OS X Yosemite

[Uncle Peter]

You need to enable debug mode for disk utility Chris (see screen grab)

from terminal: defaults write com.apple.DiskUtility DUDebugMenuEnabled 1

re-launch Disk Utility and select "show every partition" from the debug menu option which appears when you launch the utility in said mode.

screenshot.jpg

[qasdfdsaq]

Originally Posted by Stuart

Actually, the Internet Recovery feature available through the firmware is a cut down version of what's provided on disk. For instance, WPA-Enterprise is not supported by the firmware Internet Recovery process, but it *is* supported by the recovery partition on the local computer. You also need a recovery partition if you are using FileVault and Find My Mac.

As such, the OSX installer does put the Recovery partition on the drive, you just don't necessarily need to keep it there, even if you are planning to install OSX from the Internet.

The OSX installer certainly puts the Recovery Partition on the system drive of my work computer (a mid 2011 27 inch iMac with up to date firmware).

'Internet recovery' and 'what's provided on disk' are different features and are completely separate, neither is a 'cut down version' of anything else. OS X Recovery, which is found on the hard drive, comes with the machine and doesn't usually get put there by installers after the fact. The 20 or so times I've erased it, it doesn't come back after you reinstall. At least not that I've seen - though it may be version specific.

I have now installed Yosemite.2 on the Mac Mini. It seems a little faster than Mavericks.5 which was on it previously. Screen Sharing, which I use frequently to refer between Macs in our house, is notably faster under Yosemite.

So, tonight I am going to download the installer onto the iMac, which in theory should be fine as the hardware is only months older than the Mini and the spec is higher. The only thing that still concerns me slightly is the possibility of things lurking in the background for years that might trip it up. I'm going to back up my photos, videos and documents to an external HDD first, just to be safe.

[Stuart]

Originally Posted by Chris

Stu, what does this partition look like when viewed through Disk Utility? Or is it invisible? I cannae see anything ...

It's hidden unless you turn on debug mode in Disk Utility and set Disk Utility to show hidden partitions.

---------- Post added at 16:24 ---------- Previous post was at 16:18 ----------

Originally Posted by qasdfdsaq

'Internet recovery' and 'what's provided on disk' are different features and are completely separate, neither is a 'cut down version' of anything else. OS X Recovery, which is found on the hard drive, comes with the machine and doesn't usually get put there by installers after the fact. The 20 or so times I've erased it, it doesn't come back after you reinstall. At least not that I've seen - though it may be version specific.

I beg to differ. The installer does put it there, and has done every time I run it. Indeed, it did on my work machine not long before I posted that (hence my comment).

I've also prepared various installs for Mavericks and Yosemite for imaging, and had to remove recovery partitions from every one, as they are a potential security risk if you are dealing with multiple users.

[qasdfdsaq]

Originally Posted by Stuart

I've also prepared various installs for Mavericks and Yosemite for imaging, and had to remove recovery partitions from every one, as they are a potential security risk if you are dealing with multiple users.

If you think recovery is a "security problem" you'll **** your pants when you hear about single-user mode...

Originally Posted by qasdfdsaq

If you think recovery is a "security problem" you'll **** your pants when you hear about single-user mode...

I would have thought that leaving machines on the network that can effectively be factory re-set by use of a simple key stroke was a farly obvious security problem. But then whadda I know ...

I'm sat outside an Apple store right now. I'd go in and ask, but now the assistants all have massive hipster beards it's quite intimidating.

[qasdfdsaq]

Originally Posted by Chris

I would have thought that leaving machines on the network that can effectively be factory re-set by use of a simple key stroke was a farly obvious security problem. But then whadda I know ...

As I say, single-user mode is worse. Since it allows anyone to walk up to the machine and log in as root, remove any passwords, and access everything on it that isn't separately encrypted. Removing the recovery partition won't stop that, nor will it stop users resetting the machine with the equally simple key strokes required to boot into internet recovery, or any OS X install CD or USB drive.

Resetting the machine at least prevents the end user accessing existing data that's on it (well, it doesn't but does makes it harder). To be fair, any mode of security that relies on end users not being able to wipe or reset their machine is fundamentally flawed. Furthermore if network security is the concern then anything short of 802.1x can be trivially bypassed by someone yanking the cable out of the computer and plugging into their own.

If you want to secure end devices in an enterprise environment, you simply do not use Macs.

[ianch99]

Originally Posted by qasdfdsaq

As I say, single-user mode is worse. Since it allows anyone to walk up to the machine and log in as root, remove any passwords, and access everything on it that isn't separately encrypted. Removing the recovery partition won't stop that, nor will it stop users resetting the machine with the equally simple key strokes required to boot into internet recovery, or any OS X install CD or USB drive.

Resetting the machine at least prevents the end user accessing existing data that's on it (well, it doesn't but does makes it harder). To be fair, any mode of security that relies on end users not being able to wipe or reset their machine is fundamentally flawed. Furthermore if network security is the concern then anything short of 802.1x can be trivially bypassed by someone yanking the cable out of the computer and plugging into their own.

If you want to secure end devices in an enterprise environment, you simply do not use Macs.

Seems you can control access to single user mode: Setting up firmware password protection in Mac OS X This also seems a good site for this kind of stuff: http://www.securemac.com/

[MadGamer]

Originally Posted by Chris

Blinking nora. Apple encouraging people to use the command line?

With this:
http://liondiskmaker.com/ it's even easier

[qasdfdsaq]

Originally Posted by ianch99

Seems you can control access to single user mode: Setting up firmware password protection in Mac OS X This also seems a good site for this kind of stuff: http://www.securemac.com/

Setting a firmware password requires that password to be entered when you power it on. If you have to give the user the password in order to turn on the computer, it doesn't really control access does it?