Netboot and a Parental Control managed account

I am trying to set up a group of kiosks (Mac Minis) using NetBoot off of OS X Server 10.5.2. I've created a netbootable disk image with two accounts. One is an admin account, the other is a managed account with Parental Controls.
My thinking was that I could lock down the managed account and limit the websites that can be visited as well as apps that can be launched using Parental Controls. Everything seems to work fine except one important piece. Neither Firefox or Safari can actually access the internet. I always get a connection error from the browsers. If I run network diagnostics, it returns green on all levels. Similarly, in a Terminal window under that same account, I can ping the webservers I'm trying to get to.
Does anyone have any ideas why Parental Controls on that account seem to limit the ability for the browsers to see the Internet? It works fine when the original image is booted locally. Are managed Parental Control accounts not compatible with NetBoot? Any suggestions?

Ok, this gets more interesting. Based on more testing, I believe there is an incompatibility between Netboot and a Parental Control account. I tried doing a port scan using Network Utility (ports 0-1000) in a variety of accounts both local drive boot and Netboot. The results are further below.
For some reason, the Parental Control account on the Netboot device does not see port 80 (http) off the computer it is scanning. As you can see there are three different cases. The http and https protocols are where the discrepancy occurs. Anyone know if this is by design or a bug? I find it hard to believe I'm the only one trying such a solution but this seems to be a pretty significant roadblock.
*_Netboot Parental Control account results:_*
Port Scan has started ...
Port Scanning host: 10.16.31.84
Open TCP Port: 22 ssh
Open TCP Port: 88 kerberos
Open TCP Port: 139 netbios-ssn
Open TCP Port: 443 https
Open TCP Port: 445 microsoft-ds
Open TCP Port: 548 afpovertcp
Port Scan has completed ...
*_Original HD/OS that is the source of the Netboot image in Parental Control account:_*
Port Scan has started ...
Port Scanning host: 10.16.31.84
Open TCP Port: 22 ssh
Open TCP Port: 80 http
Open TCP Port: 88 kerberos
Open TCP Port: 139 netbios-ssn
Open TCP Port: 443 https
Open TCP Port: 445 microsoft-ds
Open TCP Port: 548 afpovertcp
Port Scan has completed ...
*_Other instances results:_*
*(Includes Netbooted Admin account,*
*Netbooted Standard account,*
*3rd machine hard drive boot as an additional example)*
Port Scan has started ...
Port Scanning host: 10.16.31.84
Open TCP Port: 22 ssh
Open TCP Port: 80 http
Open TCP Port: 88 kerberos
Open TCP Port: 139 netbios-ssn
Open TCP Port: 445 microsoft-ds
Open TCP Port: 548 afpovertcp
Port Scan has completed ...

Similar Messages

Parental Controls -- Managed Account Time Limits

My son's MacBook Air is running Mavericks OS X 10.9.3; MacBookAir6,1; Intel Core i5
I set a 2 hour time limit per day and upon the 2 hours expiring, the system logs him off. Then he shuts it and closes it for the night.
However, upon opening it the next day, the login screen prompts him for a time extension. It's a whole new day and the 2 hours should start over, but they don't.
Worse, when I go to extend his time to let him log on, it sometimes gets caught in a loop of some sort where it will allow him back on per my administrator password to allow it. It will allow him on for a split second, then immediately restrict him again saying he reached the maximum time limit and the administrator box shows up again. The only way I've been able to fix this is by deleting his managed user profile, then adding it in again, once again defining all the parental control parameters, allowed websites, etc. It's a pain. I do try to have him log off at the end of his sessions thinking that it will help keeping things orderly, but if the computer cuts him off, I'm guessing that he was automatically logged out and I am not sure that's the case. It cuts off his time (as it's supposed to) nonetheless. Overall, it's as if the computer's date/time function doesn't factor in to the parental control settings. How could Apple overlook such an obvious detail when planning for time limits? Please, Apple, get these two parts of the OS working together. So...
Honey-Do List for Mavericks OS X Gurus
Get the Date-Time settings to jive with Parental Controls; kill the loop that occurs when time extension requirement shows up first thing the next day
Create a countdown timer of a sort for managed accounts that keeps the user aware of how much of their logon time is used/still left
Pretty please
Thanks!

I have found the most common way is simply this: he knows your administrator password. To see if this is the case just change your password (don't leave a sticky note laying around with the written down password on it please) and see if he's still able to get his way.
Also, restrict access to applications like Terminal. Some Google searches could have shown him how to get stuff done through the command line.

Safari can't establish secure connection in parental controls managed user account

Hi,
Safari can't establish any secure connection in parental controls managed user account. Normal web sites open OK, but secure connections, like Gmail which requires https doesn't work. This is what I get instead:
Safari can’t open the page “https://www.google.com/accounts/ServiceLogin?service=mail&passive=true&rm=false& continue=http%3A%2F%2Fmail.google.com%2Fmail%2F%3Fui%3Dhtml%26zy%3Dl&bsv=llya694 le36z&scc=1&ltmpl=default&ltmplcache=2&from=login” because Safari can’t establish a secure connection to the server “www.google.com”.
Any ideas how to overcome this?

Do you have anti virus software installed, or Peer Guardian?
"https note: For websites that use SSL encryption (the URL will usually begin with https), the Internet content filter is unable to examine the encrypted content of the page. For this reason, encrypted websites must be explicitly allowed using the Always Allow list. Encrypted websites that are not on the Always Allow list will be blocked by the automatic Internet content filter."
From here:
Mac OS X v10.5, 10.6: About the Parental Controls Internet content filter

Switchboard on startup and with parental controls

CS5 Design Standard, OS X Snow Leopard
I have a user account with parental controls, and when the user opens, there is a message to the effect that "you don't have permission to open switchboard"
My questions are:
Is it necessary to have switchboard open on login? I don't see an application or launcher in the normal places that opens switchboard, the only place is in the user Adobe preferences file. Is that where it is prompted to open on login?
Can I delete the file launch.switchboard to prevent open on login, but still retain the usability of the program?
What does switchboard do exactly?
Thank you.

..."I've allowed all Utilities, Applications, etc and no matter what, as soon as I turn on the "only allowed selected programs" option, it won't work."...
I'm not sure, but it is possible that allowing / disallowing based on the pre-defined categories may not work because the software that Wacom uses on my system is in an atypical location, and has an atypical structure - it actually has one application contained inside another. It may be necessary to approve the apps explicitly.
Perhaps try either:
i) Opening "/Library" > "Application Support" > "Tablet" and explicitly dragging any apps present there into the "Parental Controls" pref pane in the panel where the programmes are listed. On my system, the app is called "PenTabletDriver.app"...
or
ii) Logging in to the managed account (with application restrictions in place), and trying to launch the "PenTabletDriver.app" programme. If this generates the "application is not allowed" message, it should be possible to "always allow" with "admin" authentication to white-list it at that stage...

Installing applications and changing parental controls

I have added 2 new programs to my client computers thru ARD with no problems, but would like to know how to set up parental controls for them. Currently when you click on each program I get a message saying that I need to modify the parental controls to +*Never Allow, Always Allow or Allow Once*+. I would like to chnege the access to Always allow from ARD and enable the command to *Modify the Dock* as well
Is there a Unix command for this?

You can copy and paste the settings in the PC pref pane in System Preferences. Make sure remote management is enabled on each machine. Control click on one in System Preferences (from the Admin Mac) and paste into each of the other machines.
Alternatively, you can do it with some UNIX commands:
It can be done using MCX settings. First (make sure all machines are logged out), configure ONE of the accounts with the proper parental controls. Than, in Terminal, use this command:
dscl . -mcxexport /Users/user1 > /path/to/file
*path to file is the path to the file you want to save the settings to. the file will be created. replace user1 with proper username
Now, copy that file to all the other computers to the same location (using ARD).
In ARD, run this command on the machine:
dscl . -mcximport /Users/user2 /path/to/file
*replace user2 with proper username. run as the user root
Now, make sure to delete that file off the machines. Login on a machine. The settings should be applied.

Parental control & network accounts

Is there any way to set up parental control for network accounts?
All my family member's accounts are of the network type, including the kids'. However, it appears only managed users can have parental controls turned on.

Kevin,
I wondered if you had found a way to access the various logs available on Leopard client but when using network accounts. I'm proposing using it in a school but without the logging facility it won't be feasible.
Thanks
Alistair

ICloud and BT Parental Control

If your Internet provider in the UK is BT and you have enabled BT Parental Control, you will need to add iCloud.com to your list of 'allowed' websites in order to use iCloud on your Mac computers and iPhones.

Hi OM1,
Thanks for posting. Sorry you're having problems with the pop up message. I can help with this. Drop me an email with the details, including what browser you're using. You'll get the 'contact us' luink in my profile.
Cheers
David
BTCare Community Mod
If we have asked you to email us with your details, please make sure you are logged in to the forum, otherwise you will not be able to see our ‘Contact Us’ link within our profiles.
We are sorry but we are unable to deal with service/account queries via the private message(PM) function so please don't PM your account info, we need to deal with this via our email account :-)

The constant update of Java and Flash in a managed account

First off sorry if this question has been answered, I had tried a search and could not find it. I have a lab of machines (Maverick with managed accounts) that uses Jar files and Flash applets that are downloaded to the desktop. I would update the machines on a Friday for these internet plugins. But then another update, either Flash or Java, will roll on the weekend and the browser is useless on Monday because Safari refuses to load the jar file or flash applet and Firefox will download corrupt jar files. So the students cannot just use one browser. I would prefer Firefox since it is more forgiving on the flash and allows me to have time till the end of the week to update but now there is an issue of the jar. How can I make it that the java console and Flash will automatically update in the managed account or allow the person to update only these applications and it would not matter which browser is used? Is there a way to use Automator for this, I have a feeling it is a no but I want to be sure? Or is there a way on the firewall to prevent it from checking in the browser for the updates? This is a little frustrating for there seems to be an update more then two or three times in a month and rendering the machine useless for lab.

(Released 4/16/2014) Flash Player 13.0.0.201 (Mac only) (44.67 MB)
That has the fixed Flash 13.0.0.201 plug-in and the debugger. in it. You just need to run the regular installer from that zip file.

How to enable and edit parental control in mac OS X programmatically

I want to create an application for editing Parental Control settings. Application will be running in background and it will get the command from server. On receiving the commands it will change the setting of parental control. Can any one tell me how to achieve this. I want the information like, whether this is allowed by apple or not, if allowed which framework/API's to use. I want to do basically web content and app filtering.

Up!
I am very interesting in this case too!

Xbox Live Video Marketplace and WRT54GS Parental Controls.

There is a funky error when using a WRT54GS with Parental Controls enabled and trying to download movies on Xbox live. This error code (8007000b) only appears when Parental Controls are on, and it only affects the Video Marketplace portion of Xbox live.
It might be Microsoft's fault, but just FYI..
-Chris

The parental controls prevent you from browsing the video marketplace completely.
I don't think that should be how it operates though. Usually the parental controls just let Xbox Live through.
Even so, I wouldn't expect the parental controls to affect the Xbox at all, as the Xbox has its own parental control system in-place.

Smart DNS and BT Parental Controls

I wish to have parental controls turned on, but is there any way to allow Smart DNS to get through?
BT Parental Controls seem to block any DNS other than the BT DNS servers, but is there any way I can allow my Smart DNS service through?
http://en.wikipedia.org/wiki/Smart_DNS_proxy_server
Many thanks for any help.

OnFire wrote:
I wish to have parental controls turned on, but is there any way to allow Smart DNS to get through?
BT Parental Controls seem to block any DNS other than the BT DNS servers, but is there any way I can allow my Smart DNS service through?
No, its not possible. BT have done it that way to ensure that people cannot bypass the Parental Controls by using different DNS servers.
There are some useful help pages here, for BT Broadband customers only, on my personal website.
BT Broadband customers - help with broadband, WiFi, networking, e-mail and phones.

Multiple Applications in Parent Controlled User Account

I've been running Mac for a while but this is the first time I've set up a second user. I'm also not as Mac savvy as a lot of you are on here but I can make my way around, so please be patient with me if I ask a silly question or two.
In setting up a user account for my "Kids", I used the Simple Finder, limited their applications to a select few, and limited their web use to a set number of web pages as they are still quite young and are just beginning to use computers. Everything worked out well, except when we log out and back in again. When we do this, a second copy of applications show up in the Applications folder. With every log in, there is a new set. I think we are now up to 19 copies of each application allowed.
I deleted the shortcuts and they reappear. I've deleted the user account entirely and carefully set it all up again. Same thing. I tried deleting it again but ditto with the result. I've restarted multiple times. I've reset the PRAM. I've deleted prefences files. I've ran a Mac Cleaner. I updated to Mavericks from Lion in hopes it was related. It still does it. This is driving me nuts. I've googled and googled. I've searched these discussion boards. What am I missing? Surely there is something relatively simple to resolve this? I'm out of ideas and I'd really like this fixed so my kids can use their user account.
Can anyone help out a stressed out mom?
Thanks in advance.

I still need a bit of guidance with this please. When I enter the expanded finder and open up the "Kids" Library folder, under Managed Items/My Applications, it lists all the duplicate application shortcuts. I've deleted these again. Put them in the trash, logged out and restarted. Once logging back in, again, I have duplicates occuring. What is going on?? Please help. I'm not sure what else to try or do. There has to be a simple fix to this. Doesn't there?

Using ARD to copy Parental Control Whitelist?

I'm relatively familiar with ARD and use it to manage many aspects of a 50+ mac school. Older students have accounts (and thus Parental Controls) managed by Snow Leopard Server, but each computer also has a local account which is managed by the Parental Controls on the local computer. Unfortunately Parental Controls in Snow Leopard turn out to have a rather disasterous bug which prevents connections to secure sites. This is causing havoc when students try to use the state-mandated testing sites. We of course filter at other levels, but we have to have Parental Controls in place in this account.
All I wish to do is use ARD to copy whichever files are necessary to copy a master "Whitelist" to each of the client computers, but I've had no luck whatsoever figuring out how to do this.
So, let's say "Master" is my master computer and "Clients 1-50" are the rest of the systems. I should be able to go into my "Master" computer admin account, access Parental Controls for my "master copy" of my "localstudent" account, set the whitelist for that account, and then copy the necessary files to every client machine in a few seconds using ARD.
Can anyone please (PLEASE) tell me which files I need to copy?
Thanks in advance!

I've located a couple threads on this topic here and at other forums, but the solutions are always absurdly complex and cumbersome (and, the ones I've tried returned errors, so no go anyway). Every setting on a computer (other than those few in firmware, such as your Startup Disk preference) have *got* to be in a file of some kind somewhere, and thus should be able to be copied from one computer to another.
Does nobody know where this darn whitelist file is stored?
(I don't need to copy all Parental Control settings, just the whitelist, but I sure don't want to have to add multiple exceptions to 50+ computers just to get around Apple's stupid SSL bug with parental controls.)

Downgrade Admin to "Managed with parental controls" - no data loss?

I want to change my daughter's iMac account (originally my wife's computer) from "Admin" to "Managed with parental controls."
Is this possible while saving all of her school work/music/etc. which are now under the admin login/account? Or do I backup her home folder, delete the admin account, add a new one for me, then put her back in as "Standard" and go from there?
Hope there is an elegant/easy way to avoid data loss while still upgrading security on her usage...
Thanks in advance!
Kevin

hi k,
yes you can down grade her account and enable parental controls. This will not delete her content such as itunes, photos, documents, extra.
if you haven't done so already, make another administrator account with you will use to manage the computer. Make sure the account has a password; and that password is not the same as her password.
then Login with the new administrator account.
go to system preferences and click on accounts. unlock accounts by clicking on the lock. click on the old administrator account. now uncheck allow this user to administrate this computer. then check enable parental controls. then click on the open parental controls button.
you can now configure parental controls.

How do you disable mobile account settings/parental controls

My school had a one-to-one macbook program, but I switched schools. Now i have a heavily restricted computer. They had my account set to mobile and had parental controls enabled, so I used single user mode to create a new admin (remove /var/db/.applesetupdone and reboot) and remove them. However, even though no account has parental controls turned on, they are still enabled somewhere for all accounts, even admins. I have two questions: how do i disable mobile account settings, and where are the parental controls files located? I found some in /library/managed preferences/<account name here> , but editing these gives only temporary relief from parental controls, and they are reset when i restart. There has to be somewhere else that parental controls are flagged as on/set to sync on login. i removed the actual parental controls executables and stuff somewhere in /system but after that i couldnt open activity monitor and i didnt want to risk a reboot. please help me as this is very annoying. btw im on OS X 10.6.7

HI,
Try this..
Open System Preferences/MobileMe and select the Sync tab.
Deselect the box where you see: Synchronize with MobileMe. The last sync will noted at the bottom left side of the window.
Carolyn

Netboot and a Parental Control managed account

Similar Messages

Maybe you are looking for