7 ms·

So you're saying i can now have a fully remote mac mini server with auto-reboot on power outage without the need to physically log in with a keyboard attached?

So you're saying i can now have a fully remote mac mini server with auto-reboot on power outage without the need to physically log in with a keyboard attached? Awesome

varenc 1y ago
You can also do this: sudo fdesetup authrestart -delayminutes -1 which will make the computer auto login to the chosen account on next reboot, without having to type in a password. Only lasts once. Has obvious security downsides though but that might be fine.
- eastbound 1y ago
  But then you could just disable FileVault?
  - derefr 1y ago
    I think the point of this technique is to be able to leave the machine locked on cold boot, but to be able to e.g. unlock it, put it to sleep, and go on vacation; and then, if you need to remotely reboot it, you can reboot it in such a way that it stays unlocked on next boot, rather than reverting to locked.
    - kkylin 1y ago
      Generally I have used fdesetup to do remote OS upgrades: do this just before an OS upgrade so that on reboot I can still log in.
    - anyfoo 1y ago
      It's still a little bit like putting your jewelry in a safe, and leaving the key on top of the safe.
      - derefr 1y ago
        I mean, I assume you'd set the unlock-on-reboot flag, and then immediately reboot — at which point the unlock-on-reboot flag gets automatically unset. So, sure, it's a bit like leaving the key on top of the safe... while you have the safe open. Which isn't all that odd.
        anyfoo 1y ago
        No, the scenario was power outage at an unknown time in the future, not immediate reboot.
      - BHSPitMonkey 1y ago
        When it comes to disk encryption, at least in the home, the threat model isn't somebody sitting around in your home finding a way to exfiltrate the currently-unlocked filesystem; It's someone taking the computer or the drive with them and leaving. In your analogy, the key atop the vault vanishes as soon as the vault is moved from its location (loses power).
        anyfoo 1y ago
        If that was the case (maybe it is, I don’t know), then how does the proposed solution help against power outages, which was asked for?
        avianlyric 1y ago
        That wasn’t what was asked for. The original reason given was to require a password on cold boot, but not require a password when rebooting e.g. for an OS update
        anyfoo 1y ago
        Well, you've asked me to quote in another subthread, I did. Since I don't fully get what you're referring to now, can you please quote?
      - 1y ago
  - johncolanduoni 1y ago
    This only puts the key in NVRAM until the next restart - so if you run it just before you restart an attacker would have to happen to grab the device in those few minutes.
    - anyfoo 1y ago
      The stated problem was power outages. I did not verify the syntax of the proposed solution, but -1 looks like it disables the delay. So, indefinitely until the next reboot? Which, if the key is indeed saved in NVRAM (I don’t know), means someone can take the machine and have it unlocked at their destination.
      - johncolanduoni 1y ago
        It used to be NVRAM at least, but that was before the integrated Secure Enclave. Now it could in theory store it there and only unlock if the boot chain is validated (similar to the automatic TPM-based unlock that Windows uses by default).
        anyfoo 1y ago
        Right, but my point was, if the idea is to do this to have an automatic unlock on power outages (and if this persists across power outages), it’s not just a few minutes, it’s indefinitely.
      - avianlyric 1y ago
        You’re going to have to quote that the stated problem was power outages. The first comment in this thread was taking about how the linked article solves the power outage problem. But the sub-thread about using the existing utils is only for solving the unlock on reboot problem, and explicitly not solving the cold boot unlock problem.
        anyfoo 1y ago
        First comment: > So you're saying i can now have a fully remote mac mini server with auto-reboot on power outage without the need to physically log ... Reply: > You can also do this: [...] -delayminutes -1 [...] which will make the computer auto login to the chosen account on next reboot, without having to type in a password. Only lasts once. Has obvious security downsides though but that might be fine. Even though I haven't checked, the "-delayminutes -1" very much sounds to me like it disables the automated reboot, so it waits until the machine reboots for other reasons. Given this and given that it is a direct reply, I personally took it as another solution to the power outage problem, the "reboot" in question actually being a cold boot due to the power outage. Note that I haven't verified whether this works after removing power.
- firecall 1y ago
  I was also aware of this - but I dont want my Mac to actually auto login, for obvious reasons! I just want me to able to remotely login!
  - varenc 1y ago
    You could have another script that immediately triggers the Lock Screen after boot...but agreed this comes with many compromises. But if your Mac is physically secure, and has no keyboard or monitor on it anyway, I don't quite understand the risk? Remote login still requires the password after this of course. But if physical security is a concern it makes sense. Also I suppose there's other risks from having a decryption key sitting in NVRAM.
deleted 1y ago
[deleted]
Reason077 1y ago
You’ve always been able to do this, just not in combination with FileVault.
tristansokol 1y ago
How would you automatically login via ssh?
- SXX 1y ago
  autossh + sshpass. Work perfectly.
firecall 1y ago
I'm hoping that's the case! Having to physically login to a remote Mac that has FieVault enabled to get it online after a power outage is not ideal! So will I be able to actually remote into the GUI now after a reboot? I've looking at getting a Mac mini for my homelab again, but thinking I'll need one of those remote enable KVM devices!
reader9274 1y ago
Just tested it and it works flawlessly! 1. Enable: General > Sharing > Remote Management 2. After reboot, when trying to SSH you get this message: "This system is locked. To unlock it, use a local account name and password. Once successfully unlocked, you will be able to connect normally." 3. Once you successfully ssh, the ssh connection is closed, and this message is shown: "System successfully unlocked. You may now use SSH to authenticate normally." 4. You have to re-ssh and you're in!
- SXX 1y ago
  One question for you or anyone who tried it. SSH host (mac) key pre disk unlock is randomly generated and persistent?
  - lxgr 1y ago
    I'd be surprised if it were a different key from the regular host key. Most SSH clients I know show a big and often non-overridable warning in case of a changed host key and don't allow (at least not TOFU-style) trusting two keys.
    - SXX 1y ago
      > Most SSH clients I know show a big and often non-overridable warning in case of a changed host key and don't allow (at least not TOFU-style) trusting two keys. You can solve this with HostKeyAlias, but yeah I doubt Apple would do this. Considering other comments mentioning "just SSHing after reboot" it's certainly the same host key. https://stackoverflow.com/questions/733753/how-to-handle-ssh-host-key-verification-with-2-different-hosts-on-the-same-but PS: Another option obviously UserKnownHostsFile, but I would better keep single known hosts file.
      - lxgr 1y ago
        Wow, TIL about HostKeyAlias and CheckHostIP. Especially the latter sounds super useful when it comes to frequently changing private IPs. Thank you!
alerighi 1y ago
I remember the time one of my coworkers accidentally enabled failevault on our CI machine, I had to take it out of the rack, dust it off, connect it to a monitor and keyboard, just to login and disable it. Good thing they made it can be unlocked with SSH, so in case it happens another time I can just do it remotely.
drusklo 1y ago
Honest question; why would you want a server with mac os? I am asking because I thought about getting a mac mini for that purpose, because the hardware is great, but running mac os vs linux is what is throwing me off.
- drexlspivey 1y ago
  I use it as a plex server and it can handle anything you throw at it. Previously plex was running on the synology NAS itself and it would choke with a couple concurrent transcodes
- dbdr 1y ago
  Have you considered https://asahilinux.org/ https://asahilinux.org/ ?
  - happymellon 1y ago
    It sounds like they already are, and questioning what benefits having a remote MacOS server would give them. Time Machine backups could be one reason?
    - rendx 1y ago
      Time Machine does not require Mac. You can point it to e.g. a SMB share as destination as well.
  - rollcat 1y ago
    Unfortunately they only support M1/M2 (last time I checked - hardstuck). It would be a great choice to repurpose existing hardware, but I wouldn't go shopping for Asahi specifically.
- mvanbaak 1y ago
  A couple of reasons for me to run it: - time machine - photos.app backup (have photos.app download local copies of your iCloud photos library, backup the photos.app files) - build server for ios/ipados/macos apps
amelius 1y ago
Until Apple triggers something that needs user input, such as an AppleID prompt. Then it's back to the data center ...
- naikrovek 1y ago
  maybe. but until then...
- SXX 1y ago
  What's wrong with just connecting to mini over VNC? You can even firewall it off and tunnel VNC connection over SSH, or tailscale / zerotier. I dont think there is any single action you cant perform on Mini remoty. Once it's unlocked that is.
  - amelius 1y ago
    Maybe actions like "Please enter your AppleID", or a popup showing on your physical screen saying "system has to restart now", which doesn't show in VNC. In any case, you don't want this in a server because these are usually used over SSH and those types of popup will simply not be seen. Also, servers are usually administrated using scripting and those popups wouldn't work anyway.
SXX 1y ago
Yeah this is really cool. Before I had to setup hardware KVM for managing Mac build server. Extra $50 for SiSpeed NanoKVM is okay, but then KVM is effectively MiTM that can siphon the password for disk encryption. Having it work with just properly encrypted SSH is really welcome change.
ubermonkey 1y ago
Oh, this is nice indeed.

So you're saying i can now have a fully remote mac mini server with auto-reboot on power outage without the need to physically log in with a keyboard attached? Awesome

varenc 1y ago

You can also do this: sudo fdesetup authrestart -delayminutes -1 which will make the computer auto login to the chosen account on next reboot, without having to type in a password. Only lasts once. Has obvious security downsides though but that might be fine.

eastbound 1y ago
But then you could just disable FileVault?
- derefr 1y ago
  I think the point of this technique is to be able to leave the machine locked on cold boot, but to be able to e.g. unlock it, put it to sleep, and go on vacation; and then, if you need to remotely reboot it, you can reboot it in such a way that it stays unlocked on next boot, rather than reverting to locked.
  - kkylin 1y ago
    Generally I have used fdesetup to do remote OS upgrades: do this just before an OS upgrade so that on reboot I can still log in.
  - anyfoo 1y ago
    It's still a little bit like putting your jewelry in a safe, and leaving the key on top of the safe.
    - derefr 1y ago
      I mean, I assume you'd set the unlock-on-reboot flag, and then immediately reboot — at which point the unlock-on-reboot flag gets automatically unset. So, sure, it's a bit like leaving the key on top of the safe... while you have the safe open. Which isn't all that odd.
      - anyfoo 1y ago
        No, the scenario was power outage at an unknown time in the future, not immediate reboot.
    - BHSPitMonkey 1y ago
      When it comes to disk encryption, at least in the home, the threat model isn't somebody sitting around in your home finding a way to exfiltrate the currently-unlocked filesystem; It's someone taking the computer or the drive with them and leaving. In your analogy, the key atop the vault vanishes as soon as the vault is moved from its location (loses power).
      - anyfoo 1y ago
        If that was the case (maybe it is, I don’t know), then how does the proposed solution help against power outages, which was asked for?
        avianlyric 1y ago
        That wasn’t what was asked for. The original reason given was to require a password on cold boot, but not require a password when rebooting e.g. for an OS update
        anyfoo 1y ago
        Well, you've asked me to quote in another subthread, I did. Since I don't fully get what you're referring to now, can you please quote?
    - 1y ago
- johncolanduoni 1y ago
  This only puts the key in NVRAM until the next restart - so if you run it just before you restart an attacker would have to happen to grab the device in those few minutes.
  - anyfoo 1y ago
    The stated problem was power outages. I did not verify the syntax of the proposed solution, but -1 looks like it disables the delay. So, indefinitely until the next reboot? Which, if the key is indeed saved in NVRAM (I don’t know), means someone can take the machine and have it unlocked at their destination.
    - johncolanduoni 1y ago
      It used to be NVRAM at least, but that was before the integrated Secure Enclave. Now it could in theory store it there and only unlock if the boot chain is validated (similar to the automatic TPM-based unlock that Windows uses by default).
      - anyfoo 1y ago
        Right, but my point was, if the idea is to do this to have an automatic unlock on power outages (and if this persists across power outages), it’s not just a few minutes, it’s indefinitely.
    - avianlyric 1y ago
      You’re going to have to quote that the stated problem was power outages. The first comment in this thread was taking about how the linked article solves the power outage problem. But the sub-thread about using the existing utils is only for solving the unlock on reboot problem, and explicitly not solving the cold boot unlock problem.
      - anyfoo 1y ago
        First comment: > So you're saying i can now have a fully remote mac mini server with auto-reboot on power outage without the need to physically log ... Reply: > You can also do this: [...] -delayminutes -1 [...] which will make the computer auto login to the chosen account on next reboot, without having to type in a password. Only lasts once. Has obvious security downsides though but that might be fine. Even though I haven't checked, the "-delayminutes -1" very much sounds to me like it disables the automated reboot, so it waits until the machine reboots for other reasons. Given this and given that it is a direct reply, I personally took it as another solution to the power outage problem, the "reboot" in question actually being a cold boot due to the power outage. Note that I haven't verified whether this works after removing power.
firecall 1y ago
I was also aware of this - but I dont want my Mac to actually auto login, for obvious reasons! I just want me to able to remotely login!
- varenc 1y ago
  You could have another script that immediately triggers the Lock Screen after boot...but agreed this comes with many compromises. But if your Mac is physically secure, and has no keyboard or monitor on it anyway, I don't quite understand the risk? Remote login still requires the password after this of course. But if physical security is a concern it makes sense. Also I suppose there's other risks from having a decryption key sitting in NVRAM.

deleted 1y ago

[deleted]

Reason077 1y ago

You’ve always been able to do this, just not in combination with FileVault.

tristansokol 1y ago

How would you automatically login via ssh?

SXX 1y ago
autossh + sshpass. Work perfectly.

firecall 1y ago

I'm hoping that's the case! Having to physically login to a remote Mac that has FieVault enabled to get it online after a power outage is not ideal! So will I be able to actually remote into the GUI now after a reboot? I've looking at getting a Mac mini for my homelab again, but thinking I'll need one of those remote enable KVM devices!

reader9274 1y ago

Just tested it and it works flawlessly! 1. Enable: General > Sharing > Remote Management 2. After reboot, when trying to SSH you get this message: "This system is locked. To unlock it, use a local account name and password. Once successfully unlocked, you will be able to connect normally." 3. Once you successfully ssh, the ssh connection is closed, and this message is shown: "System successfully unlocked. You may now use SSH to authenticate normally." 4. You have to re-ssh and you're in!

SXX 1y ago
One question for you or anyone who tried it. SSH host (mac) key pre disk unlock is randomly generated and persistent?
- lxgr 1y ago
  I'd be surprised if it were a different key from the regular host key. Most SSH clients I know show a big and often non-overridable warning in case of a changed host key and don't allow (at least not TOFU-style) trusting two keys.
  - SXX 1y ago
    > Most SSH clients I know show a big and often non-overridable warning in case of a changed host key and don't allow (at least not TOFU-style) trusting two keys. You can solve this with HostKeyAlias, but yeah I doubt Apple would do this. Considering other comments mentioning "just SSHing after reboot" it's certainly the same host key. https://stackoverflow.com/questions/733753/how-to-handle-ssh-host-key-verification-with-2-different-hosts-on-the-same-but PS: Another option obviously UserKnownHostsFile, but I would better keep single known hosts file.
    - lxgr 1y ago
      Wow, TIL about HostKeyAlias and CheckHostIP. Especially the latter sounds super useful when it comes to frequently changing private IPs. Thank you!

alerighi 1y ago

I remember the time one of my coworkers accidentally enabled failevault on our CI machine, I had to take it out of the rack, dust it off, connect it to a monitor and keyboard, just to login and disable it. Good thing they made it can be unlocked with SSH, so in case it happens another time I can just do it remotely.

drusklo 1y ago

Honest question; why would you want a server with mac os? I am asking because I thought about getting a mac mini for that purpose, because the hardware is great, but running mac os vs linux is what is throwing me off.

drexlspivey 1y ago
I use it as a plex server and it can handle anything you throw at it. Previously plex was running on the synology NAS itself and it would choke with a couple concurrent transcodes
dbdr 1y ago
Have you considered https://asahilinux.org/ https://asahilinux.org/ ?
- happymellon 1y ago
  It sounds like they already are, and questioning what benefits having a remote MacOS server would give them. Time Machine backups could be one reason?
  - rendx 1y ago
    Time Machine does not require Mac. You can point it to e.g. a SMB share as destination as well.
- rollcat 1y ago
  Unfortunately they only support M1/M2 (last time I checked - hardstuck). It would be a great choice to repurpose existing hardware, but I wouldn't go shopping for Asahi specifically.
mvanbaak 1y ago
A couple of reasons for me to run it: - time machine - photos.app backup (have photos.app download local copies of your iCloud photos library, backup the photos.app files) - build server for ios/ipados/macos apps

amelius 1y ago

Until Apple triggers something that needs user input, such as an AppleID prompt. Then it's back to the data center ...

naikrovek 1y ago
maybe. but until then...
SXX 1y ago
What's wrong with just connecting to mini over VNC? You can even firewall it off and tunnel VNC connection over SSH, or tailscale / zerotier. I dont think there is any single action you cant perform on Mini remoty. Once it's unlocked that is.
- amelius 1y ago
  Maybe actions like "Please enter your AppleID", or a popup showing on your physical screen saying "system has to restart now", which doesn't show in VNC. In any case, you don't want this in a server because these are usually used over SSH and those types of popup will simply not be seen. Also, servers are usually administrated using scripting and those popups wouldn't work anyway.

SXX 1y ago

Yeah this is really cool. Before I had to setup hardware KVM for managing Mac build server. Extra $50 for SiSpeed NanoKVM is okay, but then KVM is effectively MiTM that can siphon the password for disk encryption. Having it work with just properly encrypted SSH is really welcome change.

ubermonkey 1y ago

Oh, this is nice indeed.