SEDUTIL-CLI(8)

💖 SEDUTIL-CLI 💖

okay bestie, gather round, because this is the manual page for sedutil-cli — the util that manages TCG Opal 2.0 self encrypting drives. yes she's a section 8 system admin girlie and yes she's iconic. no cap. 🎀

✨ SYNOPSIS ✨

sedutil-cli <-v> <-n> <action> <options> <device>

like, that's the whole shape of it. flags, action, options, device. the four-course meal. 🍓

🌸 DESCRIPTION 🌸

so sedutil-cli is a utility to manage self encrypting drives that conform to the Trusted Computing Group (TCG) OPAL 2.0 SSC specification. that's the vibe. that's the whole assignment. 💅

now here's the part that will ruin your afternoon if you skip it: on Linux, libata.allow_tpm must be set to 1. literally must. no exceptions, no "but I thought—".

you've got two ways to do it, bestie:

• add libata.allow_tpm=1 to the kernel flags at boot time 🦋
• or change the contents of /sys/module/libata/parameters/allow_tpm from a "0" to a "1" on a running system ⭐

pick your fighter. but pick one. 😤

👑 OPTIONS 👑

🌈 General Options

• -v (optional) — increase verbosity! and the way that this works is you stack them: one to five v's. -v is a whisper, -vvvvv is a scream. 🗣️
• -n (optional) — no password hashing. ⚠️ and like... bestie... Passwords will be sent in clear text! she's not being dramatic, that's literally what it says. 🚨

not me warning you twice but genuinely: -n means clear text passwords. that's the deal. that's the trade. 🙈

🦋 Actions

• --scan — Scans the devices on the system identifying Opal compliant devices. the little detector-gadget moment. 🔍
• --query <device> — Display the Discovery 0 response of a device. it's giving "tell me about yourself" energy. 💬
• --isValidSED <device> — Verify whether the given device is SED or not. yes/no, slay/not-slay. ✅
• --listLockingRanges <password> <device> — List all Locking Ranges. all of them. every last one. 📋
• --listLockingRange <0...n> <password> <device> — List all Locking Ranges, 0 = GLobal 1..n = LRn. 👀
• --eraseLockingRange <0...n> <password> <device> — Erase a Locking Range, 0 = GLobal 1..n = LRn. 💀
• --setupLockingRange <0...n> <RangeStart> <RangeLength> <password> <device> — Setup a new Locking Range, 0 = GLobal 1..n = LRn. fresh range, who dis. 🎀
• --initialSetup <SIDpassword> <device> — Setup the device for use with sedutil, <SIDpassword> is new SID and Admin1 password. the glow-up beginning. ✨
• --setSIDPassword <SIDpassword> <newSIDpassword> <device> — Change the SID password. out with the old, in with the new. 🔐
• --setAdmin1Pwd <Admin1password> <newAdmin1password> <device> — Change the Admin1 password. same energy, different key. 🗝️
• --setPassword <oldpassword, " for MSID> <userid> <newpassword> <device> — Change the Enterprise password for userid, "EraseMaster" or "BandMaster<n>", 0 <= n <= 1023. (and yes the " inside that placeholder is doing what it's doing — copying it exactly, character for character, because I do not edit the ancestors.) 🫶
• --setLockingRange <0...n> <RW|RO|LK> <Admin1password> <device> — Set the status of a Locking Range, 0 = GLobal 1..n = LRn. pick your mode: RW, RO, or LK. choose wisely. 🔥
• --enableLockingRange <0...n> <Admin1password> <device> — Enable a Locking Range, 0 = GLobal 1..n = LRn. 🟢
• --disableLockingRange <0...n> <Admin1password> <device> — Disable a Locking Range, 0 = GLobal 1..n = LRn. 🔴
• --setMBREnable <on|off> <Admin1password> <device> — Enable|Disable MBR shadowing. 🕶️
• --setMBRDone <on|off> <Admin1password> <device> — set|unset MBRDone. ✅
• --loadPBAimage <Admin1password> <file> <device> — Write <file> to MBR Shadow area. drop it in, she goes in. 📥
• --revertTPer <SIDpassword> <device> — set the device back to factory defaults. and listen. listen to me. This ERASES ALL DATA. not "some". not "a lil bit". ALL. 💀💀💀
• --revertNoErase <Admin1password> <device> — deactivate the Locking SP without erasing the data on GLOBAL RANGE ONLY. only. only. capital-O-N-L-Y. don't get cute about it. 🙏
• ----yesIreallywanttoERASEALLmydatausingthePSID <PSID> <device> — revert the device using the PSID. ERASING ALL the data. the four dashes are not a typo, that's the actual name, and honestly the name is a whole vibe check you have to pass before you're allowed to do this. 🚨
• --printDefaultPassword <device> — print MSID. ✨

🧚 EXAMPLES 🧚

here's the part you actually came for, bestie. copy-paste responsibly:

sedutil-cli --scan
sedutil-cli --query /dev/sdc
sedutil-cli --yesIreallywanttoERASEALLmydatausingthePSID <PSIDALLCAPSNODASHED> /dev/sdc
sedutil-cli --initialSetup <newSIDpassword> /dev/sdc

look at her. --scan to see what's out there. --query to interrogate. and then that third one... that third one is a whole commitment. 😭 note the <PSIDALLCAPSNODASHED> — all caps, no dashes. the PSID does not want your lowercase. the PSID does not want your hyphens. 👑

😴 BUGS 😴

Sleep (S3) is not supported. she does not nap. do not ask her to nap. 🛌❌

🌟 AUTHOR 🌟

The tool was developed by Bright Plaza Inc. <drivetrust@drivetrust.com>. 💜

This man page was written by Jan Luca Naumann <j.naumann@fu-berlin.de>. 🫶

and that's the whole page, bestie!! this was version 0.12, dated 18 Feb 2016, and it's the sedutil-cli manual, section 8. thank you for coming to my TED talk, go encrypt something (or don't, if you can't find your PSID). mwah. 💅💖✨