1

How may I encrypt my home folder without using Apple FileVault? Is it possible to create an image of the user folder with DiskImage and mount that as home folder? How to make this.

PS: I can't use Apple FileVault (or at least I couldn't get it to work with a remote connection to OS X Server). I don't want to use any additional software. It has to work with onboard utilities.

5
  • apple.stackexchange.com/questions/99646/… seems to cover the same topic, does this help?
    – nohillside
    Sep 9, 2015 at 6:42
  • Let's stick to the problem of encrypting your home folder. If you want help in solving your remote connection issues to OS X Server, please ask a separate question for this.
    – nohillside
    Sep 9, 2015 at 6:43
  • Hi patrix, thank you for the url. O.K. I have understand i can make a DiskImage but how can I mount this as my home folder (/Users/thisfolder)? I have ask a new question to get up and running with File Vault in the Server Version of 10.10.5. Apple Screen Sharing must work but I have no idee to get this work.
    – sm_a
    Sep 9, 2015 at 7:11
  • Problem with encrypting your whole home folder is that sometime during the login process you need to be able to enter the passphrase of the encrypted image (Keychain doesn't help because it is stored within ~/Library). Would it be enough to just encrypt Documents?
    – nohillside
    Sep 9, 2015 at 7:15
  • Thanks for your help patrix. It must the complete home folder (/Users/myuser) while I have in it ssh keys and much more data that must be secured. Greetings Sven
    – sm_a
    Sep 9, 2015 at 7:30

1 Answer 1

2

I do this on my own Mac at home with scripts that run at boot and mount a Core Storage volume. I'm on 10.11.6, but the same principles should apply.

To be clear, FileVault is much simpler, but it is possible to do what you ask. I went down a rabbit hole to get an encrypted $HOME working, and so I still use it, but FileVault is superior in just about every way.

I wrote up an article detailing how I did this. I'd post the vital steps here, but it is a fairly long and involved process.

Here's the gist of it. You need to do the following:

  1. Format a USB drive
  2. Add a keyfile (max 1023 chars) to that drive
  3. Create a core storage volume somewhere
  4. Encrypt that core storage volume with your keyfile
  5. Migrate files to your new encrypted home
  6. Create a Launchd task that runs a mount script on boot
  7. Create that mount script.
    1. The mount script will read the keyfile from your USB drive
    2. The mount script will attempt to unlock your core storage volume using the contents of the keyfile
    3. The mount script must unmount the core storage volume from /Volumes
    4. The mount script must mount the core storage volume to /Users
  8. Unmount the USB drive so the keyfile isn't just sitting there

It took me a lot of trial and error.

There are probably ways to improve my steps like using an exported keychain rather than a plain text keyfile. You could probably also re-define the location of $HOME for your user in System Preferences, but I opted to mount the encrypted home over the normal home so that the path would be standard.

I tried changing $HOME to /Volumes/THE_ENCRYPTED_DRIVE, but I immediately noticed things like my iTunes library were messed up. All the library file references were stale and needed to be updated. That's an example of how screwing with $HOME can get messy.

Really, FileVault would be way easier if you can get it going. If FileVault is not an option, you should check out VeraCrypt, which is a fork of TrueCrypt that was recently audited and seems legit.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .