0

Is there any way for me to protect my home folder and keychain from other users with admin privileges on a single machine?

EDIT: Here's some background on the situation. In my office, we have several shared workstations. Everyone on the development floor has access to a general admin account that we use to maintain the software on the machines. I'd like to be able to personalize an account on the machine, but I worried about leaving myself open to the possibility of the other "admins" accessing my files. (I'm not keeping anything particularly sensitive; just my ssh keys for GitHub, my work Dropbox folder, leaving gmail logged in, etc.)

Improve this question
6
  • 1
    Define "protect". Local Admins don't have access to files in your home directory without resorting to extraordinary measures. They have no access to the contents of your keychain file unless they know your password..
    – jaberg
    Jan 25, 2013 at 18:12
  • @jaberg I was under the impression that my home folder was accessible by other admins; if that isn't the case, that sort of answers my question.
    – Evan Davis
    Jan 25, 2013 at 22:42
  • Your home directory is not accessible to an Administrator via the Finder. An administrator can access files via Terminal if they know the proper incantation. (They probably do.)
    – jaberg
    Jan 25, 2013 at 22:55
  • @jaberg You mean like cd /Users/mathletics? If that's all it takes, do I have options to keep other admins out of my home folder?
    – Evan Davis
    Jan 25, 2013 at 23:05
  • An admin would need to use sudo to access your files.
    – jaberg
    Jan 26, 2013 at 4:59

3 Answers 3

Reset to default
3

Nobody can get into your keychain without the password.

You may be able to protect your home folder if you are running a version of OS X with the original Filevault, which was introduced in OS X Panther (10.3) and replaced by Filevault2 in Mac OS X Lion (10.7). So if you are running 10.3 through 10.6 then all you have to do is enable Filevault protection. The old version encrypts a user's home folder.

Improve this answer
2
  • 2
    You could also put particularly sensitive files into an encrypted disk image.
    – jaberg
    Jan 25, 2013 at 18:28
  • The machine is 10.7 now, and will likely be 10.8 soon. That said, it sounds like I was confused about how much access admins have over other accounts.
    – Evan Davis
    Jan 25, 2013 at 22:47
1

You can store info in the key chain.

You can use disk utility to create a disk image with a password . Disk images work like fiash drives. ( any other disk partition. ) [ don't know the effect of the master password ]

There are other encryption programs around for files.

the administrator would have to use the sudo command or enable root

Macintosh-HD -> Applications -> Utilities -> Terminal

sudo ls -la /Users/your short name

sudo cat /Users/your short name/your file name

Improve this answer
0

It depends on the knownledge of the admin. It is possible to use your files and also the keychain (loged in for example with http://arstechnica.com/security/2012/09/mac-os-x-keychain-pillaging-app/) loged out with your password (it is not really difficult to get it or to set a new one). FileFault 1 and 2 is good but it was hacked and depends who has the master password for it. Also don't forget that their could be a backup before you encrypt it.

Improve this answer
6
  • When was FileVault 2 hacked?
    – jaberg
    Jan 25, 2013 at 22:56
  • This is only an example link that it works tuaw.com/2012/02/03/… it is not the topic here to show how. The Mac must be running and the key must be in memory - to get software (backdoors, trojans, ... ) on a Mac see google (but works fine using Adobe Flash).
    – NaWi at Mac
    Jan 26, 2013 at 0:26
  • And encrypted DMG´s are also not save ... georgestarcher.com/?p=228 or Spartan and a nice dictionary file workes fine - but bruteforce attacks need some time.
    – NaWi at Mac
    Jan 26, 2013 at 0:39
  • This is a rather obscure vulnerability. FileVault 2 is generally considered secure.
    – jaberg
    Jan 26, 2013 at 5:01
  • I earn my daily money which things like that and it works. You can call it obscure or whatever but the question was to "protect". If you have the required things and knownledge then it is no problem. But you are also right FileVault 2 is save as it is possible (even there is a way in).
    – NaWi at Mac
    Jan 26, 2013 at 10:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .