Securing macs

[TechMonkey]

Got my first ever Mac a few weeks ago and we are now possibly looking at getting a few for the music department. This is a BIG step here! Our biggest concern is locking them down as we have no experience of Macs really so just need some reassuring. Not looking for specifics and I'm sure it can all be done but can:
Terminal be blocked?
Unix programs be blocked?
Programs be restricted to a white list, so not even bundled stuff?

Also which is easier to manage, MacAdministrator or turn a mac Mini into a Mac server and run settings from that?

Any resources (or hints and tips!) I could be pointed in the direction of would be fantastic too.

Many thanks.

[GrumbleDook]

Both MacAdministrator and OSX Server are good options ... in fact the best options.

The MacAdministrator team produce damn good documentation and anything you are not sure about they will respond quickly.

For the OSX side of things the best site is still macenterprise.org

To answer your other questions, yes you can block whatever you want.

If you are not sure about things you can always contact and Apple Solutions Expert (they do vary around the country but if you PM with your location I can get one recommended to you who will not purely be interested in getting sales!). Failing that I am trying to get Apple to set up some extra workshops in the next few months ... mainly to follow on from the sessions they do with teachers, but also to help cover the integration side of things.

Again, a location would help with this.

[TechMonkey]

Thanks for your reply. Location is South Coast, Sussex.

Apple solutions expert sounds like a plan, are they costly or do they just pop in to have a look and then hop eyou buy from them?

[GrumbleDook]

PMed.

[indie]

Or just create a user for the machine, go into Accounts, select the User, select Parental Controls, Select Finder & System and configure it so the kids can only run the apps you want them to. (instructions for 10.4.5, slightly different for 10.3)

Make it so that the locked down user logs on automatically. We've had no problems with doing things that way.

[GrumbleDook]

@indiegirl: Then you are left with a level of fiddling for students finding home areas and we like to give the VIth form media students access to a few more programs than the lower years.

We used to do it your way ... and then have loginhook (login scripts) that would do clever things ... but they were bespoke and if they broke due to an upgrade it was a pig to sort out ... and in the end some things created more work than was easily sorted (mainly students deleting each other's work)

[indie]

@indiegirl

First time i've been called that, but then there's a first time for everything

In that case you might want to go down the OS X Server route and use Workgroup Manager, its fairly easy and im pretty sure you can still authenticate from a Windows domain but apply restrictions to the users logging onto the mac's with it.

[GrumbleDook]

@indiegirl

First time i've been called that, but then there's a first time for everything

It's been a long week ... serves me right for trying to write 3 messages at once

In that case you might want to go down the OS X Server route and use Workgroup Manager, its fairly easy and im pretty sure you can still authenticate from a Windows domain but apply restrictions to the users logging onto the mac's with it.

We have done ... we now have a lovely mac mini running OSX Server, hooked into the AD and locking things down depending on the AD security groups.

We haven't gone the whole hog of syncing the LDAP services between the AD and the OpenDirectory services ... but may do if we get more Macs in.

[guestgirl]

I recently bought a mac mini and was thinking about how to make it more secure.
Is it true that macs generally get fewer viruses because most viruses are made for pcs??

[petectid]

I recently bought a mac mini and was thinking about how to make it more secure.
Is it true that macs generally get fewer viruses because most viruses are made for pcs??

This was true, but the attention of the virus coders is slowly turning to both the Mac and Linux, though the number of viruses out there is still minimal the threat is increasing.

[Geoff]

Linux/Mac OSX has a more secure default security model. Out of the box, the only thing a virus would be able to trash is your user data (which you backup regularly anyway of course).

True windows has limited user accounts which do the same thing but I've found this causes 90% of software to break. You can make the software work with tweaking. But this is no help to Auntie Betty, precisely the kind of person who would benefit most.