Apple: SSH and FileVault

Re:Apple: SSH and FileVault by reader9274 on Friday September 19, 2025 @01:48AM (#45298327)

Just tested it and it works flawlessly!

1. Enable: General > Sharing > Remote Management

2. After reboot, when trying to SSH you get this message:

"This system is locked. To unlock it, use a local account name and password. Once successfully unlocked, you will be able to connect normally."

3. Once you successfully ssh, the ssh connection is closed, and this message is shown:

"System successfully unlocked. You may now use SSH to authenticate normally."

4. You have to re-ssh and you're in!

[ Parent | on HN ]

Re:Apple: SSH and FileVault by SXX on Friday September 19, 2025 @08:11AM (#45300726)

One question for you or anyone who tried it. SSH host (mac) key pre disk unlock is randomly generated and persistent?

[ Parent | on HN ]

Re:Apple: SSH and FileVault by lxgr on Friday September 19, 2025 @08:35AM (#45300955)

I'd be surprised if it were a different key from the regular host key.

Most SSH clients I know show a big and often non-overridable warning in case of a changed host key and don't allow (at least not TOFU-style) trusting two keys.

[ Parent | on HN ]

Re:Apple: SSH and FileVault by SXX on Friday September 19, 2025 @08:47AM (#45301073)

  > Most SSH clients I know show a big and often non-overridable warning in case of a changed host key and don't allow (at least not TOFU-style) trusting two keys.

You can solve this with HostKeyAlias, but yeah I doubt Apple would do this. Considering other comments mentioning "just SSHing after reboot" it's certainly the same host key.

  https://stackoverflow.com/questions/733753/how-to-handle-ssh-host-key-verification-with-2-different-hosts-on-the-same-but

PS: Another option obviously UserKnownHostsFile, but I would better keep single known hosts file.

[ Parent | on HN ]

Re:Apple: SSH and FileVault by lxgr on Friday September 19, 2025 @08:52AM (#45301126)

Wow, TIL about HostKeyAlias and CheckHostIP. Especially the latter sounds super useful when it comes to frequently changing private IPs. Thank you!

[ Parent | on HN ]

Re:Apple: SSH and FileVault by nazarewk on Friday September 19, 2025 @10:27AM (#45302048)

I actually turned it on after the update with General > Sharing > Remote Login.

It's worth noting I had to disable and re-enable (I had it enabled to begin with) this option for SSH to start working.

Remote Management option didn't change anything for me and is currently turned off.

[ Parent | on HN ]

Re:Apple: SSH and FileVault by reader9274 on Sunday September 21, 2025 @01:01PM (#45324534)

Ah, I use Remote Management because I also do screen sharing on this mac mini from time to time

[ Parent | on HN ]

Re:Apple: SSH and FileVault by kylehotchkiss on Friday September 19, 2025 @08:22PM (#45308439)

If you had it on prior to the MacOS update with FileVault off, MacOS automatically enabled FileVault and didn't flip the switch with SSH to support this.

So now I have a Mac mini that I have to unmount and connect to a screen to get working again. blerg

[ Parent | on HN ]