Mac OS X- Telnet Exploit

[MCS117]

Hi. I am a tech aide in my school. We recently discovered that people with low privileges can open telnet using 'telnet:' or 'ssh:' on the browsers and use the 'open [filename]' command to open programs that are restricted to them. We thought we can delete the telnet/console applications but realized that people can use a copy from their flash drives/cd/any other removable storage. How can we disable the browser command to open the telnet or prevent them from opening the application?

 

[Ric]

Hi there and welcome !

Not sure about locking down the browser, I'll have to think about that.

It's fairly easy to 'stop' the students accessing the USB port, CD drive etc, is this an option for you ? Or do they need access to the USB port for the flash drives to copy there work ?

regards

Ric

 

[MCS117]

I just want to lock out the mac commands for the 'telnet:' cmd to not work. And we do need usbports/cd drives for the students to save their work. But if we can't, then we will soon lockout the usb/cds.

 

[Ric]

Hi there,

are these Macs "managed" via a OS X server, if they are you can stop them from using any Apps on local volumes...other than those you specify !

regards

Ric

 

[MCS117]

Yes we do have a server.

 

[Ric]

Hi there,

what version of OS X Server are you running ?

Do you mange your users via the server ? If so then...

In Tiger (10.4 Server Software) you can limit the users at to what Applications can run, even those that are on remote volumes...you can also allow programs to run, but not allow program 'x' (ie Safari) to launch another program 'y' (ie Terminal).

How have you got the server set up ?

regards

Ric

 

[MCS117]

I think we got tiger. He was also planning to do this also. But we need to wait to set up the coding and registering all the kids to the server.

 

[Ric]

Hi there,

If you have the Tiger Server, then I would start reading all the PDF's (manuals) that are on the Install disks...

...there's quite a lot to understand, but it will definately be worth it !

If you set up Tiger server it will make running your network and managing the students so much easier !

You have a lot of control and can do things 'globally' to all Mac's !

It's definately the way to go.

regards

Ric