TweetFollow Us on Twitter

MacEnterprise: FileVault in the Enterprise, Part 2

Volume Number: 24 (2008)
Issue Number: 09
Column Tag: MacEnterprise

MacEnterprise: FileVault in the Enterprise, Part 2

Data security for OS X administrators

By Greg Neagle, MacEnterprise.org

Previously in MacTech

Data security is a hot topic in Enterprise IT these days. As laptop usage increases, pushing out traditional desktops, the risk to company data is greater than ever. If a laptop is stolen or lost, the replacement cost of the hardware may be a pittance compared to the value of the data stored on the laptop's hard drive.

Therefore many companies are mandating some sort of data encryption for company laptops. If a laptop is then stolen or lost, the data would be inaccessible to the thief. "Whole–disk encryption" is a direction many companies are moving toward, but as of this writing, there are no shipping products that will encrypt a Mac boot volume. So Mac administrators must work with what is available: a technology Apple calls "FileVault," which secures users' home directories with AES–128 encryption.

In part one of this series, we covered preparation and implementation of FileVault in an enterprise environment.

In this installment, we'll examine some of the issues you may encounter when implementing and supporting FileVault in an enterprise environment, and techniques and tools to use to deal with some of these issues.

Living with FileVault

Once encrypted, a FileVault–protected home directory is relatively transparent in operation to the user when he or she logs in. The main clue you'll see when using a FileVault–protected account is the FileVault icon replaces the "normal" home icon in the Finder.

It's important to realize that while the user is logged in, any other user that has access to the machine (either physically or over the network, say via SSH) and that has root or sudo privileges can still access the files in the user's home directory. This can be a good thing, or a bad thing, depending on your point of view. Only when the user is logged out are the files inaccessible, because the encrypted disk image is unmounted.


FileVault–protected home directory in the Users folder

This points out a security hole: what if a laptop is stolen while the user is logged in? In fact, this is a very likely scenario Ð many users rarely log out or shut down; instead they simply put the machine to sleep by closing the lid. If a machine is stolen in such a state, the FileVault disk image is unencrypted and mounted, so the user's files are accessible.

To close this security hole, you'll want to enforce the Require password to wake this computer from sleep or screen saver setting found in the Security preference pane.


Security preference pane

This setting can be enforced using MCX policy. If a thief were to take a laptop configured in this manner, the password request would prevent them from accessing the logged–in user's files.

FileVault Issues

Some applications may behave poorly with FileVault–encrypted home directories. Some examples:

Final Draft 7 would crash at startup when launched from a FileVault–protected account; this was fixed in version 7.1.3:

http://media.finaldraft.com/downloads/readme_fd713.txt

  • Some Automator actions fail on FileVault–protected accounts:

    http://www.macosxhints.com/article.php?story=20051020203919140

    iMovie and GarageBand have known performance issues with FileVault home directories:

    http://docs.info.apple.com/article.html?artnum=93460

    http://docs.info.apple.com/article.html?artnum=42964

    http://docs.info.apple.com/article.html?artnum=93699

    http://docs.info.apple.com/article.html?artnum=93618

    http://docs.info.apple.com/article.html?path=GarageBand/4.0/en/6567.html

    FinalCut Pro and Express have performance issues as well:

    http://docs.info.apple.com/article.html?artnum=93454

    Other applications that need high–performance disk access may be similarly affected.

    There are certainly other applications that have issues. Be sure to test the important applications you use.

    In most cases, there are workarounds for the FileVault issues, but most of the workarounds open up data security issues once again, as they rely on moving data to a non–encrypted part of the disk. You'll need to decide how to handle this.

    Reclaiming unused space

    In 10.4 (Tiger), FileVault makes use of what Apple calls "Encrypted Sparse Disk Images"; the image files are very space–efficient. But as items are added and deleted, these image files can grow bigger than they need to be and some housekeeping must be done to recover unused space. If this is not done, eventually the disk image file will grow to fill all available hard drive space. Periodically at logout, the user is notified that the image is using more space than is needed and asks for permission to recover the unused space. If the user is in a hurry to shutdown, restart, or log back in, they can cancel this housekeeping task – but they shouldn't put it off forever! Depending on the size of the home directory and the amount of recoverable space, recovery can be quite fast, or take a very long time. Train your users to treat the computer with kid gloves during the space recovery – if they were to get impatient and turn off the computer or force a restart during the recovery process, they could corrupt the disk image, which could then lead to total loss of the home directory contents!

    With 10.5, the user experience is improved. FileVault now makes use of "sparsebundles", in which the disk image data is kept in a collection of files inside an enclosing directory. This revised format has several advantages, but the one relevant here is that unused space recovery is much, much faster. In fact, it's so fast that Apple no longer asks at logout if you want to reclaim unused space Ð it just goes ahead and does it at each logout.

    A related issue: a user sees their hard drive is getting too full. They delete a bunch of files from their home directory and empty the trash. They are confused when there is no change in the available space on the hard drive. This is because the space is not reclaimed from the disk image file until logout (and, in Tiger, after the user agrees). Your support staff should be made aware of this issue, as it can cause much confusion.

    Recovering from a lost FileVault password

    If the user forgets their password, or changes their login password in a way that doesn't also update the FileVault password, they may find themselves locked out of their FileVault home directory. If you have the FileVault master password (and keychain), you can reset the password on the FileVault disk image.

    If password hints are turned on, after three unsuccessful attempts, a password hint will be shown, if one is set for the user's account. If there is no user password hint, or the user still enters an incorrect password, the login window will change, showing text directing the user (or an administrator) to enter the FileVault master password to reset the user's password and to unlock FileVault.

    In practice, I've found this to work only with purely local accounts protected with FileVault. Mobile accounts (those with Portable Home Directories) never show a password hint or the Master Password prompt, at least when testing in my environment. Fortunately, there is another way to unlock a FileVault–protected home directory: via the command line.

    Command–line FileVault Recovery

    Here's how to change the FileVault password from the command line. Log in as root, or with an account that has sudo privileges to act as root (Admin accounts by default on OS X have this ability). Watch the line breaks Ð in the example below, all commands are entered as one single line:

    [mbp:~] gneagle% sudo security unlock–keychain /Library/Keychains/FileVaultMaster.keychain
    password to unlock /Library/Keychains/FileVaultMaster.keychain: 
    <enter FileVault master password>
    [mbp:~] gneagle% sudo hdiutil chpass /Users/someuser/someuser.sparseimage –recover /Library/Keychains/FileVaultMaster.keychain Ðnewstdinpass
    Enter new disk image passphrase:
    <enter your desired password>

    Be careful, as you are not prompted to confirm the new password. If you make a mistake, just run hdiutil chpass again.

    Leopard improvements

    A common scenario requiring the FileVault password to be changed is when the user changes their login password by some method other than the Mac OS X Accounts preference pane. For example, many organizations provide a web page to change network passwords. If a user changes their network account password in this manner, the FileVault password cannot be updated. The same issue occurs if the user uses multiple machines and changes their password on a machine other than the one with the FileVault–protected home directory.

    Under Tiger, this password mismatch almost always required administrator assistance to recover from. Leopard makes users' and administrators' lives easier in this regard: if a user authenticates at the login window with their correct network credentials, but the FileVault disk image cannot be unlocked with the current network password, the OS will now display a dialog asking the user to enter their previous login password. If the entered password can unlock the FileVault disk image, the disk image password is updated, and the user is able to login.

    Miscellaneous trivia

    You may have a need to determine if FileVault is turned on for a particular user of a machine. Since waiting for the user to step away from their machine so you can peek at the Security preferences pane while they are logged in isn't always practical, it's helpful to have another way.

    The most accurate way to determine if FileVault is enabled is to use dscl:

    [mbp:~] gneagle% dscl . read /Users/gneagle HomeDirectory
    HomeDirectory: <home_dir><url>file://localhost/Users/gneagle/gneagle.sparsebundle</url></home_dir>

    Note the file:// URL and the filename ending with ".sparsebundle" (or ".sparseimage" in Tiger). This is your proof positive that the account is using a FileVault–protected home directory.

    You might be a bit confused here. If the sparsebundle (or sparseimage) is stored inside /Users/username, how can it be made available at /Users/username when the user logs in?

    When the user is not logged in, the /Users directory looks something like this:

    [mbp:/Users] root# ls –al
    drwxr–xr–x    7 root    admin   238 May  2 16:01 .
    drwxrwxr–t   46 root    admin  1632 Apr 25 16:14 ..
    –rw–rÑrÑ    1 root    wheel     0 Sep 23  2007 .localized
    drwxrwxrwt   24 root    wheel   816 Apr 30 14:46 Shared
    drwxrÑrÑ  115 gneagle staff  3978 May  2 12:28 gneagle

    The gneagle.sparsebundle file is inside the gneagle directory. But once gneagle logs in, the /Users directory looks like this:

    [mbp:/Users] root# ls –al
    drwxr–xr–x    7 root    admin   238 May  2 16:01 .
    drwxrwxr–t   46 root    admin  1632 Apr 25 16:14 ..
    dr–xÑÑÑ+   6 gneagle staff   204 Apr 30 12:06 .gneagle
    –rw–rÑrÑ    1 root    wheel     0 Sep 23  2007 .localized
    drwxrwxrwt   24 root    wheel   816 Apr 30 14:46 Shared
    drwxrÑrÑ  115 gneagle staff  3978 May  2 12:28 gneagle

    Note the new ".gneagle" directory. Further investigation will show the gneagle.sparsebundle file is now inside the .gneagle directory, and the disk image is mounted on /Users/gneagle:

    [mbp:/Users] root# mount
    /dev/disk0s3 on / (hfs, local, journaled)
    devfs on /dev (devfs, local)
    fdesc on /dev (fdesc, union)
    map –hosts on /net (autofs, automounted)
    map auto_home on /home (autofs, automounted)
    /dev/disk1s2 on /Users/gneagle (hfs, local, nodev, nosuid, journaled)

    So let's put this knowledge to use.

    On rare occasions on Tiger machines, you may encounter a situation where a FileVault–protected user cannot log in. You login to the machine with an admin account, and look in the /Users/username folder, and find the sparseimage file missing! Instead of panicking, you use your hard–earned systems administration knowledge, and you remember to look for a ".username" directory under /Users. You find it, and inside, the username.sparseimage file. You then move the sparseimage file back into the /Users/username directory, remove the /Users/.username directory, and tell the user to try to log in. They succeed, and you are a sysadmin hero.

    What has happened is that the machine crashed while the user was logged in, and the sparseimage file was not moved back into /Users/username, as it would be after a normal logout. When this happens, Tiger does not always fix things after the reboot, so you may need to help things along.

    Wrap–up

    Thus concludes our look at implementing FileVault in an enterprise environment. We've looked at preparation tasks and deployment options. We've identified some common issues and user experiences, and demonstrated some tools and strategies to deal with these. You now have the knowledge to confidently help protect your organization's private data and intellectual property with FileVault's home directory encryption.


    Greg Neagle is a member of the steering committee of the Mac OS X Enterprise Project (macenterprise.org) and is a senior systems engineer at a large animation studio. Greg has been working with the Mac since 1984, and with OS X since its release. He can be reached at gregneagle@mac.com.

  •  

    Community Search:
    MacTech Search:

    Software Updates via MacUpdate

    Posterino 4.4 - Create posters, collages...
    Posterino offers enhanced customization and flexibility including a variety of new, stylish templates featuring grids of identical or odd-sized image boxes. You can customize the size and shape of... Read more
    Chromium 119.0.6044.0 - Fast and stable...
    Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all Internet users to experience the web. List of changes available here. Version for Apple... Read more
    Spotify 1.2.21.1104 - Stream music, crea...
    Spotify is a streaming music service that gives you on-demand access to millions of songs. Whether you like driving rock, silky R&B, or grandiose classical music, Spotify's massive catalogue puts... Read more
    Tor Browser 12.5.5 - Anonymize Web brows...
    Using Tor Browser you can protect yourself against tracking, surveillance, and censorship. Tor was originally designed, implemented, and deployed as a third-generation onion-routing project of the U.... Read more
    Malwarebytes 4.21.9.5141 - Adware remova...
    Malwarebytes (was AdwareMedic) helps you get your Mac experience back. Malwarebytes scans for and removes code that degrades system performance or attacks your system. Making your Mac once again your... Read more
    TinkerTool 9.5 - Expanded preference set...
    TinkerTool is an application that gives you access to additional preference settings Apple has built into Mac OS X. This allows to activate hidden features in the operating system and in some of the... Read more
    Paragon NTFS 15.11.839 - Provides full r...
    Paragon NTFS breaks down the barriers between Windows and macOS. Paragon NTFS effectively solves the communication problems between the Mac system and NTFS. Write, edit, copy, move, delete files on... Read more
    Apple Safari 17 - Apple's Web brows...
    Apple Safari is Apple's web browser that comes bundled with the most recent macOS. Safari is faster and more energy efficient than other browsers, so sites are more responsive and your notebook... Read more
    Firefox 118.0 - Fast, safe Web browser.
    Firefox offers a fast, safe Web browsing experience. Browse quickly, securely, and effortlessly. With its industry-leading features, Firefox is the choice of Web development professionals and casual... Read more
    ClamXAV 3.6.1 - Virus checker based on C...
    ClamXAV is a popular virus checker for OS X. Time to take control ClamXAV keeps threats at bay and puts you firmly in charge of your Mac’s security. Scan a specific file or your entire hard drive.... Read more

    Latest Forum Discussions

    See All

    ‘Monster Hunter Now’ October Events Incl...
    Niantic and Capcom have just announced this month’s plans for the real world hunting action RPG Monster Hunter Now (Free) for iOS and Android. If you’ve not played it yet, read my launch week review of it here. | Read more »
    Listener Emails and the iPhone 15! – The...
    In this week’s episode of The TouchArcade Show we finally get to a backlog of emails that have been hanging out in our inbox for, oh, about a month or so. We love getting emails as they always lead to interesting discussion about a variety of topics... | Read more »
    TouchArcade Game of the Week: ‘Cypher 00...
    This doesn’t happen too often, but occasionally there will be an Apple Arcade game that I adore so much I just have to pick it as the Game of the Week. Well, here we are, and Cypher 007 is one of those games. The big key point here is that Cypher... | Read more »
    SwitchArcade Round-Up: ‘EA Sports FC 24’...
    Hello gentle readers, and welcome to the SwitchArcade Round-Up for September 29th, 2023. In today’s article, we’ve got a ton of news to go over. Just a lot going on today, I suppose. After that, there are quite a few new releases to look at... | Read more »
    ‘Storyteller’ Mobile Review – Perfect fo...
    I first played Daniel Benmergui’s Storyteller (Free) through its Nintendo Switch and Steam releases. Read my original review of it here. Since then, a lot of friends who played the game enjoyed it, but thought it was overpriced given the short... | Read more »
    An Interview with the Legendary Yu Suzuk...
    One of the cool things about my job is that every once in a while, I get to talk to the people behind the games. It’s always a pleasure. Well, today we have a really special one for you, dear friends. Mr. Yu Suzuki of Ys Net, the force behind such... | Read more »
    New ‘Marvel Snap’ Update Has Balance Adj...
    As we wait for the information on the new season to drop, we shall have to content ourselves with looking at the latest update to Marvel Snap (Free). It’s just a balance update, but it makes some very big changes that combined with the arrival of... | Read more »
    ‘Honkai Star Rail’ Version 1.4 Update Re...
    At Sony’s recently-aired presentation, HoYoverse announced the Honkai Star Rail (Free) PS5 release date. Most people speculated that the next major update would arrive alongside the PS5 release. | Read more »
    ‘Omniheroes’ Major Update “Tide’s Cadenc...
    What secrets do the depths of the sea hold? Omniheroes is revealing the mysteries of the deep with its latest “Tide’s Cadence" update, where you can look forward to scoring a free Valkyrie and limited skin among other login rewards like the 2nd... | Read more »
    Recruit yourself some run-and-gun royalt...
    It is always nice to see the return of a series that has lost a bit of its global staying power, and thanks to Lilith Games' latest collaboration, Warpath will be playing host the the run-and-gun legend that is Metal Slug 3. [Read more] | Read more »

    Price Scanner via MacPrices.net

    Clearance M1 Max Mac Studio available today a...
    Apple has clearance M1 Max Mac Studios available in their Certified Refurbished store for $270 off original MSRP. Each Mac Studio comes with Apple’s one-year warranty, and shipping is free: – Mac... Read more
    Apple continues to offer 24-inch iMacs for up...
    Apple has a full range of 24-inch M1 iMacs available today in their Certified Refurbished store. Models are available starting at only $1099 and range up to $260 off original MSRP. Each iMac is in... Read more
    Final weekend for Apple’s 2023 Back to School...
    This is the final weekend for Apple’s Back to School Promotion 2023. It remains active until Monday, October 2nd. Education customers receive a free $150 Apple Gift Card with the purchase of a new... Read more
    Apple drops prices on refurbished 13-inch M2...
    Apple has dropped prices on standard-configuration 13″ M2 MacBook Pros, Certified Refurbished, to as low as $1099 and ranging up to $230 off MSRP. These are the cheapest 13″ M2 MacBook Pros for sale... Read more
    14-inch M2 Max MacBook Pro on sale for $300 o...
    B&H Photo has the Space Gray 14″ 30-Core GPU M2 Max MacBook Pro in stock and on sale today for $2799 including free 1-2 day shipping. Their price is $300 off Apple’s MSRP, and it’s the lowest... Read more
    Apple is now selling Certified Refurbished M2...
    Apple has added a full line of standard-configuration M2 Max and M2 Ultra Mac Studios available in their Certified Refurbished section starting at only $1699 and ranging up to $600 off MSRP. Each Mac... Read more
    New sale: 13-inch M2 MacBook Airs starting at...
    B&H Photo has 13″ MacBook Airs with M2 CPUs in stock today and on sale for $200 off Apple’s MSRP with prices available starting at only $899. Free 1-2 day delivery is available to most US... Read more
    Apple has all 15-inch M2 MacBook Airs in stoc...
    Apple has Certified Refurbished 15″ M2 MacBook Airs in stock today starting at only $1099 and ranging up to $230 off MSRP. These are the cheapest M2-powered 15″ MacBook Airs for sale today at Apple.... Read more
    In stock: Clearance M1 Ultra Mac Studios for...
    Apple has clearance M1 Ultra Mac Studios available in their Certified Refurbished store for $540 off original MSRP. Each Mac Studio comes with Apple’s one-year warranty, and shipping is free: – Mac... Read more
    Back on sale: Apple’s M2 Mac minis for $100 o...
    B&H Photo has Apple’s M2-powered Mac minis back in stock and on sale today for $100 off MSRP. Free 1-2 day shipping is available for most US addresses: – Mac mini M2/256GB SSD: $499, save $100 –... Read more

    Jobs Board

    Licensed Dental Hygienist - *Apple* River -...
    Park Dental Apple River in Somerset, WI is seeking a compassionate, professional Dental Hygienist to join our team-oriented practice. COMPETITIVE PAY AND SIGN-ON Read more
    Sublease Associate Optometrist- *Apple* Val...
    Sublease Associate Optometrist- Apple Valley, CA- Target Optical Date: Sep 30, 2023 Brand: Target Optical Location: Apple Valley, CA, US, 92307 **Requisition Read more
    *Apple* / Mac Administrator - JAMF - Amentum...
    Amentum is seeking an ** Apple / Mac Administrator - JAMF** to provide support with the Apple Ecosystem to include hardware and software to join our team and Read more
    Child Care Teacher - Glenda Drive/ *Apple* V...
    Child Care Teacher - Glenda Drive/ Apple ValleyTeacher Share by Email Share on LinkedIn Share on Twitter Read more
    Cashier - *Apple* Blossom Mall - JCPenney (...
    Cashier - Apple Blossom Mall Location:Winchester, VA, United States (https://jobs.jcp.com/jobs/location/191170/winchester-va-united-states) - Apple Blossom Mall Read more
    All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.