Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

10.8 Server with FileVault

U

unplugme71

macrumors 68030
Original poster
May 20, 2011
2,827
754
Earth
I have a Mac Mini running 10.8.4 Server and I'm interested in turning FileVault on.

On a server without filevault, I can restart the computer remotely and after the computer boots up, it goes to the login window. Meanwhile, the server OS is up and running and allows for services to be used. With filevault, does the OS not boot up until you login? So how can one use the server with FileVault being headless? Or is it not possible to use File Vault on servers?
 
Weaselboy

Weaselboy

Moderator
Staff member
Jan 23, 2005
34,137
15,602
California
I have not used FV with Server, but I do use FV on Mountain Lion client and when you boot and get the login screen you are actually at that point only running off a boot stub on the recovery partition and the entire OS partition is still locked. So I am going to say you can't do what you are asking with FV on.
 
A

alexrmc92

macrumors regular
Feb 7, 2013
218
0
Weaselboy said:
I have not used FV with Server, but I do use FV on Mountain Lion client and when you boot and get the login screen you are actually at that point only running off a boot stub on the recovery partition and the entire OS partition is still locked. So I am going to say you can't do what you are asking with FV on.
Click to expand...

Although i haven't tested this myself, i'm going to agree. From what i can tell FV requires a password to finish the boot process, which wont work for a headless system unless you have an XServe with LOM.
 
U

unplugme71

macrumors 68030
Original poster
May 20, 2011
2,827
754
Earth
That's what I figured. I guess the assumption is the Mac Mini running a Server OS would be located in a physically secure location.
 
talmy

talmy

macrumors 601
Oct 26, 2009
4,726
332
Oregon
I solved this problem by having a system boot partition without FileVault and having a second partition that is encrypted. I don't keep anything sensitive on the unencrypted partition. I admit that I don't know how to move the databases for Contact and Calendar servers off of this partition, but I don't consider that data sensitive. I haven't tested to see if the encrypted drives are accessible before I log in since I always need to log in after power up to run services that aren't really services.
 
U

unplugme71

macrumors 68030
Original poster
May 20, 2011
2,827
754
Earth
talmy said:
I solved this problem by having a system boot partition without FileVault and having a second partition that is encrypted. I don't keep anything sensitive on the unencrypted partition. I admit that I don't know how to move the databases for Contact and Calendar servers off of this partition, but I don't consider that data sensitive. I haven't tested to see if the encrypted drives are accessible before I log in since I always need to log in after power up to run services that aren't really services.
Click to expand...

I ended up just putting a firmware password on the mac mini server. The login passwords were strengthened some more. My external drive that connects to the mini just hosts iTunes and iPhoto libraries, so there's nothing extremely important anyway.

I'm just trying to think of better ways to manage a home network with server. The one thing I like about PHD is the ability to sync my HomeDir with any of the Macs I log onto. However, since this data is not encrypted on the Mini server, I'm starting to wonder if the benefit outweighs the security risk.
 
ZMacintosh

ZMacintosh

macrumors 65816
Nov 13, 2008
1,445
684
it is not recommended to have filevault turned on for your OS X server.
any user who connects to the server, that data will be encrypted unless theyre on FTP.

I'd highly recommend going through the server essentials guide and the 10.8 Server Admin page on Apple.com. good resources there to help secure your server.
 
K

kirdes

macrumors newbie
Jul 3, 2011
4
1
unplugme71 said:
I have a Mac Mini running 10.8.4 Server and I'm interested in turning FileVault on.

On a server without filevault, I can restart the computer remotely and after the computer boots up, it goes to the login window. Meanwhile, the server OS is up and running and allows for services to be used. With filevault, does the OS not boot up until you login? So how can one use the server with FileVault being headless? Or is it not possible to use File Vault on servers?
Click to expand...

There's a special reboot command for this particular case, details here:

http://blog.macminicolo.net/post/32419058726/restart-a-remote-mac-that-is-running-filevault-2
 
  • Like
Reactions: zhaoxin
U

unplugme71

macrumors 68030
Original poster
May 20, 2011
2,827
754
Earth
talmy said:
That will allow you to manually reboot, however if the system shuts down for any reason (such as a power failure) you are unable to start it without a keyboard attached.
Click to expand...

Yup. Even if the 'restart after power failure' option is enabled. You are still screwed. Luckily with a mac mini server in a data center, you should have a better chance at winning the lottery than losing power. At least you'd hope so.
 
talmy

talmy

macrumors 601
Oct 26, 2009
4,726
332
Oregon
unplugme71 said:
Yup. Even if the 'restart after power failure' option is enabled. You are still screwed. Luckily with a mac mini server in a data center, you should have a better chance at winning the lottery than losing power. At least you'd hope so.
Click to expand...

The only reason to use FileVault is physical security, an issue with a home server. However one would hope that the data center is secure, in which case FileVault is of marginal usefulness anyway. In any case the workaround of using a small, unencrypted boot partition and putting everything of importance on an encrypted partition works fine.
 
U

unplugme71

macrumors 68030
Original poster
May 20, 2011
2,827
754
Earth
talmy said:
The only reason to use FileVault is physical security, an issue with a home server. However one would hope that the data center is secure, in which case FileVault is of marginal usefulness anyway. In any case the workaround of using a small, unencrypted boot partition and putting everything of importance on an encrypted partition works fine.
Click to expand...

Depends on what you find important. To me, Open Directory for example can be important and that would have to reside on the unencrypted boot partition.

Most likely, I will probably opt for a server rack and get one of those trays that supports 4 Mac Mini's.

If someone wants to take my Mac Mini (or data), they'd have to go through quite a bit of physical security first. And to do all that just to know my identity, financial records, and large iPhoto/iTunes library is probably not worth the effort - not until I push over 7 figure net-worth.
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom