Back to browser

Crypt

com.grahamgilbert.crypt

Crypt settings

macOS

Configuration Keys (8)

Key	Type	Title	Description	Default	Range
`ServerURL`required	string	—	—	—	—
`RemovePlist`	boolean	Leave recovery key plist on disk	By default, the plist at /var/root/crypt_output.plist with the FileVault Key will be removed once it has been escrowed. If this is set to True the key will remain as root read only.	true	—
`RotateUsedKey`	boolean	Rotate recovery key on each use. (Only HFS-formatted disks)	If the recovery key plist is still present on the disk, rotates the recovery key after the key is used to unlock the disk.	true	—
`ValidateKey`	boolean	Validate recovery key	If the recovery key plist is still present on the disk, validates the recovery key. If the key fails validation, the plist is removed so it can be regenerated on next login.	true	—
`OutputPath`	string	Recovery key plist path	Path where the recovery key plist is written to disk.	"/var/root/crypt_output.plist"	—
`KeyEscrowInterval`	integer	Recovery key re-escrow interval	Time interval in Hours for how often Crypt tries to re-escrow the key to Crypt-Server after the first successful escrow.	1	—
`SkipUsers`	array	Users ignored	Local users that will not be forced to enable FileVault.	—	—
`PostRunCommand`	array	Recovery key error command	Command that is run after Crypt has detected an error condition with a stored key that cannot be resolved silently - either it has failed validation or the server has instructed the client to rotate the key. These cannot be resolved silently on APFS volumes, so the user will need to log in again. If you have a tool that can enforce a logout or a reboot, you can run it here.	—	—
`Username`	string	—	Username that will not be forced to enable FileVault	—	—
`Command`	string	—	—	—	—