SecureDoc for Mac v6.1 User Manual
Copyright 1997-2012 by WinMagic Inc. All rights reserved. Printed in Canada Many products, software and technologies are subject to export control for both Canada and the United States of America. WinMagic advises all customers that they are responsible for familiarizing themselves with these regulations. Exports and reexports of WinMagic Inc. products are subject to Canadian and US export controls administered by the Canadian Border Services Agency (CBSA) and the Commerce Department s Bureau of Industry and Security (BIS). For more information, visit WinMagic s web site or the web site of the appropriate agency. WinMagic, SecureDoc, SecureDoc Enterprise Server, Compartmental SecureDoc, SecureDoc PDA, SecureDoc Personal Edition, SecureDoc RME, SecureDoc Removable Media Encryption, SecureDoc Media Viewer, SecureDoc Express, SecureDoc for Mac, MySecureDoc, MySecureDoc Personal Edition Plus, MySecureDoc Media, PBConnex and SecureDoc Central Database are trademarks and registered trademarks of WinMagic Inc., registered in the US and other countries. All other registered and unregistered trademarks herein are the sole property of their respective owners. 2012 WinMagic Inc. All rights reserved. Acknowledgements This product includes cryptographic software written by Antoon Bosselaers, Hans Dobbertin, Bart Preneel, Eric Young (eay@mincom.oz.au) and Joan Daemen and Vincent Rijmen, creators of the Rijndael AES algorithm. This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org/) WinMagic would like to thank these developers for their software contributions. Contacting WinMagic WinMagic 200 Matheson Blvd West, Suite 201 Mississauga, Ontario, L5R 3L7 toll free: 1-888-879-5879 phone: (905) 502-7000 fax: (905) 502-7001 Sales: sales@winmagic.com Marketing: marketing@winmagic.com Human Resources: hr@winmagic.com Technical Support: support@winmagic.com For information: info@winmagic.com For billing inquiries: finance@winmagic.com WinMagic Inc. SecureDoc for Mac User Manual 2
About SecureDoc for Mac SecureDoc for Mac securely encrypts the hard disk in your Mac computer (desktop or laptop). When the disk has been encrypted, SecureDoc's pre-boot authorization window (boot logon) appears each time you start the computer. At this window you must enter a SecureDoc password to complete the authentication and gain access to the encrypted data on your Mac. SecureDoc for Mac can also be used to encrypt and decrypt USB flash drives, protecting them with either a password or a key. This manual describes the functions of both SecureDoc for Mac when installed as a standalone application, or when installed as part of a SecureDoc Enterprise Server (SES) environment; the differences between the two will be noted in the document. WinMagic Inc. SecureDoc for Mac User Manual 3
About SecureDoc for Mac 3 Getting Started with SecureDoc for Mac 6 SecureDoc for Mac or FileVault 2 6 System Requirements (SecureDoc for Mac) 6 Installing SecureDoc for Mac 6 Step 1: Installing Software 6 Step 2: Encrypting a Hard Disk 8 Step 3: Create Data Recovery Media 8 SecureDoc and Boot Camp 10 Silent Installation 10 Accessing the encrypted hard disk 10 For SED Users: Firmware Updates 11 Uninstalling SecureDoc for Mac 12 Using SecureDoc for Mac 13 Customizing Boot Logon 13 Encrypting USB Media 14 Accessing Encrypted Removable Media 16 Accessing Using Encryption Key 16 Accessing Using Password 17 Working with Password-Protected USB Media 17 Changing your Password 18 Acceptable Passwords 19 Changing or Setting Self-Help Answers 20 Recovering from a Lost Password 20 WinMagic Inc. SecureDoc for Mac User Manual 4
Creating a Backup Key File 20 Using Recovery Media 21 Performing Cryptographic Engine Tests 21 Enabling/Disabling Hardware Protection (SED Boot Drive Only) 22 Enabling/Disabling Single Sign-On or Single Sign-On and Password Sync 22 Communicating with the Server 23 Performing Crypto-Erase 23 SecureDoc and FileVault 2 24 System Requirements 24 Installation and encryption 24 Giving local accounts access to the encrypted drive 26 Removing SecureDoc and FileVault 2 encryption 27 WinMagic Inc. SecureDoc for Mac User Manual 5
Chapter 1 SecureDoc for Mac or FileVault 2 GETTING STARTED WITH SECUREDOC FOR MAC Your SES administrator may have given you a FileVault 2 installation package. FileVault 2 is the native encryption engine on the Mac OS X operating system. SES can manage devices with both SecureDoc (i.e., SecureDoc for Mac) or FileVault 2 encryption. If you have a FileVault 2 installation package (check the filename), then see "Securedoc and FileVault 2" on page 1. If you have a SecureDoc for Mac installation package, then follow the instructions in this chapter. System Requirements (SecureDoc for Mac) Operating system and hardware requirements are listed here. To create data recovery media (highly recommended), you need a USB flash drive, CD, or DVD of at least 32MB capacity that can be reserved exclusively for data recovery purposes. Installing SecureDoc for Mac Before installing SecureDoc for Mac we recommend that you backup your computer and then run a disk utility to check the status of your hard drive. Step 1: Installing Software Note: If you are installing SecureDoc for Mac on a laptop, then make sure the laptop is connected to a power supply for the duration of the installation and encryption process. 1. Log in to the Mac with an account that has administrator rights. Note: If your Mac has multiple bootable volumes, log in to the volume where you want SecureDoc installed. Any additional Mac bootable volumes will be encrypted but cannot be used to start your Mac (boot logon can access only your primary volume). 2. For standalone users, download the appropriate zip file (for example, WinMagicxdSecureDocMacStandAlone) from the WinMagic web site and unzip WinMagic Inc. SecureDoc for Mac User Manual 6
Getting Started with SecureDoc for Mac Installing SecureDoc for Mac it. A folder is created, containing the SDMacintosh.dmg file.for users in an SES environment, obtain the SDMacintosh.dmg file from your SES administrator. 3. Double-click this file to mount the disk image. 4. Double-click the pkg file and, on the Welcome dialog, click Continue. 5. Read, print or save the software license agreement. Click Continue. To continue, you must agree to the terms of the license agreement. 6. Confirm that the current volume is the one where you want to install SecureDoc for Mac (defaults to current volume). If you want to install on another volume, stop the installation, log in to that volume, and re-start installation. 7. Choose a location for the installation. 8. Click Install. You are prompted to re-enter the administrator userid and password. Note: In an SES environment, recovery keys are sent to the server at this point. 9. For standalone users, you are prompted to enter an initial password. 10.You are warned that installing the software requires a restart and prompted to choose whether to continue. 11.Installation progress is shown. When installation is complete, you are prompted to click Restart to restart your computer. 12.When the computer restarts, the SDForm dialog appears, showing the identifying information for your computer. Click Submit. In a standalone environment, if you did not already do so, you will be asked to set a password (you can change this password later, if necessary). In an SES environment, this information is communicated to SES. Note: In an SES environment, if at any time communication with SES fails, you may be prompted to continue the installation locally. Your computer will continue to attempt to communicate with SES at regular intervals. WinMagic Inc. SecureDoc for Mac User Manual 7
Getting Started with SecureDoc for Mac Installing SecureDoc for Mac Step 2: Encrypting a Hard Disk Note: Encryption will continue even if you log off. 1. Encryption starts automatically. Note: If you are not in an SES environment, and you have an SED device, you are prompted to choose hardware or software encryption. If you choose Hardware, the encryption process will be very fast; if you choose Software, the encryption process is slower. 2. A progress indicator shows the percentage of the hard disk encrypted (in an SES environment, this indicator may be hidden). The length of this process depends on the size of the hard disk: approximately 28-40 GB is encrypted per hour. Note: You may continue with other work while the encryption takes place. 3. Once the hard disk has been encrypted, SES users are prompted for a new password to replace the temporary password (this was provided by your SES administrator) used during initial encryption. See Acceptable Passwords on page 19 for instructions on how to choose a password. SES users may also be prompted to answer self-help password recovery questions. Note: Remember your new password: you will need it to login to your computer (at pre-boot) and to login to the SecureDoc Control Center. Step 3: Create Data Recovery Media Note: In an SES environment, data recovery media is usually created by the SES administrator, but you can also create it yourself. Data recovery media can be used to access encrypted data if for some reason boot logon does not appear. You can choose to create recovery media on a USB drive or a CD/DVD. Be sure you have available a USB flash drive of at least 32MB capacity, a CD, or a DVD that can be reserved exclusively for data recovery purposes. Note: If you use a USB flash drive, the entire contents of the drive are overwritten. Once this process is complete, you cannot use the USB flash drive for any other purpose. 1. In the SecureDoc Control Center, select Recovery Actions. WinMagic Inc. SecureDoc for Mac User Manual 8
Getting Started with SecureDoc for Mac Installing SecureDoc for Mac 2. Choose the type of media to use for data recovery. If you choose to use a USB, connect the USB flash drive and click OK. If you choose a CD/DVD, you will be prompted to insert it at the appropriate time. 3. Click OK to copy the recovery files to the media. Once SecureDoc has finished writing recovery media, remove it and store it in a safe place. WinMagic Inc. SecureDoc for Mac User Manual 9
Getting Started with SecureDoc for Mac SecureDoc and Boot Camp SecureDoc and Boot Camp If you use Boot Camp to boot into another OS (which must be on a self-encrypting drive), you must 1. Enter your username and password but do not press Enter. Instead, press F12. 2. When the machine re-boots, hold the ALT key. You will be prompted to choose the OS you want to boot into. Silent Installation Your SES administrator may have used silent installation, which allows SecureDoc to be installed without your involvement. The first phase of installation is done before you log on to your Mac account, at which time the second phase of installation occurs. If installation is not completed when you log out, it will continue until complete, at which point you will have access to SecureDoc. Accessing the encrypted hard disk Once SecureDoc for Mac is installed and your disk is encrypted, you will see boot logon each time you restart your computer. It prompts for two things: key file just press Return to use the default key file, either stored on the computer itself or, if in an enterprise environment where Preboot Networking is being used, on the network SecureDoc password. If preboot authentication is done through the network and the network is not currently available, you will see an error message: clear the userid field to authenticate locally. Note: SED users who chose hardware encryption will see boot logon only when they turn the computer on and off again. Note: SES users may not see boot logon at all. If you want to boot to a CD/DVD or any other bootable Mac media (for example, for repairing an encrypted fixed disk), press and hold ALT after entering your key file and password. You are prompted to choose from a list of available bootable devices. You can change the password at any time, as described in Using SecureDoc for Mac on page 13. SES users may have a limit set to the number of attempts they can make to log in. After this limit is reached, the computer may reboot or become locked, requiring administrator support. The SecureDoc icon appears on the menu bar. When the disk is encrypted, this icon has both a dark border and a dark image. If the disk is not yet fully encrypted, the border and/or image are lighter. WinMagic Inc. SecureDoc for Mac User Manual 10
Getting Started with SecureDoc for Mac For SED Users: Firmware Updates For SED Users: Firmware Updates When you do a firmware update on an SED, you need to disable the hardware protection option. When the update is complete, be sure to enable hardware protection again. WinMagic Inc. SecureDoc for Mac User Manual 11
Getting Started with SecureDoc for Mac Uninstalling SecureDoc for Mac Uninstalling SecureDoc for Mac Note: If you are uninstalling SecureDoc for Mac from a laptop, then make sure the computer is connected to a power supply for the duration of the uninstallation and decryption process. 1. If you encrypted any removable media, decrypt it (following the steps in Using SecureDoc for Mac on page 13) before proceeding. Once SecureDoc for Mac is uninstalled, your computer can no longer access data on removable media encrypted by SecureDoc for Mac. 2. Locate the Applications\ WinMagic folder. Double-click the uninstall file SecDocUninstall. You are prompted to confirm that you want to remove protection. 3. Enter your SecureDoc password and click OK. 4. You are prompted to confirm again. 5. All data is decrypted. This process takes approximately the same amount of time as encryption. 6. You are prompted to complete the uninstall. This restarts your computer. 7. When the computer restarts, the software is automatically uninstalled. WinMagic Inc. SecureDoc for Mac User Manual 12
Chapter 2 Customizing Boot Logon USING SECUREDOC FOR MAC In most cases your administrator will have customized the appearance of the boot logon screen. You can change or remove these settings, but we recommend that you contact your administrator before attempting to do so. 1. Click the SecureDoc icon on the menu bar and select the the SecureDoc Control Center. 2. Select Advanced Actions. 3. Select the Preboot Customization tab and click Set Default to restore the default setting. You can personalize your SecureDoc by adding a different background image for boot logon. Choose Add Customized and browse to the location of the new background image, which must be 24 bit, PNG format, 1024 x 768 and, when zipped (SecureDoc zips the file for you), no larger than 0.5MB. WinMagic Inc. SecureDoc for Mac User Manual 13
Using SecureDoc for Mac Encrypting USB Media Encrypting USB Media If your installation has been configured to allow this, you can choose to encrypt USB media (including, optionally, SED removable media) with any of the following: the default key used to encrypt your hard disk (advisable only if you will not be sharing your media, since anyone with access to that key also has access to your encrypted hard disk data); another key in your key file; a password you specify. This allows you to share your media with another user. The other user will need one of the following: a Mac with SecureDoc on it and either the key or the password used to encrypt the media; a Windows machine with SecureDoc installed on it and either the key or the password used to encrypt the media; a Windows machine with the free Media Viewer (available from WinMagic) installed on it and the password used to encrypt the media. 1. Connect the USB media to the Mac. Note: Enterprise users may have media encrypted automatically, with or without warning. 2. Click the SecureDoc icon on the menu bar and select the SecureDoc Control Center. 3. Select Media Conversion. WinMagic Inc. SecureDoc for Mac User Manual 14
Using SecureDoc for Mac Encrypting USB Media 4. Choose the desired media from the list. 5. Choose how you want the media protected (if you click Choose Key, you see a list of available keys to choose from). If you click Password Based, you are prompted for a password (see below). 6. Choose the method you want to use for encryption: fast mode encrypts only the sectors in use at the moment, then encrypts all new data written to the drive, and is best used for media that has never contained sensitive information; thorough mode encrypts all sectors on the desk, whether used or not, and takes a little longer than fast mode; WinMagic Inc. SecureDoc for Mac User Manual 15
Using SecureDoc for Mac Accessing Encrypted Removable Media 7. Click Encrypt. The encryption process may take a few minutes depending on the size of the media. A message appears when the process is complete. 8. If encrypting SED removable media, you will be prompted to create recovery media and define a recovery password for the removable media. This can be used to access the encrypted removable media without the encryption key. 9. Once encryption is complete, you may remove the media. Accessing Encrypted Removable Media Accessing Using Encryption Key If you protected removable media with a key and are not logged in to the keyfile containing that key, when you insert removable media you are prompted to locate and log in to the appropriate key file. WinMagic Inc. SecureDoc for Mac User Manual 16
Using SecureDoc for Mac Working with Password-Protected USB Media Click Browse Key File and navigate to the appropriate key file, then enter the Password and click OK. If the removable media is a SED, you can, alternatively, navigate to the recovery file path and enter the recovery password. Accessing Using Password When encrypted removable media is inserted into a machine that does not have SecureDoc installed on it, the user is prompted for the password or, for SEDs, for the password or the recovery file and password. Working with Password-Protected USB Media 1. Connect the USB media to the Mac. 2. Click the SecureDoc icon on the menu bar and select the SecureDoc Control Center. WinMagic Inc. SecureDoc for Mac User Manual 17
Using SecureDoc for Mac Changing your Password 3. Select the removable media with which you want to work. 4. To change the password, click Set New Password and, when prompted, enter a new password. To remove the password, leaving the media inaccessible, click Remove Password. You are prompted to confirm. To decrypt the media, click on Decrypt. Changing your Password You can change your password at any time after installation and encryption. You may find that your SecureDoc and Mac passwords have been synchronized, so that changing one changes the other automatically. 1. Click the SecureDoc icon on the menu bar and select SecureDoc Control Center. 2. Select SecureDoc Users. 3. Select the user, and choose Change Password. WinMagic Inc. SecureDoc for Mac User Manual 18
Using SecureDoc for Mac Acceptable Passwords 4. Enter the old (current) password, then enter and confirm the new password. 5. Optionally, to display a hint that can help you remember your password, enter the hint in the Password Hint box (the box appears if your password rules permit it). Note: Be sure the hint does not contain enough information for an illegitimate user to determine the password, or the password itself. 6. Click OK to accept the change. Acceptable Passwords To make sure that your password is secure and difficult to guess, you must use a password that contains at least one of each of the following: upper case letter (A - Z) lower case letter (a - z) numeric character (0-9) non-alphanumeric keyboard character (any other character, such as #,? @, etc.) IMPORTANT: Ensure that you remember your new password: once the computer restarts into the SecureDoc environment, there is no way to recover your data without this password. WinMagic Inc. SecureDoc for Mac User Manual 19
Using SecureDoc for Mac Changing or Setting Self-Help Answers Changing or Setting Self-Help Answers Use this feature to define a set of self-help questions and answers to be used for password recovery. If your installation was configured to use this feature, you can change the answers to questions originally posed at installation. Click the SecureDoc icon on the menu bar and select the SecureDoc Control Center. Choose Change Self-Help Answers. Enter questions and the corresponding answers, then click OK. Enterprise users will not be able to change the questions. Recovering from a Lost Password If you can t remember your password, at boot logon, press Enter, then press F8 and follow the instructions to perform a challenge/response password recovery or press F9 to provide answers to the self-help password recovery questions you provided when your drive was initially encrypted. When you have answered all the questions, your answers are compared to those you gave originally. If you answered any of the questions incorrectly, you are returned to the boot logon screen to try again. If you successfully answered all of the questions your Mac starts up as normal. You are immediately taken to the Change Password screen to assign a new password. Creating a Backup Key File A backup key file can be used if you forget your password or make an error when changing your password. The backup contains your encryption keys and requires no password or token to gain access, so it must be kept safe and secure at all times. 1. Click the SecureDoc icon on the menu bar and select the SecureDoc Control Center. 2. Choose Recovery Actions, then Create key file. WinMagic Inc. SecureDoc for Mac User Manual 20
Using SecureDoc for Mac Using Recovery Media 3. Re-enter the password used to access your encrypted hard disk. 4. Enter a recovery password and browse to the location where the key file should be created. 5. Click OK. This function creates a file called Securdoc.dbk (note the lack of an e ) in the specified location. Note that a backup key file is not the same thing as a copy: a copy requires the key file password to access. Using Recovery Media If for some reason boot logon does not appear, use your data recovery media (you may need to get this media from your SES administrator). Connect or insert the data recovery media, then hold down Option while restarting your computer. Choose to reboot from the drive containing the recovery media and follow the instructions that appear. Note: You will need to know the SecureDoc password that was in effect when you created the media. Performing Cryptographic Engine Tests You can run tests to ensure the cryptographic engine is running correctly, or to check the integrity of your computer s boot files to ensure they have not been tampered with or corrupted on boot-up. 1. Click the SecureDoc icon on the menu bar and select the SecureDoc Control Center. 2. Select Advanced Actions. 3. Select Perform Cryptographic Engine Self-Test or Perform Cryptographic Engine Integrity Test. WinMagic Inc. SecureDoc for Mac User Manual 21
Using SecureDoc for Mac Enabling/Disabling Hardware Protection (SED Boot Drive Only) Enabling/Disabling Hardware Protection (SED Boot Drive Only) Under normal circumstances, you would not disable hardware protection for your SED boot drive, since doing so makes the drive available to anyone. However, to upgrade SecureDoc you need to disable hardware protection (you will be prompted to enable it again as soon as the software is upgraded. The option to disable and enable hardware protection appears on the SecureDoc options menu. Enabling/Disabling Single Sign-On or Single Sign-On and Password Sync Single sign-on means that when you log on to boot logon, you automatically also log on to your Mac. Password sync means that changes to your boot logon password affect your Mac password, and vice versa. In an SES environment, these options may have been configured for you. To enable or disable these features, click the SecureDoc icon on the menu barand select SecureDoc Control Center. Choose Advanced Actions, then Settings, then Enable/Disable Single Sign On or Enable/Disable Single Sign On and Password Sync (both are toggles). You will be prompted for the password for your Mac account (local or network). WinMagic Inc. SecureDoc for Mac User Manual 22
Using SecureDoc for Mac Communicating with the Server Note: If your account password is changed or the account is deleted, you will be prompted, after logging on to boot logon, to enter the new password, define a new account for Single Sign-On, or disable the option. Communicating with the Server Normally communication between your computer and the server is done, at intervals, in the background. If you want to manually establish communication with the server (for example, on the request of your administrator) you can do so. Click the SecureDoc icon Performing Crypto-Erase on the menu bar and select Communicate with Server. At pre-boot or after the Mac OS has started, you can crypto-erase your computer, removing the encryption key and rendering it inaccessible. This is done only under exceptional circumstances. At the appropriate time, press the key sequence your administrator defined for this function. This takes effect immediately. If the key sequence is used at pre-boot, login will be denied. If it is used after the OS has started, the system will shut down as soon as the sequence is entered and access will be denied to all users. WinMagic Inc. SecureDoc for Mac User Manual 23
Chapter 3 System Requirements SECUREDOC AND FILEVAULT 2 Operating system requirements are listed here. Installation and encryption 1. Login to the Mac with an account that has administrator rights. 2. Double-click on the SDFVMac.pkg file (from your SES administrator). 3. Click Continue to review the ReadMe and the license agreement. WinMagic Inc. SecureDoc for Mac User Manual 24
SecureDoc and FileVault 2 Installation and encryption 4. Click Continue. WinMagic Inc. SecureDoc for Mac User Manual 25
SecureDoc and FileVault 2 Giving local accounts access to the encrypted drive 5. Click Restart. When the computer restarts, you are asked to login to the local administrator account that was created during the installation. The password for this account is set by your SES administrator. This account gives SecureDoc the ability to manage access to the encrypted drive for all the local accounts on the computer. The encryption continues once you have logged into this account. The encryption process takes place in the background and could take a few hours. During this time you can continue working normally on your computer; you can even log off or turn off your computer. Giving local accounts access to the encrypted drive The local accounts will not have access to the encrypted drive until they are added to the "unlock" list. When a user logs in, SecureDoc prompts for the password so that the account can be added to the "unlock" list. WinMagic Inc. SecureDoc for Mac User Manual 26
SecureDoc and FileVault 2 Removing SecureDoc and FileVault 2 encryption Any accounts that are created after encryption are automatically added to the "unlock" list. Removing SecureDoc and FileVault 2 encryption To uninstall SecureDoc and disable FileVault 2 encryption on the drive, run SecDocFvUninstall. WinMagic Inc. SecureDoc for Mac User Manual 27