TweetFollow Us on Twitter

MacEnterprise: Migrating FileVault

Volume Number: 24
Issue Number: 10
Column Tag: MacEnterprise

MacEnterprise: Migrating FileVault

Moving FileVault-encrypted accounts to a new machine

By Greg Neagle, MacEnterprise.org

Another FileVault challenge

A few issues ago, we looked at implementing FileVault in an enterprise environment. FileVault is Apple's technology for securing the contents of a user's home directory. Your organization may wish to protect its users' data on company laptops, in case a laptop is lost or stolen. Using FileVault is one method to accomplish this goal.

In those earlier issues of MacTech, we looked at preparing for FileVault implementation, turning it on for a given user account, and options for managing, automating, and controlling the use of FileVault in your organization. Later, we looked at dealing with some of the day-to-day issues in dealing with FileVault-protected home directories, and methods for recovering from a lost FileVault password.

Moving FileVault Accounts

One thing not covered in the earlier articles is how you might move a FileVault-protected account and home directory from one machine to another. If you are giving a user a new machine, you may need to move his or her existing account and home directory to the new machine. For reasons best known to Apple, the Migration Assistant is of little help in this task - it refuses to migrate a FileVault user unless there are no other users on the target machine. If you have a machine built from a standard image, you may have one or more prebuilt user accounts, like a local administrative account, on the new machine and so the Migration Assistant refuses to move the FileVault-protected user account.

The advice given by the Migration Assistant is to turn off FileVault, move the account, and turn it back on. While this might work, it is problematic for several reasons:

You'll need the user's password, or at least their cooperation, to turn FileVault off. This requires more coordination between you and the user.

You'll need enough available space on the startup disk to make a duplicate of the contents of the user's FileVault-protected home folder. That space may not be available.

Decrypting and re-encrypting the FileVault-protected home directory can take a long time.

If you are using MCX to enforce FileVault, turning it off (and back on) can present a challenge, as the GUI options are disabled.

So it would be better if we could just move the FileVault-protected account as-is. Fortunately, it can be done, and really isn't that difficult - at least if you aren't afraid of the command line.

Basic Concepts

The basic ideas behind moving the FileVault account are simple:

Recreate the account information on the new machine.

Move the FileVault sparseimage or sparsebundle to the new machine.

Edit the account information to point to the FileVault disk image.

Of course, the devil is in the details. So let's get started!

Recreating the account

If you are using mobile accounts, recreating the account is easy. Just create a new mobile account for the user - either graphically, or via the command line. In Tiger, the relevant command-line tool is MCXCacher, located in

/System/Library/CoreServices/mcxd.app/Contents/Resources/

You call it like so:

cd /System/Library/CoreServices/mcxd.app/Contents/Resources
./MCXCacher -U usershortname

which should create a new mobile account for the network user.

For Leopard, the relevant tool is called createmobileaccount. It is located in /System/Library/CoreServices/ManagedClient.app/Contents/Resources.

It's called like this:

cd /System/Library/CoreServices/ManagedClient.app
cd Contents/Resources
./createmobileaccount -n usershortname

If you aren't using mobile accounts, you can manually recreate the account using the Accounts preferences pane, or the dscl command-line utility, but be sure the shortname, uid, and GeneratedUID of the recreated account match the original. The dscl utility can be of great help here, allowing you to read the appropriate values from the old account and write them to the new one:

oldmac:/ root# dscl . read /Users/localuser uid
dsAttrTypeNative:uid: 4389
newmac:/ root# dscl . create /Users/localuser uid 4389

Another challenge, if you are not using mobile accounts, is copying the stored password from the old account and machine to the new one, but this, too, can be done. The passwords are stored in /private/var/db/shadow/hash. For local accounts, the shadow files are named after the GeneratedUID of the user account:

root# dscl . read /Users/localuser GeneratedUID
GeneratedUID: 1DECD42B-52EB-4B89-B2B2-359F0623EB1F

So for "localuser" above, the password is stored in /private/var/db/shadow/hash/1DECD42B-52EB-4B89-B2B2-359F0623EB1F. To copy the password hash from the old machine to the new one, you'd just copy that file.

Move the FileVault disk image

The next step is easier. All you need to do is copy the FileVault disk image from the old machine to the new one. But first, let's do some prep work. If you recreated the account on the new machine, you may have a folder in /Users that is partially populated. We don't really need the contents of this folder, as we're going to replace it with the FileVault disk image. If your new machine is running Tiger, or you've recreated a purely local user, just remove all the contents:

newmac:/ root# rm -rf /Users/localuser/*

If your new machine is running Leopard, and you have recreated a mobile account, you should keep the .account directory inside the user's home folder. This stores cached account info and is used by the new External Accounts in Leopard.

newmachine:/ root# ls /Users/mobileuser
.CFUserTextEncoding   Movies
.account                     Music
Desktop                     Pictures
Documents                  Public
Downloads                  Sites
Library

You can remove everything else in the user's folder; just leave .account.

Let's look at the old machine for a second. You might see two relevant directories in /Users:

.localuser/
localuser/

If you look inside .localuser/, you'll see the sparseimage/sparsebundle. If you look in localuser/, you'll see an .autodiskmounted file. This happens when the FileVault disk image is not unmounted cleanly. The important bit is that you want to find and copy the sparseimage/sparsebundle, even if it's in a different directory than you were expecting.

One strategy to copy the FileVault disk image is to startup the old machine in FireWire target disk mode, connect it to the new machine, and use sudo cp or ditto to copy the sparseimage/sparsebundle. If you do this, it's probably a good idea to uncheck the "Ignore ownership" box in the Get Info window for the FireWire-connected volume. If you don't do this, you can manually reassign ownership of the FileVault image after the copy.

cp -pvr /Volumes/oldmac/Users/myuser/myuser.sparsebundle \ /Users/myuser/myuser.sparsebundle
chown -R myuser /Users/myuser/myuser.sparsebundle

If you cannot abide the command line, it is possible to do this completely from the Finder, but you'll need to first change the permissions and/or ownership of the various directories so you can read and write. Be sure to change ownership and permissions back when you are done copying.

When you are done copying, you should have a username.sparsebundle or username.sparseimage in /Users/username on the new machine. /Users/username and /Users/username/username.sparsebundle should be owned by username, and the owner should have read, write and execute permissions:

chown -R username /Users/username
chmod -R u+rwX  /Users/username

Editing the new account

We're almost there! We've recreated the account, and we've copied the FileVault disk image. But the recreated account has the wrong value for the HomeDirectory attribute. We need to fix that. While previous steps could be done without using the command line, I'm afraid that for this task you have no choice but to fire up the terminal.

newmac:/ root# dscl . read /Users/myuser HomeDirectory   
No such key: HomeDirectory

For a "normal" non-FileVault encrypted home directory, this attribute does not exist (the NFSHomeDirectory attribute does exist, but that's a different thing...) We need to create this attribute and point it to the FileVault disk image.

dscl . create /Users/myuser HomeDirectory '<home_dir><url>file://localhost/Users/myuser/myuser.sparsebundle</url></home_dir>'

The above command should be all one line. Substitute the correct username for "myuser" and in "myuser.sparsebundle". If the encrypted home directory is in the older FileVault format, substitute "sparseimage" for "sparsebundle".

If you did everything right, the user should now be able to log in on their new machine with their username and password and access their FileVault-encyrpted home directory. And maybe you've learned some things about FileVault, mobile accounts and the Directory Service along the way.

Wrapping up

To review:

We recreated the user account on the new machine, using MCXCacher or createmobileaccount if the account was a mobile account; or manually if it was a local account, ensuring the shortname, uid, and GeneratedUIDs matched.

For local accounts, we copied the shadow password file. (Recreating a mobile account generates this for us automatically)

We copied the FileVault disk image from the old machine to the new one.

We edited the local accounts' HomeDirectory attribute to point to the FileVault disk image.

That was a lot of work - but should have been faster than turning FileVault off, moving the account and data, and then turning it back on. Additionally, the user's password was not needed to move the account and data. Once you get this technique down, you might consider writing a script to do most of it for you, which is, of course, what I've done. Better would be to help persuade Apple to update the Migration Assistant to do this: if we can do it, so could the Migration Assistant!


Greg Neagle is a member of the steering committee of the Mac OS X Enterprise Project (macenterprise.org) and is a senior systems engineer at a large animation studio. Greg has been working with the Mac since 1984, and with OS X since its release. He can be reached at gregneagle@mac.com.

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

Paragraphs 1.0.1 - Writing tool just for...
Paragraphs is an app just for writers. It was built for one thing and one thing only: writing. It gives you everything you need to create brilliant prose and does away with the rest. Everything in... Read more
BlueStacks App Player 0.9.21 - Run Andro...
BlueStacks App Player lets you run your Android apps fast and fullscreen on your Mac. Version 0.9.21: Note: Now requires OS X 10.8 or later running on a 64-bit Intel processor. Initial stable... Read more
Apple iTunes 12.2 - Play Apple Music...
Apple iTunes lets you organize and stream Apple Music, download and watch video and listen to Podcasts. It can automatically download new music, app, and book purchases across all your devices and... Read more
Apple Security Update 2015-005 - For OS...
Apple Security Update 2015-005 is recommended for all users and improves the security of OS X. For detailed information about the security content of this update, please visit: http://support.apple.... Read more
Apple HP Printer Drivers 3.1 - For OS X...
Apple HP Printer Drivers includes the latest HP printing and scanning software for OS X Lion or later. For information about supported printer models, see this page. Version 3.1: The latest printing... Read more
Epson Printer Drivers 3.1 - For OS X 10....
Epson Printer Drivers installs the latest software for your EPSON printer or scanner for OS X Yosemite, OS X Mavericks, OS X Mountain Lion, and OS X Lion. For more information about printing and... Read more
Xcode 6.4 - Integrated development envir...
Xcode provides everything developers need to create great applications for Mac, iPhone, and iPad. Xcode brings user interface design, coding, testing, and debugging into a united workflow. The Xcode... Read more
OS X Yosemite 10.10.4 - Apple's lat...
OS X Yosemite is Apple's newest operating system for Mac. An elegant design that feels entirely fresh, yet inherently familiar. The apps you use every day, enhanced with new features. And a... Read more
Dash 3.0.2 - Instant search and offline...
Dash is an API Documentation Browser and Code Snippet Manager. Dash helps you store snippets of code, as well as instantly search and browse documentation for almost any API you might use (for a full... Read more
FontExplorer X Pro 5.0 - Font management...
FontExplorer X Pro is optimized for professional use; it's the solution that gives you the power you need to manage all your fonts. Now you can more easily manage, activate and organize your... Read more

Heroki (Games)
Heroki 1.0 Device: iOS Universal Category: Games Price: $7.99, Version: 1.0 (iTunes) Description: CLEAR THE SKIES FOR A NEW HERO!The peaceful sky village of Levantia is in danger! The dastardly Dr. N. Forchin and his accomplice,... | Read more »
Hands-On With Raceline CC
Set for release soon, Rebellion’s motorbike racing game, Raceline CC certainly looks stylish. But how does it play? I got my hands on a preview build to answer exactly that. | Read more »
Siegefall - Tips, Tricks, and Strategies...
So, you fancy establishing a base and ruling the world again. Siegefall is a convenient place to do that, but how about some great tips and tricks on how best to go about it? Here are a few ideas on how to get ahead as a beginner to this medieval... | Read more »
The WWE Comes to Racing Rivals - Because...
Racing Rivals is a racing game that's all about, well, rivalry. And who knows rivalry better than WWE superstars (shhhh, that was rhetorical)? [Read more] | Read more »
Hey, Who Put Apple Music in My SoundHoun...
One of the App Store's popular music discovery sources - SoundHound - has already been updated to include Apple's own music discovery source - Apple Music. That was fast! [Read more] | Read more »
Arcane Legends has a New Expansion Calle...
Arcane Legends has been going strong since it debuted at the tail end of 2012. So well, in fact, that it's already up to its sixth expansion. [Read more] | Read more »
Vector 2 is Officially a Thing and it...
Vector is a pretty cool parkour-driven runner that's gotten a pretty decent following since it first came out - although personally I think more people could stand to show it some love. Anyway, Nekki has announced that a sequel isofficially on its... | Read more »
Get Ready to Trucksform and Roll Out (an...
It looks like NuOxygen is bringing the truck-transforming racer Trucksform (get it?) to iOS in a couple of weeks. Although really it's more of an auto-driver than a racer. But still, transforming trucks! [Read more] | Read more »
This Week at 148Apps:June 22-26, 2015
June's Summer Journey Continues With 148Apps How do you know what apps are worth your time and money? Just look to the review team at 148Apps. We sort through the chaos and find the apps you're looking for. The ones we love become Editor’s Choice,... | Read more »
LEGO® Minifigures Online (Games)
LEGO® Minifigures Online 1.0.1 Device: iOS iPhone Category: Games Price: $4.99, Version: 1.0.1 (iTunes) Description: | Read more »

Price Scanner via MacPrices.net

Logo Pop Free Vector Logo Design App For OS X...
128bit Technologies has released of Logo Pop Free 1.2 for Mac OS X, a vector based, full-fledged, logo design app available exclusively on the Mac App Store for the agreeable price of absolutely free... Read more
21-inch 1.4GHz iMac on sale for $999, save $1...
B&H Photo has new 21″ 1.4GHz iMac on sale for $999 including free shipping plus NY sales tax only. Their price is $100 off MSRP. Best Buy has the 21″ 1.4GHz iMac on sale for $999.99 on their... Read more
16GB iPad mini 3 on sale for $339, save $60
B&H Photo has the 16GB iPad mini 3 WiFi on sale for $339 including free shipping plus NY tax only. Their price is $60 off MSRP. Read more
Save up to $40 on iPad Air 2, NY tax only, fr...
B&H Photo has iPad Air 2s on sale for up to $40 off MSRP including free shipping plus NY sales tax only: - 16GB iPad Air 2 WiFi: $489 $10 off - 64GB iPad Air 2 WiFi: $559 $40 off - 128GB iPad Air... Read more
Apple Releases OS X 10.10.4 With WIFi Fix, iO...
On Tuesday, Apple released final versions of OS X 10.10.4 and iOS 8.4, as well as updates for the Safari browser for OS X Yosemite, Mavericks, and Mountain Lion. The OS X 10.10.4 update focuses on... Read more
Dual-Band High-Gain Antennas for Home Wi-Fi N...
Linksys has announced what it claims are the first dual-band, omni-directional high-gain antennas for the consumer market. The new Linksys high-gain antennas available in a 2- and 4-pack (WRT004ANT... Read more
Apple refurbished 2014 15-inch Retina MacBook...
The Apple Store has Apple Certified Refurbished 2014 15″ 2.2GHz Retina MacBook Pros available for $1609, $390 off original MSRP. Apple’s one-year warranty is included, and shipping is free. They have... Read more
Clearance 2014 MacBook Airs available for up...
Adorama has 2014 MacBook Airs on sale for up to $301 off original MSRP including NY + NJ sales tax and free shipping: - 11″ 256GB MacBook Air: $798 $301 off original MSRP - 13″ 128GB MacBook Air: $... Read more
5K iMacs on sale for $100 off MSRP, free ship...
B&H Photo has the new 27″ 3.3GHz 5K iMac on sale for $1899.99 including free shipping plus NY tax only. Their price is $100 off MSRP. They have the 27″ 3.5GHz 5K iMac on sale for $2199, also $100... Read more
27-inch 3.2GHz iMac on sale for $1679, save $...
B&H Photo has the 27″ 3.2GHz iMac on sale for $1679.99 including free shipping plus NY sales tax only. Their price is $120 off MSRP. Read more

Jobs Board

*Apple* TV Live Streaming Frameworks Test En...
**Job Summary** Work and contribute towards the engineering of Apple 's state-of-the-art products involving video, audio, and graphics in Interactive Media Group (IMG) at Read more
Project Manager, WW *Apple* Fulfillment Ope...
…a senior project manager / business analyst to work within our Worldwide Apple Fulfillment Operations and the Business Process Re-engineering team. This role will work Read more
Senior Data Scientist, *Apple* Retail - Onl...
**Job Summary** Apple Retail - Online sells Apple products to customers around the world. In addition to selling Apple products with unique services such as iPad Read more
*Apple* Music Producer - Apple (United State...
**Job Summary** Apple Music seeks a Producer to help shepherd some of the most important content and editorial initiatives within the music app, with a particular focus Read more
Sr. Technical Services Consultant, *Apple*...
**Job Summary** Apple Professional Services (APS) has an opening for a senior technical position that contributes to Apple 's efforts for strategic and transactional Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.