Mac – Encrypt home directory only

Encrypting the entire user folder will break OS X 10.10 since certain user processes get started before you log in.

You might have to re-evaluate your security levels for users if you can't trust administrators to not abuse their power. FileVault only protects you against non-users. Admin users are root and you can only hope they a) don't know that or b) refrain from bad behavior.

Look at a MDM solution like Casper from JAMF. It has a self-service tool that allows app updates and limited administrative tasks without needing end users to be admin. All users can easily be normal users whether you make tools to do the limited things they need or purchase a tool that has those policies already created.

I do this on my own Mac at home with scripts that run at boot and mount a Core Storage volume. I'm on 10.11.6, but the same principles should apply.

To be clear, FileVault is much simpler, but it is possible to do what you ask. I went down a rabbit hole to get an encrypted $HOME working, and so I still use it, but FileVault is superior in just about every way.

I wrote up an article detailing how I did this. I'd post the vital steps here, but it is a fairly long and involved process.

Here's the gist of it. You need to do the following:

1. Format a USB drive
2. Add a keyfile (max 1023 chars) to that drive
3. Create a core storage volume somewhere
4. Encrypt that core storage volume with your keyfile
5. Migrate files to your new encrypted home
6. Create a Launchd task that runs a mount script on boot
7. Create that mount script.
   1. The mount script will read the keyfile from your USB drive
   2. The mount script will attempt to unlock your core storage volume using the contents of the keyfile
   3. The mount script must unmount the core storage volume from /Volumes
   4. The mount script must mount the core storage volume to /Users
8. Unmount the USB drive so the keyfile isn't just sitting there

It took me a lot of trial and error.

There are probably ways to improve my steps like using an exported keychain rather than a plain text keyfile. You could probably also re-define the location of $HOME for your user in System Preferences, but I opted to mount the encrypted home over the normal home so that the path would be standard.

I tried changing $HOME to /Volumes/THE_ENCRYPTED_DRIVE, but I immediately noticed things like my iTunes library were messed up. All the library file references were stale and needed to be updated. That's an example of how screwing with $HOME can get messy.

Really, FileVault would be way easier if you can get it going. If FileVault is not an option, you should check out VeraCrypt, which is a fork of TrueCrypt that was recently audited and seems legit.