3

I have multiple Macs (for multiple users) backing up to a single Time Capsule over our network with an external USB drive connected. In the case of the backups saved to the external drive, they're all saved in the drive's root directory.

My Time Capsule is protected with user accounts, and each user has their own account.

I'd like to configure Time Machine such that each user can only see their own backup file on the Time Capsule, not those of other users, when they open the Time Capsule in Finder.

I'm aware that there's an option to encrypt backups in Time Machine setup, but the language around it suggests that the entire disk will be encrypted with a single password; I don't want to do this. I simply want each user to only be able to see their own backup file when they open the Time Capsule in Finder, and I want them to be able to log into the Time Capsule with their own username and password.

Is this the actual functionality of encrypting backups? If not, is there another way I can accomplish this?

Improve this question
2
  • The problem with user accounts in a Time Capsule is that it controls access to the disk and does not map those users onto file permissions for folders and files. You'll need OSX server.app or similar to implement that level of ACL and permissions control.
    – bmike ♦
    Feb 12, 2014 at 16:06
  • Also - there are lots of ways to accomplish this. The main issue is can each user see the other's files directly on the Mac they share? If they have admin rights or remote log in - you might need to secure that first and then see if your backup needs any changes once that is done.
    – bmike ♦
    Feb 12, 2014 at 16:26

1 Answer 1

Reset to default
2

Apple tried encrypting each user's files in FileVault 1 and did away with that when FileVault 2 arrived.

The easy/recommended way to do this is make no user an admin so that they cannot get around the prohibition to look at other user files. Also, you will have to physically secure the backup drive or trust that no one breaks the policy to not access that drive.

One easy thing you could do is have each Mac encrypt the backups by ticking that switch to prevent some users from seeing files from another computer but that won't prevent same computer users that are admin and know what to type. The downside there is for several computers managing the passwords becomes onerous to a less than ideal step up in privacy.

I would recommend you set up storage on a Mac mini server and have it serve up Time machine to each Mac so that you can control access better than using TimeCapsule. The performance will go up substantially along with the cost. The setup is fairly easy and there are inexpensive books to guide you if needed. AppleCare also supports server so hat is extremely inexpensive for three years of phone support for enterprise caliber support.

Improve this answer
5
  • 1
    That's an extremely exhaustive explanation for the issue. Thank you so much! So what I was going for was to have each user encrypt their backup image with their own username and password, such that they can't see other users' backup images. Will ticking "Encrypt backups" do this? Will it allow each mac backing up to the Time Machine to have their own password to encrypt the file with?
    – Argus9
    Feb 12, 2014 at 16:14
  • What you describe would be awesome - it's how the original file vault worked. It's not how the encrypt option now works. It sets one password for the image of each Mac. So if users A, B and C shared one Mac - their files would all be encrypted with the same passphrase on the disk. Now, if you stored that password in the system keychain, they should not be able to see each other's files without an admin user/password to override the built in protections.
    – bmike ♦
    Feb 12, 2014 at 16:25
  • 1
    Sorry Mike, I meant users on the Time Capsule, not on each Mac. Let me re-phrase: Each mac that we're backing up is used by only one person. I'd just like to make it where each mac is unable to see the backup images of other macs on the Time Capsule, but also that they are still able to log in to the Time Capsule with their own username and password (as set in the Time Capsule options in AirPort Utility). From your response it sounds like this is exactly what will happen - can you please confirm?
    – Argus9
    Feb 12, 2014 at 16:43
  • Yes - ticking the encrypted backups option will isolate files on the share. Anyone with credentials could download the entire backup, but would have to break the encryption to actually mount and look at the contents. I didn't realize I was complicating your case by addressing multiple users per single Mac.
    – bmike ♦
    Feb 12, 2014 at 17:46
  • Not at all Mike - it's kind of confusing when you're talking about different kinds of users. Thanks a lot for helping out a Mac noob. :) If I had the 15 rep I'd upvote this answer.
    – Argus9
    Feb 12, 2014 at 21:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .