About Me

Aside from the occasional initiation into the Dark Brotherhood, I spend my time telling people how to fix their Macs. Not that they are broken, but hey, every step closer to Linux is a positive one. Security and stability, brothers.

Monday, August 30, 2010

Don't allow remote guest access or enable Leopard's guest account

Macs have always supported guest access for file sharing, in which a remote user can connect to a Mac without providing a username, password or other identifying information. The idea of allowing remote access to your Mac has always been fraught with potential for security compromises. It should never be allowed because it presents a grave security threat that could prevent you from easily tracking the source of a breach.
In Leopard, Apple extended guest access to the local level: Users can log in and use a Mac with a guest account that requires no username or password. The idea of a guest account is a convenient one. If you have friends or family visiting, you can let them use your Mac without allowing them access to your user account or files. When they log out as a guest, their home folder and any files they created are automatically deleted.
There are, however, some system directories, such as the Unix /tmp directory, that the guest account can write data to that may or may not be deleted at logout (or forced restart). The guest also has access to any installed applications, which could be used to perform malicious actions from your computer. If you must use the guest account, limit its access using Parental Controls.

Disable the guest account.

You can turn off both the guest account and remote guest access in the Accounts pane of System Preferences in Leopard. Select Guest Account on the left, then uncheck both "Allow guests to log into this computer" and "Allow guests to connect to shared folders."
If you'd rather keep the guest account but limit its access to files and apps, keep "Allow guests to log into this computer" checked and click the Open Parental Controls button for options.

1 comment:

  1. We'd like to have remote access between:
    a) our two macs in our home
    b) those two macs and the mac at our business location.

    Is it not possible to enable remote access, but only between these computers? If you open up your computer to remote access, is it necessarily a blanket invitation to *everyone*?

    We use guest accounts to login and do everything on our macs, for enhanced security. Do you recommend this? And will we be able to have remote access between our guest accounts??