Blog Archives
creating secure folders and files
With FileVault 2 having a number of drawbacks, a common question I’m seeing is how best to secure data on Lion and Mountain Lion without using FV2.
There’s a number of tricks on offer, from making transparent folders, excluding folders from Spotlight, or using Terminal to make them invisible or hidden.
However, all of these methods suffer from one inevitable drawback: anyone who knows their way around Terminal can open, read, copy or delete your folders as if you had never employed any of the above tricks at all. Well, not many people know their way around Terminal you say? But everyone knows their way around Google, and learning how to find files via the Terminal is information easily found, even on Applehelpwriter! In short, all those methods listed above are really a waste of time if it’s security that you’re after.
Fortunately, there is a simple answer to securing localised files or folders, and that’s to make a local encrypted disk image with Disk Utility and then move your data into it. To do so, follow this procedure:
1. Open Disk Utility (Applications/Utilities/Disk Utility.app)
2. Click near the bottom of the sidebar in empty space to make sure none of the disks in the sidebar are selected.
3. Click the New Image icon in the task bar.
4. Give the image a name and choose a location to store it. Storing it in the User Library is not a bad idea. Give it a boring name like ‘old system’, ‘old data’ or something like that, but don’t hit ‘Create’ just yet.
5. At the bottom of the dialogue box is a field for encryption. Click on the option button and choose either 128-bit or 256-bit (the second choice is the strongest but also slower. 128-bit is still so strong that almost no-one save the CIA will be able to crack it!)
6. Create a password that you’re not going to forget. Do NOT use the same password that you use for your Admin account or for anything else for maximum security. Uncheck the ‘save in my keychain’ option.
Warning!
Warning!
if you forget the password don't waste time seeking help trying to break it. The system is designed to be uncrackable. If you forget the password, your data is lost for good.
PRO TIP: For that reason, you might like to use a password manager like ‘1Password‘ for this and all your other passwords. The main reason people forget passwords is infrequency of use. With 1Password you use a single password to unlock all your other passwords and to have them entered automatically into web pages and other fields.
7. Set up the rest of the options as in the screenshot below.
8. When you’re ready, press ‘Create’ to make the disk image.
9. Once the image has been created, copy the files you want to protect into the disk image window, just like you would a hard disk or other connected device. Now, whenever you want to access your protected data, just click on the disk image and enter the password and your data is ready to be used.
10. Test mounting and ejecting the disk image a few time. Open a few files and save your changes. After you’re sure everything is working as expected, delete the files from the original location that you copied them from. Also, don’t forget to eject the disk image in Finder’s sidebar each time when you’re done using it to prevent anyone else accessing your protected files.
🙂
how to secure your mac (OS X Lion)
Security in OS X Lion is a big problem that not many people are aware of, and here’s why: your Lion computer contains the install/recovery disk on the internal drive. That means anyone with a basic knowledge of Mac and Lion can start up your mac and reset your passwords, thereby accessing your user accounts and all your personal data. The same trick can help kids easily get round restrictions applied through OS X’s ‘Parental Controls’ feature.
How is this possible, you may ask? First, a little history. Among the 250 changes vaunted about Lion over its predecessor, Snow Leopard, there is one that is widely known but whose implications are rarely pointed out: you download the OS rather than install it from a disc. In the past, if your OS went bad and needed to be recovered, or you forgot your admin passwords, the simplest answer was to insert your install disk. From that, you could restore the OS and reset your passwords. That made your Mac a little safer (though not entirely safe) so long as your disc was kept somewhere physically different from your computer.
With Lion having no install disc, Apple had to find an answer as to how to provide the recovery option. The solution was to install a Recovery partition on the same disk as the operating system itself. In the event that the OS goes bottoms up and needs to be recovered or re-installed, you just restart your computer holding down the ‘command’ and ‘r’ keys to access the Recovery partition.
So far so good, but likewise, just as with the old DVD install discs, you — or anyone else — can also reset the user account passwords from the Recovery partition. That means your passwords are effectively useless. Anyone who wants to hack your user account just has to restart your Mac holding down ‘command’ and ‘r’ and then use the built-in Password Utility to make new passwords for your accounts. Now I’m not going to tell you quite how to do it (you do need a little knowledge to get the user account names and know how to do the reset) but it is widely publicized elsewhere, and indeed even in Apple’s own online documentation (so if you really want to know, google is your friend or follow some of the links in this post…).
What’s the answer to this security nightmare? Here’s one thing that’s NOT the answer but which I have seen widely touted: setting a firmware password. If you’re not familiar with the concept of the firmware password, don’t worry. It is practically useless, since anyone can reset that simply by taking off the back of your computer, and then pulling out and then putting back in one of the memory chips.
Apple, of course, thought about this problem. Their own solution is to encourage you to use FileVault 2 (FV2) to encrypt all your data. Indeed, this is the BEST solution. Without your password, no one can access the disk on your computer no matter what they do (and that includes YOU if you forget it…). However, there are a couple of drawbacks to FV2. One is that it requires extra disk space, and if you have more than one partition on your hard drive, or a lot of data, and little space you may not be able to encrypt and decrypt your data. The other drawback is that FV2 places a little extra wear-and-tear on your hard disk (though that may be negligible given the security pay off).
Using FileVault 2 is really the only security option if you’re using Lion. However, if you don’t have the space for it, there is a ‘second-best’ strategy (see below why it’s only ‘second best’), and that is to remove the recovery disk and use a clone as your recovery option instead (WARNING: the Recovery disk is required for FileVault 2, so by removing it you will also remove the ability to use FV2).
There’s a couple of ways to remove the recovery partition on your internal disk, but this is probably the best:
1. Clone your current system to an external disk using Carbon Copy Cloner. This will clone your entire system exactly as it is now, but it will not copy the Recovery disk.
2. Still booted into your internal OS (the one on your machine), open Terminal.app and paste the following command:
defaults write com.apple.DiskUtility DUDebugMenuEnabled 1
Press ‘Return’.
3. Open Disk Utility.app (Applications/Utilities/Disk Utility.app). In the menu bar of Disk Utility, choose Debug > Show Every Partition.
4. In the left-hand pane of Disk Utility, you can now see the Recovery HD. Click on it. Then click on the Erase tab on the (larger) right-hand pane. Click the Erase button down there on the bottom right.
5. Quit Disk Utility.
Now you can use your bootable clone as your recovery disk if your OS becomes corrupt and no one can boot up your computer with ‘command-r’. If you keep the clone backed up on a regular incremental schedule (you can choose anything from once an hour, once a day, week, or month), you can simply restore a corrupted internal disk to exactly the same state as your last backup.
Why only ‘second best’?
As alluded to earlier, it is still possible for advanced users to start up your mac and reset the password without the Recovery partition (this was also true in Snow Leopard even without the install disc). In fact, what this procedure does is give your OS X Lion installation the same security level as an OS X Snow Leopard installation, which is not actually that great, but better than Lion with a Recovery disk! Also, if you are storing highly sensitive data, don’t neglect the fact that someone who has complete unfettered access to your hard drive could even remove the disk and recover the data using special software.
The short story is if you want to be absolutely certain that your data is secure, FileVault 2 is really your only option.
featured picture Security Workstation by digitalhadz
how to fix permissions (Permissions Pt 2)
(This post continues from here on file permission problems.)
Did you know there are two levels of permissions on your mac? User level and system level. Most discussions of fixing permissions only discuss the latter, but you may also need to fix the former (also sometimes called ‘ACLs’) for some problems caused by upgrading Lion on top of Snow Leopard.
4. System Level Permissions
You can safely repair your system level permissions at any time, and doing it once in a while is a good maintenance activity even if you’re not experiencing any problems. It’s also the first thing to do as soon as you notice any problems with apps launching, file access problems, or your computer seems to be running unusually slow.
How to do it:
— 1. Go to Applications > Utilities > Disk Utility.app and double click the app to open it.
— 2. Click your HDD icon in the left column (if you have more than one, click the one that contains your startup disk).
— 3. If it is not already selected, click on the ‘First Aid’ tab. Choose the ‘Repair Disk Permissions’ button near the bottom of the window (see the larger of the two windows in the screenshot above).
— 4. Wait for the process to finish (it could take ten minutes or more), then quit Disk Utility. You can ignore most of the error messages that appear unless they’re in red.
5. User Level Permissions (ACLs)
These permissions apply only to your ‘Home’ folder and its contents, and if you have more than one user you will need to do this procedure for any user experiencing a problem. However, unlike system level permissions, repairing ACLs isn’t something you should do unless there is a specific issue to be solved. Problems that this repair might help with include permission conflicts inherited from an earlier Snow Leopard or Leopard installation, such as Finder always asking for your password when you try to delete, move or copy a file.
To reset the ACLs in Lion: (To reset the ACLs in Leopard/Snow Leopard have a look here.)
— 1. Remove the current ACLs by opening Terminal.app (Applications > Utilities > Terminal.app) and copy and pasting this command:
sudo chmod -RN ~
Press return. You’ll be asked for your password. Notice that when you type it in you won’t see anything on the screen. Press return again. If you get an error message, you probably didn’t type in your password correctly. Repeat this step till its accepted. It will take some time to complete. Then paste this command into Terminal also:
sudo chown -R `id -un` ~
and press return. Enter your password again if necessary.
— 2. Press the Power button on the computer and choose ‘Restart’. When the screen goes blank, hold down the ‘command’ and ‘R’ keys on the keyboard until you hear the start up chime. In the menu bar at the top, choose Utilities > Terminal
— 3. At the Terminal prompt type
resetpassword
Then hit ‘Return’
— 4. Forget about resetting your password; what you’re looking for is your hard disk icon at the top. Hit that, and then from the drop-down menu select your user account.
— 5. Go to the bottom of the dialogue window – leaving all password fields blank – and choose ‘Reset’ under ‘Reset Home Folder Permissions and ACLs’ (see the smaller of the two windows in the screenshot above, inside the red dotted line).
— 6. When the process finishes, quit everything and restart your Mac. 🙂
Related Posts
How to Troubleshoot Your Mac with FT2
can’t create kext cache error
FastTasks – download the free OS X utility app from Applehelpwriter
why does Trash ask for a password? (Permissions Pt 1)
There are several reasons why Trash may ask for your password. Let’s deal with the obvious ones first:
1. FileVault is turned on
Solution: either turn FileVault off, or put up with the behaviour.
2. If you are using an account with ‘Parental Controls’ enabled, the person who set up your account may have denied you permission to delete, modify or move some or all files.
Solution: Speak to mom!
If 1 and 2, aren’t your problem, then you may have some permissions errors.
3. Check Permissions on .Trash
— 1. Open a Terminal window (Applications >Utilities > Terminal.app) and check the permissions by typing/pasting in the following:
ls -al
You should end up with a long list, among which will be the permissions for your .Trash folder. Mine looks like this:
drwx—— 2 SnowLpd staff 68 29 Nov 15:33 .Trash
— 2. What’s important here that the name after the series of ‘drwx’ letters is the same as your user name (my user name, as you can see, is ‘SnowLpd’). If it is, then ignore the rest of this post and go to the post Permissions Pt2.
If the name is not the same, then you need to type this command into Terminal:
sudo chown -R your_username .Trash
Where you replace your_username with (surprise…) your user name, which is also the name of your home folder (note there’s a space both before and after your_username). Thus, for example, if in the previous step it said ‘root’ instead of my username, then I’d type in ‘sudo chown -R SnowLpd .Trash’.
—3. Now press ‘Return’. You will be prompted for your admin password. Type it in, but notice that you won’t see anything as you type, so type carefully. Hit ‘Return’ again. You should be returned to the Terminal prompt pretty quickly. Quit Terminal.app and see if your problems are solved.
4. If your .Trash permissions were OK, then you may need to fix either system permissions or ACL permissions. To do that, go to the next post.
Related Posts
how to fix permissions (Permissions Pt 2)
‘delete’ doesn’t send files to Trash
applehelpwriter.com 