1

I am considering enabling File Vault 2 on my Macbook Pro, which frequently stays at work overnight, and which I often need to log into remotely using ssh. What are the ramifications of using File Vault 2 for a machine that needs to receive ssh connections? Specifically,

  • Will I need to stay logged into my user account overnight, or will I still be able to sign out and leave the machine at the login screen when I leave?

  • Can the machine sleep without requiring keyboard authentication for File Vault 2 when it wakes up? Right now, I allow the machine to sleep and utilize "Wake for network access". Will this still be possible with File Vault 2 enabled, or will I need to prevent it from sleeping?

(I'll note that I'm aware of the sudo fdesetup authrestart option to restart the machine from remote without physically being there, which is helpful only if these other issues are not a problem.)

Improve this question

2 Answers 2

Reset to default
2

The only time the machine will need the filevault key to unlock is at boot, at all other times the system is effectively decrypted with the key in ram.

As soon as the machine powered off, it will be locked again.

You do not need to be logged in, and waking the machine up from sleep is no issue.

Improve this answer
2
  • So basically as long as I don't utilize pmset's destroyfvkeyonstandby option, the key will remain in memory, even during sleep? It seems then that I will have to sacrifice some security (e.g. a cold boot attack will be possible if someone breaks into the office overnight) for the convenience of having the machine available for ssh.
    – JCOidl
    Commented Jun 6, 2013 at 17:43
  • @JCOidl I wouldn't quite call it a sacrifice, as you have you go well out of your way to enable it. (but if you do enable it, you will want the forced hibernation on sleep) But yes, as long as you don't turn that on, normal mac operation does not need the key unless you are booting.
    – demure
    Commented Jun 6, 2013 at 17:48
0

With ssh you can remotely login:

  • before a local login
  • after a local log out.

If you have the home directory on a volume that's separate from the startup volume. you could use Core Storage to encrypt only what's required (allow the Mac to restart without authentication). If you take this approach then you should be prepared to remotely unlock the volume with diskutil(8).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .