Apple guide to securing your OS X 10.x Clients

[HodgeHi]

Good morning,

 

I have just come across a link on the AFP548.com website that goes to a security document on securing/hardening OS X client machines.

 

I thought I would post it here for others to see. It looks to be quite a detailed doc.

 

Apple - Support - Security Configuration Guides

[richardp]

thanks! very handy!.

[Guest theeldergeek]

Good morning,

 

I have just come across a link on the AFP548.com website that goes to a security document on securing/hardening OS X client machines.

 

I thought I would post it here for others to see. It looks to be quite a detailed doc.

 

Apple - Support - Security Configuration Guides

 

Off the back of this, any idea how I could completely disable the Guest account via ARD/UNIX?

At present it is set for "allow access to shared folders", but as the security guide suggests disabling completely if not needed, then this is what I would prefer to do.

 

What I want to avoid is having to log into each machine and configuring the guest accounts manually.

 

EDIT : would this method work http://marosnax.blogspot.com/2006/06/disabling-guest-account-in-mac-os-x.html in the same way as adding the plist for the desktop background did, or is this method very user specific, and editing the plist would in fact reflect the users for the machine it was taken from?

Edited May 20, 2010 by theeldergeek

[HodgeHi]

If you have a 10.6 (I think it is also in 10.5) OS X Server then you can disable the guest account for machines through WGM. Just go to the preferences for a computer list and apply the setting inside the login option.

 

This obviously assumes that you have your machines added to the OD (not necessarily bound) and in computer lists.

Edited May 20, 2010 by HodgeHi
added 10.5

[Guest theeldergeek]

If you have a 10.6 (I think it is also in 10.5) OS X Server then you can disable the guest account for machines through WGM. Just go to the preferences for a computer list and apply the setting inside the login option.

 

This obviously assumes that you have your machines added to the OD (not necessarily bound) and in computer lists.

 

Good ol' WGM

 

I've got all my macs in groups, so can apply this. I'm going to find some time to really explore WGM, as there are clearly things in there I need to be exploring.