I've been attempting to add a custom script to run after the FileVault password is entered on login that will check whether it a 'special password' that will run a script in the background after proceeding to normal login (such as background SSD deletion). I was hoping to achieve an end result much in the same way that TrueCrypt allowed you to do when configuring the initial encryption:
It will now prompt you to enter the outer volume password. This is the password you might have to divulge under duress.
So far I've found no TrueCrypt alternative (maintained or otherwise) that I can use with OS X, so I've attempted to emulate this to an extent by either adding a script to /etc/passwd
and also using the Directory Utility in order to modify the login script.
Thus far I have been unable to find such a way to accomplish this, though I have found a field in the Directory Utility that may correlate to the password of the user (as shown in the image below) but am unable to find a way to link it to a script or add any extra layers of authentication.
I know that you can do this on a plain UNIX system with the /etc/passwd
script mentioned above and here. Find below a flowchart visualising what I'm trying to do as well, in case I explained this poorly.
Is it even possible to do this on an OS X system, and if so, how?