0

I use this command to mount an encrypted volume:

hdiutil mount ~/Documents/secret.sparsebundle/

On first use I'm prompted for a password. I then close it either by clicking 'eject' in finder or the matching hdiutil unmount command.

If I try and re-open it using the original command, I'm sometimes granted access without the password challenge. This appears to occur across terminal sessions and (overnight) screen locks.

Is this expected behaviour or a bug? How do I ensure that the passwords are not cached?

  • I've had a look in my keychain and there's no mention of it there. The Mac is only a week old and is pretty close to a fresh install so it was easy going through all the entries. – Damien Sawyer Mar 11 '16 at 0:37
1

From the hdiutil man page:

unmount volume [-force]
            unmount a mounted volume without detaching any associated
            image.  Volume is a /dev entry or mountpoint.  NOTE: unmount
            does NOT detach any disk image associated with the volume.
            Images are attached and detached; volumes are mounted and
            unmounted.  hdiutil mountvol (or diskutil mount) will remount
            a volume that has been unmounted by hdiutil unmount.

The image encryption key isn't discarded until the image is detached, so after hdiutil unmount you'll be able to remount it without supplying the password. Solution: use hdiutil detach (or the eject button in Finder) instead.

  • Thank you! I wasn't aware of detach. There was a fundamental gap in my understanding! – Damien Sawyer Mar 11 '16 at 2:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .