Catholic Education Ministries

Keychain (for passwords)

Keychain can be thought of a central place to store all the passwords used on your computer (web site passwords, email passwords, wireless network passwords, etc). Keychain is a technology in the Mac OS where a user's passwords are centrally stored in an encrypted file.

The Mac OS makes sure that only approved applications can see passwords. The slightest discrepancy in an application's identity causes the user to be warned. For example, if the Safari web browser is upgraded, the new Safari cannot access saved passwords until the users gives his or her approval via a dialog box similar to this one...

Not all programs store passwords in the keychain. Some programs might be saving passwords in an unsafe manner. To view and edit the Keychain-saved passwords, use the application Keychain Access, which is in the computer's utilities folder.

Disable automatic login

By default, Mac OS computers will login to the first user account created on the computer. For home use, that is normally great. However, in schools where multiple people have access to the same computer, that is undesirable. Disable automatic login by....

1. In the Apple menu, select System Preferences.
2. Click Security.
3. Check Disable automatic login.

or

1. In the Apple menu, select System Preferences.
2. Click Accounts.
3. Click Login Options.
4. Uncheck Automatically login as...

When automatic login is disabled, the computer will require a password upon startup.

Require password to wake computer

Sometimes a person walks away from his or her computer without logging out. This allows other people in the room to access confidential information. It is possible to set a screen saver or sleep mode on the computer to require a password if it has been idle for a period of time. Here is the screen saver procedure...

1. In the Apple menu, select System Preferences.
2. Click Desktop & Screen Saver.
3. Click the Screen Saver tab.
4. Set the screen saver to start after the computer has been idle three minutes to two hours.
5. In the toolbar, click Show All.
6. Click Security.
7. Check Require password to wake this computer from sleep or screen saver.

In school settings, it may be desirable for the technology leader to force the screen saver on idle computers. This can be accomplished by...

1. On any computer, and in any account, configure the screen saver desired idle time via System Preferences.
2. In the Finder's "Go" menu, select "Home."
3. Double-click "Library," then "Preferences," and then "ByHost."
4. Locate the file "com.apple.screensaver.------------.plist" and drag it to the desktop.
5. Rename that file to just "com.apple.screensaver.plist".
6. Launch and log into Workgroup Manager.
7. Click the "Preferences" icon in the toolbar.
8. Click the "Groups" tab.
9. Select a group, such as "Students" or "Employees."
10. Click the "Details" tab.
11. Click "Add..."
12. In the open dialog box that appears, select the file on the desktop titled "com.apple.screensaver.plist" and click "Add."
13. In the list, select "com.apple.screensaver" and click "Edit..."
14. Expand the section titled "Often."
15. Verify that the record (key) titled "idleTime" is set as an "integer" for your desired idle time. (The idle time is calculated in second.) Edit this time if desired.
16. There should also be a record (key) titled "askForPassword" that is set as an "integer" of "1". If this record (key) does not exist, click the "New Key" button to create it.
17. Delete any other records (keys).
18. When done, click "Apply Now" and then "Done."
19. Repeat steps nine through eighteen for each managed group.
20. Quit Workgroup Manager.

However, the computer is still vulnerable from the moment the user walks away to when the screen saver starts. It is possible for the user to invoke the screen saver through the use of hot corners (via System Preferences) or by placing an icon for the screen saver in his or her Dock. To add the screen saver to the Dock, drag it's application engine from the following location to the Dock...
/System/Library/Frameworks/ScreenSaver.framework/Versions/A/Resources/ScreenSaverEngine

In school settings, it may be desirable for the technology leader to force the screen saver into the Docks of all users via Workgroup Manager.

FileVault

FileVault encrypts a user's home directory. (The home directory includes the Documents folder, the Desktop, preferences, music, photos, movies, etc.) Encryption guarantees privacy of the data when the user is not logged in.

1. In the Apple menu, select System Preferences.
2. Click Security.
3. Carefully read the FileVault information on the screen.

Firmware Password

A firmware password prevents a computer from been booted from a CD, DVD, external hard drive, or into FireWire Target Disk Mode without a password. For more information, read Apple's article, "Setting up firmware password protection in Mac OS X 10.1 or later.

More options

The National Security Administration and Apple have published a 171-page document title, "Mac OS X Security Configuration For Version 10.4 or Later, Second Edition." For a summarized version of the document, see Larry Dignan's blog entry.

In February 2007, Tech News World published an article summarizing the anti-virus and security software available for Mac OS. However, it is not complete. For example, it excludes ClamXav.