4

A couple months ago when speaking to an Apple advisor about an unrelated issue, they told me the auto-shutdown was a "security feature". I think I may remember something about it only happening when Filevault is enabled. I know it is intended behavior as per Apple, but as I'm sure we all know, they do not always make the best decisions. If anyone has a solution to disable it, please let me know.

This seems to have been introduced in OS X Mavericks and has continued through at least OS X El Capitan—and most likely MacOS Sierra. If a Mac is started, and there is no login within a couple minutes, it will shut down after 5 minutes.

This is really bad from a remote perspective. Let's say I reboot the machine using ssh—if I don't reconnect and log in within this short timeframe, the computer will shut down, and then I have no way to connect to it. The only way to start the machine at that point is to have someone at the physical location. I've completely lost remote access to my machine for weeks because of this. This is not something that should happen without an option to disable it.

My only known workaround is to log in before it shuts down and then keep that user logged in. Unfortunately, this opportunity may be lost if restarting and connecting remotely with slow internet speeds. This functionality makes it so I cannot depend on an ssh connection to my machine.

I have tested this again on all three of my Machines. 2 are personal and one is for work which has never had any account transfers or even so much as a remote connection to any of my other machines. It is consistently reproducible on these three entirely different machines and OS versions. They each have shut down from the log in screen exactly 5 minutes after boot. (Again, only after no activity or log-in). That is, completely shut down—not go into sleep mode.

This is consistently reproducible on all three of the Macs in my possession:

  • Mac Pro (Late 2013) - 10.11.6 El Capitan
  • MacBook Pro (17-inch, Early 2011) - 10.10.5 Yosemite
  • MacBook Pro (Retina, 15-inch, Late 2013) - 10.9.5 Mavericks

There are no log messages for the time the auto shut down happens, but here are the times of restart, reboot and the corresponding logs from one of the machines:

  1. Reboot initiated at 9:02:30 AM
  2. Mac had rebooted to login screen at 9:03
  3. Auto shutdown at 9:08 (5 minutes after log in screen visible)
  4. Mac was manually started again at 9:10:41AM

Logs during that time:

2/27/17 9:02:31.291 AM shutdown[1528]: reboot by [username]: 
2/27/17 9:02:31.000 AM kernel[0]: Kext loading now disabled.
2/27/17 9:02:31.000 AM kernel[0]: Kext unloading now disabled.
2/27/17 9:02:31.000 AM kernel[0]: Kext autounloading now disabled.
2/27/17 9:02:31.000 AM kernel[0]: Kernel requests now disabled.
2/27/17 9:02:31.291 AM shutdown[1528]: SHUTDOWN_TIME: 1488204151 290568
2/27/17 9:02:31.291 AM com.apple.xpc.launchd[1]: (com.apple.xpc.launchd.domain.system) System shutdown initiated by: shutdown.1528<-sessionlogoutd.1527<-launchd.1
2/27/17 9:02:31.000 AM kernel[0]: Process launchd [1] disabling system-wide I/O Throttling
2/27/17 9:02:31.000 AM kernel[0]: Process launchd [1] disabling system-wide CPU Throttling
2/27/17 9:10:41.000 AM bootlog[0]: BOOT_TIME 1488204641 0

Is there a way to prevent a Mac from automatically shutting down at the login screen after 5 minutes?

  • The reason is to avoid keeping the decryption key for the disk in memory unnecessary. Once the computer is shut down, the key is unavailable until a user has authenticated so your unattended computer is completely safe from any side-channel (for instance DMA) attacks. When you power it back up, the login screen you see is shown from firmware since the disk cannot be decrypted again until after authentication. – Fuzzy76 Jul 25 '18 at 13:52
1

I have not found a way to disable filevault auto-shutdown, but I have found a way to restart while bypassing the filevault pre-boot login screen (where the auto-shutdown happens). Entering this command in terminal will allow a remote restart without the risk of a shutdown:

sudo fdesetup authrestart

After entering the command and a password for sudo, you will need to enter either the filevault recovery key or a user password for a filevault-enabled user. This password will then be stored in memory and used automatically upon boot to satisfy the filevault authentication requirement. After the disk is decrypted, you will then be taken to the standard post-filevault login screen which doesn't trigger shutdown after 5 minutes.

Additionally, the authrestart command could be set to load a plist file automatically each time the computer is booted to authenticate filevault automatically, but this partially negates the purpose of filevault, and I don't think it's a great idea to store a password in a plist file.

I found this information here.

I'd still like to find a way to disable auto-shutdown permanently, but at least this is a workaround for the remote restart issues.

  • Seems like this is the cause... The only other alternative would be to disable filevault completely. – Fuzzy76 Oct 3 '17 at 6:30
0

Would this work? It's a kludge.

Set up a test user with minimal privilege. Set that user to not auto log out. Require password to disable screen saver.

Login as that user from the desktop. That user being logged in keeps the machine from shutting down.

  • They reboot the machine remotely so that's not likely to work – dstarh Feb 28 '17 at 13:42
  • Correct, dstarh—I can get the same effect from keeping my user logged in, but that will not solve my problem when rebooting. – user1533191 Feb 28 '17 at 20:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .