Using an old Mac as a Time Machine server

Time Machine supports a wide variety of network-attached disks, but it's not always obvious how to make it work. In this article, we walk through the steps to configure Time Machine to backup to an ordinary shared folder, with the backup destination encrypted.

Normally, when setting up a Time Machine backup over the network, Time Machine Preferences automatically detects qualified network shares for you, and offers them as a choice when selecting another backup disk. This happens when the shared disk is served by a Time Capsule, an AirPort Extreme, macOS Server, or in macOS 10.13 or later, you can even do this with ordinary macOS these days.

Time Machine Preferences refuses to set up a Time Machine disk in other situations, such an with an ordinary shared disk. Don't worry; there's a way.

Enter tmutil: Time Machine's command-line equivalent to Time Machine Preferences.

Disclaimer: I don't profess to be an expert on Time Machine. I merely discovered how this can be done, and I wrote it down here in case it's useful to someone else. There very well could be much easier ways to accomplish the same goals.

Adding a network share as a new Time Machine backup disk

Let's say you have a Mac, MyClient, that you want to configure to back up to a server, MyServer. While writing these instructions, my Mac was running 10.13, and my server was running Mac OS X 10.5.

  1. On MyServer, decide where you want Time Machine backups to go. Time Machine backups can be very large; you may want to consider using a new, dedicated hard drive. It's not hard to move the backups to a different location or disk later. I called the folder where I want my Time Machine backups MyClientTimeMachine.
  2. Open Sharing Preferences, and share the folder you decided to use for Time Machine backups. You can use AFP, SMB, NFS, and probably others. I'm using AFP.
  3. Create a subfolder on MyServer inside your network share. The name of this folder will become the name of the Time Machine backup database displayed in Time Machine Preferences. I called my subfolder MyClientBackups.
  4. Configure MyClient to begin backing up to MyServer:

    Edit: These instructions were written with a Mac OS X 10.5 server and a macOS 10.13 client. After upgrading the client to macOS 10.14, this command no longer results in a working Time Machine configuration. Some brief experimentation suggests that network Time Machine disks are still supported, just perhaps not between a 10.5 server and 10.14 client, or perhaps just not with this configuration command.

    $ sudo tmutil setdestination -ap afp://myuser@MyServer.local/MyClientTimeMachine/MyClientBackups
      1           2               34 5     6      7              8                   9
    
    1. tmutil must be ran as root, so we always need sudo.
    2. The setdestination subcommand tells tmutil you want to configure a new backup disk.
    3. The -a flag tells tmutil that we want to add a new backup disk. Without -a, tmutil will replace the existing backup disk configuration.
    4. The -p flag tells tmutil that we will provide the password to the network share interactively, via stdin, instead of in the URL.
    5. In this example, I'm using AFP. You can use AFP, SMB, NFS, and perhaps others.
    6. The username to connect to this server is myuser.
    7. The hostname of the server on this local network is MyServer.local. Sharing Preferences can tell you the name of your computer on the local network.
    8. The name of the folder I shared on MyServer is MyClientTimeMachine. MyClientTimeMachine is itself a subfolder on a hard drive, not an entire hard drive.
    9. tmutil refuses to add the root of a network share as a Time Machine backup disk. The URL must include at least one subfolder. I don't know why. Without the subfolder, this is the error you get:

      $ sudo tmutil setdestination -ap afp://myuser@MyServer.local/MyClientTimeMachine
      Password:
      Destination password:
      Disk does not support Time Machine backups. (error 45)
      The backup destination could not be added.
      

      If you properly include the subfolder in the URL, but don't create it ahead of time on MyServer, this is the error you get:

      $ sudo tmutil setdestination -ap afp://myuser@MyServer.local/MyClientTimeMachine/MyClientBackups
      Destination password:
      Failed to mount afp://myuser@MyServer.local/MyClientTimeMachine/MyClientBackups (error 22)
      The backup destination could not be added.
      
  5. Open Time Machine Preferences; you should see the new Time Machine disk you set up. If this is the first Time Machine disk on MyClient, you may find that you need to turn on Time Machine so that it backs up automatically. The first backup will not start immediately, though it will likely start on its own within an hour. If you feel impatient, there's nothing wrong with manually starting the first backup so that it starts immediately.

At this point, you have Time Machine backing up to a network share! You can even see it in Time Machine Preferences. However, it's not encrypted on the server yet; let's do that.

Encrypting the backup disk

Time Machine does not save its directory structure directly inside the network share; it creates a disk image there, and backs up into the disk image instead.

Especially in a family household where multiple people may all be backing up to the same physical server (thus, they all have some degree of access), it is a good idea to encrypt the disk image used for your computer's backups.

  1. To encrypt the disk image, we will use Disk Utility to encrypt the disk image, which means that the disk image must exist. If you haven't ran the first backup yet:
    1. On MyServer, open the MyClientBackups folder in Finder. It should be empty.
    2. On MyClient, tell Time Machine to start a new backup.
      1. If you don't have a Time Machine menu in the menu bar, open Time Machine Preferences, and check the checkbox at the bottom of the window that says "Show Time Machine in menu bar".
      2. In the Time Machine menu in the menu bar, choose "Back Up Now".
    3. On MyServer, you should see a file suddenly appear with a weird name. For me, the name was F80B6FB4-1B85-7B0C-30AF-29EAE6E1F7E6.sparsebundle.
    4. Wait a moment. Eventually, the file should suddenly rename itself to the name of the computer. For me, the new name is MyClient.sparsebundle.
    5. Now that the disk image exists on disk, we can cancel this backup, and encrypt the disk. From the Time Machine menu in the menu bar, choose "Skip This Backup".
    6. Wait for the Time Machine menu in the menu bar to stop indicating that a backup is in progress.
  2. On MyClient, open Time Machine Preferences, and turn off automatic backups. We don't need MyClient starting a backup in the middle of our encryption process.
  3. To encrypt the disk image, begin by getting filesystem access to the disk image. You may do this on the client via file sharing, or on the server. Depending on your network (especially WiFi), doing it on the server can be significantly faster, but both will work.

    $ cd /path/to/folder/with/MyClientTimeMachine/MyClientBackups
    
  4. Next, rename the disk image so that the new encrypted copy can take its place:

    $ mv MyClient.sparsebundle MyClient-noencrypt.sparsebundle
    
  5. Encrypt the disk image:

    $ hdiutil convert -format UDSB -encryption MyClient-noencrypt.sparsebundle -o MyClient.sparsebundle
    
  6. Copy Time Machine-specific plist files from the old image to the new one:

    $ cp -v MyClient-noencrypt.sparsebundle/com.apple.TimeMachine.* MyClient.sparsebundle/
    
  7. Delete the old (unencrypted) disk image:

    $ rm -rf MyClient-noencrypt.sparsebundle
    
  8. Close the Terminal window (or at least run cd so that we can eject the network drive later).

    Next, we must teach the client the password to the newly encrypted disk image.

  9. On the client, mount the network share, if you haven't already.
  10. Navigate to the newly encrypted disk image, and double-click it to mount it.
  11. When prompted, type in the password you used to encrypt the disk image. Check the checkbox to remember the password in your keychain.
  12. Eject the disk image.
  13. Eject the network share.

    Because Time Machine operates at the system layer, it doesn't have access to your personal keychain. We'll need to move that password to the system layer.

  14. Open Keychain Access (in the Utilities folder).
  15. In the search bar (upper-right corner of the window), search for the name of your disk image.

    One of the columns in the list is "Keychain", which denotes which keychain contains the selected item. The keychain that contains your disk image's password is currently the "login" keychain; we're going to change that.

  16. Drag-and-drop the entry for your disk image's password into the System keychain (in the list of keychains in the upper left). When prompted, type in your computer's admin password. You may have to type in your password twice; this is normal (one for macOS, and one for kcproxy).

    In the Keychain column, the name of the keychain for your disk image's password should change to "System".

  17. On MyClient, open Time Machine Preferences, and turn on automatic backups.

    Time Machine will know that we swapped out the disk image behind its back, and will complain. We now need to tell Time Machine that it's okay to use the new disk image for backups going forward.

  18. Start a backup.
  19. When Time Machine warns you that the disk has changed and asks whether you want to abort or use the new disk, tell it to use the new disk.

At this point, you now have Time Machine backing up to an encrypted network share!

However, because the default size of the disk image that Time Machine creates is the size of the underlying disk, it's possible for one computer's Time Machine backups to unjustly hog all of the disk space. If you have multiple computers backing up to the same server, you should configure some disk space quotas.

Argument for using separate physical hard drives instead of disk space quotas

If you have the money to do it, there is value in giving each computer its own dedicated hard drive. Doing so has some advantages:

  1. A hard disk failure will only affect the Time Machine backups stored on that disk.
  2. Filesystem corruption, such as what can happen during a power failure, is generally limited only to disks actively in use. If you use one disk for all Time Machine backups, you both increase the probability that any computer in the house will be backing up during a power failure, and when the disk goes corrupt, it puts everyone's Time Machine backups at risk, not just the backups of the one computer that was backing up.
  3. Time Machine defaults to using the entire disk for backups, so if you give it a whole disk, you don't need to set up a disk space quota.

Configuring a disk space quota for a disk image

To change the size of a disk image, begin by getting filesystem access to the disk image. You may do this on the client via file sharing, or on the server. You don't have to mount the disk image.

Once you have filesystem access to the disk image:

  1. Cancel the current backup, if it is running. Wait for it to fully stop running.
  2. Open Time Machine Preferences, and turn off automatic backups.
  3. Resize the disk image. You may use Disk Utility, or the command-line. In Disk Utility, choose "Resize" from the Images menu. If you prefer the command-line, the following is the equivalent.

    $ hdiutil resize -size 300g /path/to/folder/with/MyClientTimeMachine/MyClientBackups/MyClient.sparsebundle
    

    You can change the size to whatever you think is appropriate. See man hdiutil for more details.

    Note: Regardless of whether you use Disk Utility or the command-line, your computer may ask you for an administrator password. This is because your computer knows that the System Keychain knows the password to the disk image and would like to use it, but because the disk image resize operation is running as your personal user, you don't have direct access to the System Keychain; hence, the password prompt. It's fine to enter an administrator password. If you don't, Disk Utility or the command-line will ask you for the password to just the disk image.

  4. Open Time Machine Preferences, and turn on automatic backups.

0 Comments

If you have any comments, feel free to email them to me and I'll post them here.