13

Is is possible to enable encryption for a Time Machine target disk with a script or using the command line?

Is an encrypted Time Machine disk really just the same as a normal disk, full-disk-encrypted using FileVault?

I'd like to automate as much as is convenient when installing a Mac for a new user. This includes backups. We're using OS X Mountain Lion.

Additional discoveries:

  • You can ask a target to be encrypted from the Time Machine preferences GUI. This does not make it show up as such using the fdesetup command. It will however list as encrypted using diskutil cs list
  • If first encrypting a drive, the Time Machine prefs GUI will say "Encrypt backups" for that entry. This would support the method suggested below by Rene (except he suggests doing it on an encrypted image placed on a disk).
Improve this question
6
  • I haven't built a complete tool chain, but fdesetup is the tool to encrypt a volume and once that's done, tmutil setdestination would let you set a mounted drive as the destination for time machine.
    – bmike ♦
    Sep 30, 2013 at 14:06
  • You should also be able to choose a sparsebundle with tmutil inheritbackup [machine_directory | sparsebundle], which you have created in advance - maybe encrypted with hdiutil -encryption [AES-128|AES-256]
    – Rene Larsen
    Sep 30, 2013 at 15:32
  • @bmike - To figure out whether File Vault really is the same as Time Machine ecnryption, i encrypted my Time machine target disk using the GUI. While sudo diskutil cs list shows that the volume is now encrypted, sudo fdesetup status tells me FileVault is off.
    – llaurén
    Oct 1, 2013 at 6:48
  • 1
    Keep in mind - file vault means a bootable OS with keys arranged so that one or more user account can decrypt the image at boot time to run the system whereas Time Machine merely uses the same basic encrypted container and core storage layer without respect to user accounts or the entire boot process. Time Machine just needs to mount the volume once the system is already booted.
    – bmike ♦
    Oct 1, 2013 at 11:59
  • I am sorry I do not have an answer for you, but there is some talk in this thread about taking an existing time machine backup and encrypting it. discussions.apple.com/thread/4520699
    – Anil
    Dec 16, 2013 at 22:54

2 Answers 2

Reset to default
3
+50

No, sorry chickpee, I believe you're incorrect.

Is an encrypted Time Machine disk really just the same as a normal disk, full-disk-encrypted using FileVault?

Yes. It is. This would be "FileVault 2" we are talking about, aka CoreStorage, Apple's newish logical volume manager. This is different that the previous TM and FileVault technologies, which are based on AES-encrypted sparse-bundle disk images (which are still used for network backups, etc.). The process that starts in System Preferences (these days) when you enable disk encryption (whether on an external disk, for Time Machine, or on the boot drive for FileVault), provided the disk is suitable, it does an online conversion from a traditional GPT Partition Table to a single monolithic data store, with a very small partition for the CS firmware. Logical volumes (in logical volume groups) are then carved out of this, and these (software) volumes are then HFS formatted and encrypted.

I believe the most straightforward method for doing this would be to:

  • Attach the disk you're going to use, wipe it. Free space or a single HFS+ partition.
  • diskutil cs create/convert (wasn't/was formatted; unimportant) to initialize and add a new LVG
  • diskutil cs createVolume, create a single LV. You could enable encryption at this point, with diskutil cs encryptVolume, if you know the passphrase you're going to use; if not, leave it unencrypted for now.
  • diskutil partitionDisk diskX -- see below -- CS volumes appear as if they are completely autonomous, separate disks, so you partitionDisk.

Then: mount and unlock the volume on your new user's machine. Once the disk is unlocked, there shouldn't be any trouble 'adopting' it for use there. If you want to put it into a config script, I believe it's just something like tmutil -a /Volumes/Foo, tmutil startbackup -ad disk.... This is the part I'm least sure about, but I'm also sure its easily doable. I haven't done this for Time Machine per se my self, but I pre-encrypt disks for FileVault like this all the time, and the OS sort of just knows what to do with if after that.

A properly suitable CS-enabled-disk is going to appear like this in diskutil (although you might not have the third partition on disk0 if it's knows it's not going to be a boot drive:

/dev/disk0
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *251.0 GB   disk0
   1:                        EFI EFI                     209.7 MB   disk0s1
   2:          Apple_CoreStorage                         250.1 GB   disk0s2
   3:                 Apple_Boot Boot OS X               250.0 MB   disk0s3
/dev/disk1
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:                  Apple_HFS Macintosh LV           *249.8 GB   disk1

disk0 will not appear as encrypted, ever, since this is what the volume manager basically has to 'boot' off of. disk1 will be encrypted and will require the passcode to mount.

Improve this answer
1

I'll chance an answer.

Encrypted Time Machine backup isn't the same as FileVault, it's actually the same as selecting "Mac OS Extended ([Case-sensitive], Journaled, encrypted)" in Disk Utility.

So to automate it with an external drive, assuming it is "disk1", I think the following should work (sorry, don't have a spare USB drive around to test on):

diskutil partitionDisk disk1 1 GPT JHFS+ TimeMachine *X*G [X=size of partition]
sudo tmutil setdestination /Volumes/TimeMachine
diskutil cs convert disk1s2 -passphrase *xxxx* [or -stdinpassphrase if you prefer]
Improve this answer
3
  • I'll need to check that when i'm back at work. OSX hasn't been very friendly in telling me that the backups are in fact encrypted.
    – llaurén
    Dec 20, 2013 at 17:04
  • Network-based encrypted time machine backups should be pretty similar too, I think, except creating a new disk image bundle rather than partitioning the disk.
    – drfrogsplat
    Dec 21, 2013 at 6:42
  • <since I don't have enough rep points yet to comment on @G. Nix's answer> Both a boot disk with FileVault 2 enabled AND an encrypted Time Machine backup disk are Core Storage logical volumes...but I think FileVault 2 specifically refers to the full-disk encryption feature where, instead of the user selecting the encryption passphrase, the random recovery key is generated and only the approved user accounts are able to access it at login and decrypt the rest of the disk.
    – chikpee
    Dec 22, 2013 at 5:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .