1

I have a Mac Mini that's shared among several users at my house, including being our media server and the file server for baking up our laptops (via rsync/ssh) which are a mix of Mac/Linux/Windows. For security on this very portable machine (which, conveniently for thieves, is right next to the TV), I use Filevault to protect the home accounts.

OK, here's my problem: remote logins (including ssh and rsync) will correctly mount my Filevault-encrypted home directory, but it never dismounts, even when the remote session ends. So if I subsequently try to log into the console of the Mac, it shakes and tells me "Can't log into Filevault at this time" and won't let me log in. Presumably this is because it's already mounted and thinks a Filevault error has occurred instead of just proceeding.

Can anybody offer advice on any or all of the following:

  • Can I get the console login to just allow me to log in and not worry about Filevault if it's already correctly mounted, instead of stupidly refusing to allow a login?

  • Can I make it so that remote sessions (e.g., ssh) automatically dismount the Filevault when they are done? Ideally, only the last live or ssh login should dismount, since other simultaneous ones ought to be able to continue accessing the files in my home directory.

Thanks!

(Note: edited for clarity and succinctness.)

2
  • AFP would likely be more Mac friendly. The other idea is that it's busy reclaiming space after you've logged out. How long do you wait between disconnecting on the network and trying to physically login?
    – Jeremy L
    Jul 8, 2010 at 17:57
  • We have a mix of Mac, Linux, and Windows in the house (and until recently, the shared server was Linux), so rsync seemed nicely cross-platform and has worked for us for some time. Good suggestion on waiting, but that doesn't help -- remote logins (like ssh) correctly mount Filevault, but simply don't dismount when they are done. It's not a matter of waiting, it seems. Jul 9, 2010 at 13:23

2 Answers 2

1

You could make an AFP or SMB share (within your Filevaulted home directory) on the Mac Mini, and then use Carbon Copy Cloner (if your other machines are Macs; other backup solutions are available to PCs) to push backups to the share.

Is there some particular reason you need SSH, or are you just paranoid about security on your home network? If you decide that you really need to use SSH, perhaps you could look at MacFuse for mounting SSHFS shares (?).

3
  • Ssh is just for security over the wireless network and to make sure that no insecure connections are accepted by the server to make it less hackable. But ssh per se a red herring -- the point is that I want my home directory decrypted only in the moments when I'm purposely logged in or am backing up to this machine, and safely encrypted the rest of the time. Putting the partition up for "permanent" mounting partially defeats the purpose. But maybe I should only care that if the machine is disconnected and stolen that it be in an encrypted state. Jul 9, 2010 at 13:27
  • Can you give me a few more details? For instance, when you SSH into your Mac Mini, are you connecting to the root of the drive (such as ssh [email protected]) and navigating to the encrypted home folder, or are you connecting directly to the encrypted folder (such as ssh [email protected]/users/username)? Also---and I'm only asking this because I don't know much about Filevault---does the folder actually have to be "mounted", or does it simply act as a normal folder? If the former, do you have to issue some command to force the folder to mount, or does SSH do it automatically?
    – jrc03c
    Jul 9, 2010 at 14:17
  • Finally, are you issuing a command to exit the SSH session (such as exit), or are you simply closing the console?
    – jrc03c
    Jul 9, 2010 at 14:18
1

OK, I have to make some assumptions here, but I believe I have an answer for your question. I kinda wrote this so that any novices with the same problem could reasonably follow along.

  1. Open Terminal

  2. At the prompt, type:

    diskutil list
    

    A list of all the currently mounted local volumes should be listed. Find the Identifier of the FileVault user you cannot log into (should be labeled something like diskX where X is a number). Here's an example:

        /dev/disk0
        #:                       TYPE NAME                SIZE       IDENTIFIER
        0:      GUID_partition_scheme                    *160.0 GB   disk0
        1:                        EFI                     209.7 MB   disk0s1
        2:                  Apple_HFS Macintosh HD        159.7 GB   disk0s2
        /dev/disk1
        #:                       TYPE NAME                SIZE       IDENTIFIER
        0:      GUID_partition_scheme                    *1.0 TB     disk1
        1:                        EFI                     209.7 MB   disk1s1
        2:                  Apple_HFS Time Machine        376.5 GB   disk1s2
        3:                  Apple_HFS Media Disk HD       623.2 GB   disk1s3
        /dev/disk2
        #:                       TYPE NAME                SIZE       IDENTIFIER
        0:     Apple_partition_scheme                    *319.4 GB   disk2
        1:        Apple_partition_map                     32.3 KB    disk2s1
        2:                  Apple_HFS main                319.4 GB   disk2s2
    

    In the example above, where it says Apple_HFS main, main is the FileVault user account that we're targeting. So the Identifier we want is disk2.

  3. At the prompt, type:

    diskutil unmountDisk diskX
    

    Make sure you enter the appropriate number in place for the "X" for your situation. It may take a few moments, but the Terminal should return a message, stating:

    Unmount of all volumes on diskX was successful
    

    You should now be able to use FUS into that account again.

    If that doesn't work, there's two alternatives I can think of: either restart your computer (not the most ideal solution); or kill the process keeping your sparsebundle open (could possibly result in data corruption):

  4. At the Terminal prompt, type:

    sudo lsof | grep sparsebundle
    

    The system should return a list of open files that are being accessed by the process that's holding your FileVault image open. On Snow Leopard, it should be diskimages. Note the process id next to the name. Below is what mine looked like:

      diskimage 68420           root    4u      REG       14,2    8388608 5858242 /Users/main/main.sparsebundle/bands/241
      diskimage 68420           root    5u      REG       14,2     122880 5856490 /Users/main/main.sparsebundle/token
      diskimage 68420           root    6r      DIR       14,2        204 5856486 /Users/main/main.sparsebundle
      diskimage 68420           root    7r      DIR       14,2      56780 5856489 /Users/main/main.sparsebundle/bands
      diskimage 68420           root    8u      REG       14,2    8388608 5856497 /Users/main/main.sparsebundle/bands/0
    
  5. At the prompt, type:

    sudo kill [process id of diskimages]
    

(In the example above, my PID would be 68240.) You may have to repeat step 3 above, but that should allow you FUS into your account. However since you killed the diskimage process, it's possible that your disk image may suffer some corruption. (Note that I haven't tested this). I have been using FileVault on Tiger since May 2006 and on several occasions had to forcefully unmount my user account. But I haven't had any corruption problems with FileVault. But I don't have much experience on Snow Leopard's version of FileVault.

I also tried to see if I could unmount prior to logging out but it failed, probably because files were open as a result of me being logged in. I wouldn't doubt that you could write a script and have the system run it upon the final affected remote user being logged out, but unfortunately that's beyond my expertise.

One thing you can do is to remotely login as another user and do step 3 after you've ended your session until you're able to automate it. If you are able to find a way to automate it, please post it as I would love to learn how to do that.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .