Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We would like to encrypt the entire disk of a Snow Leopard workstation running some sensitive file, database and web services. PGP does not yet work for 10.6, and we cannot use FileVault as it is not compliant with FIPS and would require non-standard installation of services.

What whole-disk options are available that are known to work with Snow Leopard?

share|improve this question

5 Answers 5

up vote 1 down vote accepted

It looks like the PGP WDE beta has opened. I'm beta testing it now and it appears to be working fine on Snow Leopard 10.6.2

share|improve this answer

I can also confirm that the Checkpoint FDE solution is incompatible with Snow Leopard. So far they haven't got back to me with an estimated release date. PGP however are soliciting beta testers for their FDE update which will support 10.6.

share|improve this answer

I would say that encrypting the whole disk is probably going to increase overhead of the system. I would use Disk Utility to create a disk image that's password protected, and thus encrypted. Mount it as a startup item and then create symlinks in your filesystem to its mount point.

So if the disk image was called "Secret-Image" and it was for a postgres database then you would mount the image and make the symlink ln -s /Volumes/Secret-Image /var/lib/pgsql

share|improve this answer

PGP Whole Disk Encryption (10.0.1) does now work on Snow Leopard (10.6.3), and it seems to work well. On my MacBook Pro, there is no noticeable reduction in overall system performance with PGP WDE, except that the boot process takes about 15 seconds longer than usual.

I can recommend PGP Whole Disk Encryption, but for email encryption I find PGP's commercial product a bit klunky (it's proxy-based so it doesn't integrate with Mail.app in any way). For PGP email, I use Thunderbird + its EnigMail PGP plugin, which seems smooth so far, even though it meant ditching Apple's Mail.app. Fortunately Thunderbird 3.0 is polished, and integrates with Address Book and Spotlight.

I would argue against using Apple's FileVault to provide filesystem security. Firstly of course it's less secure (it can't protect the operating system binaries and config files from tampering - it only protects your user files). Secondly I've tried FileVault on my home directory in the past, and it was noticeably slower at starting up and especially at shutting down. If you want encryption, I think it's faster and smoother to encrypt the filesystem rather than using an encrypted file container.

  • Martin
share|improve this answer

TrueCrypt is an option to keep an eye on, though like PGP, it does not yet work on Snow Leopard

share|improve this answer
    
At this point, TrueCrypt only does whole disk encryption on Windows, not Linux or any version of OS X (I'm not disagreeing, I'm just being more specific). –  emgee Oct 17 '09 at 2:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.