Is there any way for me to protect my home folder and keychain from other users with admin privileges on a single machine?

EDIT: Here's some background on the situation. In my office, we have several shared workstations. Everyone on the development floor has access to a general admin account that we use to maintain the software on the machines. I'd like to be able to personalize an account on the machine, but I worried about leaving myself open to the possibility of the other "admins" accessing my files. (I'm not keeping anything particularly sensitive; just my ssh keys for GitHub, my work Dropbox folder, leaving gmail logged in, etc.)

  • 1
    Define "protect". Local Admins don't have access to files in your home directory without resorting to extraordinary measures. They have no access to the contents of your keychain file unless they know your password.. – jaberg Jan 25 '13 at 18:12
  • @jaberg I was under the impression that my home folder was accessible by other admins; if that isn't the case, that sort of answers my question. – Mathletics Jan 25 '13 at 22:42
  • Your home directory is not accessible to an Administrator via the Finder. An administrator can access files via Terminal if they know the proper incantation. (They probably do.) – jaberg Jan 25 '13 at 22:55
  • @jaberg You mean like cd /Users/mathletics? If that's all it takes, do I have options to keep other admins out of my home folder? – Mathletics Jan 25 '13 at 23:05
  • An admin would need to use sudo to access your files. – jaberg Jan 26 '13 at 4:59

Nobody can get into your keychain without the password.

You may be able to protect your home folder if you are running a version of OS X with the original Filevault, which was introduced in OS X Panther (10.3) and replaced by Filevault2 in Mac OS X Lion (10.7). So if you are running 10.3 through 10.6 then all you have to do is enable Filevault protection. The old version encrypts a user's home folder.

  • 2
    You could also put particularly sensitive files into an encrypted disk image. – jaberg Jan 25 '13 at 18:28
  • The machine is 10.7 now, and will likely be 10.8 soon. That said, it sounds like I was confused about how much access admins have over other accounts. – Mathletics Jan 25 '13 at 22:47

You can store info in the key chain.

You can use disk utility to create a disk image with a password . Disk images work like fiash drives. ( any other disk partition. ) [ don't know the effect of the master password ]

There are other encryption programs around for files.

the administrator would have to use the sudo command or enable root

Macintosh-HD -> Applications -> Utilities -> Terminal

sudo ls -la /Users/your short name

sudo cat /Users/your short name/your file name


It depends on the knownledge of the admin. It is possible to use your files and also the keychain (loged in for example with http://arstechnica.com/security/2012/09/mac-os-x-keychain-pillaging-app/) loged out with your password (it is not really difficult to get it or to set a new one). FileFault 1 and 2 is good but it was hacked and depends who has the master password for it. Also don't forget that their could be a backup before you encrypt it.

  • When was FileVault 2 hacked? – jaberg Jan 25 '13 at 22:56
  • This is only an example link that it works tuaw.com/2012/02/03/… it is not the topic here to show how. The Mac must be running and the key must be in memory - to get software (backdoors, trojans, ... ) on a Mac see google (but works fine using Adobe Flash). – NaWi at Mac Jan 26 '13 at 0:26
  • And encrypted DMG´s are also not save ... georgestarcher.com/?p=228 or Spartan and a nice dictionary file workes fine - but bruteforce attacks need some time. – NaWi at Mac Jan 26 '13 at 0:39
  • This is a rather obscure vulnerability. FileVault 2 is generally considered secure. – jaberg Jan 26 '13 at 5:01
  • I earn my daily money which things like that and it works. You can call it obscure or whatever but the question was to "protect". If you have the required things and knownledge then it is no problem. But you are also right FileVault 2 is save as it is possible (even there is a way in). – NaWi at Mac Jan 26 '13 at 10:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .