PGP Whole Disk Encryption Command Line - 10.0 Instruction Manual
PGP Whole Disk Encryption
Command Line
User's Guide
Version Information
PGP Whole Disk Encryption Command Line User's Guide. Version 10.0.0. Released January 2010.
Copyright Information
Copyright © 1991-2010 by PGP Corporation. All Rights Reserved. No part of this document can be reproduced or transmitted in any form or by any
means, electronic or mechanical, for any purpose, without the express written permission of PGP Corporation.
Trademark Information
PGP, Pretty Good Privacy, and the PGP logo are registered trademarks of PGP Corporation in the US and other countries. IDEA is a trademark of Ascom
Tech AG. Windows and ActiveX are registered trademarks of Microsoft Corporation. AOL is a registered trademark, and AOL Instant Messenger is a
trademark, of America Online, Inc. Red Hat and Red Hat Linux are trademarks or registered trademarks of Red Hat, Inc. Linux is a registered trademark
of Linus Torvalds. Solaris is a trademark or registered trademark of Sun Microsystems, Inc. AIX is a trademark or registered trademark of International
Business Machines Corporation. HP-UX is a trademark or registered trademark of Hewlett-Packard Company. SSH and Secure Shell are trademarks of
SSH Communications Security, Inc. Rendezvous and Mac OS X are trademarks or registered trademarks of Apple Computer, Inc. All other registered
and unregistered trademarks in this document are the sole property of their respective owners.
Licensing and Patent Information
The IDEA cryptographic cipher described in U.S. patent number 5,214,703 is licensed from Ascom Tech AG. The CAST-128 encryption algorithm,
implemented from RFC 2144, is available worldwide on a royalty-free basis for commercial and non-commercial uses. PGP Corporation has secured a
license to the patent rights contained in the patent application Serial Number 10/655,563 by The Regents of the University of California, entitled Block
Cipher Mode of Operation for Constructing a Wide-blocksize block Cipher from a Conventional Block Cipher. Some third-party software included in PGP
Universal Server is licensed under the GNU General Public License (GPL). PGP Universal Server as a whole is not licensed under the GPL. If you would
like a copy of the source code for the GPL software included in PGP Universal Server, contact PGP Support (https://support.pgp.com). PGP Corporation
may have patents and/or pending patent applications covering subject matter in this software or its documentation; the furnishing of this software or
documentation does not give you any license to these patents.
Acknowledgments
This product includes or may include:
-- The Zip and ZLib compression code, created by Mark Adler and Jean-Loup Gailly, is used with permission from the free Info-ZIP implementation,
developed by zlib (http://www.zlib.net
the MIT License found at http://www.opensource.org/licenses/mit-license.html
available high-quality data compressor, is copyrighted by Julian Seward, © 1996-2005. -- Application server (http://jakarta.apache.org/
(http://www.apache.org/
developed by the Apache Software Foundation. The license is at www.apache.org/licenses/LICENSE-2.0.txt
framework for moving data from XML to Java programming language objects and from Java to databases, is released by the ExoLab Group under an
Apache 2.0-style license, available at http://www.castor.org/license.html
Foundation that implements the XSLT XML transformation language and the XPath XML query language, is released under the Apache Software
License, version 1.1, available at http://xml.apache.org/xalan-j/#license1.1
Protocol") used for communications between various PGP products is provided under the Apache license found at
http://www.apache.org/licenses/LICENSE-2.0.txt
an Apache-style license, available at http://mx4j.sourceforge.net/docs/ch01s06.html
Independent JPEG Group. (http://www.ijg.org/
distributed under the MIT License http://www.opensource.org/licenses/mit-license.html. -- PCRE version 4.5
copyrighted and distributed by University of Cambridge. ©1997-2006. The license agreement is at http://www.pcre.org/license.txt
Binary Tree Library and Domain Name System (DNS) protocols developed and copyrighted by Internet Systems Consortium, Inc. (http://www.isc.org
Free BSD implementation of daemon developed by The FreeBSD Project, © 1994-2006. -- Simple Network Management Protocol Library developed
and copyrighted by Carnegie Mellon University © 1989, 1991, 1992, Networks Associates Technology, Inc, © 2001- 2003, Cambridge Broadband Ltd. ©
2001- 2003, Sun Microsystems, Inc., © 2003, Sparta, Inc, © 2003-2006, Cisco, Inc and Information Network Center of Beijing University of Posts and
Telecommunications, © 2004. The license agreement for these is at http://net-snmp.sourceforge.net/about/license.html. -- NTP version 4.2
by Network Time Protocol and copyrighted to various contributors. -- Lightweight Directory Access Protocol developed and copyrighted by OpenLDAP
Foundation. OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP). Copyright © 1999-2003, The
OpenLDAP Foundation. The license agreement is at http://www.openldap.org/software/release/license.html
developed by OpenBSD project is released by the OpenBSD Project under a BSD-style license, available at http://www.openbsd.org/cgi-
bin/cvsweb/src/usr.bin/ssh/LICENCE?rev=HEAD. -- PC/SC Lite is a free implementation of PC/SC, a specification for SmartCard integration is released
under the BSD license. -- Postfix, an open source mail transfer agent (MTA), is released under the IBM Public License 1.0, available at
http://www.opensource.org/licenses/ibmpl.php
BSD-style license, available at http://www.postgresql.org/about/licence
PostgreSQL database using standard, database independent Java code, (c) 1997-2005, PostgreSQL Global Development Group, is released under a
BSD-style license, available at http://jdbc.postgresql.org/license.html
database management system, is released under a BSD-style license, available at http://www.postgresql.org/about/licence
version of cron, a standard UNIX daemon that runs specified programs at scheduled times. Copyright © 1993, 1994 by Paul Vixie; used by permission. -
- JacORB, a Java object used to facilitate communication between processes written in Java and the data layer, is open source licensed under the GNU
Library General Public License (LGPL) available at http://www.jacorb.org/lgpl.html
open-source implementation of a CORBA Object Request Broker (ORB), and is used for communication between processes written in C/C++ and the
data layer. Copyright (c) 1993-2006 by Douglas C. Schmidt and his research group at Washington University, University of California, Irvine, and
Vanderbilt University. The open source software license is available at http://www.cs.wustl.edu/~schmidt/ACE-copying.html
downloading files via common network services, is open source software provided under a MIT/X derivate license available at
http://curl.haxx.se/docs/copyright.html
under a BSD-style license, available at http://thunk.org/hg/e2fsprogs/?file/fe55db3e508c/lib/uuid/COPYING
libpopt, a library that parses command line options, is released under the terms of the GNU Free Documentation License available at
http://directory.fsf.org/libs/COPYING.DOC
communicate with the Intel Corporation AMT chipset on a motherboard, is distributed under the GNU Public License, available at
), Jakarta Commons (http://jakarta.apache.org/commons/license.html) and log4j, a Java-based library used to parse HTML,
). -- Libxml2, the XML C parser and toolkit developed for the Gnome project and distributed and copyrighted under
. Copyright © 2007 by the Open Source Initiative. -- bzip2 1.0, a freely
), web server
. -- Castor, an open-source, data-binding
. -- Xalan, an open-source software library from the Apache Software
. -- Apache Axis is an implementation of the SOAP ("Simple Object Access
. -- mx4j, an open-source implementation of the Java Management Extensions (JMX), is released under
. -- jpeglib version 6a is based in part on the work of the
) -- libxslt the XSLT C library developed for the GNOME project and used for XML transformations is
Perl regular expression compiler,
. -- BIND Balanced
) --
developed
. Secure shell OpenSSH version 4.2.1
. -- PostgreSQL, a free software object-relational database management system, is released under a
. -- PostgreSQL JDBC driver, a free Java program used to connect to a
. -- PostgreSQL Regular Expression Library, a free software object-relational
. -- 21.vixie-cron is the Vixie
. Copyright © 2006 The JacORB Project. -- TAO (The ACE ORB) is an
. -- libcURL, a library for
. Copyright (c) 1996 - 2007, Daniel Stenberg. -- libuuid, a library used to generate unique identifiers, is released
. Copyright (C) 1996, 1997 Theodore Ts'o. --
. Copyright © 2000-2003 Free Software Foundation, Inc. -- gSOAP, a development tool for Windows clients to
http://www.cs.fsu.edu/~engelen/soaplicense.html. -- Windows Template Library (WTL) is used for developing user interface components and is
distributed under the Common Public License v1.0 found at http://opensource.org/licenses/cpl1.0.php
utilities used to automate a variety of maintenance functions and is provided under the Perl Artistic License, found at
http://www.perl.com/pub/a/language/misc/Artistic.html
rendering, and alpha blending, and is distributed under the license found at
http://refit.svn.sourceforge.net/viewvc/*checkout*/refit/trunk/refit/LICENSE.txt?revision=288
-- Java Radius Client, used to authenticate PGP Universal Web Messenger users via Radius, is distributed under the Lesser General Public License
(LGPL) found at http://www.gnu.org/licenses/lgpl.html
Copyright (c) 2009, Yahoo! Inc. All rights reserved. Released under a BSD-style license, available at http://developer.yahoo.com/yui/license.html. --
JSON-lib version 2.2.1, a Java library used to convert Java objects to JSON (JavaScript Object Notation) objects for AJAX. Distributed under the Apache
2.0 license, available at http://json-lib.sourceforge.net/license.html
at http://ezmorph.sourceforge.net/license.html
http://commons.apache.org/license.html
http://commons.apache.org/license.html
. -- Apache Commons BeanUtils, used by JSON-lib, is distributed under the Apache 2.0 license, available at
.
. -- rEFIt - libeg, provides a graphical interface library for EFI, including image rendering, text
. -- Yahoo! User Interface (YUI) library version 2.5.2, a Web UI interface library for AJAX.
. -- EZMorph, used by JSON-lib, is distributed under the Apache 2.0 license, available
. -- Apache Commons Lang, used by JSON-lib, is distributed under the Apache 2.0 license, available at
. -- The Perl Kit provides several independent
. Copyright (c) 2006 Christoph Pfisterer. All rights reserved.
Export Information
Export of this software and documentation may be subject to compliance with the rules and regulations promulgated from time to time by the Bureau
of Export Administration, United States Department of Commerce, which restricts the export and re-export of certain products and technical data.
Limitations
The software provided with this documentation is licensed to you for your individual use under the terms of the End User License Agreement provided
with the software. The information in this document is subject to change without notice. PGP Corporation does not warrant that the information meets
your requirements or that the information is free of errors. The information may include technical inaccuracies or typographical errors. Changes may be
made to the information and incorporated in new editions of this document, if and when made available by PGP Corporation.
4
Contents
Introduction 5
About PGP Whole Disk Encryption 5
About PGP Whole Disk Encryption Command Line 5
Important Terms 6
Audience 7
System Requirements 7
Installing and Uninstalling 7
PGP Whole Disk Encrypting a Drive 8
The Command-Line Interface 9
Overview 9
Scripting 10
Editing the Path 10
WDE-ADMIN Active Directory Group 11
Passphrases 11
Licensing 13
Overview 13
--license-authorize 13
Licensing via a Proxy Server 14
Generic Commands 17
--help (-h) 17
--version 18
Disk Information Commands 19
--enum 19
--info 20
--show-config 21
--status 22
i
PGP Whole Disk Encryption Command Line Contents
User Management Commands 23
--add-user 23
--change-passphrase 25
--change-userdomain 25
--list-user 26
--offload 27
--remove-user 27
--verify-user 28
Disk Management 31
--auth 31
--instrument 32
--uninstrument 32
Disk Operation 33
--decrypt 33
--encrypt 34
--resume 35
--secure 36
--stop 37
Boot Bypass Commands 39
--add-bypass 39
--check-bypass 40
--remove-bypass 41
Recovery Token Commands 43
--new-wdrt 43
PGP BootGuard Customization Commands 45
--set-background 45
--set-language 46
--set-sound 47
--set-start 48
--set-text 49
ii
PGP Whole Disk Encryption Command Line Contents
Local Self Recovery 51
--recovery-configure 52
--recovery-questions 53
--recovery-verify 54
--recovery-remove 55
--recovery-change-passphrase 55
Authenticating if you Have Forgotten Your Passphrase 56
Options 59
"Secure" Options 62
--admin-authorization 62
--admin-passphrase 62
--all 63
--answers-file 63
--auto-start 63
--beep 63
--dedicated-mode 64
--disk (-d) 64
--display 64
--domain-name 65
--fast-mode 65
--image 65
--interactive 66
--keyboard 66
--keyid 66
--license-email 67
--license-name 67
--license-number 67
--license-organization 68
--message 68
--new-domain 68
--new-passphrase 69
--no-beep 69
--partition 69
--passphrase (-p) 70
--proxy-passphrase 70
--proxy-server 71
--proxy-username 71
--questions-file 71
--recovery-token 72
--safe-mode 72
--sso 72
--username 73
--xml 73
iii
PGP Whole Disk Encryption Command Line Contents
Quick Reference 75
Commands 75
Options 77
Troubleshooting 79
Overview 79
Encryption Does Not Begin 80
Encryption Does Not Finish 82
Problems at PGP BootGuard 83
iv
1
Introduction
This User's Guide tells you how to use PGP Whole Disk Encryption Command
Line.
In This Chapter
About PGP Whole Disk Encryption............................................................ 5
About PGP Whole Disk Encryption Command Line ..................................5
Important Terms ........................................................................................ 6
Audience .................................................................................................... 7
System Requirements ...............................................................................7
Installing and Uninstalling ..........................................................................7
PGP Whole Disk Encrypting a Drive ..........................................................8
About PGP Whole Disk Encryption
PGP Whole Disk Encryption (WDE) is a software product from PGP Corporation
that uses encryption to lock down the entire contents of a boot disk, partition,
external disk, or removable disk.
For more information about PGP WDE, see the:
PGP Desktop User's Guide
PGP WDE Quick Start Guide
PGP WDE Data Sheet (available via the PGP WDE page on the PGP
Corporation website)
About PGP Whole Disk Encryption Command Line
PGP Whole Disk Encryption Command Line gives you access to PGP WDE
functionality using a command-line interface. Accessing PGP WDE functions
from the command line is useful for scripting PGP WDE functions,
troubleshooting problems, or if the graphical user interface is not available.
Note: Not all PGP WDE functions are available via the command line.
5
PGP Whole Disk Encryption Command Line Introduction
PGP WDE command line functionality is available for both Windows and Mac
OS X systems. This Guide covers both versions. Differences between the two
versions are noted where applicable.
Note: The Mac OS X Safe Boot feature does not work on a boot disk that has
been whole disk encrypted; if you hold down the Shift key to enter Safe Boot,
the system will fail to boot after authenticating at the PGP BootGuard screen.
Important Terms
Understanding the following terms will help make it easier to use PGP Whole
Disk Encryption Command Line:
PGP Whole Disk Encryption (PGP WDE): a standalone product from PGP
Corporation and a feature of PGP Desktop that lets you encrypt the entire
contents of a disk; boot disks, partitions, and non-boot disks such as USB
thumb drives can all be whole disk encrypted. PGP WDE functionality is
available via a graphical user interface and through a command-line
interface.
PGP WDE command line: the command-line interface to PGP WDE
functionality. Because PGP WDE is available on both Windows and Mac OS
X systems, you can use the PGP WDE command line interface using
command line utilities such as the Command Prompt application, cmd.exe,
on Windows systems or the Terminal application on Mac OS X systems.
passphrase user: a user who can authenticate to an encrypted disk using a
passphrase.
public-key user: a user who can authenticate to an encrypted disk using
the passphrase to the corresponding private key.
encrypt: the process of "scrambling" data so that it is not usable unless you
properly authenticate.
decrypt: the process of "unscrambling" encrypted data.
master boot record (MBR): software on a disk that is "in front" of the
partition table; that is, it is implemented during the startup process before
the operating system itself. The instructions in the MBR tells the system
how to boot.
instrument: a part of the process of whole disk encrypting a disk/partition
where the Windows or Mac OS X MBR is replaced with the PGPMBR.
PGPMBR: an MBR from PGP Corporation that implements the PGP
BootGuard. Once a disk is instrumented, even if it is not fully encrypted,
subsequent startups will bring up the PGP BootGuard.
PGP BootGuard: the screen that appears after instrumenting a disk that
requires proper authentication for the boot process to continue. If proper
authentication is not provided, the boot process will not continue; the
operating system will not load and the system will not be usable.
6
PGP Whole Disk Encryption Command Line Introduction
uninstrument: removing the PGPMBR and replacing it with the original
Windows or Mac OS X MBR (which was saved when the disk was
instrumented).
whole disk recovery token (WDRT): an additional passphrase for a whole
disk encrypted disk that is passed to the appropriate PGP Universal Server
if the disk is part of a PGP Universal-managed environment.
PGP Universal Server: a management console for securing data from PGP
Corporation.
recovery: the process of restoring access to a disk/partition that has been
whole disk encrypted but now cannot be decrypted.
Audience
This User's Guide is for anyone who is going to be using PGP Whole Disk
Encryption Command Line to perform PGP WDE functions from the command
line.
It assumes you are familiar with using PGP WDE via the graphical user interface,
either in the standalone product or as part of PGP Desktop.
System Requirements
The system requirements for PGP Whole Disk Encryption Command Line are
the same as for PGP WDE itself; if PGP WDE (standalone or as part of PGP
Desktop) installs on a system, PGP Whole Disk Encryption Command Line will
also install and be usable.
Installing and Uninstalling
PGP Whole Disk Encryption Command Line is installed automatically when PGP
WDE or PGP Desktop is installed on a system.
To uninstall PGP Whole Disk Encryption Command Line, simply uninstall PGP
WDE or PGP Desktop.
7
PGP Whole Disk Encryption Command Line Introduction
PGP Whole Disk Encrypting a Drive
To PGP Whole Disk Encrypt a drive requires several things: the drive must be
instrumented, there must be at least one authorized user on the drive, and the
drive must be encrypted.
There are two ways to PGP Whole Disk Encrypt a drive:
using a single command, --secure: this one command instruments the
drive, creates an authorized user, and encrypts the drive. This command is
most useful when you have just installed PGP Whole Disk Encryption
Command Line and thus have not instrumented any drives, created any
authorized users, or encrypted any drives.
using multiple commands: for scenarios where you do not need all three
things required to PGP Whole Disk Encrypt at drive, or if you just prefer
using individual commands, you can use --instrument, --add-user,
and finally --encrypt to PGP Whole Disk Encrypt a drive.
8
The Command-Line
2
Overview
Interface
This section describes the command-line interface used by PGP Whole Disk
Encryption Command Line.
In This Chapter
Overview.................................................................................................... 9
Scripting ...................................................................................................10
Editing the Path........................................................................................ 10
WDE-ADMIN Active Directory Group ...................................................... 11
Passphrases............................................................................................. 11
PGP Whole Disk Encryption Command Line uses a command-line interface.
You enter a valid command at the command prompt and press Enter or return.
PGP Whole Disk Encryption Command Line responds based on what you
entered: with success (if you entered a valid command) or with an error
message (if you entered an invalid or incorrectly structured command).
All PGP Whole Disk Encryption Command Line commands have a long form: the
text "pgpwde", a space, two hyphens "--", the command name, and options (if
appropriate).
For example:
C:\>pgpwde --help [Enter]
is the command to display the built-in help information. It has no options.
(The command prompt, C:\> in the above example, and [Enter] will no longer be
shown in examples; only the necessary commands and options will be shown.)
A few commands also have a short form: either one hyphen and then a single
letter or two hyphens and two letters.
For example:
-h for help instead of --help
--aa for administrative authorization instead of --adminauthorization
9
PGP Whole Disk Encryption Command Line The Command-Line Interface
You can mix long forms and short forms in a single command.
Scripting
Short forms are noted where appropriate.
PGP Whole Disk Encryption Command Line commands can easily be inserted
into scripts for automating common tasks, such as encrypting a disk or getting
information about an encrypted disk.
PGP Whole Disk Encryption Command Line commands can easily be added to
scripts written with scripting languages such as Perl or Python.
Editing the Path
By default, the PGP Whole Disk Encryption Command Line application,
pgpwde.exe, is installed in C:\Program Files\PGP Corporation\PGP Desktop\ on
Windows systems.
To use PGP Whole Disk Encryption Command Line using the Windows
Command Prompt application, you need to navigate to the PGP Whole Disk
Encryption Command Line directory to execute commands (or the commands
will fail).
If you wish to be able to execute PGP Whole Disk Encryption Command Line
commands from any location when using Windows Command Prompt, you
need to change the path on the system to include the location of the PGP
Whole Disk Encryption Command Line application.
Note: On Mac OS X systems, you can use the Terminal application that ships
with Mac OS X as your command line editor. You can enter commands from
any location on the system; you do not have to navigate to a specific location.
To add the PGP Whole Disk Encryption Command Line application to your path
on a Windows 7 or Vista system:
1 On the Windows desktop, right click the Computer icon, then select
Properties.
2 On the left side of the System Control Panel screen, click Advanced
System Settings.
3 If you are prompted for permission to continue, click Continue.
4 At the bottom of the System Properties screen, click Environment
Variables.
5 In the System Variables section at the bottom of the Environment
Variables screen, select Path, then click Edit.
10
PGP Whole Disk Encryption Command Line The Command-Line Interface
6 At the end of the existing Variable value line, enter a semicolon (;), then
add the path to the PGP Whole Disk Encryption Command Line application
7 Click OK to save the change, then close the windows you opened.
To add the PGP Whole Disk Encryption Command Line application to your path
on a Windows XP or 2000 system:
1 On the Windows desktop, right click the My Computer icon, then select
Properties.
2 On the System Properties dialog, click the Advanced tab.
3 At the bottom of the Advanced tab, click Environment Variables.
4 In the System Variables section at the bottom of the Environment
Variables screen, select Path, then click Edit.
5 At the end of the existing Variable value line, enter a semicolon (;), then
add the path to the PGP Whole Disk Encryption Command Line application.
6 Click OK to save the change, then close the windows you opened.
WDE-ADMIN Active Directory Group
If you are an administrator of PGP WDE clients in a PGP Universal environment
and using Active Directory, you can create a special Active Directory group to
allow you to run commands on your managed PGP WDE clients without
knowing the passphrase of a user on the encrypted disk.
This special Active Directory group, which must be called WDE-ADMIN, must
be a security group, not a distribution group.
Using the --admin-authorization option is useful for running
administrative tasks in an enterprise.
Refer to the PGP Universal Administrator's Guide for more information about
creating and using the WDE-ADMIN Active Directory group.
Passphrases
For consistency, all example passphrases in this guide are shown in single
quotation marks ('). Putting passphrases between single quotation marks
ensures that reserved characters and spaces are interpreted correctly.
If you do not use any reserved characters or spaces in your passphrases, then
you do not have to enclose them in single quotation marks.
11
PGP Whole Disk Encryption Command Line The Command-Line Interface
On Windows systems, if you have a space in a passphrase, you must enclose
the passphrase in single or double quotation marks when you enter it. Also,
double quotation marks (") as part of the passphrase must be escaped with a
preceding double quotation mark.
For example, if you want to use
Thomas "Stonewall" Jackson
as your passphrase, you would have to enter it as
'Thomas ""Stonewall"" Jackson'
on the command line. You need the quotation marks at the beginning and end
for the spaces and you need to escape each double quotation mark used in the
passphrase with another double quotation mark.
If you do enclose your passphrases in single quotation marks, and you have a
single quotation mark as part of a passphrase on a *NIX system, you must
escape the single quotation mark that is part of the passphrase. Escaping means
you need to put another special character in front of the character; in this case, a
backslash (\).
For example, if you enclose your passphrases in single quotation marks and you
want to use
I can't believe it's not butter
as your passphrase, you would have to enter it as
'I can\'t believe it\'s not butter'
on the command line. You need the quotation marks at the beginning and end
for the spaces and you need to escape each single quotation mark used in the
passphrase with a backslash.
Note: If you are having problems entering certain characters in your
passphrases, check the information about how to handle reserved characters
for the operating system or shell interpreter you are using.
12
3
Licensing
This section describes how to license PGP Whole Disk Encryption Command
Line.
In This Chapter
Overview.................................................................................................. 13
--license-authorize ....................................................................................13
Licensing via a Proxy Server ....................................................................14
Overview
PGP Whole Disk Encryption Command Line requires a valid license to operate.
This section describes how to license PGP Whole Disk Encryption Command
Line if it is currently unlicensed or if you want to change to a different license.
PGP Whole Disk Encryption Command Line supports the following licensing
scenarios:
Using a License Number. This is the normal method to license PGP Whole
Disk Encryption Command Line. You must have your license information
and a working connection to the Internet.
Through a Proxy Server. If you connect to the Internet through a proxy
server, use this method to license PGP Whole Disk Encryption Command
Line. You must have your license information and the appropriate proxy
server information.
The licensing command is --license-authorize.
Once PGP Whole Disk Encryption Command Line is correctly installed and
licensed on your system, you can encrypt your drive.
--license-authorize
Use --license-authorize to license PGP Whole Disk Encryption Command
Line.
13
PGP Whole Disk Encryption Command Line Licensing
The usage format is:
pgpwde --license-authorize --license-name <name> -license-number <number> [--license-email <emailaddress>]
[--license-organization <org>]
Where:
--license-authorize is the command to license PGP Whole Disk
Encryption Command Line.
--license-name is the option to specify the user.
<name> is your name or a descriptive name.
--license-number is the option to enter a license number.
<number> is a valid license number for PGP Whole Disk Encryption
Command Line.
--license-email is the option to enter an email address.
<emailaddress> is a valid email address.
--license-organization is the option to enter an organization.
<org> is the name of your organization.
If you decide not to enter a license email, you may see a warning message but
your license will authorize.
Example:
pgpwde --license-authorize --license-name "Alice
Cameron"
--license-number "aaaaa-bbbbb-ccccc-ddddd-eeeee-fff"
--license-email "acameron@example.com"
--license-organization "Example Corporation"
(When entering this text, it all goes on a single line.)
Licensing via a Proxy Server
If the Internet access of the system hosting PGP Whole Disk Encryption
Command Line is via an HTTP proxy connection, you can still license PGP Whole
Disk Encryption Command Line directly; you simply need to add the necessary
proxy information.
Use --license-authorize to license PGP Whole Disk Encryption Command
Line via a proxy server.
14
PGP Whole Disk Encryption Command Line Licensing
The usage format is:
pgpwde --license-authorize --license-name <name>
--license-number <number> [--license-email
<emailaddress>] [--license-organization <org>] [--proxyserver <proxyserver>] [--proxy-username <proxyusername>]
[--proxy-passphrase <proxypass>]
Where:
--license-authorize is the command to license PGP Whole Disk
Encryption Command Line.
--license-name is the option to specify the user.
<name> is your name or a descriptive name.
--license-number is the option to enter a license number.
<number> is a valid license number for PGP Whole Disk Encryption
Command Line.
--license-email is the option to enter an email address.
<emailaddress> is a valid email address.
--license-organization is the option to enter an organization.
<org> is the name of your organization.
--proxy-server is the command to go through a proxy server to access
the Internet.
<proxyserver> is the appropriate proxy server.
--proxy-username is the command to specify a user on the proxy server
when authentication is required.
<proxyusername> is a valid username on the specified proxy server.
--proxy-passphrase is the option to specify the passphrase of the
specified user when authentication is required.
<proxypass> is the passphrase for the specified user on the proxy server.
Example:
pgpwde --license-authorize --license-name "Alice
Cameron"
--license-number "aaaaa-bbbbb-ccccc-ddddd-eeeee-fff"
--license-email "acameron@example.com
"
--license-organization "Example Corporation"
--proxy-server "proxyserver.example.com"
--proxy-username "acameron"
--proxy-passphrase 'a_cameron1492sailedblue'
(When entering this text, it all goes on a single line.)
15
4
Generic Commands
PGP Whole Disk Encryption Command Line generic commands are:
--help (-h), which shows basic help information for PGP Whole Disk
Encryption Command Line.
--version, which shows version information for PGP Whole Disk
Encryption Command Line.
In This Chapter
--help (-h) ..................................................................................................17
--version.................................................................................................... 18
--help (-h)
The --help command provides a brief description of the commands and
options available in PGP Whole Disk Encryption Command Line.
The long form usage format is:
pgpwde --help
The short form usage format is:
pgpwde -h
Example:
pgpwde --help
PGP WDE command line tool.
Commands:
Generic:
-h --help this help message
--version show version information
and so on.
This example shows the response to the --help command.
17
PGP Whole Disk Encryption Command Line Generic Commands
--version
The --version command displays information about the version of PGP Whole
Disk Encryption Command Line you are using.
The usage format is:
pgpwde --version
Example:
pgpwde --version
PGP WDE, Version 10.0.0
Copyright (C) 2010 PGP Corporation
This example shows the response to the --version command.
18
Disk Information
5
Commands
PGP Whole Disk Encryption Command Line includes several commands that
provide information about the disks on a system and their status:
--enum: Tells you about the disks on the system, including disk
designation.
--status: Gives you PGP WDE information about a disk on the system.
--show-config: Gives you PGP BootGuard information about a disk on
the system.
--info: Gives you general information about a disk on the system.
In This Chapter
--enum...................................................................................................... 19
--info .........................................................................................................20
--show-config ...........................................................................................21
--status .....................................................................................................22
--enum
The --enum command displays disk designations (for example, Disk 0 as the
boot disk), which is used in other PGP Whole Disk Encryption Command Line
commands.
The usage format is:
pgpwde --enum
Where:
--enum displays information about the disks on your system.
Examples:
pgpwde --enum
Total number of installed fixed/removable storage
device (excluding floppy and CDROM): 1
Disk 0 has 1 online volumes:
19
PGP Whole Disk Encryption Command Line Disk Information Commands
volume C is on partition 2 with offset 80325
Enumerate disks completed
This example shows that the system has one disk, Disk 0, which is drive
letter C and is the boot disk. Drive 0 is the boot disk in most cases on
Windows and Mac OS X systems.
pgpwde --enum
Total number of installed fixed/removable storage
device (excluding floppy and CDROM): 2
Disk 0 has 1 online volumes:
volume C is on partition 2 with offset 80325
Disk 1 has 1 online volumes:
volume F is on partition 1 with offset 245
Enumerate disks completed
This example shows information for the boot disk and a USB token on the
system; the token is Disk 1 and drive letter F.
--info
You can find out more information about the disks on your Windows
system in the Disk Management section of the Computer Management
tool (compmgmt.msc). You can find out more information about the disks
on your Mac OS X system using the Disk Utility application
(/Applications/Utilities/Disk Utility).
The --info command provides general status information for the specified
disk.
Use the --status command for PGP WDE-specific information about a disk.
Information you can see about a disk using --info includes:
model information.
total number of sectors on the disk.
The usage format is:
pgpwde --info --disk <number>
Where:
--disk specifies the disk to which the operation applies.
<number> is the disk number on the system.
20
PGP Whole Disk Encryption Command Line Disk Information Commands
Examples:
pgpwde --info --disk 0
Disk information for disk disk 0.
Model Number: ST910021AS
Total number of sectors on disk: 192426569
Display disk information completed
This example shows the model number and sectors for a boot disk.
pgpwde --info --disk 1
Disk information for disk 1.
Model Number: SanDisk U3 Titanium USB 2.18
Total number of sectors on disk: 4001425
Display disk information completed
--show-config
This example shows the model number and sectors for a USB thumb drive.
The --show-config command displays information about how PGP
BootGuard is configured on an encrypted disk.
No information displays if the command is run on a disk that is not encrypted by
PGP WDE.
The usage format is:
pgpwde --show-config --disk <number>
Where:
--disk specifies the disk to which the operation applies.
<number> is the disk number on the system.
Examples:
pgpwde --show-config --disk 0
Login Message:
Display Startup Screen: No
Use Audio Prompts: No
User lockout: Disabled
Allow user decrypt: Yes
Show configuration information completed
This example shows the PGP BootGuard information for a boot disk that is
encrypted.
21
PGP Whole Disk Encryption Command Line Disk Information Commands
--status
The --status command provides PGP WDE-specific status information for the
specified disk.
(Use the --info command for general information about a disk.)
Information you can see about a disk using --status includes:
whether or not the disk is instrumented.
whether or not the disk is whole disk encrypted.
the number of sectors on the disk.
the highwater mark (the number of encrypted sectors on the disk).
Note: If you are decrypting a disk, and you want to check progress, you can
run --status periodically and check the high water mark; this number
decreases as the decryption progresses.
The usage format is:
pgpwde --status --disk <number>
Where:
--disk is the option specifying to which disk on the
system the information applies.
<number> is the disk number on the system.
Examples:
pgpwde --status --disk 0
Disk disk0 is instrumented by bootguard.
Current key is valid.
Whole disk encrypted
Total sectors: 192426569 highwatermark: 192426569
Disk status completed
In this example, Disk 0 is instrumented by PGP BootGuard, the current key
used for authentication is valid, the disk is encrypted, the total number of
sectors on the disk is 192426569, and the high water mark (the number of
sectors encrypted) is 192426569.
pgpwde --status --disk 1
Disk disk 1 is not instrumented by bootguard.
Disk status completed
In this example, disk 1 is not instrumented by PGP BootGuard.
22
User Management
6
Commands
The user management commands are:
--add-user: Adds user to disk or group.
--change-passphrase: Changes passphrase of specified user or group.
--change-userdomain: Changes authentication domain of specified user
or group.
--list-user: Lists authorized users on an encrypted disk.
--offload: Offloads passphrase user information onto specified device.
--remove-user: Removes user from specified disk or group.
--verify-user: Verifies passphrase of user or group.
In This Chapter
--add-user .................................................................................................23
--change-passphrase ................................................................................25
--change-userdomain................................................................................ 25
--list-user...................................................................................................26
--offload ....................................................................................................27
--remove-user...........................................................................................27
--verify-user ..............................................................................................28
--add-user
The --add-user command adds an authorized user to the encrypted disk.
The usage format is:
pgpwde --add-user --disk <number> --domain-name <domain>
--sso --passphrase <phrase> --username <user> --adminauthorization | --admin-passphrase <pass> | --recoverytoken <string>
Where:
--disk specifies the disk to which the operation applies.
23