2

I had set up FileVault 2 encryption while using long&strong user password, and later changed user password to a shorter one. At first time it seemed like everything is working as I expect: OS X asks for long password at power on (because this password was used to encrypt everything), and later I can unlock my gear with shorter password.

But today I noticed that I can use short password even after the system was powered down. This seems very suspicious! Why did it happen and how can I make sure that when powered off, the system is protected by the long password?

I'm using OS X Mavericks 10.9.4.

  • What does your disk setup look like. If you are using file vault on a separate partition other than the system partition or an external hard disk you make have inadvertently saved the long file vault password in your users key chain during one of your mounts. Use spotlight to find keychain access, and look to see if your disk/file vault password is being saved. – Brian Duke Jul 1 '14 at 20:50
  • @user3623501 I have only one disk and one volume in it. Pretty much the default setup in MacBook Pro with 512GB drive. Disk Utility screenshot: ovrload.ru/f/26015_screen_shot_2014-07-02_at_1.55.42_am.png – Sarge Borsch Jul 1 '14 at 21:57
  • @user3623501 I couldn't find anything suspicious in Keychain Access... – Sarge Borsch Jul 1 '14 at 23:12
2

FileVault should use whatever is the current password for your account. When you change your user accounts password, FileVault will be updated with the new password.

We can get what you want — a long FileVault password and a short user account password — by creating two user accounts.

When you first enable FileVault, only the user account that you use to start FileVault will be setup to unlock FileVault. You can use the FileVault System Preferences to add other accounts to unlock FileVault by selecting the user an entering their password.

After FileVault has been enabled, any new users created will automatically allowed to unlocking FileVault.

To achieve your goal of having a very strong FileVault password and an easier to use User password we need to create a User with a strong password specifically to unlock FileVault, and remove all other users from FileVault.

Lets say you have enabled FileVault. Your current account is frank, and you have made frank's user password easy to type.

Now create a new user account betty with a strong password. betty will be automatically added to unlock FileVault, and the only purpose of this account will be for unlocking FileVault, we will not need to actually use the account for anything else.

From the command line, we can list the users who are setup to unlock FileVault:

$ sudo fdesetup list
betty,########-####-####-####-############
frank,########-####-####-####-############

Here the #'s are the UUID

The FileVault System preferences allow you to add accounts to unlock, but you need to use the command line to remove users from this list. Let's remove frank :

$ sudo fdesetup remove -user frank

And verify that worked:

$ sudo fdesetup list
betty,########-####-####-####-############

Now only betty can unlock FileVault. (Well of course, there is also the Recovery Key.)

If you ever add another new user account, you will need to remember to remove them from FileVault.

Also, if you want to make sure that betty is used only for unlocking disk (prevent login), you can disable its ability to login by changing its login shell to /usr/bin/false as described in this answer.

Edit to add:

Check out Using fdesetup with Mountain Lion’s FileVault 2 which provides much detail about the fdesetup command.

  • Works fine, but after unlocking disk with betty this user is also logged in, his desktop shows up, etc., is there a way to prevent this? – Sarge Borsch Oct 16 '14 at 9:30
  • found the answer — this answer can be used to "disable" betty, so after unlocking the disk another user must log in. – Sarge Borsch Oct 16 '14 at 9:40
0

File vault 2 uses a master password(probably your long/strong password), but it also allows for any enabled user to unlock the system drive, strong password or not. The only users that you can't enable to unlock the drive are users with no password.

I remember a while back reading a file vault vulnerability where an attacker would compromise a apple id account and force a password reset on a users account who could unlock a file vault 2 protected system. The attacker would then log in to the system and unlock the protected drive with the new password they previously created.

  • >"but it also allows for any enabled user to unlock the system drive, strong password or not" — is there a way to disable this? – Sarge Borsch Jul 2 '14 at 1:24
  • I did have an installation once that asked for the File Vault Password and then the displayed the user logon screen. From a quick google search I think I achieved this by partitioning, formatting, and encrypting the drive in disk utility first, than doing a clean OS X installation. You can also limit which users are allowed to unlock the drive by going to system preferences->security->filvault, and selecting the button on bottom labeled enable users, if the button is not visible set your password to blank and close/reopen the file vault preference pane. Hope this helps. – Brian Duke Jul 2 '14 at 23:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .