Topic: encryption
-
Managing FileVault from the command line: status, recovery keys, secure token and bootstrap token
fdesetup reports and changes FileVault state and recovery-key handling; sysadminctl and profiles report which accounts can unlock the disk and whether a bootstrap token is escrowed with a device management service, which matters before relying on MDM-driven account provisioning.
-
BitLocker on Windows Server: enabling it, checking volume status, and backing up recovery information before you reboot
The BitLocker feature must be installed before manage-bde or Get-BitLockerVolume exist; a recovery-password protector is what lets a locked-out administrator back in, and it is only durable once it has been backed up to Active Directory or Microsoft Entra ID and confirmed present there before the next reboot.
-
Encrypting a data volume with LUKS2: format, open, crypttab, and what a lost header means
cryptsetup luksFormat and luksOpen set up and unlock a LUKS2 volume, and /etc/crypttab makes the unlock happen automatically at boot; a lost passphrase and a lost or damaged LUKS header are both unrecoverable, which is why luksHeaderBackup is a required step, not an optional one.
Machine-readable: JSON