4

I have enabled File Vault in Lion on a shared computer with several user accounts. Is it possible to encrypt each user home directory such that other users cannot access their data? As it stands, I can go on the terminal and (using sudo) access all the files in all accounts. I'd like to be able to prevent this.

  • 1
    Do you want to prevent root to view user homes? Or do you want to prevent other users to get root rights? – Matteo Sep 16 '11 at 14:14
  • I basically want the home folders to be encrypted to root also, unless they knew the password to decrypt. I presume this isn't possible? – Olly Sep 23 '11 at 17:15
  • No really, if the owner have to access them they will be mounted and readable by the user (the owner) and root. – Matteo Sep 24 '11 at 15:27
1

It's easier to just have each user store their private information in encrypted disk images since the old Filevault (1) method of encrypting the entire home folder isn't something you can set up on Lion with easy tools.

Lion does still support it, so you could migrate in a shell system that had the necessary accounts set up to use file vault, then encrypt the drive and finally move in the files from a backup external drive and presumably have both the legacy filevault storage scheme as well as the new scheme where the entire disk is unavailable until the drive password is entered.

Keep in mind - root (and any admin user that knows sudo) has total control of the system and can delete, remove any protection that was set by root. Using encryption with a distinct password is the only method to prevent root from actually making sense of the files it can easily access.

  • 1
    I already mentioned this to the asker and also suggested disabling su or editing sudoers. I was rewarded with two negative votes. Apparently browsing user homes is only important. – l'L'l Sep 16 '11 at 15:34
  • Your tips are great - I'd love to see it undeleted. I don't want your rep to suffer, but I would have voted it up and it contains AWESOME information that over time should get many more positive votes than the initial rush of negative ones. Your call, though. – bmike Sep 16 '11 at 15:51
  • Just so you know - reputation gets recalculated all the time (daily if you don't do it by adding /recalculate at the end of your account URL) - if you delete any answer - you lose any points you got from it, but you also regain any points you lost. I'd say give it a week and do what feels right... – bmike Sep 16 '11 at 16:10
1

As you know - the root user can undo anything that another admin/root does, but since all calls to sudo are logged, so you could use that to deter and detect access. If you only need to discourage idle copying/browsing, the command below will restrict access to all but the root user and the owner of the directory.

sudo chmod go-rx /Users/username

Unless you are going to physically restrain the mac (to prevent access to the insides) and use a firmware password to prevent booting from an alternate OS where the "bad actor" can bypass all account restrictions and permissions, you'll need to consider installing Truecrypt or another actual encryption tool. It has a plethora of options to encrypt files, folders, entire hard drives, etc.

Also, for other hardening tips refer to this NSA document:

http://www.nsa.gov/ia/_files/factsheets/macosx_hardening_tips.pdf

The advantage of this over the legacy Filevault is it's more likely to be supported going forward and all of your encryption eggs are not stored in Apple's basket using just Filevault.

  • 2
    That won't work if any of the users have Administrator privilege, because they can sudo to root and then su to any other user's account. – Mike Scott Sep 16 '11 at 13:45
  • Yes, I just tried it. sudo chmod go-rx /Users/username then sudo -s then su - username and I can see all the files in that user's account. – Mike Scott Sep 16 '11 at 13:52
  • 1
    Of course root can see anything that root hid. I'll edit ioi's post to make that clearer :-) The reason root is disabled is so there is a log of everyone that becomes root. You can audit those logs in most instances where you trust the people, but want to remind them to mind their own business. The NSA article / Truecrypt are great for cases where you don't have that trust and can't afford a breach - even if you know of it later. – bmike Sep 16 '11 at 16:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .