TweetFollow Us on Twitter

MacEnterprise: FileVault in the Enterprise, Part 2

Volume Number: 24 (2008)
Issue Number: 09
Column Tag: MacEnterprise

MacEnterprise: FileVault in the Enterprise, Part 2

Data security for OS X administrators

By Greg Neagle, MacEnterprise.org

Previously in MacTech

Data security is a hot topic in Enterprise IT these days. As laptop usage increases, pushing out traditional desktops, the risk to company data is greater than ever. If a laptop is stolen or lost, the replacement cost of the hardware may be a pittance compared to the value of the data stored on the laptop's hard drive.

Therefore many companies are mandating some sort of data encryption for company laptops. If a laptop is then stolen or lost, the data would be inaccessible to the thief. "Whole–disk encryption" is a direction many companies are moving toward, but as of this writing, there are no shipping products that will encrypt a Mac boot volume. So Mac administrators must work with what is available: a technology Apple calls "FileVault," which secures users' home directories with AES–128 encryption.

In part one of this series, we covered preparation and implementation of FileVault in an enterprise environment.

In this installment, we'll examine some of the issues you may encounter when implementing and supporting FileVault in an enterprise environment, and techniques and tools to use to deal with some of these issues.

Living with FileVault

Once encrypted, a FileVault–protected home directory is relatively transparent in operation to the user when he or she logs in. The main clue you'll see when using a FileVault–protected account is the FileVault icon replaces the "normal" home icon in the Finder.

It's important to realize that while the user is logged in, any other user that has access to the machine (either physically or over the network, say via SSH) and that has root or sudo privileges can still access the files in the user's home directory. This can be a good thing, or a bad thing, depending on your point of view. Only when the user is logged out are the files inaccessible, because the encrypted disk image is unmounted.


FileVault–protected home directory in the Users folder

This points out a security hole: what if a laptop is stolen while the user is logged in? In fact, this is a very likely scenario many users rarely log out or shut down; instead they simply put the machine to sleep by closing the lid. If a machine is stolen in such a state, the FileVault disk image is unencrypted and mounted, so the user's files are accessible.

To close this security hole, you'll want to enforce the Require password to wake this computer from sleep or screen saver setting found in the Security preference pane.


Security preference pane

This setting can be enforced using MCX policy. If a thief were to take a laptop configured in this manner, the password request would prevent them from accessing the logged–in user's files.

FileVault Issues

Some applications may behave poorly with FileVault–encrypted home directories. Some examples:

Final Draft 7 would crash at startup when launched from a FileVault–protected account; this was fixed in version 7.1.3:

http://media.finaldraft.com/downloads/readme_fd713.txt

  • Some Automator actions fail on FileVault–protected accounts:

    http://www.macosxhints.com/article.php?story=20051020203919140

    iMovie and GarageBand have known performance issues with FileVault home directories:

    http://docs.info.apple.com/article.html?artnum=93460

    http://docs.info.apple.com/article.html?artnum=42964

    http://docs.info.apple.com/article.html?artnum=93699

    http://docs.info.apple.com/article.html?artnum=93618

    http://docs.info.apple.com/article.html?path=GarageBand/4.0/en/6567.html

    FinalCut Pro and Express have performance issues as well:

    http://docs.info.apple.com/article.html?artnum=93454

    Other applications that need high–performance disk access may be similarly affected.

    There are certainly other applications that have issues. Be sure to test the important applications you use.

    In most cases, there are workarounds for the FileVault issues, but most of the workarounds open up data security issues once again, as they rely on moving data to a non–encrypted part of the disk. You'll need to decide how to handle this.

    Reclaiming unused space

    In 10.4 (Tiger), FileVault makes use of what Apple calls "Encrypted Sparse Disk Images"; the image files are very space–efficient. But as items are added and deleted, these image files can grow bigger than they need to be and some housekeeping must be done to recover unused space. If this is not done, eventually the disk image file will grow to fill all available hard drive space. Periodically at logout, the user is notified that the image is using more space than is needed and asks for permission to recover the unused space. If the user is in a hurry to shutdown, restart, or log back in, they can cancel this housekeeping task – but they shouldn't put it off forever! Depending on the size of the home directory and the amount of recoverable space, recovery can be quite fast, or take a very long time. Train your users to treat the computer with kid gloves during the space recovery – if they were to get impatient and turn off the computer or force a restart during the recovery process, they could corrupt the disk image, which could then lead to total loss of the home directory contents!

    With 10.5, the user experience is improved. FileVault now makes use of "sparsebundles", in which the disk image data is kept in a collection of files inside an enclosing directory. This revised format has several advantages, but the one relevant here is that unused space recovery is much, much faster. In fact, it's so fast that Apple no longer asks at logout if you want to reclaim unused space it just goes ahead and does it at each logout.

    A related issue: a user sees their hard drive is getting too full. They delete a bunch of files from their home directory and empty the trash. They are confused when there is no change in the available space on the hard drive. This is because the space is not reclaimed from the disk image file until logout (and, in Tiger, after the user agrees). Your support staff should be made aware of this issue, as it can cause much confusion.

    Recovering from a lost FileVault password

    If the user forgets their password, or changes their login password in a way that doesn't also update the FileVault password, they may find themselves locked out of their FileVault home directory. If you have the FileVault master password (and keychain), you can reset the password on the FileVault disk image.

    If password hints are turned on, after three unsuccessful attempts, a password hint will be shown, if one is set for the user's account. If there is no user password hint, or the user still enters an incorrect password, the login window will change, showing text directing the user (or an administrator) to enter the FileVault master password to reset the user's password and to unlock FileVault.

    In practice, I've found this to work only with purely local accounts protected with FileVault. Mobile accounts (those with Portable Home Directories) never show a password hint or the Master Password prompt, at least when testing in my environment. Fortunately, there is another way to unlock a FileVault–protected home directory: via the command line.

    Command–line FileVault Recovery

    Here's how to change the FileVault password from the command line. Log in as root, or with an account that has sudo privileges to act as root (Admin accounts by default on OS X have this ability). Watch the line breaks in the example below, all commands are entered as one single line:

    [mbp:~] gneagle% sudo security unlock–keychain /Library/Keychains/FileVaultMaster.keychain
    password to unlock /Library/Keychains/FileVaultMaster.keychain: 
    <enter FileVault master password>
    [mbp:~] gneagle% sudo hdiutil chpass /Users/someuser/someuser.sparseimage –recover /Library/Keychains/FileVaultMaster.keychain newstdinpass
    Enter new disk image passphrase:
    <enter your desired password>

    Be careful, as you are not prompted to confirm the new password. If you make a mistake, just run hdiutil chpass again.

    Leopard improvements

    A common scenario requiring the FileVault password to be changed is when the user changes their login password by some method other than the Mac OS X Accounts preference pane. For example, many organizations provide a web page to change network passwords. If a user changes their network account password in this manner, the FileVault password cannot be updated. The same issue occurs if the user uses multiple machines and changes their password on a machine other than the one with the FileVault–protected home directory.

    Under Tiger, this password mismatch almost always required administrator assistance to recover from. Leopard makes users' and administrators' lives easier in this regard: if a user authenticates at the login window with their correct network credentials, but the FileVault disk image cannot be unlocked with the current network password, the OS will now display a dialog asking the user to enter their previous login password. If the entered password can unlock the FileVault disk image, the disk image password is updated, and the user is able to login.

    Miscellaneous trivia

    You may have a need to determine if FileVault is turned on for a particular user of a machine. Since waiting for the user to step away from their machine so you can peek at the Security preferences pane while they are logged in isn't always practical, it's helpful to have another way.

    The most accurate way to determine if FileVault is enabled is to use dscl:

    [mbp:~] gneagle% dscl . read /Users/gneagle HomeDirectory
    HomeDirectory: <home_dir><url>file://localhost/Users/gneagle/gneagle.sparsebundle</url></home_dir>

    Note the file:// URL and the filename ending with ".sparsebundle" (or ".sparseimage" in Tiger). This is your proof positive that the account is using a FileVault–protected home directory.

    You might be a bit confused here. If the sparsebundle (or sparseimage) is stored inside /Users/username, how can it be made available at /Users/username when the user logs in?

    When the user is not logged in, the /Users directory looks something like this:

    [mbp:/Users] root# ls –al
    drwxr–xr–x    7 root    admin   238 May  2 16:01 .
    drwxrwxr–t   46 root    admin  1632 Apr 25 16:14 ..
    –rw–rr    1 root    wheel     0 Sep 23  2007 .localized
    drwxrwxrwt   24 root    wheel   816 Apr 30 14:46 Shared
    drwxrr  115 gneagle staff  3978 May  2 12:28 gneagle

    The gneagle.sparsebundle file is inside the gneagle directory. But once gneagle logs in, the /Users directory looks like this:

    [mbp:/Users] root# ls –al
    drwxr–xr–x    7 root    admin   238 May  2 16:01 .
    drwxrwxr–t   46 root    admin  1632 Apr 25 16:14 ..
    dr–x+   6 gneagle staff   204 Apr 30 12:06 .gneagle
    –rw–rr    1 root    wheel     0 Sep 23  2007 .localized
    drwxrwxrwt   24 root    wheel   816 Apr 30 14:46 Shared
    drwxrr  115 gneagle staff  3978 May  2 12:28 gneagle

    Note the new ".gneagle" directory. Further investigation will show the gneagle.sparsebundle file is now inside the .gneagle directory, and the disk image is mounted on /Users/gneagle:

    [mbp:/Users] root# mount
    /dev/disk0s3 on / (hfs, local, journaled)
    devfs on /dev (devfs, local)
    fdesc on /dev (fdesc, union)
    map –hosts on /net (autofs, automounted)
    map auto_home on /home (autofs, automounted)
    /dev/disk1s2 on /Users/gneagle (hfs, local, nodev, nosuid, journaled)

    So let's put this knowledge to use.

    On rare occasions on Tiger machines, you may encounter a situation where a FileVault–protected user cannot log in. You login to the machine with an admin account, and look in the /Users/username folder, and find the sparseimage file missing! Instead of panicking, you use your hard–earned systems administration knowledge, and you remember to look for a ".username" directory under /Users. You find it, and inside, the username.sparseimage file. You then move the sparseimage file back into the /Users/username directory, remove the /Users/.username directory, and tell the user to try to log in. They succeed, and you are a sysadmin hero.

    What has happened is that the machine crashed while the user was logged in, and the sparseimage file was not moved back into /Users/username, as it would be after a normal logout. When this happens, Tiger does not always fix things after the reboot, so you may need to help things along.

    Wrap–up

    Thus concludes our look at implementing FileVault in an enterprise environment. We've looked at preparation tasks and deployment options. We've identified some common issues and user experiences, and demonstrated some tools and strategies to deal with these. You now have the knowledge to confidently help protect your organization's private data and intellectual property with FileVault's home directory encryption.


    Greg Neagle is a member of the steering committee of the Mac OS X Enterprise Project (macenterprise.org) and is a senior systems engineer at a large animation studio. Greg has been working with the Mac since 1984, and with OS X since its release. He can be reached at gregneagle@mac.com.

  •  

    Community Search:
    MacTech Search:

    Software Updates via MacUpdate

    WhatsApp 0.2.5862 - Desktop client for W...
    WhatsApp is the desktop client for WhatsApp Messenger, a cross-platform mobile messaging app which allows you to exchange messages without having to pay for SMS. WhatsApp Messenger is available for... Read more
    Things 3.1.3 - Elegant personal task man...
    Things is a task management solution that helps to organize your tasks in an elegant and intuitive way. Things combines powerful features with simplicity through the use of tags and its intelligent... Read more
    BetterTouchTool 2.292 - Customize Multi-...
    BetterTouchTool adds many new, fully customizable gestures to the Magic Mouse, Multi-Touch MacBook trackpad, and Magic Trackpad. These gestures are customizable: Magic Mouse: Pinch in / out (zoom... Read more
    Things 3.1.3 - Elegant personal task man...
    Things is a task management solution that helps to organize your tasks in an elegant and intuitive way. Things combines powerful features with simplicity through the use of tags and its intelligent... Read more
    BetterTouchTool 2.292 - Customize Multi-...
    BetterTouchTool adds many new, fully customizable gestures to the Magic Mouse, Multi-Touch MacBook trackpad, and Magic Trackpad. These gestures are customizable: Magic Mouse: Pinch in / out (zoom... Read more
    Bookends 12.8.3 - Reference management a...
    Bookends is a full-featured bibliography/reference and information-management system for students and professionals. Bookends uses the cloud to sync reference libraries on all the Macs you use.... Read more
    Mellel 3.5.5 - The word processor for sc...
    Mellel is the leading word processor for OS X and has been widely considered the industry standard since its inception. Mellel focuses on writers and scholars for technical writing and multilingual... Read more
    Mellel 3.5.5 - The word processor for sc...
    Mellel is the leading word processor for OS X and has been widely considered the industry standard since its inception. Mellel focuses on writers and scholars for technical writing and multilingual... Read more
    Bookends 12.8.3 - Reference management a...
    Bookends is a full-featured bibliography/reference and information-management system for students and professionals. Bookends uses the cloud to sync reference libraries on all the Macs you use.... Read more
    Carbon Copy Cloner 4.1.18 - Easy-to-use...
    Carbon Copy Cloner backups are better than ordinary backups. Suppose the unthinkable happens while you're under deadline to finish a project: your Mac is unresponsive and all you hear is an ominous,... Read more

    4 RPGs like Final Fantasy XV that deserv...
    Square Enix announced another Final Fantasy XV spin-off today - Final Fantasy XV Pocket Edition. This mobile, episodic version of the hit RPG gives the game a chibi-fied makeover. The first episode will be free, followed by 9 more premium episodes... | Read more »
    Guild sieges and soul gems in latest upd...
    Webzen’s MU Origin hit app stores last year, giving fans of fantasy hack-n-slash MMOs like Diablo a new fix to fixate on. This latest update introduces a competitive guild battle, a fresh dungeon challenge, a mini-game and some elemental gems to... | Read more »
    Little Red Lie (Games)
    Little Red Lie 1.0 Device: iOS Universal Category: Games Price: $4.99, Version: 1.0 (iTunes) Description: ARE YOU MORE AFRAID OF POVERTY THAN DEATH? Little Red Lie is a narrative-focused, interactive fiction experience that reduces... | Read more »
    You can now apply to be Clash of Clans...
    Earlier this month, word got out that the Builder, the trusty handiman who tirelessly built every single building inevery singleClash of Clansbase had called it quits. Sick of seeing his work destroyed endless, the Builder has set out for our world... | Read more »
    Meshi Quest beginner's guide - how...
    Meshi Quest is Square Enix's newest free-to-play release, and it's a real charmer. You start off as the head of a sushi restaurant, upgrading your food and equipment as you serve visitors heaping helpings of your delicious meals. As you progress,... | Read more »
    BUST-A-MOVE JOURNEY (Games)
    BUST-A-MOVE JOURNEY 1.0.0 Device: iOS Universal Category: Games Price: $4.99, Version: 1.0.0 (iTunes) Description: BUST-A-MOVE Features:- Shoot bubbles and match 3 or more bubbles of the same color to make them pop!- Complete your... | Read more »
    The best card combos in Clash Royale
    Clash Royale is all about building a deck of units that synergise well. To help you get off to a flying start, we've put together a list of unit combinations that are incredibly effective. Looking for some choice 2v2 combos? Check out our guide. [... | Read more »
    The best 2v2 card combos in Clash Royale
    2v2 is making it's grand return toClash Royalequite soon. 2v2 has quickly become one of the game's most popular gameplay modes, though they still have yet to make it a permanent fixture in the game. 2v2 is exciting and adds some new flavor to... | Read more »
    The best games we played this week - Aug...
    Another busy week has come to a close. We played a lot of excellent games this week and now it's time to look back and reflect on some our favorites. Here are our picks for the week of August 18. [Read more] | Read more »
    War Wings beginner's guide - how to...
    War Wings is the newest project from well-established game maker Miniclip. It's a World War II aerial dogfighting game with loads of different airplane models to unlock and battle. The game offers plenty of single player and multiplayer action. We... | Read more »

    Price Scanner via MacPrices.net

    Sale! 13-inch 2.3GHz MacBook Pros for $100 of...
    B&H Photo has 13″ 2.3GHz MacBook Pros in stock today and on sale for $100 off MSRP including free shipping plus NY & NJ sales tax only: – 13-inch 2.3GHz/128GB Space Gray MacBook Pro (MPXQ2LL... Read more
    2016 MacBook Pros, Apple refurbished, availab...
    Apple has Certified Refurbished 2016 15″ and 13″ MacBook Pros available starting at $1189. An Apple one-year warranty is included with each model, and shipping is free: – 15″ 2.7GHz Touch Bar Space... Read more
    Apple offers Certified Refurbished iPhone 6s...
    Apple has Certified Refurbished unlocked iPhone 6s’s and 6s Plus’s available starting at $449. An Apple one-year warranty is included with each phone, and shipping is free: – 16GB iPhone 6s: $449, $... Read more
    Apple offers Certified Refurbished Pencils fo...
    Apple has Certified Refurbished Apple Pencils available for $85 including free shipping. Their price is $14 off MSRP, and it’s the lowest price available for a Pencil. Read more
    2016 15-inch 2.6GHz Touch Bar MacBook Pro ava...
    B&H Photo has clearance 2016 15″ 2.6GHz MacBook Pros in stock today and on sale for $500 off original MSRP. Shipping is free, and B&H charges NY & NJ sales tax only: – 15″ 2.6GHz Touch... Read more
    21-inch 2.3GHz iMac on sale for $999, save $1...
    Amazon has the new 2017 21″ 2.3GHz iMac (MMQA2LL/A) in stock and on sale for $999.99 including free shipping. Their price is $100 off MSRP, and it’s the lowest price available for this model. Read more
    Free Instant Translator 2.0 App For iOS Relea...
    Mobile application development company, Neoappz has announced the release and immediate availability of Instant Translator 2.0 for iOS devices. Instant Translator is a user-friendly application which... Read more
    2017 15-inch MacBook Pros on sale for $200 of...
    Amazon has 2017 15″ MacBook Pros on sale for $200 off MSRP. Shipping is free: – 15″ 2.8GHz MacBook Pro Space Gray: $2199.99, $200 off MSRP – 15″ 2.8GHz MacBook Pro Silver: $2296, $103 off MSRP – 15″... Read more
    Apple’s 2017 Back to School Promotion: Free B...
    Purchase a new Mac using Apple’s Education discount, and take up to $300 off MSRP. All teachers, students, and staff of any educational institution qualify for the discount. Shipping is free. As part... Read more
    Clearance 2016 12-inch Retina MacBooks, Apple...
    Apple has Certified Refurbished 2016 12″ Retina MacBooks available starting at $1019. Apple will include a standard one-year warranty with each MacBook, and shipping is free. The following... Read more

    Jobs Board

    Development Operations and Site Reliability E...
    Development Operations and Site Reliability Engineer, Apple Payment Gateway Job Number: 57572631 Santa Clara Valley, California, United States Posted: Jul. 27, 2017 Read more
    Frameworks Engineering Manager, *Apple* Wat...
    Frameworks Engineering Manager, Apple Watch Job Number: 41632321 Santa Clara Valley, California, United States Posted: Jun. 15, 2017 Weekly Hours: 40.00 Job Summary Read more
    *Apple* Retail - Multiple Positions - Apple,...
    Job Description: Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
    Development Operations and Site Reliability E...
    Development Operations and Site Reliability Engineer, Apple Payment Gateway Job Number: 57572631 Santa Clara Valley, California, United States Posted: Jul. 27, 2017 Read more
    Frameworks Engineering Manager, *Apple* Wat...
    Frameworks Engineering Manager, Apple Watch Job Number: 41632321 Santa Clara Valley, California, United States Posted: Jun. 15, 2017 Weekly Hours: 40.00 Job Summary Read more
    All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.