Category Archives: macOS

VeraCrypt on the Command Line for macOS

Introduction

Automation is the key to success, especially in the DevOps world. In addition, security is an ever increasing need in today’s world of hacks and ransomware.

In my last two posts I showed how to use the encryption utility, VeraCrypt, to create encrypted containers and drives to securely store data. In this, and the next two posts, we’ll see how we can automate VeraCrypt from the command line.

We’ll cover the basics. Creating a container, mounting a container (aka volume), getting a list of mounted volumes, and finally dismounting your volumes.

As it turns out, the command line syntax is a bit different for all the major operating systems. In this post we’ll focus on macOS, in the next two posts we’ll cover Windows and Linux.

Prerequisites

Naturally, you’ll have to have VeraCrypt installed. You can find out more in my first post of the series, VeraCrypt – A Powerful Encryption Utility.

The next requirement applies to macOS. In order for macOS to be able to read the variety of filesystems VeraCrypt supports, you need to install a free utility, macFUSE.

It’s free, fast to install and takes very little in the way of system resources. It’s compatible with macOS BigSur and Catalina, and probably older versions too, check their site if you have that need.

Code Samples

While I will be providing samples here, you should also check out the project I have on GitHub that goes with this post, VeraCrypt-CommandLine-Examples.

I’ll update it over time as needed, and it may be easier for you to download, or cut and paste from it.

OK, let’s get started!

Creating a Container

First off, let’s look at the long line of code needed to create a container. Please note that while your blog reader may wrap the command below, it should be one line in your shell script.

/Applications/VeraCrypt.app/contents/MacOS/VeraCrypt --text --create "/Users/arcanecode/Documents/temp/vctest.vc" --size "200M" --password MySuperSecurePassword1! --volume-type normal --encryption AES --hash sha-512 --filesystem exfat --pim 0 --keyfiles "" --random-source /Users/arcanecode/Documents/temp/randomdata.txt

OK, that’s a bit hard to read, so let me break it out into each part below.

The first item is the path to the VeraCrypt application, assuming you installed it in the default location.

/Applications/VeraCrypt.app/contents/MacOS/VeraCrypt

The --text parameter says we want to use VeraCrypt in text mode, not GUI. Note, the –text parameter must be the FIRST parameter you pass in, or it will not work.

--text

We next tell VeraCrypt we want to create a new file container, and where it is to be stored at. For this demo, I’ve created a temp folder in my Documents directory.

You’ll want to change this to the location where you store your volumes. In addition, you’ll also want to change the user folder from arcanecode to your username.

--create "/Users/arcanecode/Documents/temp/vctest.vc"

Next we indicate how big we want our container to be. If you just list a number, VeraCrypt assumes you mean bytes, but you can also affix M for megabytes, G gigabytes, K kilobytes, and so on.

Here I’m going to keep it small for demo purposes and use 200 megabytes.

--size "200M"

Now we provide our password. Normally you would not want to hard code it, but rather pass it into your script as a parameter.

I wanted to keep this demo simple though, and focus on VeraCrypt so I’ve just hard coded it I’m using the same “super secure” password I’ve used in my last few posts.

--password MySuperSecurePassword1!

Next is the volume type, normal or hidden. My previous blog post talks about hidden types, and if you are going to do a hidden volume I would suggest using the GUI in order to assure it is done right.

For this demo we’ll go with a normal volume

--volume-type normal

Now we pick the encryption type. There are quite a few, so refer to the VeraCrypt documentation for a full list. Here we’re using AES.

--encryption AES

Next up, for the encryption method we picked it needs to know the hashing algorithm. For AES I suggest SHA-512.

--hash sha-512

In order to keep this container portable across other OS’s (Windows and Linux) we’ll format using exfat. Be aware though that to use exfat on a Mac, you’ll have to install macFUSE (see the prerequisites section above.)

--filesystem exfat

The PIM is a special number that allows you to specify the number of times hashing algorithm executes. It’s a bit more complex than that, if you want full details see the VeraCrypt documentation.

For now, we can pass it the value of 0 (zero), which tells it to use the default value for the PIM.

--pim 0

You can mount a volume in VeraCrypt using a keyfile, as opposed to a password. We’ve not done that here, so we’ll just pass in an empty string to indicate we won’t use a keyfile.

--keyfiles ""

As a final parameter, you need to provide random data for VeraCrypt to use when generating its hashes. It needs at least 320 characters, but you can give more.

I’ve provided a sample one as part of this demo (see the GitHub code samples), I just randomly smacked keys on my keyboard with my eyes closed. I’d suggest creating one of your own for production, but for just testing and learning (I’m assuming you’ll throw away the vault when you are done) then the one here will be OK.

--random-source /Users/arcanecode/Documents/temp/randomdata.txt

OK, that’s everything you need to create a volume. Now that it’s created, let’s mount it.

Mounting a VeraCrypt Volume

Here is the full command line to mount. (As before, it should be on a single line, ignore any wrapping done by your browser).

/Applications/VeraCrypt.app/contents/MacOS/VeraCrypt --text --mount "/Users/arcanecode/Documents/temp/vctest.vc" /Volumes/vctest --password MySuperSecurePassword1! --pim 0 --keyfiles "" --protect-hidden no --slot 1 --verbose

Let’s start breaking it down. First, as before, is the full path to the VeraCrypt app.

/Applications/VeraCrypt.app/contents/MacOS/VeraCrypt

As with all of these commands, the --text parameter must come first to let VeraCrypt know we want to use text mode and not the GUI

--text

The mount parameter actually has two values that need to be passed in.

First we pass in the name of the file to mount.

Second we need to provide a mount point. This will let macOS treat it like any other drive you might plug in.

In macOS, use /Volumes then add on a name. For simplicity I usually use the name of the file (without any extension), but it doesn’t have to be.

In reality though, it doesn’t make a real difference as macOS overrides the name you provide, and instead uses “Untitled”, “Untitled 2”, and so on.

--mount "/Users/arcanecode/Documents/temp/vctest.vc" /Volumes/vctest

Next is our “super secure” password. If your password has spaces, you’ll need to wrap this in double quote marks.

--password MySuperSecurePassword1!

If you overrode the default PIM when creating your volume, you’ll need to provide it. Otherwise, we can pass it the value of 0 (zero), which tells it to use the default value

--pim 0

If you created your volume using a keyfile or files, provide them here. Otherwise, you can just pass in an empty string to indicate no keyfile is needed.

--keyfiles ""

If this volume contained a hidden volume, you would need to let VeraCrypt know by using a value of yes, plus some other parameters.

In this case there is no hidden partition in our volume, so we can just give a value of no.

--protect-hidden no

OPTIONAL!
Slot is an optional parameter. If you look at the VeraCrypt GUI in macOS, down the left side are a series of slot numbers. If you omit this parameter, VeraCrypt will mount in the first empty slot.

However you can specify a slot, which can be useful if you want to make sure certain volumes always mount in a specific slot. You can then use the slot number when you want to dismount your volumes.

--slot 1

OPTIONAL!
Verbose is also an optional parameter, but I often include it just to see what is going on under the covers. You can use it with any of the commands in this post, I just included it on this one for example purposes.

If you intend to make this into a script then I would suggest omitting it once your script is debugged and working.

--verbose

OK, hopefully all is going well, and you’ve created and mounted your volume. Let’s next see how to get a list, from the command line, of all your mounted volumes.

Listing Mounted Volumes

Here’s the command line to see what is mounted on your Mac.

/Applications/VeraCrypt.app/contents/MacOS/VeraCrypt --text --list

As with other commands you have seen, we start with the full path to the VeraCrypt application. We then use --text to let VeraCrypt know not to use the GUI.

We finish with --list, which tells VeraCrypt to display a list of all mounted containers. This will include the slot number, volume name, and mount directory.

Mom always taught me to put away my toys when I was done playing with them, so in the next section we’ll see how to unmount your volumes once you are done with them.

Dismounting VeraCrypt Volumes

There are four ways to dismount a volume. Three of them will dismount a specific volume, the final will dismount all volumes.

All ways follow the same pattern. Give the path to the VeraCrypt app, followed by the --text parameter to tell VeraCrypt not to launch the GUI.

Finally we give the --dismount to let VeraCrypt know we want to unload our volume. The value passed into the –dismount parameter varies, and will be explained below.

Method 1: Slot Number

/Applications/VeraCrypt.app/contents/MacOS/VeraCrypt --text --dismount --slot 1

With the first method, you provide the slot number. If you mounted a volume and used the slot number parameter, for example your personal file vault is always in slot 5, then this can be an easy way to dismount.

On the other hand, if you let VeraCrypt load in the first available slot, you’ll either have to look at the GUI, or run the list command in the previous section, to learn the slot number.

Method 2: Volume Name

/Applications/VeraCrypt.app/contents/MacOS/VeraCrypt --text --dismount "/Volumes/Untitled"

Using the volume list command or looking at the “Mount Directory” column in the GUI, you can pass in that value to unmount. Because this is typically “Untitled”, “Untitled 1” and so on, it can be of an issue trying to be reliable in unmounting the right volume.

Method 3: Volume File Name

/Applications/VeraCrypt.app/contents/MacOS/VeraCrypt --text --dismount "/Users/arcanecode/Documents/temp/vctest.vc"

This method is the most reliable. Since you know the name of the file you mounted, you can just provide the same file name to unmount.

VeraCrypt doesn’t care what slot it is loaded into, it uses the file name to find it.

The winner – Method 3!

For the reasons above, I highly suggest Method 3 be your go to method for dismounting volumes in your scripts. It is the most reliable, and easiest to understand when looking at the scripts.

But wait, there’s more!

Dismounting ALL Volumes

There is one final method, you can dismount all of the VeraCrypt volumes you have mounted.

/Applications/VeraCrypt.app/contents/MacOS/VeraCrypt --text --dismount

If you use just the --dismount parameter, and pass in no values, then VeraCrypt will attempt to dismount ALL volumes you have loaded.

This can be a useful command to run when you’re shutting down your Mac, to ensure all volumes are properly shutdown.

If you don’t have any volumes mounted, then VeraCrypt basically shrugs it’s shoulders, does nothing, and ends.

Conclusion

In this post, we learned how to create, mount, and dismount VeraCrypt volumes from the command line in macOS. In addition, we also saw how to get a listing of volumes currently mounted.

In the next two posts we’ll see how to do the same things, but in Windows, then Linux.

Cut and Copy Fast and Easy with PopClip for macOS

Introduction

Everyone has little tools they find useful, tools that make using their computers easier. Often they are time savers, even ones that only save a second or two will add up over time.

I thought I’d spend a few posts talking about some of my favorites. In this first post we’ll talk about a tool to make cutting and copying text into the clipboard fast and easy on an Apple Mac – PopClip.

PopClip for macOS

Cut and / or Copy of text is something we all do a thousand times a day. Even though it’s fast action, anything we can do to make it even faster adds up by the end of the day.

On the Apple Mac, I found PopClip to be a fantastic tool. It’s available in Apple’s App store, for the reasonable cost of $12.99.

So how does it work? Well it’s pretty simple. Start by highlighting text, here I’ve opened the basic text editor on my MacBook and highlighted part of a sentence.

When you highlight text, you will see a little toolbar automatically appears or “pops up”, without having to right click or take any other action.

Here PopClip is giving us the option of cutting and copying the text. I also happened to have something in the clipboard, so the option to paste that in also appears.

The magnifying glass will launch our default browser and use your default search engine and do a search on the selected text.

But wait, there’s more!

In addition to the standard cut / copy / paste, PopClip offers a vast array of extensions. In the following screen shot, I’ve added the braces extension.

With the braces extension added, you can now see additional options added to PopClip’s bar. For this shot, instead of clicking copy I’ll be clicking on the Square Brackets button.

This will copy the the text into my clipboard, adding brackets around it. Then when I paste it, the pasted text now is surrounded by brackets as you can see above.

The braces are just one of over a hundred extensions available to you with PopClip.

Conclusion

I realize it may seem simple, but once you try it you will be amazed at how much nicer cut and copy becomes on your Mac. In addition the vast array of extensions will make other operations you frequently do, such as surrounding text with braces, fast.

In the next post we’ll look at a similar tool for Windows, then over the next few posts highlight some other tools I find very useful in my daily life.

Formatting A Drive as exFAT on Windows, macOS and Linux

Introduction

In my previous blog post, Sharing a Drive Between Windows, macOS and Linux, I described how to setup the three operating systems to read a drive that had been formatted as exFAT. The exFAT format is readable by all three, and making it easy to share files between different operating systems.

A natural question that follows is, “how do I format a drive as exFAT?”

In this article I’ll show how to format an external drive as exFAT. I’ll be using an 8gb thumb drive, but I’ve used this technique with both thumb drives as well as the larger external multi-terabyte hard drives.

Windows

Windows is the easiest of the three to format a drive for exFAT. First, insert the drive into a USB port. This will typically open the Windows File Explorer, but if not, open it.

Now right click on the drive letter for the USB drive, and click on Format. The format dialog will appear.

In the second drop down you can pick the file system. Use it to select exFAT. You can also enter a new volume label if you want. Simply click the Start button to kick off the format process.

You will of course get a warning that all the data on the drive will be lost, simply click on OK to proceed.

Once done Windows will let you know. Just click OK and your drive is ready to use.

Apple macOS

There’s a few more steps to formatting a drive to exFAT in macOS, but it’s still pretty simple. Start by opening Finder, then go to the Applications. In Applications, open the Utilities folder.

Inside the Utilities, launch the Disk Utility. If you’ve not done so, connect the USB drive you want to format as exFAT.

On the left side of the Disk Utility is a list of drives, click on the USB drive in the list.

Above the drive info area are a series of command buttons. Click on the Erase button. Note you need to click on the icon, not the Erase label.

In the dialog that appears, you can change the label if you wish. The important box is the Format one. You can use the blue arrow to bring up the list, and change it to exFAT.

Once exFAT is selected, you can click the Erase button on the lower right.

Once done, macOS will let you know. Just click Done, and the drive will be ready for you to use.

I’ve used this technique with macOS versions from High Sierra onward.

Linux

For this section, I’m using screen shots from my Kubuntu 20.10 computer. The techniques will work with most Ubuntu/Debian based installs. To make it more portable to other versions, we’ll do most of it using the command line.

Note, these instructions assume you’ve already followed the instructions in my previous blog post, and installed the exFAT utilities.

Start by opening up a terminal window, and entering the following command:

df

Your output will look something like this:

Filesystem     1K-blocks     Used Available Use% Mounted on
tmpfs             805596     1752    803844   1% /run
/dev/sda2      244568380 18388480 213686844   8% /
tmpfs            4027972      128   4027844   1% /dev/shm
tmpfs               5120        4      5116   1% /run/lock
tmpfs               4096        0      4096   0% /sys/fs/cgroup
/dev/sda1         523248     7984    515264   2% /boot/efi
tmpfs             805592      108    805484   1% /run/user/1000
/dev/sdb1        7815648       96   7815552   1% /media/arcanecode/4ECB-E340

For this exercise, I’ll be using the /dev/sdb1 drive which is my 8gb thumb drive.

Before we can proceed, we’ll have to unmount the drive. The command is simple.

sudo umount /dev/sdb1

Now that the drive has been unmounted, we can format it using the mkfs utility.

sudo mkfs.exfat /dev/sdb1

Once formatting is complete, we can check its status using the fsck command.

sudo fsck /dev/sdb1

Your output will vary depending on the drive you formatted, but it will resemble something like this:

fsck from util-linux 2.36
exfatfsck 1.3.0
Checking file system on /dev/sdb1.
File system version           1.0
Sector size                 512 bytes
Cluster size                 32 KB
Volume size                7633 MB
Used space                 3041 KB
Available space            7631 MB
Totally 1 directories and 3 files.
File system checking finished. No errors found.

A benefit of using fsck is that will also remount the drive for you, making it ready to use.

You can verify it again using your systems file explorer. Here I’m using Dolphin, the explorer built into Kubuntu.

Navigate to the drive, right click on it, and pick Properties.

In the properties window it will show you the file system. As you can see, it has been formatted to exFAT.

Conclusion

In this post we saw how to format a drive for exFAT on three operating systems. You can now format a drive using any of the OS’s, and be able to use it across all of them.

Sharing a Drive Between Windows, macOS and Linux

I have a lot of computers, on which I use a variety of operating systems. Some run Windows 10, my Apple macBooks all run macOS, and on others I have a variety of Linux distros, primarily Ubuntu based.

I would like the ability to share external drives, such as thumb drives or external SSD drives, between them. To get that compatibility across OS’s, I need to format those drives in a file format called exFAT.

exFAT is a replacement for the older FAT32, but has the benefits of other file systems such as NTFS. I can have long file names, and store files bigger than four gigabytes in size to name a few.

Windows and macOS both support exFAT out of the box. I can just plug in an exFAT drive into them, and both will let me read and write to them. (Note that not all drives come formatted as exFAT, you may need to reformat them to the exFAT system). Linux, however is another story.

To allow Linux to read an exFAT drive you need to install the exfat-utils utility. On Ubuntu based distros it’s pretty easy, just open up a terminal and enter the following command, all on one line.

sudo apt-get install exfat-fuse exfat-utils

For other distros you can use their native installer, such as yum, to install the exfat-utils. After that you can simply plug an exFAT thumb drive or SSD into your Linux box and it will know how to read and write to the drive.

Supressing “The certificate Couldn’t Be Verified” message Using the Microsoft Remote Desktop Application on Apple macOS

Introduction

In my previous blog post, Using the Microsoft Remote Desktop Application on Apple MacOS, I showed how easy it is to connect to one of your Windows computers from your Mac.

I frequently use the Microsoft Remote Desktop application on my Apple MacBook Pro to connect to one of my Windows computers. It presents a nice interface that’s easy to use and setup.

Once you’ve added your computer to the Microsoft Remote Desktop application (you’ll find the instructions in my previous post), all you have to do is double click on it to access your remote computer.

Here is the launching point, note that for security reasons in all of the images in this article I’ve blurred out the name of my computer and replaced it with <name>.

There is one irritating behavior. When connecting to a computer it frequently displays the following message: “You are connecting to the RDP host <name>. The certificate couldn’t be verified back to a root certificate. Your connection may not be secure. Do you want to continue?

Having to stop every time and click Continue is really annoying. Especially if you are on your home network, connecting to a computer you own and trust. There’s an easy fix though!

Suppressing the Warning Message

Simply click the Show Certificate button to display the certificate information.

Once you review, simply put a check mark in the “Always trust...” checkbox (pointed to by the arrow) then click Continue.

Since you are changing the trust certificates for your MacBook (or other Apple Mac computer, like the Mac Mini), macOS will prompt you to enter your admin password. Do so, then continue.

From here on out, all you need to do to connect to your remote computer is double click on it, and (if you’ve not saved it within the remote desktop program) enter your credentials. No more having to click to continue past the “certificate couldn’t be verified” message.

Conclusion

I’ll wrap this up with two quick notes. First, this works on the last several versions of macOS including Big Sur.

Second, while I’ve used Windows as the example, this will work with any OS (such as various Linux distros) that support RDP (Remote Desktop Protocol). Sadly, macOS does not support RDP so you cannot connect to another Mac from the Microsoft Remote Desktop application.

Closing All Finder Windows at Once in Apple macOS

It’s not uncommon for me to have multiple Finder windows open at once on my Mac. Often I’m cleaning up my drive, moving files from downloads to where I want them.

When I’m done, I naturally want to close all my Finder windows. Normally, if you go to the File menu in Finder, you’ll see an option to close the current window.

It can be annoying, and potentially time-consuming to go to every Finder window and close it. Even if I close using the red X button, I still have to go to each Finder window. It’d be nice to just close them all at once.

This is yet another instance where the OPTION key will be our friend. Simply hold down the OPTION key and the menu option will update.

You can simply click Close All and all open Finder windows will be exited. Alternatively, you can also press CMD+OPTION+W on the keyboard and all your Finder windows will be closed.

As an added bonus, this not only works in Finder but with any application that allows you to have multiple copies of the program open. For example, I opened up multiple copies of BBEdit and using the OPTION key enabled the Close All Windows choice. Do note though, the shortcut key may vary with each application.

This technique works on Big Sur, Catalina, and other recent versions of Apple macOS.

Skip The Countdown When Shutting Down Apple macOS

I’m sure any macOS user knows how to shut down their Apple computer. Just go to the Apple menu in the upper left, click on it, and pick Shut Down…

Doing so pops up a dialog with a count down timer. You can skip the 60 second count down timer by clicking the Shut Down button.

It’s possible though to skip this dialog and shut down your Mac immediately. The trick to this is, as with my previous blog post, using the OPTION key.

With the above menu open, simply hold down the OPTION button. When you do the menu updates.

The change is very subtle, so look closely. The three periods after “Shut Down” disappear. Now when you click shut down, the shut down dialog is by-passed. Your macBook will now shut down immediately.

This technique works on Big Sur, Catalina, as well as several previous versions of macOS.

Moving A File in Apple macOS

I’ve been using Windows since version 2, before that MSDOS all the way back to the earliest version. Thus working in the Microsoft world is very comfortable to me. My earliest exposure to Microsoft was with GWBASIC running on a Radio Shack (Tandy) TRS-80 Model 1.

I’ve been regularly using various distros of Linux for at least five years, perhaps longer, before that I used various UNIX or UNIX based systems. One of the earliest was CP/M on my Commdore 128, or later AmigaOS.

macOS is relatively new to me, I bought my first Mac about 3 years ago. The macOS GUI is very different in terms of commands from Windows or Linux. There are many things that aren’t intuitive to someone coming from another platform. Even though they may seem easy to an experienced Apple user, they took me some time to figure out. I thought I’d spend a few blog post helping out others who are experienced computer users, but relatively new to macOS.

One that befuddled me at first was very simple, moving a file to a different folder. Turns out it’s fairly simple when you know how.

First, open Finder and go to the file you want to move. Right click and pick Copy.

Now go to the folder you want to move the file to. If you right click, you’ll see the Paste option you may have seen before.

Now here comes the secret. Press and hold the OPTION key. When you do, the menu will update.

While the OPTION key is being held down, the Paste option changes to Move Item Here. Click on it and the file will be moved.

As I stated before, this may seem normal to a long time Apple user, but having menus change by holding a key isn’t something normally done in Windows or most Linux distros. As a new macOS user, it never occurred to me to hold down the OPTION key.

Using the OPTION key can unlock all kinds of new menu options, as you will see in upcoming posts.

Note this technique works in Big Sur, Catalina, as well the last several versions of macOS before that.

Getting Started with PowerShell Core on Linux and macOS

My newest course, Getting Started with PowerShell Core on Linux and macOS, is now live on Pluralsight! This course is my eighteenth in a long line of Pluralsight courses.

I begin the course explaining the difference between PowerShell for Windows (version 5.1) and the all-new PowerShell Core (version 6.2 was used for this course), which works not only on Windows but on Linux and macOS as well. I then show how to install PowerShell Core, along with a few other key components such as Visual Studio Code, on both Linux and macOS.

Not familiar with PowerShell? No problem! I quickly cover the basics of PowerShell including cmdlets, the use of the pipeline, how to write functions, and how to put those functions in reusable scripts.

As if that weren’t enough, I show how to do some “cool things” with PowerShell Core, including working with Docker containers, SQL Server, and Azure.

For the course, I primarily used Ubuntu 19.04 and macOS Mojave. The code was also tested on Ubuntu 18.04 LTS and 18.10, as well as macOS High Sierra. In addition, I tested the Linux installs on a variety of distributions including CentOS, Manjaro, and more. The samples include markdown files with information on how to install on these other distributions.

All of the samples are included in the downloadable components of the course on Pluralsight. New with this course I have the samples also available on my GitHub site. As I move into the future the GitHub codebase will be updated with new samples and information.

Also included in the samples are several markdown files that have additional information not included in the course, such as setting VSCode on Windows to use PowerShell Core instead of Windows PowerShell 5.1 as the default terminal.

While you are up on my GitHub site be sure to check out the full list of repositories, I have a lot of examples on it, including some from previous courses such as my recent Reporting Services course. (For a full list of my courses just check out the About ArcaneCode page on this site.)

Note the sample file on Pluralsight will remain static, so if someone watches the course their samples will reflect what is in the course. For the latest updated samples see the GitHub site referenced above.

What? You don’t have a Pluralsight subscription yet? Well, no worries dear reader, just email me, free @ arcanetc.com and I can send you a code good for 30 days with which you can watch all 18 of my courses, plus anyone else’s course at Pluralsight.