Quantcast
Channel: rtrouton – Der Flounder
Viewing all articles
Browse latest Browse all 764

FileVault recovery key redirection profile changes in macOS High Sierra

$
0
0

For macOS Sierra and earlier, Apple had a dedicated FileVault Recovery Key Redirection profile payload for FileVault recovery key redirection. This profile was designed to work with a mobile device management (MDM) server, to allow the MDM server to act as a recovery key escrow service and store FileVault personal recovery keys.

Screen Shot 2018 01 15 at 12 40 23 PM

Note: Jamf Pro will be used as the example MDM server in this post. However, similar functionality is available in other MDM services.

On macOS High Sierra, this FileVault Recovery Key Redirection profile payload no longer works. In its place, Apple has added new Enable Escrow Personal Recovery Key settings to the FileVault section of the existing Security profile payload.

Screen Shot 2018 01 15 at 12 44 56 PM

Adding the recovery key redirection to the Security payload may cause issues in some environments, as the Security profile payload has other settings which those environments may prefer to manage separately, or not manage at all.

For those who prefer to manage FileVault recovery key redirection separately from the other settings managed by the Security payload, it is possible to create a profile (with some manual editing) which only manages FileVault recovery key redirection. For more details, see below the jump.

The first thing to do is to create a new profile (which should not be assigned to any Macs) and configure the Security profile payload with the desired recovery settings on your MDM server.

Screen Shot 2018 01 15 at 12 44 57 PM

Once the profile is configured as desired, download a copy of the profile to your workstation. After downloading, the profile can be edited to include only those settings which manage the FileVault recovery key redirection. To help with figuring out the appropriate settings, I have a sample profile available below.

Note: As currently set up, the sample profile doesn’t redirect recovery keys. It needs the relevant payload content (specifically the FileVault2Comm.cer certificate payload) from the Security profile created by your own MDM server:

Once the profile has been edited and all settings have been verified:

  1. Upload the profile to your MDM server
  2. Deploy the profile to a test Mac
  3. Rotate the FileVault personal recovery key on the test Mac to verify that redirection is working as desired.

Screen Shot 2018 01 15 at 1 15 58 PM

Screen Shot 2018 01 15 at 1 18 26 PM

To make sure that the MDM server does not try to alter the edited FileVault recovery key redirection profile, I recommend signing the profile.

Screen Shot 2018 01 15 at 1 15 59 PM

Signing the profile encrypts it, which prevents the MDM from changing the profile’s contents. The MDM server can now serve out the redirection profile, but will not be able to edit it or change it in any way.


Viewing all articles
Browse latest Browse all 764

Trending Articles