Headless mac Mini M1 on Big Sur

Question

Level 1

5 points

Headless mac Mini M1 on Big Sur

So, I just rack mounted a M1 macMini, right next to a 2012 macMini.

There are a number of issues with the M1 mac that I don't have with the Intel Mac, these are most likely due to the different in OS.

The M1 will not respond to Remote Management unless it's logged in. So, you have to figure out how to authenticate to it constantly, which is a significant challenge on a headless installation.

The only solution I've found is to:

Disable FileVault
Set my user account to auto-login
Disable require password at screen saver (so disable the auto-screen lock
Disable authentication with Apple Watch

The result is a useable, headless, macMini M1

The security risks are minimal, because you'd have to break into my house, find my server rack, disassemble the rack with the minis in it (assuming you knew what you were looking for), and then take the macMini.

At that point, sure, an attacker would have access to all of the files on the mini. Again, that risk is minimal.

The real breaking issue here is FileVault. The login password is the same as the FileVault authorization key and as such, you cannot have auto-login with FileVault enabled. I'm okay with that.

What I'm not okay with is that ARD doesn't work at all until you've logged into the system. That's just silly and renders a whole series of valid and useful security options inoperable.

Why can't the ARD daemon run in the background at boot and then allow me to access the system and authenticate normally like every other system on the planet? Seems odd.

Mac mini, macOS 11.4

Posted on May 31, 2021 9:04 AM

Reply

Answer 1

robpickering Author

Level 1

5 points

May 31, 2021 9:11 AM in response to robpickering

Quick update to this...

After playing around a bit, the primary limiting factor is FileVault itself.

You DO NOT need to:

Set the user account to auto-login
Disable require password at screen saver (so disable the auto-screen lock
Disable authentication with Apple Watch (although I left this disabled, it's just annoying)

So, in my set-up I've re-enabled a username/password only login (no choices, so you'll have to brute-force the username too), and re-enabled a password on screen saver/lock.

With FileVault disabled, the headless experience seems to be as expected.

Reply

Answer 2

May 31, 2021 12:46 PM in response to robpickering

FWIW, if this is a headless Mini, there is no reason to

have a screen saver enabled unless you have some

specific reason for using it. Nor should you be concerned

about sleeping it either as it draws a lot less power than

any Intel Mini.

Just a mention as either of those could be causing some

oddities, especially any sleep function.

Reply

Answer 3

robpickering Author

Level 1

5 points

May 31, 2021 2:29 PM in response to woodmeister50

Agree on the screensaver.

Disagree on sleeping it, as when it sleeps ARD seems to have issues re-connecting.

Unless you were suggesting to NOT sleep it, as that's what I do.

CORRECTION: Just actually went to check it and ARD showed it was sleeping and when I connected it immediately woke up, crazy fast too, I love these M1s!

Reply

Answer 4

Jun 1, 2021 4:18 AM in response to robpickering

robpickering wrote:

....

Unless you were suggesting to NOT sleep it, as that's what I do.

...

Probably didn't word it the best way but that is what I meant.

Just as an aside, I don't know if you noticed it on your 2012 Mini

and even the new one, if after a while you see any "slowness"

in connection creeping in, reboot. At least that is what I found

with my 2010 Mini running High Sierra that over time connecting

and downloading will tend to slow a bit so I periodically reboot

and things are back to what they were. Maybe has something to

do with RAM or disk caches or some such thing.

Reply

Headless mac Mini M1 on Big Sur

Similar questions