TweetFollow Us on Twitter

MacEnterprise: FileVault in the Enterprise, Part 1

Volume Number: 24 (2008)
Issue Number: 07
Column Tag: Security

MacEnterprise: FileVault in the Enterprise, Part 1

Data security for OS X administrators

By Greg Neagle, MacEnterprise.org

Data Security

Data security is a hot topic in Enterprise IT these days. As laptop usage increases, pushing out traditional desktops, the risk to company data is greater than ever. If a laptop is stolen or lost, the replacement cost of the hardware may be a pittance compared to the value of the data stored on the laptop's hard drive.

Therefore many companies are mandating some sort of data encryption for company laptops. If a laptop is then stolen or lost, the data would be inaccessible to the thief. "Whole-disk encryption" is a direction many companies are moving toward, but as of this writing, there are no shipping products that will encrypt a Mac boot volume (although some companies have products in the beta stage). So Mac administrators must work with what is available: a technology Apple calls "FileVault," which secures users' home directories with AES-128 encryption.

In part one of this series, we'll cover preparation and implementation of FileVault in an enterprise environment.

In part two, we'll examine some of the issues you may encounter when implementing and supporting FileVault in an enterprise environment, and techniques and tools to use to deal with some of these issues.

FileVault - encryption for user data

FileVault works by storing a user's files in an encrypted disk image file. Disk images are familiar to OS X administrators — many large organizations set up their OS X machines by restoring a disk image to the machine's hard drive, and many software installers are distributed in the form of disk image files. FileVault uses a disk image that is encrypted with the user's login password. When the user logs in, his or her password is used to unlock the disk image. The image is then mounted under /Users/<username> and for the most part, looks and behaves like a normal user home folder.

There are two primary risks associated with implementing FileVault for your users. The first is that they forget their password and cannot access their data. Since the password is the same as the login password, this seems an unlikely scenario, but there are other ways a user can lock themselves out of a FileVault-protected account. It's not uncommon for organizations to implement a web page that all users can go to change their password. If, however, a user with a FileVault-protected account does this, the FileVault disk image is not updated with the new password – this only happens if you use the Accounts preferences pane to change your password. Another way the password can get out of sync is if the user has multiple machines, and changes their password on a machine other than the laptop with the FileVault-encrypted home directory. Apple has provided a way for administrators to unlock FileVault disk images – this is the FileVault "master password". We'll look at this later in the article.

The second primary risk associated with FileVault is data corruption. Under Tiger, FileVault-protected home directories are encrypted disk images, and since a disk image is a single file, corruption of that single file can lead to the loss of the entire FileVault home directory. This type of corruption is rare, but is possible. In Leopard, FileVault now uses "sparsebundles" as the disk image format. This stores the disk image data in multiple files within an enclosing directory. Apple claims better performance, and importantly, better reliability, which presumably means that disk image corruption is even less likely. Your best defense against data corruption is backups. Backups are always important for enterprise data, but they are even more important for FileVault-protected data.

Preparing for FileVault

Before implementing FileVault in your organization, you might want to do some prep work. The most important bit of prep work is to set the FileVault master password for all your machines. This is the password you can use to get access to a FileVault-protected disk image if the user's password has been forgotten or is otherwise not available. In order to be useful, you almost certainly want this master password to be the same on all the machines you manage.


10.5's Security Preference pane – FileVault tab

To do this, you'll create a FileVault master password on one machine, and then copy certain files to all your managed machines. Open the Security preference pane and click Set Master Password. Since this will be deployed to all your managed machines, and since changing it (and propagating that change to existing FileVault-protected accounts) is difficult, make sure it's a non-trivial password, and do not make it the same as any other admin or root password you have in use. Use the Password Assistant to check on the quality of your chosen password.

Two new files are created in /Library/Keychains: FileVaultMaster.cer, and FileVaultMaster.keychain.

To implement the FileVault master password on all the machines you manage, simply install these two files on all your managed machines. You can use any method to do this (put them in your install image, using ARD, radmind, FileWave, etc), but make sure they are in place before FileVault is turned on for any accounts on a given machine. If FileVault has been turned on before these FileVaultMaster files are installed, the pre-existing FileVault-protected accounts cannot be unlocked using the FileVault master password you just created.

The second most important preparation task is to ensure you have a method to backup user's home directories. If you are using Mobile Accounts and Portable Home Directories, you can simply back up the network home directories on the server. If you can't use Portable Home Directories, you may decide to use something like Retrospect or Time Machine to directly backup user home directories.

You may or may not want to implement the next preparation task: turning on password hints. If your users forget their passwords, in order to get a prompt to allow an administrator to unlock the account using the master password, Show password hints must be turned on in the Accounts preference pane, under Login Options, or if you are managing your clients via MCX, in Workgroup Manager, manage this Preference under Login->Login Window, checking Show password hint when needed and available. One last option is to do this via command-line, perhaps as part of a script:

sudo defaults write /Library/Preferences/com.apple.loginwindow RetriesUntilHint 3

In Tiger, this setting is labeled Show password hint after 3 attempts to enter a password in Workgroup Manager's preference management settings.

Additionally, the MasterPasswordHint key must exist in the defaults keys for /Library/Preferences/com.apple.loginwindow. Normally, this is set when you create the FileVault master password via the Security preferences pane. But if you simply distribute the /Library/Keychains/FileVaultMaster.cer and /Library/Keychains/FileVaultMaster.keychain files to other machines you manage, this key will probably not be set.

sudo defaults write /Library/Preferences/com.apple.loginwindow MasterPasswordHint ""

will do the job. (It's OK to have an empty hint, but the key must exist.)

Enabling password hints is itself considered a security risk in many organizations, so consider if you really want to do this. If you don't, there is no way from the GUI for an admin to recover a FileVault-protected home directory — but an admin can still do so from the command line.

The final preparation task is training. Train your tech support staff on FileVault, and provide a method for your users to find out more about FileVault as well. The better you document and train, the higher users acceptance will be.

Local preparation

There are a few things you can do on the local machine before turning on FileVault that will increase your odds of success. First, make sure the startup disk is healthy. Run Disk Utility to verify, and if needed, repair the startup disk. Second, minimize the amount of data that needs to be copied to the encrypted disk image - delete unneeded files. Empty the trash. rm -R /Users/username/Library/Caches/* to get rid of cache files. If you use Norton/Symantec AntiVirus, turn off AutoProtect. This will speed up creation of the new disk image and avoid issues where Norton AutoProtect interferes with disk image creation. (But be sure to turn it back on later!)

Finally, make sure there is enough free disk space on the startup disk for the FileVault conversion. When FileVault is enabled for an account, an encrypted disk image is created, everything is copied from the "unencrypted" home directory to the encrypted disk image, and finally the items in the unencrypted home directory are deleted. This means that you must have more free space on the hard drive than the size of the home directory you are encrypting. If the user has 60GB of data in his or her home directory, there needs to be more than 60GB free on the hard drive.

Turning on FileVault

Turning on FileVault is straightforward. Log in as the user for which you'd like to turn on FileVault. In the Security preferences pane, click the "Turn On FileVault..." button. If the preference pane is locked, you'll be asked to enter an admin password (which may effectively prevent users from turning on FileVault by themselves). You'll then be prompted for the user's account password (which may effectively prevent admins from turning on FileVault for users without their involvement). You'll be presented with one last dialog, informing you of the dire consequences that await you should you forget your login password and lose the master password.


FileVault confirmation dialog

New to Leopard is the option to turn on secure virtual memory from this dialog; in both Leopard and Tiger it can also be turned on in the Security preference pane. Also note the check box labled "Use secure erase". You should check this. If you do not, when OS X removes the original home folder after creating the FileVault disk image, it is possible to recover some or all of the data using an unerase or file rescue utility. This could defeat much of the purpose of turning on FileVault.

Once you click "Turn On FileVault" in this final confirmation dialog, the current user will be logged out and the FileVault conversion process will start. If anything interrupts the logout (such as cancelling when asked what to do with an unsaved document), the FileVault conversion will be cancelled and you'll have to visit the Security preference pane to start again from the beginning.

If the FileVault conversion process fails for any reason, the partially-created encrypted disk image is removed, and the original home directory is left untouched. Possible reasons for failure of the FileVault conversion are a full hard drive; drive or file system errors or failures; and anti-virus scanning of the drive image.

Automating FileVault

New to Leopard is the ability to enable FileVault protection when creating new accounts, or creating mobile accounts. This saves a step: you no longer have to create the account, then login and turn on FileVault. More importantly, you can use MCX policies to enforce FileVault so that it is automatically turned on for all new mobile and local accounts.

Enforcing FileVault on mobile accounts is straightforward using Workgroup Manager. There is a new checkbox in Mobility preferences under Account Creation Options, labeled Encrypt contents with FileVault.

Apple doesn't make enforcing FileVault for local accounts quite as easy to discover or implement, but it is possible.

In Workgroup Manager, choose a Computer or ComputerGroup to manage, click the Preferences icon in the toolbar, then select the Details pane. Click the "+" button to add a new preference domain. Navigate to /Applications and double-click on the System Preferences app.

You should now have the com.apple.systempreferences domain available to you, and it should look like this:


Preferences details in Workgroup Manager

Double-click the entry for com.apple.systempreferences, and delete all the imported keys - we don't want any of them. Turn down the Always dictionary, and add a new key like this:


Managing com.apple.systempreferences keys

Save your changes.

Once the updated management settings become available on your managed client machines, you'll see that when creating a new local account, the Turn on FileVault protection checkbox is pre-selected, and disabled so that it cannot be deselected. All new local accounts will automatically have FileVault turned on as they are created.


FileVault enforced for local accounts

To be continued...

We've prepared our infrastructure, enabled FileVault on existing user accounts, and looked at options for enforcing FileVault for all new accounts. In part two of this series, we'll look at some issues you and your users might encounter, and what you can do to manage these issues.


Greg Neagle is a member of the steering committee of the Mac OS X Enterprise Project (macenterprise.org) and is a senior systems engineer at a large animation studio. Greg has been working with the Mac since 1984, and with OS X since its release. He can be reached at gregneagle@mac.com. The MacEnterprise project is a community of IT professionals sharing information and solutions to support Macs in an enterprise. We collaborate on the deployment, management, and integration of Mac OS X client and server computers into multi-platform computing environments.

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

Parallels Desktop 13.3.0 - Run Windows a...
Parallels allows you to run Windows and Mac applications side by side. Choose your view to make Windows invisible while still using its applications, or keep the familiar Windows background and... Read more
Bookends 13.0.6 - Reference management a...
Bookends is a full-featured bibliography/reference and information-management system for students and professionals. Bookends uses the cloud to sync reference libraries on all the Macs you use.... Read more
macOS 10.13.3 Supplemental Update 1.0 -...
macOS High Sierra Supplemental Update includes security improvements to Safari and WebKit to mitigate the effects of Spectre. Version 1.0: Update fixes an issue where using certain character... Read more
Chromium 64.0.3282.167 - Fast and stable...
Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all Internet users to experience the web. Version 64.0.3282.167: [806388] High CVE-2018-6056:... Read more
Chromium 64.0.3282.167 - Fast and stable...
Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all Internet users to experience the web. Version 64.0.3282.167: [806388] High CVE-2018-6056:... Read more
Parallels Desktop 13.3.0 - Run Windows a...
Parallels allows you to run Windows and Mac applications side by side. Choose your view to make Windows invisible while still using its applications, or keep the familiar Windows background and... Read more
Bookends 13.0.6 - Reference management a...
Bookends is a full-featured bibliography/reference and information-management system for students and professionals. Bookends uses the cloud to sync reference libraries on all the Macs you use.... Read more
macOS 10.13.3 Supplemental Update 1.0 -...
macOS High Sierra Supplemental Update includes security improvements to Safari and WebKit to mitigate the effects of Spectre. Version 1.0: Update fixes an issue where using certain character... Read more
ffWorks 1.0.6 - Convert multimedia files...
ffWorks (was iFFmpeg), focused on simplicity, brings a fresh approach to the use of FFmpeg, allowing you to create ultra-high-quality movies without the need to write a single line of code on the... Read more
Adobe Acrobat 18.011.20035 - Powerful PD...
Acrobat DC is available only as a part of Adobe Creative Cloud, and can only be installed and/or updated through Adobe's Creative Cloud app. Adobe Acrobat DC with Adobe Document Cloud services is... Read more

Latest Forum Discussions

See All

Alto's Odyssey (Games)
Alto's Odyssey 1.0.1 Device: iOS Universal Category: Games Price: $4.99, Version: 1.0.1 (iTunes) Description: Just beyond the horizon sits a majestic desert, vast and unexplored. Join Alto and his friends and set off on an endless... | Read more »
Check out these 5 games that are a lot l...
So you're in love with Minecraft, but you're looking for something else to play as well? You've come to the right place then, because this list is all about games that are a bit like Minecraft. Some of them, more than others. [Read more] | Read more »
Our top 5 characters from casual RPG Cre...
Creature Quest definitely lives up to its name with a host of collectible creatures based on fantasy tales and world mythologies. To celebrate Creature Quest’s first birthday, we’re going to lay out what we think are the five best characters in the... | Read more »
Around the Empire: What have you missed...
Did you know that Steel Media has a whole swathe of other sites dedicated to all aspects of mobile gaming? Sure you'll get the very best iPhone news, reviews, and opinions right here at 148Apps, but we don't want you missing out on a single piece... | Read more »
All the best games on sale for iPhone an...
Oh hi there, and welcome to our round-up of the best games that are currently on sale for iPhone and iPad. You thought I didn't see you there, did you, skulking behind the bushes? Trust me though, the bushes aren't where the best deals are. The... | Read more »
The Battle of Polytopia Guide - How to H...
A new update just released for The Battle of Polytopia (formerly Super Tribes), which introduces online multiplayer. For all the fans of Midjiwan’s lite take on Civilization, this is certainly welcome news, but playing online isn’t as easy and... | Read more »
Here are the very best mobile games to p...
It's Valentine's Day! Did you get loads of cards and chocolates and other tacky, simple expressions of human affection? Did you send out tat because you find it almost impossible to express emotion unless there's a section dedicated to it at your... | Read more »
Florence (Games)
Florence 1.0 Device: iOS Universal Category: Games Price: $2.99, Version: 1.0 (iTunes) Description: Florence is an interactive storybook from the award-winning lead designer of Monument Valley about the heart-racing highs and... | Read more »
Purrfect Date (Games)
Purrfect Date 1.0 Device: iOS Universal Category: Games Price: $4.99, Version: 1.0 (iTunes) Description: Cats are a lil’ like marmite. Either you absolutely head-over-heels love’ em, or… nahhh, who are we kidding?! Everyone... | Read more »
More monsters to collect and evolve in C...
A laid-back mix of RPG and TCG, Creature Quest is all about building your deck, evolving your creatures and winning in battle. It’s the creation of VC Mobile, set up by Might and Magic producer Jon Van Caneghem. There are elements of that classic... | Read more »

Price Scanner via MacPrices.net

Apple refurbished Mac minis in stock again st...
Apple has restocked Certified Refurbished Mac minis starting at $419. Apple’s one-year warranty is included with each mini, and shipping is free: – 1.4GHz Mac mini: $419 $80 off MSRP – 2.6GHz Mac... Read more
Tuesday MacBook Deals: $250 off 15″ 2.9GHz Ma...
Adorama has the Silver 15″ 2.9GHz Apple MacBook Pro on sale today for $250 off MSRP. Shipping is free, and Adorama charges sales tax for residents in NY & NJ only: – 15″ 2.9GHz Silver MacBook Pro... Read more
Save up to $350 with these Apple Certified Re...
Apple has a full line of Certified Refurbished iMacs available for up to $350 off original MSRP. Apple’s one-year warranty is standard, and shipping is free. The following models are available: – 27... Read more
B&H offers $200 discount on Silver 15″ Ma...
B&H Photo has Silver 15″ Apple MacBook Pros on sale for $200 off MSRP. Shipping is free, and B&H charges sales tax for NY & NJ residents only: – 15″ 2.8GHz Touch Bar MacBook Pro Silver (... Read more
12″ Apple iPad Pro Sale of the Year! Models u...
B&H Photo has 12″ #iPad Pros on sale for up to $150 off MSRP. Shipping is free, and B&H charges sales tax in NY & NJ only: – 12″ 64GB WiFi iPad Pro: $719 $80 off MSRP – 12″ 256GB WiFi... Read more
Deals on 32GB 9″ iPads: Up to $50 off MSRP, s...
B&H Photo has 2017 9.7″ 32GB iPads on sale for $299 including free shipping plus NY & NJ sales tax only. Their price is $30 off MSRP, and it’s currently the lowest price available for these... Read more
15″ 2.2GHz Retina MacBook Pro available for o...
Apple has Certified Refurbished 15″ 2.2GHz Retina MacBook Pros available for $1699. That’s $300 off MSRP for this model, and it’s the lowest price available for a 15″ MacBook Pro currently offered by... Read more
13″ 3.1GHz/256GB Silver Touch Bar MacBook Pro...
Amazon has the Silver 13″ 3.1GHz/256GB Touch Bar MacBook Pro (MPXX2LL/A) on sale for $1649.99 including free shipping. Their price is $150 off MSRP, and it’s the lowest price available for a new 13″... Read more
Saturday Sale: Amazon offers 13″ 1.8GHz/256GB...
Amazon has the 13″ 1.8GHz/256B Apple MacBook Air on sale today for $250 off MSRP including free shipping: – 13″ 1.8GHz/256GB MacBook Air (MQD42LL/A): $949.99, $250 off MSRP Their price is the lowest... Read more
Roundup of Apple Certified Refurbished 12″ Ma...
Apple has Certified Refurbished 2017 12″ Retina MacBooks available for $200-$240 off the cost of new models. Apple will include a standard one-year warranty with each MacBook, and shipping is free.... Read more

Jobs Board

*Apple* Retail - Multiple Positions - Apple,...
Job Description: Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
Strategist, *Apple* Media Products, Content...
# Strategist, Apple Media Products, Content and Marketing Job Number: 113399632 Santa Clara Valley, California, United States Posted: 20-Feb-2018 Weekly Hours: 40.00 Read more
*Apple* Store Leader - Retail District Manag...
Job Description:Job SummaryAs more and more people discover Apple , they visit our retail stores seeking ways to incorporate our products into their lives. It's your Read more
*Apple* Retail - Multiple Positions - Apple,...
Job Description:SalesSpecialist - Retail Customer Service and SalesTransform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
*Apple* Retail - Multiple Positions - Apple,...
Job Description: Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.