139 lines
4.1 KiB
Bash
139 lines
4.1 KiB
Bash
#!/bin/bash
|
|
##########################################################################
|
|
# Script : Change FW-PW
|
|
# Autor : Andreas Vogel
|
|
# Copyright : macenterprise gmbh, 2020
|
|
##########################################################################
|
|
unset setpassword_fv
|
|
unset rotatepassword_fv
|
|
unset adduser_fv
|
|
|
|
############################################# Jamf Hepler Messanger #############################################################
|
|
|
|
jamfHelper="/Library/Application Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper"
|
|
jamf="/usr/local/bin/jamf"
|
|
|
|
ErrorIcon="/Library/Application Support/JAMF/ING/France_road_sign_A14.svg.png"
|
|
Error="An unexpected error has occurred. The encryption does not work properly. Please contact Mac support."
|
|
MessageIcon="/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/ToolbarCustomizeIcon.icns"
|
|
Message="The Filevault setting must be updated. Please enter your current Windows password in the next window."
|
|
|
|
|
|
############################################# Variablen #########################################################################
|
|
Status=$(fdesetup status | head -1 | cut -d ' ' -f 3)
|
|
|
|
user=$(stat -f '%u %Su' /dev/console | cut -d ' ' -f 2)
|
|
|
|
DecryptString() {
|
|
# Usage: ~$ DecryptString "Encrypted String" "Salt" "Passphrase"
|
|
echo "${1}" | /usr/bin/openssl enc -aes256 -d -a -A -S "${2}" -k "${3}"
|
|
}
|
|
|
|
adminName="$7"
|
|
adminPass=$(DecryptString "$4" "$5" "$6")
|
|
|
|
############################################# Funktion #########################################################################
|
|
|
|
enable_fv () {
|
|
expect <<EOF
|
|
spawn fdesetup enable
|
|
expect "Enter the user name:"
|
|
send "$adminName\r"
|
|
expect "Enter the password for user $user:"
|
|
send "$adminPass\r"
|
|
expect EOF
|
|
EOF
|
|
}
|
|
|
|
|
|
rotatepassword_fv () {
|
|
expect <<EOF
|
|
spawn fdesetup changerecovery -personal
|
|
expect "Enter the user name:"
|
|
send "$adminName\r"
|
|
expect "Enter the password for user $adminName:"
|
|
send "$adminPass\r"
|
|
expect EOF
|
|
EOF
|
|
}
|
|
|
|
adduser_fv () {
|
|
expect <<EOF
|
|
spawn fdesetup add -usertoadd $user
|
|
expect "Enter the primary user name:"
|
|
send $adminName\r
|
|
expect "Enter the password for the user $adminName:"
|
|
send $adminPass\r
|
|
expect "Enter the password for the added user $user:"
|
|
send $APASS\r
|
|
expect
|
|
EOF
|
|
}
|
|
|
|
|
|
ask_pw () {
|
|
loggedInUser=$(stat -f%Su /dev/console)
|
|
loggedInUID=$(id -u $loggedInUser)
|
|
|
|
# Abfrage, dass nicht ROOT angemeldet ist
|
|
if [[ "$loggedInUser" != "root" ]] && [[ "$loggedInUser" != "_mbsetup" ]]
|
|
then
|
|
|
|
## Create local script
|
|
cat << EOD > /private/tmp/WN_PW.sh
|
|
#!/bin/bash
|
|
|
|
WN_PW=\$(/usr/bin/osascript -e 'text returned of (display dialog "Please enter your current Windows password" with hidden answer default answer "" buttons {"OK"} default button 1)')
|
|
|
|
printf "\${WN_PW}" > /private/tmp/WN_PW.txt
|
|
|
|
EOD
|
|
/bin/chmod +x /private/tmp/WN_PW.sh
|
|
/bin/launchctl asuser "$loggedInUID" sudo -iu "$loggedInUser" "/private/tmp/WN_PW.sh"
|
|
APASS=$(cat /tmp/WN_PW.txt)
|
|
|
|
fi
|
|
|
|
}
|
|
|
|
|
|
|
|
############################################# Ausführung #############################################################################
|
|
|
|
if [[ $Status == "Off." ]]
|
|
then
|
|
HELPER=$("$jamfHelper" -windowType utility -icon "$MessageIcon" -title "Error" -description "$Message" -button1 "OK" -defaultButton 1)
|
|
echo "Exit Code: FileVault is disabled and will now be enabled."
|
|
|
|
ask_pw
|
|
|
|
if enable_fv
|
|
then
|
|
sleep 60
|
|
|
|
if adduser_fv
|
|
then
|
|
rm -f /private/tmp/WN_PW.sh
|
|
rm -f /private/tmp/WN_PW.txt
|
|
|
|
jamf recon
|
|
else
|
|
printf HELPER=$("$jamfHelper" -windowType utility -icon "$ErrorIcon" -title "Error" -description "$Error" -button1 "OK" -defaultButton 1)
|
|
echo "Exit Code: FileVault 2 wurde aktiviert. User konnte nicht hinzugefügt werden."
|
|
rm -f /private/tmp/WN_PW.sh
|
|
rm -f /private/tmp/WN_PW.txt
|
|
fi
|
|
|
|
else
|
|
printf HELPER=$("$jamfHelper" -windowType utility -icon "$ErrorIcon" -title "Error" -description "$Error" -button1 "OK" -defaultButton 1)
|
|
echo "Exit Code: FileVault 2 konnte nicht aktiviert werden."
|
|
rm -f /private/tmp/WN_PW.sh
|
|
rm -f /private/tmp/WN_PW.txt
|
|
fi
|
|
else
|
|
echo "FileVault is active. The key is changed"
|
|
rotatepassword_fv
|
|
jamf recon
|
|
rm -f /private/tmp/WN_PW.sh
|
|
rm -f /private/tmp/WN_PW.txt
|
|
fi |