Forum Replies Created
-
Posts
-
MacTroll wrote:
So hard code it in /etc/rc and see what happens. Don’t give it the option of checking.
The checking doesn’t happen in /etc/rc. When the ENCRYPTSWAP directive is present in /etc/hostconfig, /etc/rc passes the -E option to dynamic_pager. For some reason, the option is ignored on Server.
MacTroll wrote:
Interesting…
Bad app leaving password in swap!
You know which app is doing this?
I imagine you’re unable to turn this on on the server as it wouldn’t make that much sense. You’d need to be root to read the files, and presumably not traveling with your server where the drive could easily be gotten to.
However, there is no difference in the kernel between server and client. The actual setting of the encryption is done in /etc/rc. Look in there for a line about encrypting the swap, it then passes a -E to the dynamic pager.
I think loginwindow.app is responsible.
Turning swap encryption on makes plenty of sense to me. My server isn’t under 24-hour armed guard. It hosts encrypted data, and I don’t want that data to be compromised if the server comes under physical attack.
As I said in my original post, I know that swap encryption is initialized from /etc/rc, and I know that the server and client kernels are the same. What I don’t know is why it doesn’t work in the server version. I suspect that dynamic_pager is checking ServerVersion.plist and ignoring the -E option if it’s present.
