Possible to move home directory to an encrypted partition

Question

Level 1

25 points

Possible to move home directory to an encrypted partition

Dear all,

I recently bought a MacBook Pro with a 512SSD and like always, I partitioned the main HDD and was trying to relocate my home directory out of the startup disk. This time I had to do encrypt the 2nd partition as well and that's where the problem starts - I cannot login with my user profile on a encrypted disk. Is there anyway to achieve that?

I came across with this: https://github.com/jridgewell/Unlock but it doesn't work as it's looking for CoreStorage and I don't seem to have one:

$ diskutil cs list

No CoreStorage logical volume groups found

I have to have the full disk-encryption (some regulation at work) this time. Any idea what I can do?

-San

MacBook Pro 13”, macOS 10.14

Posted on Mar 19, 2019 5:56 PM

Reply

Answer 1

Top-ranking reply

John Lockwood

Level 6

13,697 points

Mar 20, 2019 4:26 AM in response to santanu

A MacBook Pro only supports a single internal physical drive - an SSD drive. It could be divided in the multiple partitions/volumes or you would have to also use a second external drive.

If your desire is only to ensure your home directory is on an encrypted drive then you should instead use FileVault2 to encrypt the entire boot drive.

Note: Mojave only supports booting from APFS drives, APFS drives do not use CoreStorage. Mojave does support additional drives using CoreStorage but the boot one as mentioned must be APFS. It is possible to also have additional partitions/volumes on the single internal drive and the additional volumes could be CoreStorage but the boot volume must APFS.

If your desire is to have the home directory on a different physical drive i.e. an external drive then this is possible at least when not encrypted. You would edit the user account details to specify via the hidden advanced options to store the home directory in a different non-standard location.

The problem I see is that before you login there would be no way to trigger the unlocking of a hypothetical encrypted external drive/volume to then make that home directory available during login.

From the rest of your post it seems you are still storing the home directory on the single internal SSD, in which case I can see no reason why not to use FileVault2 and have the entire drive encrypted.

Reply

Answer 2

Mar 20, 2019 2:55 PM in response to santanu

Mojave has built-in FileVault2 support, it does not support the older FileVault1 which actually might have accomplished what you want. FileVault1 instead of encrypting the entire boot drive merely encrypted the users home directory inside a disk image file and I believe it would have been possible to locate the disk image on a different volume.

You turn FileVault2 on using System Preferences -> Security & Privacy -> FileVault

There are other third-party equivalents to FileVault2 such as PGP Whole Disk Encryption and CheckPoint Full Disk Encryption however they work in a very similar way to FileVault2 so would have the same limitations as far as you are concerned.

Reply

Answer 3

santanu Author

Level 1

25 points

Mar 20, 2019 12:00 AM in response to CraZ_Dude

I was under impression that CS was introduced for fusion drive and OS X automatically converts into it if required.

But any way, I did try the cs convert command but getting error saying:

$ sudo /usr/sbin/diskutil cs convert /dev/disk1

Password:

Error converting disk to CoreStorage: A GUID Partition Table (GPT) partitioning scheme is required (-69773)

I didn't dig any deeper though but do you know the reason?

-S

Reply

Answer 4

santanu Author

Level 1

25 points

Mar 20, 2019 11:56 AM in response to John Lockwood

thaks John for replying!

All good what you have mentioned and learned those things a bit hardway, as I didn't use Mojave with SSD until now.

As far as my requirment goes, I don't need to have my home directly on seperate physical drive but on the diffrent partitions/volumes partation on the same internal drive, which I have been doing for ages now. I donlt have any issue with have APFS as the bot partation but looks like the 'SSD + aditional_partation + excrypted APFS + home_dir' combo won't work? Isn't FV2 used by default on Mojave? And will it help to unlock thw 2nd drive with user profile in it for login in?

All I need is the home directory on the 2nd partation (on the same internal drive), with encrypted volume.

-S

Reply

Answer 5

santanu Author

Level 1

25 points

Mar 20, 2019 2:13 PM in response to John Lockwood

You might be able to have a FileVault2 encrypted APFS boot drive with a second volume also APFS and also encrypted containing the home directory. This has never been tried as far as I am aware.

That's exactly the goal but after doing so, I cannot login to my account anymore (for the obvious reason that it cannot decrypt the volume during the system startup to get to the profile. Having user a/c on the boot drive or not having encryption is not an option for me; I could do the rest of the other options staright away, long time ago, if I didn't have the restriction(s). So, you saying I donlt have anyone choice? What's the next closest thing I can do?

Ona seperate note, it's by default FileVault2 on OS X 10.14.x, right? no additional things do for that?

-S

Reply

Answer 6

Barney-15E

Level 10

122,870 points

Mar 20, 2019 6:13 PM in response to santanu

Ona seperate note, it's by default FileVault2 on OS X 10.14.x, right?

On Mojave and a laptop, the startup assistant defaults to turning FileVault on, but you can change it.

On a new Mac that has a T2 chip, the entire drive is encrypted even if FileVault is off.

Reply

Answer 7

Mar 19, 2019 10:00 PM in response to santanu

You need a Core Storage encrypted volume to use the program.

Reply

Answer 8

santanu Author

Level 1

25 points

Mar 19, 2019 11:28 PM in response to CraZ_Dude

hi CraZ_Dude, thanks for the reply.

How do I do CoreStorage encrypted volume? I didn't find any option to do that. Is there any howto or something available that I can follow?

-San

Reply

Answer 9

Mar 19, 2019 11:30 PM in response to santanu

try this: https://blog.fosketts.net/2012/10/03/mac-os-corestorage-convert/

Reply

Answer 10

babowa

Level 9

78,580 points

Mar 20, 2019 3:29 PM in response to santanu

it's by default FileVault2 on OS X 10.14.x, right?

It is available, but not on by default.

Reply

Answer 11

santanu Author

Level 1

25 points

Mar 21, 2019 12:05 AM in response to Barney-15E

This is what I have at the moment - how do I know if it is FileVault2 or not?

-S

Reply

Answer 12

Mar 21, 2019 2:35 AM in response to santanu

macOS has only supported FileVault2 for many years, so if your running Mojave you are definitely using FileVault2.

Reply

Answer 13

Mar 20, 2019 12:40 PM in response to santanu

You could have a non-encrypted APFS boot drive with the home directory on a non encrypted second volume which could APFS or Core Storage.

You could have a FileVault2 encrypted APFS boot drive with the home directory on it.

You could have a FileVault2 encrypted APFS boot drive with the home directory on it and a second volume used as a data volume encrypted with either the same FileVault2 software or some other software.

You might be able to have a FileVault2 encrypted APFS boot drive with a second volume also APFS and also encrypted containing the home directory. This has never been tried as far as I am aware.

Note: Normally accessing a second FileVault2 volume during login would not work because the key to unlock it is stored in the users keychain at least this is how it used to be prior to APFS I am not sure if this would apply here as I said this has never been tried so you would have to experiment. It maybe copying any relevant keychain entry to the System keychain instead might get round this.

You cannot have a have the home directory on a second volume encrypted by something else as there would be no way to access it during the login.

Reply

Possible to move home directory to an encrypted partition

Similar questions