All right, so now we're going to go ahead and create our institutional.
Now our institutional key is going to allow us to decrypt any single computer that has the institutional
key applied to it.
All right, so I've gone ahead and I've restarted or reset my VM, and so now it's no longer running,
I'm still logged in as administrator in the Mojave Network.
Users never logged in to this computer yet.
And so the first thing I'm going to want to do is run a command to create the the key.
So this command is going to generate a key and put it on my desktop.
And so it's asking me for a password.
And the password that you type in should be a password that you're comfortable with, letting a tech
or even possibly an end user decrypt their laptop or computer in an emergency.
So if they forget their password and they can't get in and they need to to be able to decrypt and the
only way they can do it is with the institutional key.
They're going to need the password to be able to perform the procedure now that we've generated the
key.
The next thing that we need to do is we need to create a disk image of that key.
So here's the command that I'm going to use to create a disk image of the key.
Now, why are we creating a disk image of the key?
Well, the key when we generate it is got a public and private key in it.
And when we install firewall, we only want the public key on the and user's computer.
Now, the disk image with the private key is going to be mounted to a computer where the user's passwords
no longer known and the computer needs to be decrypted.
We're going to mount this disk image so we have access to the private key.
Now, after you create a disk image, it's always a good idea to make sure that it works and that the
files inside are available and we can see that they are OK.
So the next step is, is that since this key has the public and private key in it, what we need to
do is go into.
Keychain access, and we need to remove the private key from this key chain and so you can highlight
the private key and hit to the and right.
Click and delete.
And then now the private key is gone from the file and only the public key is available, and then we
can go ahead and quick and quick keychain access.
All right.
So the next thing that we want to do is we want to turn on file vault.
Now, I said that there is a remote way to do it, and so that's what we're going to do.
So I have created a job and we'll go ahead and take a look at it.
And it says Turn on file vault.
Now, what we're doing is we're downloading the file vault master key chain, which is the one with
the public key only.
And we're putting it in library key chains.
And that's the place where it needs to go and stay now, the next file that we're downloading is something
that's called file vault list and we're going to put it in temp.
Now, what this does is this allows us to enable file vault without needing to enter a user name and
password.
And in the previous video, I showed you how when you enable it, you need username and password credentials.
Now, I've copied this to my monkey repo, and I'm going to show you what this file looks like.
And so you can see that I have got administrator and then the administrators password now remember in
our example that we enabled it for the administrator user, but then we had to interact with the Mojave
user.
Now it is possible to make a list of all your usernames and passwords that you want to have file they'll
file vault accounts on and then enable it for everybody.
However, it's unlikely you're going to know the usernames and passwords for the people using the computer.
And therefore even doing this method, it still takes interaction with the end user using the the laptop
to get them to be a firewall user.
So, again, you can do it in a remote session so you could you can install firewall remotely for them,
install an institutional key, and while you're in a remote session with them, you can interact with
them to get them to be able to make their user a firewall user.
All right.
So I'm going to go ahead and get out of here.
And so basically, we're going to download that file to temp since our username and password is in it.
And we're going to change the permissions on the key chain file so that a regular user can't delete
it.
And then this is the command to turn on file without using the password, plus that I just showed you.
And then we're going to go ahead and delete the post.
All right.
So that's the job.
And we're going we'll be ready for it.
I mean, obviously, you have to copy these to a place on the server will really just the key chain
file.
The disk image, since it's got the private key, probably don't want it to be on a public web server,
but you can move it there when it's needed and then remove it when it's not needed.
But another thing about this file, it's got your private and public key in it, make copies, put the
copies in multiple places, because this is the key to unlocking any of your Macs that are using this
key.
And it's the only way to do it if your passwords are lost.
All right, so we're going to go ahead and run this on this computer and then we'll go ahead and let
it run.
And then the other thing I want to point out is I have this job of switching to an institutional key.
Now, what we're doing is we're downloading the key chain file and we're putting it in the same place.
And that would overwrite the key if there was another key there.
We're changing the permissions again.
And but what this does is if file vault is already on, it's going to switch that computer to using
the institutional key if it had a different key in it.
So if file vault was already on a machine, you could run this job instead, in a way, convert it to
using an institutional key.
All right, so if we guess if we point out a system preferences, then we should get a status on file
of all.
And you can see that a recovery has been set by your company, school or institution, and the disk
is encrypting now, I've created a little job here called file vault status.
And let's go ahead and talk about this.
So it's going to give us a status.
It's going to list the users that have file vault enabled for them.
And then it also will let us know if the computer's got an institutional recovery key.
And then it also will let us know if it supports authorized restarts, which we will talk about later.
So let's go ahead and run this script on our machine.
And so you can see that file vault is on and we've got a master key chain.
It's 20 percent complete and only our administrator user has file vault turned on, which means, of
course, that our McGarvey user has it off.
Also, our institutional key is set to true.
So it's using an institutional key, which we saw from the movie.
And then we have the ability to do an authorized reboot with this computer.
I think most newer computers and there were operating systems have this ability.
Like I said, we'll cover what it does exactly later.
All right.
So like I said, we still have the same issue with Mojave not being able to use the computer when we
reboot.
And so I'm not going to cover that again.
But after the this computer is reboot or when the encryption is fully done, we're going to go ahead
and see the same exact message that we saw before.
So I'm going to go ahead and pause the video for this is to be done and then we'll continue that.
All right, so encryption is finished and and it's still not showing the Mojave thing, and that's because
I haven't logged in as Mojave yet.
So that that's really the reason why once Mojave is in and there is a profile, then the computer will
see that there is a profile for a user and that they don't have firewall turn on and then we'll get
the warning.
The other thing I want to point out is, is that we have this password file about Publius that I put
on the monkey server.
It's got the administrator name and password on it.
Now, the monkey repo may not be the best place to put it.
You can store the firewall type list on your own computer that has remote desktop on it, and then you
can simply drag and drop that out to your clients.
That will be a much more secure way of handling the file Pellis.
But for simplicity's sake, I just put all my files on the the monkey repo for these demos.
All right.
So in the next video, we are going to show you how to use the institutional key to decrypt your computer.