In continuing with our Mac OS X security series, we will start looking into the standard Business and Corporate environments.
For those people who primarily work within Windows based corporate networks, you may have – from time to time – seen a Mac floating around. Up until about 24 months ago, Mac’s were rarely seen within these environments.
Enter Tiger and Leopard.
With the invent of Mac OS X Tiger and Leopard, Apple has taken a walk into the standard corporate environment as a proven desktop alternative to either Windows XP or Windows Vista.
As a majority of Aquafruit Media’s clients are within the Small Business/Creative circles, we often come across executives and senior management who have moved onto a Mac for everyday business. A move – that these executive say – is a move for the better.
For Microsoft Network Admins and desktop support staff, the Mac is still known as a “nightmare” within the enterprise environment.
The truth be told, integrating Mac’s into the corporate environment is a challenging one, but also a rewarding one as long as you know how to integrate them and what the challenges/limitations are.
Simple solutions
Within any business environment, security of the network environment is paramount. Especially when a majority of your decision making staff are using mobile office solutions (PDA’s, Smart Phones, iPhone, Laptops and VPN access) to access and corporate environment.
With Mac OS X, a majority of the security issues are handled as per standard network topology security and deployment scenarios.
User Permissions Model
Mac OS X inherits its permissions model from UNIX. Apple has enhanced this security model by disabling the root account by default, a method known as “running with least privileges.”
By running code with the minimum necessary level of privileges, Mac OS X helps protect the system from inadvertent or deliberate damage.
There are three types of user accounts in Mac OS X:
The User Account.
The user account is the least privileged account in the Mac OS X system. The user can modify settings only for his or her account, not the entire system.
It is considered a good security practice to have all users operate at this level of permissions. If further
privileges are required to install software or modify system settings, an administrator can be authenticated when needed.
Additional limits can be placed on user accounts to prevent them from:
- Opening System Preferences
- Removing items from the Dock
- Changing passwords
- Burning CDs or DVDs
- Using certain installed applications
These limits can be managed using either parental controls in Leopard or managed preferences in Leopard Server.
Administrator.
Mac OS X establishes an administrator user account when the system is first installed. An admin user can perform most of the operations normally associated with the root user, except directly adding, modifying, or deleting files in the system domain.
However, an administrator can use the Installer or Software Update applications for this purpose.
(More on these in a later article.)
The Root Account.
Mac OS X (like most UNIX operating systems) has a superuser, named root, who has full permissions for access to all files on the system. That is, root can execute any file that has any of its execute permissions turned on and can access, read, modify, or delete any fi le and any directory.
Unlike traditional UNIX systems, Mac OS X disables this powerful account by default. This precaution helps to limit the extent of harmful changes that viruses or unauthorized users could make to the operating system.
In addition to user accounts, Mac OS X uses less privileged system accounts for some system services and software that require specialized access to certain system components, but not login access.
To prevent unauthorized users from altering the system in an undesirable way, new users do not have administrative privileges unless assigned to them by the administrator.
As users are added to the system, Mac OS X assigns them non administrative user accounts and prompts them to choose a password, providing a means of authentication. In Leopard, privileged access (such as use of the sudo command) and remote access are not allowed for users with no password.
Additional Account – The Guest Account
In Leopard, you can use the new guest user account to allow anyone to surf the web and check email as a guest on your Mac.
When a user logs out of the guest account, Mac OS X purges the account, removing any trace of that user’s activity. Each time someone logs in as a guest, he or she gets a fresh, unused account.
Activity Directory and Open Directory Integration.
As with any desktop client, a Mac running Mac OS X also allows for direct integration into the corporate environment whilst respecting the standards of Active Directory and Open Directory access protocols.
In our next article, moving beyond passwords.
Warm Regards,
Scott Malpass
Aquafruit Media.
Mac OS X – inherently secure? – part 10 – Into the Corporate Environment
In continuing with our Mac OS X security series, we will start looking into the standard Business and Corporate environments.
For those people who primarily work within Windows based corporate networks, you may have – from time to time – seen a Mac floating around. Up until about 24 months ago, Mac’s were rarely seen within these environments.
Enter Tiger and Leopard.
With the invent of Mac OS X Tiger and Leopard, Apple has taken a walk into the standard corporate environment as a proven desktop alternative to either Windows XP or Windows Vista.
As a majority of Aquafruit Media’s clients are within the Small Business/Creative circles, we often come across executives and senior management who have moved onto a Mac for everyday business. A move – that these executive say – is a move for the better.
For Microsoft Network Admins and desktop support staff, the Mac is still known as a “nightmare” within the enterprise environment.
The truth be told, integrating Mac’s into the corporate environment is a challenging one, but also a rewarding one as long as you know how to integrate them and what the challenges/limitations are.
Simple solutions
Within any business environment, security of the network environment is paramount. Especially when a majority of your decision making staff are using mobile office solutions (PDA’s, Smart Phones, iPhone, Laptops and VPN access) to access and corporate environment.
With Mac OS X, a majority of the security issues are handled as per standard network topology security and deployment scenarios.
User Permissions Model
Mac OS X inherits its permissions model from UNIX. Apple has enhanced this security model by disabling the root account by default, a method known as “running with least privileges.”
By running code with the minimum necessary level of privileges, Mac OS X helps protect the system from inadvertent or deliberate damage.
There are three types of user accounts in Mac OS X:
The User Account.
The user account is the least privileged account in the Mac OS X system. The user can modify settings only for his or her account, not the entire system.
It is considered a good security practice to have all users operate at this level of permissions. If further
privileges are required to install software or modify system settings, an administrator can be authenticated when needed.
Additional limits can be placed on user accounts to prevent them from:
These limits can be managed using either parental controls in Leopard or managed preferences in Leopard Server.
Administrator.
Mac OS X establishes an administrator user account when the system is first installed. An admin user can perform most of the operations normally associated with the root user, except directly adding, modifying, or deleting files in the system domain.
However, an administrator can use the Installer or Software Update applications for this purpose.
(More on these in a later article.)
The Root Account.
Mac OS X (like most UNIX operating systems) has a superuser, named root, who has full permissions for access to all files on the system. That is, root can execute any file that has any of its execute permissions turned on and can access, read, modify, or delete any fi le and any directory.
Unlike traditional UNIX systems, Mac OS X disables this powerful account by default. This precaution helps to limit the extent of harmful changes that viruses or unauthorized users could make to the operating system.
In addition to user accounts, Mac OS X uses less privileged system accounts for some system services and software that require specialized access to certain system components, but not login access.
To prevent unauthorized users from altering the system in an undesirable way, new users do not have administrative privileges unless assigned to them by the administrator.
As users are added to the system, Mac OS X assigns them non administrative user accounts and prompts them to choose a password, providing a means of authentication. In Leopard, privileged access (such as use of the sudo command) and remote access are not allowed for users with no password.
Additional Account – The Guest Account
In Leopard, you can use the new guest user account to allow anyone to surf the web and check email as a guest on your Mac.
When a user logs out of the guest account, Mac OS X purges the account, removing any trace of that user’s activity. Each time someone logs in as a guest, he or she gets a fresh, unused account.
Activity Directory and Open Directory Integration.
As with any desktop client, a Mac running Mac OS X also allows for direct integration into the corporate environment whilst respecting the standards of Active Directory and Open Directory access protocols.
In our next article, moving beyond passwords.
Warm Regards,
Scott Malpass
Aquafruit Media.