16 ms·

Apple: SSH and FileVault

507 points by ingve 1y ago

syndeo 1y ago
>When FileVault is enabled, the data volume is locked and unavailable during and after booting, until an account has been authenticated using a password. The macOS version of OpenSSH stores all of its configuration files, both system-wide and per-account, in the data volume. Therefore, the usually configured authentication methods and shell access are not available during this time. However, when Remote Login is enabled, it is possible to perform password authentication using SSH even in this situation. This can be used to unlock the data volume remotely over the network. However, it does not immediately permit an SSH session. Instead, once the data volume has been unlocked using this method, macOS will disconnect SSH briefly while it completes mounting the data volume and starting the remaining services dependent on it. Thereafter, SSH (and other enabled services) are fully available. Now THAT is a welcome change!
mmaunder 1y ago
There’s an attack vector in there somewhere.
- xoa 1y ago
  Kinda struggling to think of what, beyond the well understood risks of using password-based SSH at all. But that's easily ameliorated by sticking it behind Wireguard or something similar. I think this is a pretty welcome change vs turning off FV entirely which I've had to do with Mac servers in the past.
  - adastra22 1y ago
    Tahoe now escrows your FileVailt key to the iCloud keychain, even if that is something you explicitly opted out of before. Can this recovery key be used to unlock over SSH?
    - Citizen8396 1y ago
      1. Keychain is local if you don't enable iCloud 2. If someone has compromised your iCloud account and/or device, you have bigger things to worry about 3. No
      - adastra22 1y ago
        > If someone has compromised your iCloud account and/or device, you have bigger things to worry about That doesn't mean all my security should be a house of cards with a single point of failure in the form of my iCloud account and/or device(s). Someone shouldn't be able to get the keys to the castle just by compromising any single one of those.
    - pseudalopex 1y ago
      > Tahoe now escrows your FileVailt key to the iCloud keychain, even if that is something you explicitly opted out of before. Yes and no according to Glenn Fleishman. Storing FileVault recovery keys in iCloud Keychain wasn't a choice before. The old iCloud recovery method wasn't end to end encrypted. But iCloud Keychain is. So calling it escrow is debatable. And old recovery keys aren't added to iCloud Keychain. But new recovery keys are stored in iCloud Keychain if enabled.[1] [1] https://sixcolors.com/post/2025/09/filevault-on-macos-tahoe-no-longer-uses-icloud-to-store-its-recovery-key/ https://sixcolors.com/post/2025/09/filevault-on-macos-tahoe-...
      - adastra22 1y ago
        I can confirm that old recovery keys are added to the iCloud Keychain, even if you explicitly opted out of iCloud recovery before. This is exactly what happened to me when I upgraded my systems to macOS 26 yesterday. iCloud Keychain is NOT the same security as a hardcopy written down recovery key, which is what I used before. This is absolutely a forced change in security policy that was not communicated or opted into by the user.
        pseudalopex 1y ago
        Was iCloud Keychain enabled before you upgraded? Or was it forced on?
  - g-mork 1y ago
    1) steal computer, 2) copy unencrypted SSH host key from it to a new computer (which necessarily must not be stored in the data volume), configured with the network identity of original computer 3) leave new computer in place of original to capture remote SSH-to-unlock attempt 4) use knowledge of password to unlock original's filevault at your leisure somewhere offsite
    - johncolanduoni 1y ago
      I’m not sure if they do this, but nothing would stop Apple from putting the SSH host key in the Secure Enclave. This would prevent the extract the SSH host (private) key step.
  - shawnz 1y ago
    Would Wireguard function in this pre-unlock environment?
- bigyabai 1y ago
  Yup. My post-Blastdoor reaction to these writeups is always one of tentative suspicion.
- lxgr 1y ago
  Unless this somehow force-enables username/password authentication for SSH configs that otherwise enforce public-key auth, I can't really think of anything. Can you?
sugarpimpdorsey 1y ago
Maybe stop using Macs as multiuser servers? Unavailability of FileVault-mounted home directories when not logged in has been the case since Tiger. I'm curious - if the OpenSSH config files are not available - how do they start sshd? If the system keys are encrypted, how do they accept connections? There's a surprising lack of detail here.
- numbsafari 1y ago
  How about I just want to access my files remotely after a reboot occurs without having to get to the device at my house? Agreed, though… MacOS isn’t a proper multi-user system and X is Not Unix…
  - gjsman-1000 1y ago
    macOS is a Unix by pedigree; Linux is not. https://en.wikipedia.org/wiki/List_of_Unix_systems#/media/File:Unix_history-simple.svg https://en.wikipedia.org/wiki/List_of_Unix_systems#/media/Fi... I have to dig out this chart when people complain about macOS's "non-standard utilities." Linux's GNU tools are the ones that aren't standard. If anything, Linux did an "embrace, extend, extinguish" against Unix in general.
    - dangus 1y ago
      I’d add that it is rather prescriptive to declare that macOS is not a “proper multi-user system.” It is quite capable of handling multiple users. Maybe just not in the way that certain people want it to.
    - jen20 1y ago
      It's also not just Unix by pedigree, but also by certification [1]. [1]: https://www.opengroup.org/openbrand/certificates/1223p.pdf https://www.opengroup.org/openbrand/certificates/1223p.pdf
  - jacobgkau 1y ago
    In addition to the pedigree that someone else pointed out, macOS is also explicitly certified as UNIX by the legal stewards of that name: https://www.opengroup.org/openbrand/register/ https://www.opengroup.org/openbrand/register/ This includes Tahoe specifically: https://www.opengroup.org/openbrand/register/brand3725.htm https://www.opengroup.org/openbrand/register/brand3725.htm
reader9274 1y ago
So you're saying i can now have a fully remote mac mini server with auto-reboot on power outage without the need to physically log in with a keyboard attached? Awesome
- varenc 1y ago
  You can also do this: sudo fdesetup authrestart -delayminutes -1 which will make the computer auto login to the chosen account on next reboot, without having to type in a password. Only lasts once. Has obvious security downsides though but that might be fine.
  - eastbound 1y ago
    But then you could just disable FileVault?
    - derefr 1y ago
      I think the point of this technique is to be able to leave the machine locked on cold boot, but to be able to e.g. unlock it, put it to sleep, and go on vacation; and then, if you need to remotely reboot it, you can reboot it in such a way that it stays unlocked on next boot, rather than reverting to locked.
      - kkylin 1y ago
        Generally I have used fdesetup to do remote OS upgrades: do this just before an OS upgrade so that on reboot I can still log in.
      - anyfoo 1y ago
        It's still a little bit like putting your jewelry in a safe, and leaving the key on top of the safe.
        derefr 1y ago
        I mean, I assume you'd set the unlock-on-reboot flag, and then immediately reboot — at which point the unlock-on-reboot flag gets automatically unset. So, sure, it's a bit like leaving the key on top of the safe... while you have the safe open. Which isn't all that odd.
nozzlegear 1y ago
> The capability to unlock the data volume over SSH appeared in macOS 26 Tahoe. Neat! I thought it was odd that I was able to SSH into my Mac after upgrading to Tahoe the other night – part of me wondered if I actually hit that "Upgrade" button before walking away. This is a welcome change though; I don't usually shut my Mac down but there have been a few times where I'm working away from home and need to SSH into my Mac only to remember that I'd installed some major update the night before.
- watusername 1y ago
  IIRC macOS upgrades will automatically store a FileVault token (basically `fdesetup authrestart`) before restarting, so the disk is automatically unlocked. It's not a Tahoe-specific thing.
  - nozzlegear 1y ago
    Oh I didn't know that, interesting to learn in hindsight. Thanks!
- port11 1y ago
  As someone staying away from Tahoe for as long as possible, it's a shame this wasn't backported.
Cu3PO42 1y ago
Neat. Though I wonder if this suffers from the same race condition that the graphical session does when your shell is stored on a data volume. Specifically, if you restart and opt to restart apps, they can come up before all volumes have been decrypted and mounted. If your shell is on one such volume, your terminal emulator may fail to start, for example. This can happen when using Nix to install your shell, for example. I imagine this may be even easier to hit over SSH unless the underlying problem was resolved.
- xrisk 1y ago
  This is such a hilarious failure mode. I would never have imagined something like this to a problem. In the case of SSH though, I assume retrying after a second or so would be enough. You probably have some sort of retry mechanism to deal with network failures anyway.
- conradev 1y ago
  Apple does a “userspace reboot” (killing all processes) after device unlock to categorically solve this problem
- lilyball 1y ago
  Unlock over SSH terminates the connection after unlocking the data volume, so it doesn't even attempt to start the shell until you reconnect after it's fully booted up. FWIW you can fix the shell issue by wrapping your shell in a shim that essentially runs wait4path on the nix store before exec'ing your real shell. I set up my environment to install that shim binary directly onto the data volume at a known path so it can be used as my login shell.
  - Cu3PO42 1y ago
    Depending on the timeouts involved, I imagined it might still happen if you had automatic retry. And thanks for the pointer, I actually have the same fix in my config with the nice benefit of only adding a single non-changing entry to /etc/shells. It might be worth up streaming something like this to nix-darwin, so we don't all go implement essentially the same fix.
daft_pink 1y ago
It’s such a welcome change. I have filevault disabled specifically for that purpose.
pfexec 1y ago
Friendly reminder that you've been able to automatically unlock fully-encrypted Linux systems via TPM for years since it was added to systemd... (Here's a nickel kid...)
- trueismywork 1y ago
  Link?
  - pfexec 1y ago
    https://www.freedesktop.org/software/systemd/man/251/systemd-cryptenroll.html https://www.freedesktop.org/software/systemd/man/251/systemd...
- rnhmjoj 1y ago
  Also possible without a TPM: you just put openssh into the initrd, so you can log in and type the password to unlock the root. (It's technically not full-disk encryption because the kernel and initrd are in plaintext, but everything else is)
  - pfexec 1y ago
    What do you authenticate against? Your shadow file is in the unencrypted area leaving it susceptible to offline attack. With the TPM you can fully disable password auth over SSH.
    - rnhmjoj 1y ago
      Correct, someone with physical access could run a MitM attack and steal your passphrase. I just find this extremely unlikely, so I honestly don't care.
    - auguzanellato 1y ago
      My Raspberry Pi some time ago had a setup where only public key auth was enabled for LUKS unlock, so I only had to have an authorized_keys file unencrypted.
georgeburdell 1y ago
Biggest change for corporate non-personal Mac usage. Mac Minis are actually fairly good value and good quality for miscellaneous automation purposes. We started switching over to them at work, and the FileVault issue described here was actually one of the big things holding us back.
- TheTaytay 1y ago
  Ive been curious about using some Macs for general purpose servers. Is there anything else you do to make them easier to administrate as servers? Are you running Mac-specific stuff on them or more general purpose Linux containerized stuff?
  - mrtesthah 1y ago
    Macs make terrible servers. I’ve had to manage various on-premises Mac servers for the last 15-20 years and every year Apple breaks something extremely basic and obvious with no reasonable workaround. Especially these days with locking down all the administrative functions such that only a local admin user (with a SecureToken!) clicking a button in the GUI with a physically attached mouse/keyboard can enable them.
    - leakycap 1y ago
      I'd rather know how a mac server is to run today than how it was over the last 15-20 years. Seems things are getting better now, especially with this ssh news. Security is rarely convenient. Since the early OS X days, Apple seems to be willing to do things the more secure way even if it's a bit of a hassle. Seems to be paying off for them.
      - trollbridge 1y ago
        It’s a lot harder than it used to be. You basically need to ensure you have a remote KVM, or else have access to smart hands every few months to press a button.
AceJohnny2 1y ago
Interesting. I thought even networking didn't come up after a cold boot on a system with FileVault until there was a local login, which is a big reason I do not enable FileVault on my office workstation. I guess this has been changed on Tahoe too?
- johannes1234321 1y ago
  I guess it is need, so that the IT department may revoke keys remotely.
- conradev 1y ago
  Networking always comes up after cold boot, but WiFi passwords are stored on the encrypted volume. So, it depends on whether you use WiFi!
  - SoftTalker 1y ago
    And also depends on your using DHCP?
  - wpm 1y ago
    One network will get stored on NVRAM, I think it’s probably whatever the first one you connect to is.
ninkendo 1y ago
I guess this means the system volume is not encrypted with FileVault? It makes total sense, since it’s supposed to be sealed, read-only data, and identical for every macOS installation. There’s no reason you shouldn’t be able to boot all the way up including networking, before requiring the data volume to be decrypted. I know they do a lot of clever things with overlays too, to make it look like you’re writing to the system partition when you’re actually writing to the data partition. It’s a pretty welcome change if FileVault can just skip encrypting the sealed system volume altogether.
- astafrig 1y ago
  Not always on networking; any WiFi passwords are on the data volume too.
  - unloader6118 1y ago
    Some WiFi password and Bluetooth keyboard pairing are in nvram.
    - jiveturkey 1y ago
      not exactly. https://eclecticlight.co/2024/07/30/nvram-in-apple-silicon-macs/ https://eclecticlight.co/2024/07/30/nvram-in-apple-silicon-m...
- deleted 1y ago
  [deleted]
saraxx22 1y ago
[dead]
techlatest_net 1y ago
[dead]
epistasis 1y ago
I've been playing with Omarchy ("highly opinionated" Arch configuration) which has full disk encryption, and was wondering if I could use it as my primary VM. While in person, I would get a full GPU accelerated desktop, with access to all the long-running compute jobs etc. that I'm doing otherwise. However the one thing stopping me is exactly what's solved here with the new MacOS. If I'm away for a few weeks, and the machine power cycles, the full disk encryption password still needs to be entered, in person, as far as I can tell. I'm running it under ProxMox, with the GPU in-person USB devices being passed to the VM. So the standard VNC viewer doesn't work for the setup. It would be interesting to see if Omarchy tries somethnig similar...
- halJordan 1y ago
  You've been able to bake a dropbear into the initramfs for, well, ever on linux
  - epistasis 1y ago
    Thanks for the pointer! Looks like tailscale also has at least 3 implementations for initramfs too: https://news.ycombinator.com/item?id=45296075 https://news.ycombinator.com/item?id=45296075
nnx 1y ago
Is there a way to somehow authenticate with ssh key instead?
kylehotchkiss 1y ago
Can LaunchDaemons spin up after this initial unlock? I'm trying to get my Mac Mini server to run things regardless of my login status. It would be great to get FileVault enabled on the server with this. I'm OK to manually login whenever the power goes out.
- lilyball 1y ago
  LaunchDaemons don't rely on GUI login state so they should come up. If you use LaunchAgents then they won't start this way, but LaunchDaemons should be enabled once the data volume is unlocked and booting finishes.
lossolo 1y ago
Finally, MacOS version of Linux dropbear + LUKS. I waited for this.
cjensen 1y ago
>When FileVault is enabled, the data volume is locked and unavailable during and after booting This is incorrect. Macs do only a tiny partial boot before showing the login. The real work is done after the machine is unlocked. When using OpenCore on a Hackintosh, the unlock login is almost instantly presented after OpenCore completes its part of startup. Only after the unlock does MacOS startup really do anything. It's awesome that someone has managed to get ssh to do the unlock, but saying the data volume is "locked... after booting" is going too far.
- deleted 1y ago
  [deleted]
- mjg59 1y ago
  "Someone" here is Apple - this is the Apple manpage for a Tahoe feature
- unloader6118 1y ago
  You are confused. There are no "partial boot". This is fully booted in "before first unlock" state. Apple's public document always call it that way.
  - dishsoap 1y ago
    In the past it used to work the way the parent comment is describing. The confusion is understandable. Apple basically got rid of macos and replaced most of it with things from ios in 2020, a lot changed.
    - dcrazy 1y ago
      Your comment is overbroad as written, but it is close to true about the boot chain. The Apple Platform Security Guide [1] says: “When a Mac with Apple silicon is turned on, it performs a boot process much like that of iPhone and iPad.” [1]: https://support.apple.com/guide/security/boot-process-secac71d5623/1/web/1 https://support.apple.com/guide/security/boot-process-secac7...
- 1y ago
odo1242 1y ago
They also seem to have added the ability to use external displays on the login screen while FileVault is enabled, which is pretty useful.
- leakycap 1y ago
  Pretty useful is a kind way to put it, but I'm glad they fixed this.
oefrha 1y ago
Sadly you need to upgrade to the abomination that is macOS 26 to use this… Which I probably won’t do until latest Xcode drops support for macOS 15.
nunez 1y ago
Huge news for kick-starting Mac minis in a rack and remote lockout troubleshooting!
sandreas 1y ago
I welcome this change, while I'm still asking myself whether macs did not support JetKVM or NanoKVM? This should allow way more flexible remote access solutions than having to use SSH.
tonymet 1y ago
could this be used more generally for secrets & creds? i would like to improve the security of api keys and stuff
Halan 1y ago
I have a Mac mini that I deemed unfit for home lab due to the lack of this feature. This changes everything
egorfine 1y ago
This has been such a PITA for us. A very, very welcome change. Given Apple's stance towards professional users I truly wonder how come this change has been considered at all. Maybe this was something Apple themselves struggled with.
crest 1y ago
Now that's a nice quality of life feature if it's implemented correctly!
kylehotchkiss 1y ago
Real life experience on my headless Mac mini: I had SSH enabled and FileVault disabled. Updated to latest MacOS. FileVault was automatically enabled(!!!). Restart again. All Mac mini services invisible. SSH `Connection refused`.

507 points by ingve 1y ago

>When FileVault is enabled, the data volume is locked and unavailable during and after booting, until an account has been authenticated using a password. The macOS version of OpenSSH stores all of its configuration files, both system-wide and per-account, in the data volume. Therefore, the usually configured authentication methods and shell access are not available during this time. However, when Remote Login is enabled, it is possible to perform password authentication using SSH even in this situation. This can be used to unlock the data volume remotely over the network. However, it does not immediately permit an SSH session. Instead, once the data volume has been unlocked using this method, macOS will disconnect SSH briefly while it completes mounting the data volume and starting the remaining services dependent on it. Thereafter, SSH (and other enabled services) are fully available. Now THAT is a welcome change!

mmaunder 1y ago

There’s an attack vector in there somewhere.

xoa 1y ago
Kinda struggling to think of what, beyond the well understood risks of using password-based SSH at all. But that's easily ameliorated by sticking it behind Wireguard or something similar. I think this is a pretty welcome change vs turning off FV entirely which I've had to do with Mac servers in the past.
- adastra22 1y ago
  Tahoe now escrows your FileVailt key to the iCloud keychain, even if that is something you explicitly opted out of before. Can this recovery key be used to unlock over SSH?
  - Citizen8396 1y ago
    1. Keychain is local if you don't enable iCloud 2. If someone has compromised your iCloud account and/or device, you have bigger things to worry about 3. No
    - adastra22 1y ago
      > If someone has compromised your iCloud account and/or device, you have bigger things to worry about That doesn't mean all my security should be a house of cards with a single point of failure in the form of my iCloud account and/or device(s). Someone shouldn't be able to get the keys to the castle just by compromising any single one of those.
  - pseudalopex 1y ago
    > Tahoe now escrows your FileVailt key to the iCloud keychain, even if that is something you explicitly opted out of before. Yes and no according to Glenn Fleishman. Storing FileVault recovery keys in iCloud Keychain wasn't a choice before. The old iCloud recovery method wasn't end to end encrypted. But iCloud Keychain is. So calling it escrow is debatable. And old recovery keys aren't added to iCloud Keychain. But new recovery keys are stored in iCloud Keychain if enabled.[1] [1] https://sixcolors.com/post/2025/09/filevault-on-macos-tahoe-no-longer-uses-icloud-to-store-its-recovery-key/ https://sixcolors.com/post/2025/09/filevault-on-macos-tahoe-...
    - adastra22 1y ago
      I can confirm that old recovery keys are added to the iCloud Keychain, even if you explicitly opted out of iCloud recovery before. This is exactly what happened to me when I upgraded my systems to macOS 26 yesterday. iCloud Keychain is NOT the same security as a hardcopy written down recovery key, which is what I used before. This is absolutely a forced change in security policy that was not communicated or opted into by the user.
      - pseudalopex 1y ago
        Was iCloud Keychain enabled before you upgraded? Or was it forced on?
- g-mork 1y ago
  1) steal computer, 2) copy unencrypted SSH host key from it to a new computer (which necessarily must not be stored in the data volume), configured with the network identity of original computer 3) leave new computer in place of original to capture remote SSH-to-unlock attempt 4) use knowledge of password to unlock original's filevault at your leisure somewhere offsite
  - johncolanduoni 1y ago
    I’m not sure if they do this, but nothing would stop Apple from putting the SSH host key in the Secure Enclave. This would prevent the extract the SSH host (private) key step.
- shawnz 1y ago
  Would Wireguard function in this pre-unlock environment?
bigyabai 1y ago
Yup. My post-Blastdoor reaction to these writeups is always one of tentative suspicion.
lxgr 1y ago
Unless this somehow force-enables username/password authentication for SSH configs that otherwise enforce public-key auth, I can't really think of anything. Can you?

sugarpimpdorsey 1y ago

Maybe stop using Macs as multiuser servers? Unavailability of FileVault-mounted home directories when not logged in has been the case since Tiger. I'm curious - if the OpenSSH config files are not available - how do they start sshd? If the system keys are encrypted, how do they accept connections? There's a surprising lack of detail here.

numbsafari 1y ago
How about I just want to access my files remotely after a reboot occurs without having to get to the device at my house? Agreed, though… MacOS isn’t a proper multi-user system and X is Not Unix…
- gjsman-1000 1y ago
  macOS is a Unix by pedigree; Linux is not. https://en.wikipedia.org/wiki/List_of_Unix_systems#/media/File:Unix_history-simple.svg https://en.wikipedia.org/wiki/List_of_Unix_systems#/media/Fi... I have to dig out this chart when people complain about macOS's "non-standard utilities." Linux's GNU tools are the ones that aren't standard. If anything, Linux did an "embrace, extend, extinguish" against Unix in general.
  - dangus 1y ago
    I’d add that it is rather prescriptive to declare that macOS is not a “proper multi-user system.” It is quite capable of handling multiple users. Maybe just not in the way that certain people want it to.
  - jen20 1y ago
    It's also not just Unix by pedigree, but also by certification [1]. [1]: https://www.opengroup.org/openbrand/certificates/1223p.pdf https://www.opengroup.org/openbrand/certificates/1223p.pdf
- jacobgkau 1y ago
  In addition to the pedigree that someone else pointed out, macOS is also explicitly certified as UNIX by the legal stewards of that name: https://www.opengroup.org/openbrand/register/ https://www.opengroup.org/openbrand/register/ This includes Tahoe specifically: https://www.opengroup.org/openbrand/register/brand3725.htm https://www.opengroup.org/openbrand/register/brand3725.htm

reader9274 1y ago

So you're saying i can now have a fully remote mac mini server with auto-reboot on power outage without the need to physically log in with a keyboard attached? Awesome

varenc 1y ago
You can also do this: sudo fdesetup authrestart -delayminutes -1 which will make the computer auto login to the chosen account on next reboot, without having to type in a password. Only lasts once. Has obvious security downsides though but that might be fine.
- eastbound 1y ago
  But then you could just disable FileVault?
  - derefr 1y ago
    I think the point of this technique is to be able to leave the machine locked on cold boot, but to be able to e.g. unlock it, put it to sleep, and go on vacation; and then, if you need to remotely reboot it, you can reboot it in such a way that it stays unlocked on next boot, rather than reverting to locked.
    - kkylin 1y ago
      Generally I have used fdesetup to do remote OS upgrades: do this just before an OS upgrade so that on reboot I can still log in.
    - anyfoo 1y ago
      It's still a little bit like putting your jewelry in a safe, and leaving the key on top of the safe.
      - derefr 1y ago
        I mean, I assume you'd set the unlock-on-reboot flag, and then immediately reboot — at which point the unlock-on-reboot flag gets automatically unset. So, sure, it's a bit like leaving the key on top of the safe... while you have the safe open. Which isn't all that odd.

nozzlegear 1y ago

> The capability to unlock the data volume over SSH appeared in macOS 26 Tahoe. Neat! I thought it was odd that I was able to SSH into my Mac after upgrading to Tahoe the other night – part of me wondered if I actually hit that "Upgrade" button before walking away. This is a welcome change though; I don't usually shut my Mac down but there have been a few times where I'm working away from home and need to SSH into my Mac only to remember that I'd installed some major update the night before.

watusername 1y ago
IIRC macOS upgrades will automatically store a FileVault token (basically `fdesetup authrestart`) before restarting, so the disk is automatically unlocked. It's not a Tahoe-specific thing.
- nozzlegear 1y ago
  Oh I didn't know that, interesting to learn in hindsight. Thanks!
port11 1y ago
As someone staying away from Tahoe for as long as possible, it's a shame this wasn't backported.

Cu3PO42 1y ago

Neat. Though I wonder if this suffers from the same race condition that the graphical session does when your shell is stored on a data volume. Specifically, if you restart and opt to restart apps, they can come up before all volumes have been decrypted and mounted. If your shell is on one such volume, your terminal emulator may fail to start, for example. This can happen when using Nix to install your shell, for example. I imagine this may be even easier to hit over SSH unless the underlying problem was resolved.

xrisk 1y ago
This is such a hilarious failure mode. I would never have imagined something like this to a problem. In the case of SSH though, I assume retrying after a second or so would be enough. You probably have some sort of retry mechanism to deal with network failures anyway.
conradev 1y ago
Apple does a “userspace reboot” (killing all processes) after device unlock to categorically solve this problem
lilyball 1y ago
Unlock over SSH terminates the connection after unlocking the data volume, so it doesn't even attempt to start the shell until you reconnect after it's fully booted up. FWIW you can fix the shell issue by wrapping your shell in a shim that essentially runs wait4path on the nix store before exec'ing your real shell. I set up my environment to install that shim binary directly onto the data volume at a known path so it can be used as my login shell.
- Cu3PO42 1y ago
  Depending on the timeouts involved, I imagined it might still happen if you had automatic retry. And thanks for the pointer, I actually have the same fix in my config with the nice benefit of only adding a single non-changing entry to /etc/shells. It might be worth up streaming something like this to nix-darwin, so we don't all go implement essentially the same fix.

daft_pink 1y ago

It’s such a welcome change. I have filevault disabled specifically for that purpose.

pfexec 1y ago

Friendly reminder that you've been able to automatically unlock fully-encrypted Linux systems via TPM for years since it was added to systemd... (Here's a nickel kid...)

trueismywork 1y ago
Link?
- pfexec 1y ago
  https://www.freedesktop.org/software/systemd/man/251/systemd-cryptenroll.html https://www.freedesktop.org/software/systemd/man/251/systemd...
rnhmjoj 1y ago
Also possible without a TPM: you just put openssh into the initrd, so you can log in and type the password to unlock the root. (It's technically not full-disk encryption because the kernel and initrd are in plaintext, but everything else is)
- pfexec 1y ago
  What do you authenticate against? Your shadow file is in the unencrypted area leaving it susceptible to offline attack. With the TPM you can fully disable password auth over SSH.
  - rnhmjoj 1y ago
    Correct, someone with physical access could run a MitM attack and steal your passphrase. I just find this extremely unlikely, so I honestly don't care.
  - auguzanellato 1y ago
    My Raspberry Pi some time ago had a setup where only public key auth was enabled for LUKS unlock, so I only had to have an authorized_keys file unencrypted.

georgeburdell 1y ago

Biggest change for corporate non-personal Mac usage. Mac Minis are actually fairly good value and good quality for miscellaneous automation purposes. We started switching over to them at work, and the FileVault issue described here was actually one of the big things holding us back.

TheTaytay 1y ago
Ive been curious about using some Macs for general purpose servers. Is there anything else you do to make them easier to administrate as servers? Are you running Mac-specific stuff on them or more general purpose Linux containerized stuff?
- mrtesthah 1y ago
  Macs make terrible servers. I’ve had to manage various on-premises Mac servers for the last 15-20 years and every year Apple breaks something extremely basic and obvious with no reasonable workaround. Especially these days with locking down all the administrative functions such that only a local admin user (with a SecureToken!) clicking a button in the GUI with a physically attached mouse/keyboard can enable them.
  - leakycap 1y ago
    I'd rather know how a mac server is to run today than how it was over the last 15-20 years. Seems things are getting better now, especially with this ssh news. Security is rarely convenient. Since the early OS X days, Apple seems to be willing to do things the more secure way even if it's a bit of a hassle. Seems to be paying off for them.
    - trollbridge 1y ago
      It’s a lot harder than it used to be. You basically need to ensure you have a remote KVM, or else have access to smart hands every few months to press a button.

AceJohnny2 1y ago

Interesting. I thought even networking didn't come up after a cold boot on a system with FileVault until there was a local login, which is a big reason I do not enable FileVault on my office workstation. I guess this has been changed on Tahoe too?

johannes1234321 1y ago
I guess it is need, so that the IT department may revoke keys remotely.
conradev 1y ago
Networking always comes up after cold boot, but WiFi passwords are stored on the encrypted volume. So, it depends on whether you use WiFi!
- SoftTalker 1y ago
  And also depends on your using DHCP?
- wpm 1y ago
  One network will get stored on NVRAM, I think it’s probably whatever the first one you connect to is.

ninkendo 1y ago

I guess this means the system volume is not encrypted with FileVault? It makes total sense, since it’s supposed to be sealed, read-only data, and identical for every macOS installation. There’s no reason you shouldn’t be able to boot all the way up including networking, before requiring the data volume to be decrypted. I know they do a lot of clever things with overlays too, to make it look like you’re writing to the system partition when you’re actually writing to the data partition. It’s a pretty welcome change if FileVault can just skip encrypting the sealed system volume altogether.

astafrig 1y ago
Not always on networking; any WiFi passwords are on the data volume too.
- unloader6118 1y ago
  Some WiFi password and Bluetooth keyboard pairing are in nvram.
  - jiveturkey 1y ago
    not exactly. https://eclecticlight.co/2024/07/30/nvram-in-apple-silicon-macs/ https://eclecticlight.co/2024/07/30/nvram-in-apple-silicon-m...
deleted 1y ago
[deleted]

saraxx22 1y ago

[dead]

techlatest_net 1y ago

[dead]

epistasis 1y ago

I've been playing with Omarchy ("highly opinionated" Arch configuration) which has full disk encryption, and was wondering if I could use it as my primary VM. While in person, I would get a full GPU accelerated desktop, with access to all the long-running compute jobs etc. that I'm doing otherwise. However the one thing stopping me is exactly what's solved here with the new MacOS. If I'm away for a few weeks, and the machine power cycles, the full disk encryption password still needs to be entered, in person, as far as I can tell. I'm running it under ProxMox, with the GPU in-person USB devices being passed to the VM. So the standard VNC viewer doesn't work for the setup. It would be interesting to see if Omarchy tries somethnig similar...

halJordan 1y ago
You've been able to bake a dropbear into the initramfs for, well, ever on linux
- epistasis 1y ago
  Thanks for the pointer! Looks like tailscale also has at least 3 implementations for initramfs too: https://news.ycombinator.com/item?id=45296075 https://news.ycombinator.com/item?id=45296075

nnx 1y ago

Is there a way to somehow authenticate with ssh key instead?

kylehotchkiss 1y ago

Can LaunchDaemons spin up after this initial unlock? I'm trying to get my Mac Mini server to run things regardless of my login status. It would be great to get FileVault enabled on the server with this. I'm OK to manually login whenever the power goes out.

lilyball 1y ago
LaunchDaemons don't rely on GUI login state so they should come up. If you use LaunchAgents then they won't start this way, but LaunchDaemons should be enabled once the data volume is unlocked and booting finishes.

lossolo 1y ago

Finally, MacOS version of Linux dropbear + LUKS. I waited for this.

cjensen 1y ago

>When FileVault is enabled, the data volume is locked and unavailable during and after booting This is incorrect. Macs do only a tiny partial boot before showing the login. The real work is done after the machine is unlocked. When using OpenCore on a Hackintosh, the unlock login is almost instantly presented after OpenCore completes its part of startup. Only after the unlock does MacOS startup really do anything. It's awesome that someone has managed to get ssh to do the unlock, but saying the data volume is "locked... after booting" is going too far.

deleted 1y ago
[deleted]
mjg59 1y ago
"Someone" here is Apple - this is the Apple manpage for a Tahoe feature
unloader6118 1y ago
You are confused. There are no "partial boot". This is fully booted in "before first unlock" state. Apple's public document always call it that way.
- dishsoap 1y ago
  In the past it used to work the way the parent comment is describing. The confusion is understandable. Apple basically got rid of macos and replaced most of it with things from ios in 2020, a lot changed.
  - dcrazy 1y ago
    Your comment is overbroad as written, but it is close to true about the boot chain. The Apple Platform Security Guide [1] says: “When a Mac with Apple silicon is turned on, it performs a boot process much like that of iPhone and iPad.” [1]: https://support.apple.com/guide/security/boot-process-secac71d5623/1/web/1 https://support.apple.com/guide/security/boot-process-secac7...
1y ago

odo1242 1y ago

They also seem to have added the ability to use external displays on the login screen while FileVault is enabled, which is pretty useful.

leakycap 1y ago
Pretty useful is a kind way to put it, but I'm glad they fixed this.

oefrha 1y ago

Sadly you need to upgrade to the abomination that is macOS 26 to use this… Which I probably won’t do until latest Xcode drops support for macOS 15.

nunez 1y ago

Huge news for kick-starting Mac minis in a rack and remote lockout troubleshooting!

sandreas 1y ago

I welcome this change, while I'm still asking myself whether macs did not support JetKVM or NanoKVM? This should allow way more flexible remote access solutions than having to use SSH.

tonymet 1y ago

could this be used more generally for secrets & creds? i would like to improve the security of api keys and stuff

Halan 1y ago

I have a Mac mini that I deemed unfit for home lab due to the lack of this feature. This changes everything

egorfine 1y ago

This has been such a PITA for us. A very, very welcome change. Given Apple's stance towards professional users I truly wonder how come this change has been considered at all. Maybe this was something Apple themselves struggled with.

crest 1y ago

Now that's a nice quality of life feature if it's implemented correctly!

kylehotchkiss 1y ago

Real life experience on my headless Mac mini: I had SSH enabled and FileVault disabled. Updated to latest MacOS. FileVault was automatically enabled(!!!). Restart again. All Mac mini services invisible. SSH `Connection refused`.