Crypt
com.grahamgilbert.crypt
Crypt settings
macOS
Configuration Keys (8)
| Key | Type | Description | Default | Range |
|---|---|---|---|---|
ServerURLstringrequired | string | — | Default: — | Range: — |
RemovePlistbooleanLeave recovery key plist on disk | boolean | By default, the plist at /var/root/crypt_output.plist with the FileVault Key will be removed once it has been escrowed. If this is set to True the key will remain as root read only. | Default: true | Range: — |
RotateUsedKeybooleanRotate recovery key on each use. (Only HFS-formatted disks) | boolean | If the recovery key plist is still present on the disk, rotates the recovery key after the key is used to unlock the disk. | Default: true | Range: — |
ValidateKeybooleanValidate recovery key | boolean | If the recovery key plist is still present on the disk, validates the recovery key. If the key fails validation, the plist is removed so it can be regenerated on next login. | Default: true | Range: — |
OutputPathstringRecovery key plist path | string | Path where the recovery key plist is written to disk. | Default: "/var/root/crypt_output.plist" | Range: — |
KeyEscrowIntervalintegerRecovery key re-escrow interval | integer | Time interval in Hours for how often Crypt tries to re-escrow the key to Crypt-Server after the first successful escrow. | Default: 1 | Range: — |
SkipUsersarrayUsers ignored | array | Local users that will not be forced to enable FileVault. | Default: — | Range: — |
Usernamestring | string | Username that will not be forced to enable FileVault | Default: — | Range: — |
PostRunCommandarrayRecovery key error command | array | Command that is run after Crypt has detected an error condition with a stored key that cannot be resolved silently - either it has failed validation or the server has instructed the client to rotate the key. These cannot be resolved silently on APFS volumes, so the user will need to log in again. If you have a tool that can enforce a logout or a reboot, you can run it here. | Default: — | Range: — |
Commandstring | string | — | Default: — | Range: — |