Re: [Fed-Talk] How to tell if FileVault is being used on a computer
Re: [Fed-Talk] How to tell if FileVault is being used on a computer
- Subject: Re: [Fed-Talk] How to tell if FileVault is being used on a computer
- From: "Simon, Gary" <email@hidden>
- Date: Thu, 31 Jan 2008 17:19:25 -0700
- Acceptlanguage: en-US
- Thread-topic: [Fed-Talk] How to tell if FileVault is being used on a computer
Title: Re: [Fed-Talk] How to tell if FileVault is being used on a computer
So sudo ls -la /Users/.* | grep .sparseimage will get logged in users
And sudo ls -la /Users/* | grep .sparseimage will get non logged in users
Seems simple enough....
On 1/31/08 4:51 PM, "Peter Link" <email@hidden> wrote:
try
sudo ls -la /Users/.* | grep .sparseimage
This is where the unmounted sparseimage (not sparsebundle) is
located. I tried this ssh'ing into my operating MBP from a remote
MBP. It lists my 39GB sparseimage.
At 4:40 PM -0700 1/31/08, Simon, Gary wrote:
>But not if the user is currently logged on.... The sparsedisk image doesn't
>appear in a readable directory that I can tell. The user's directory looks
>like a regular home directory. At least on 10.4.x
>
>Gary
>
>
>On 1/31/08 4:26 PM, "Dave Schroeder" <email@hidden> wrote:
>
>>
>> On Jan 31, 2008, at 5:18 PM, Simon, Gary wrote:
>>
>>> I am trying to come up with a way to look at our Macs remotely and
>>> tell whether they are using FileVault for any of the users on the
>>> system. Is there some file or files that would only be present if
>>> FileVault was in use? Or maybe a plist file that lists users that
>>> are using FileVault? So far I have not been able to find anything.
>>>
>>> I do know that /Library/Keychains/FileVaultMaster.keycahin
>>> (and .cer) will be present if a master password is set. However,
>>> you could have a master password set and still not using FileVault
>>> for any users.
>>>
>>> Also, when you turn FileVault for a user there is an entry in /
>>> Volumes/.com.apple.FileVault created for that user. However, if
>>> that user turns off FileVault, it doesn't seem to remove that entry.
>>>
>>> Any ideas?
>>>
>>> Gary Simon
>>> CSU TechDev
>>> Sandia National Laboratories
>>
>> If there are any instances of /Users/username/username.sparsebundle,
>> FileVault is currently in use for that account.
>>
>> sudo ls -la /Users/*/ | grep .sparsebundle
>>
>> will return
>>
>> drwx------@ 6 test staff 204 Jan 31 17:22 test.sparsebundle
>>
>> for any users using FileVault.
>>
>> - Dave
>
>
> _______________________________________________
>Do not post admin requests to the list. They will be ignored.
>Fed-talk mailing list (email@hidden)
>Help/Unsubscribe/Update your Subscription:
>
>This email sent to email@hidden
--
Peter Link
Cyber Security Analyst
Cyber Security Program
Lawrence Livermore National Laboratory
PO Box 808, L-315
Livermore, CA 94550
email@hidden
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Fed-talk mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden