Path: csiph.com!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: Jolly Roger <jollyroger@pobox.com>
Newsgroups: comp.sys.mac.system
Subject: Re: keeping files on an external drive
Date: 9 Nov 2018 17:12:32 GMT
Organization: People for the Ethical Treatment of Pirates
Lines: 59
Message-ID: <g4ltfvF9js2U2@mid.individual.net>
References: <ps1ekh$c8n$1@dont-email.me> <g4j5ceFlb7aU2@mid.individual.net> <slrnpu9hcg.ct8.g.kreme@jaka.local> <g4lmi3F83sfU3@mid.individual.net> <slrnpuba17.1psn.g.kreme@jaka.local>
X-Trace: individual.net xvt3pCKaYdGXO+W9pXHm2w5dORETNvPt8QdiErknoDajGYCH8y
Cancel-Lock: sha1:p3oMCKwKlbVwXDKHH4+xGEPJCRY=
X-No-Archive: Yes
MMail-Copies-To: nobody
X-Face: _.g>n!a$f3/H3jA]>9pN55*5<`}Tud57>1<n@LQ!aZ7vLO_nWbK~@T'XIS0,oAJcU.qLM dk/j8Udo?O"o9B9Jyx+ez2:B<nx(k3EdHnTvB]'eoVaR495,Rv~/vPa[e^JI+^h5Zk*i`Q;ezqDW< ZFs6kmAJWZjOH\8[$$7jm,Ogw3C_%QM'|H6nygNGhhl+@}n30Nz(^vWo@h>Y%b|b-Y~()~\t,LZ3e up1/bO{=-)
User-Agent: slrn/1.0.1 (Darwin)
Xref: csiph.com comp.sys.mac.system:119359

On 2018-11-09, Lewis <g.kreme@gmail.com.dontsendmecopies> wrote:
> In message <g4lmi3F83sfU3@mid.individual.net> Jolly Roger <jollyroger@pobox.com> wrote:
>> On 2018-11-08, Lewis <g.kreme@gmail.com.dontsendmecopies> wrote:
>>> In message <g4j5ceFlb7aU2@mid.individual.net> Jolly Roger <jollyroger@pobox.com> wrote:
>>>
>>>> I keep my entire home folder on an external FileVault-encrypted SSD
>>>> connected to my 2013 Mac Pro with USB3. I just erased/formatted it with
>>>> Disk Utility, copied my home folder contents to the drive, then set
>>>> System Preferences > Users & Groups > Advanced Options > Home directory
>>>> to the copied home folder. No problems to report - works fine.
>>>
>>> Really? When I did that on my iMac the external disk didn't load fast
>>> enough at boot and the system would create a new home folder for me
>>> since my home folder wasn't available.
>>>
>>> I still have that issue, as my Dropbox is on the external disk and many
>>> of my "dot" files live in Dropbox, so generally I have to quit Terminal
>>> on restart/login and then relaunch it so that it processes the .bashrc
>>> and such.
>
>> Not sure what to make of that. Our systems may be set up a little
>> differently. I have a firmware password set as well as FileVault set so
>> that only an administrator account can unlock the system volume, which
>> means when I initially boot the machine, I get logged into the admin
>> account first, which gives the system time to mount and unlock the
>> external drive before I log out of the admin account and into my
>> standard account.
>
> That would do it.
>
> When I get my new machine I will probably do this, even though the
> double login dance is a little annoying, I do not reboot often.

Right: rebooting is indeed a rarity. FileVault's boot sequence is
slightly annoying, but I've been doing it for so long now it doesn't
really bother me much. I'm used to entering the admin password at boot,
and I have an automatic logout script that puts me into the login screen
if no action is taken within 5 seconds after that initial admin login.
It takes just a few seconds to get logged into my standard account after
a reboot. I just prefer limiting the number of users that can unlock my
encrypted drives to one account with a really strong passcode, to reduce
the potential attack surface if someone should get physical access to a
drive. 

The firmware password is to protect against this type of thing:

<https://www.idownloadblog.com/2016/12/19/macos-sierra-10-12-2-fixed-vulnerability-that-let-attackers-obtain-disk-encryption-password/>

And Find My Mac lets me track, disable, or erase my Macs remotely should
they become "lost".

The combination of all three makes my machines virtually useless to the
common thief.

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR