Recommended encryption methods

Question

Level 1

25 points

Recommended encryption methods

Hi,

Can anyone recommend a method of encryption that will allow network users to log into machines that are encrypted?

FileVault is good but it only seems to work with local user accounts which is no good.

Encrypting a disk from scratch is not ideal either as I have some unencrypted 10.6 machines I will be upgrading and leaving intact.

Also, I would like something that has a console or something that I can verify remote machines compliance by showing they are encrypted to auditors.

Has anyone else had this issue and resolved it with a particular product?

Thanks
Rob

Posted on Nov 13, 2012 12:53 AM

Reply

Answer 1

Linc Davis

Level 10

209,541 points

Nov 13, 2012 1:55 PM in response to rannable

FileVault is good but it only seems to work with local user accounts which is no good.

Why is it no good?

Reply

Answer 2

rannable Author

Level 1

25 points

Nov 14, 2012 12:01 AM in response to Linc Davis

Because I need a networked user to log in. FileVault is for local users, there is no option to add networked users.

What I will have to do is create a non-admin local account, allow that to boot with FileVault, give that password to the network users, they will then have to login as the wrong user, log back out and then in as themselves.

Which is crazy and I can't imagine why anyone would go for this.

Reply

Answer 3

Linc Davis

Level 10

209,541 points

Nov 14, 2012 6:13 AM in response to rannable

No form of WDE is going to support pre-boot authentication over the network. You're asking for something that doesn't exist.

Reply

Answer 4

rannable Author

Level 1

25 points

Nov 15, 2012 12:50 AM in response to Linc Davis

Well McAfee Endpoint Encryption does this, as does some of their competitors.

For future reference I have figured out a way to do it- by making network users "mobile" users and logging in as them I can then choose those users to boot using their network passwords.

Reply

Answer 5

rannable Author

Level 1

25 points

Nov 15, 2012 6:29 AM in response to rannable

(ok it isnt pre boot authentication but it caches the network password)

Reply