddy: An open-source tool from Netflix for remediation of missing FileVault keys in MDM
• Elliot Jordan: Escrowing new FileVault keys to MDM without password prompts

Table of Contents

• Table of Contents
• The Problem
• The Solution
  • Step One: Configuration Profile
  • Step Two: Smart Group
  • Step Three: Script
  • Step Four: Policy
  • Follow Through
  • Compatibility
    • High Sierra (10.13) and Mojave (10.14)
    • Catalina (10.15)

The Problem

FileVault individual recovery keys can be missing from the JSS for many reasons.

• Perhaps the Mac was encrypted prior to enrollment.
• The Mac was encrypted prior to the FileVault redirection profile installation.
• The original recovery key was lost for some reason (e.g. database corruption or a bug of some kind).

The Solution

You can use a policy to generate a new FileVault key and upload to JSS.

1. A configuration profile ensures that all FileVault keys are escrowed with the JSS.
2. A smart group determines which computers lack valid individual recovery keys.
3. Customize the __reissue_filevault_recovery_key.sh__ for your environment.
4. Create a policy that deploys the __reissue_filevault_recovery_key.sh__ script to the computers in the smart group.

Step One: Configuration Profile

A configuration profile called “Redirect FileVault keys to JSS” does what the name says.

• General
  • Distribution Method: Install Automatically
  • Level: Computer Level
• FileVault Recovery Key Redirection
  • Automatically redirect recovery keys to the JSS
• Scope
  • All computers

Step Two: Smart Group

A smart group named “FileVault encryption key is invalid or unknown” selects the affected Macs.

*From Rich Trouton’s FileVault status extension attribute: http://goo.gl/zB04LT

Step Three: Script

__The reissue_filevault_recovery_key.sh script runs on each affected Mac.__

• Start by customizing the __reissue_filevault_recovery_key.sh__ script as needed for your environment.
  • Email affected employees to give them a heads up.
  • Use jamfHelper to announce the upcoming password prompt.
  • Add logo to AppleScript password prompt.
  • Fail silently if logo files aren’t present, or any other problems detected.
  • Verify the Mac login password, with 5 chances to enter correct password.

Here is the section of the script you'll want to customize:

Step Four: Policy

A policy called “Reissue invalid or missing FileVault recovery key” runs the script on each Mac in the smart group.

• General
  • Trigger: Recurring Check-In
  • Execution Frequency: Once per computer
• Packages
  • AppleScriptCustomIcon.dmg (loads /tmp/Pinterest.icns)
• Scripts
  • __reissue_filevault_recovery_key.sh (priority: After__)
• Scope
  • Smart Group: FileVault encryption key is invalid or unknown

Follow Through

Don’t forget to monitor policy logs and test FileVault recovery to verify success.

• Monitor logs and flush one-off errors. (Unable to connect to distribution point, no user logged in, etc.)
• Identify and resolve remaining problems manually.
• Test a few newly-generated FileVault keys to ensure they are working as expected.
• Update your internal documentation.

Compatibility

High Sierra (10.13) and Mojave (10.14)

This script appears to work with macOS High Sierra and Mojave, but there are a few known issues:

• On specific versions of High Sierra, entering an incorrect password during the key rotation process can result in invalidation of the existing FileVault key.
  • Since the existing FileVault key is not valid in the first place (presumably) this isn't the end of the world. But it means that if the key was stored separately, e.g. in a spreadsheet somewhere, it will no longer work.
  • We attempt to mitigate this by validating the provided password with dscl prior to using it for rotation of the FileVault key. However, there is no guarantee that your local account password and your FileVault password are the same.
• Previous versions of macOS generated log output that confirmed the successful escrow of the newly generated FileVault key. High Sierra and Mojave do not. Instead, a local file containing the new key is written, which MDM is meant to retrieve. We attempt to determine escrow success by detecting a change in that file, but it's not a guarantee of success.
• If you find additional issues with High Sierra or Mojave, I'd appreciate you opening an issue on this repo.

Catalina (10.15)

This script should work on macOS Catalina, but please open an issue if you notice any Catalina-specific bugs.

Thank you!

See the original presentation slides.