Any way to enable swapfile encryption in Tiger server?

[sofgan]

I’m finding cleartext passwords in the swapfiles, which is horrifying. The option to encrypt VM, which is available in the Security prefpane in the client version, is not available in the server version. I’ve tried adding the following line to /etc/hostconfig

ENCRYPTSWAP=-YES-

but it has no effect (after rebooting.) It’s not clear why. The kernel seems to be the same as the client version, and the /etc/rc script, which reads the above line from hostconfig, is the same.

Thanks in advance for helpful responses.

[sofgan]

MacTroll wrote:

Interesting…

Bad app leaving password in swap!

You know which app is doing this?

I imagine you’re unable to turn this on on the server as it wouldn’t make that much sense. You’d need to be root to read the files, and presumably not traveling with your server where the drive could easily be gotten to.

However, there is no difference in the kernel between server and client. The actual setting of the encryption is done in /etc/rc. Look in there for a line about encrypting the swap, it then passes a -E to the dynamic pager.

I think loginwindow.app is responsible.

Turning swap encryption on makes plenty of sense to me. My server isn’t under 24-hour armed guard. It hosts encrypted data, and I don’t want that data to be compromised if the server comes under physical attack.

As I said in my original post, I know that swap encryption is initialized from /etc/rc, and I know that the server and client kernels are the same. What I don’t know is why it doesn’t work in the server version. I suspect that dynamic_pager is checking ServerVersion.plist and ignoring the -E option if it’s present.

[sofgan]

MacTroll wrote:

So hard code it in /etc/rc and see what happens. Don’t give it the option of checking.

The checking doesn’t happen in /etc/rc. When the ENCRYPTSWAP directive is present in /etc/hostconfig, /etc/rc passes the -E option to dynamic_pager. For some reason, the option is ignored on Server.

[Author]

Posts