Encrypted disk image with recovery key

Question

I am trying to create an encrypted disk image that can also be recovered with the use of a key. It is basically trying to do what FileVault does where you have a password to get in, but there is a Master password that can recover the image if you forget/lose your password. I have pieced the basic concepts together, but it isn't working. First I create the certificates that I believe I need with a keychain using the certtool command.
certtool y c k=SecureKey.keychain
certtool c k=~/Library/Keychains/SecureKey.keychain o= SecureKey.cer
I went with the RSA 1024 bit and SHA-1 stuff (that is the technically term for it).
After that, I tried creating the image. I am in the same directory that the SecureKey.cer file is in, so that shouldn't be an issue. Also if it can't find the certificate, it tells you that. Here is the command I used.
hdiutil create -encryption -certificate SecureKey.cer -stdinpass -type SPARSE -fs "HFS+" -volname TestVolName -size 20g TestImage
and that returned
hdiutil: create failed - error 0x8001184e
Does anyone have any thoughts on what I did wrong? Thanks.

Answer 1

Hi Robert,
> Once you through a sudo in there, you lose the option
to have a regular user
   That's not really true. Sudo is one of the most flexible commands around and not only can a regular user use it but they can use it without a password. Mind you I'm not suggesting that you make all users admins; you can specify both of these privileges for this command only. All you have to do is to put a line like the following in your /etc/sudoers file. (with sudo visudo of course)
ALL ALL = NOPASSWD: /usr/bin/hdiutil create -encryption -certificate*-stdinpass -type SPARSE -fs "HFS+" -volname-size
I've included wildcards so that the cert file, volume name, size and image are arbitrary but the others must be in the user's command to qualify. I realize that you'll want different options to use FileVault certs but I don't know how to do that so I used your original example as my example.
   Of course it wouldn't be that easy for your lusers to get all of those options correct so the next thing you do is to wrap the command, with it's sudo preface, in a shell script that parses the cert file, volume name, size and image from the options the user passes to the script and puts those into the command with the right syntax. If you want to get really fancy, the script could prompt the user for any arguments that were omitted. Your lusers will think that you created this really cool command and never know that sudo was involved.
Gary
~~~~
   If you give a man enough rope, he'll claim he's tied up
   at the office.