Security: Read-only for USB and FireWire

Is there a way to secure the external data ports on a Mac so you can't write to a USB and/or FireWire drive? Obviously we need the SATA / InternalHD to be regular read/write. I've swapped out the optical drive so it is a read-only device, but it would be nice to have a solution that prevents writing to optical media as well.

I found two links that provide a solution.
http://images.apple.com/server/macosx/docs/TigerSecurity_Config021507.pdf
http://images.apple.com/server/macosx/docs/LeopardSecurity_Config20080530.pdf
I can't find the page(s) that reference these PDFs, so you have to download them directly.
Within the two documents are information about "removing support for mass storage devices" by trashing certain files (IOUSBMassStorageClass.kext for USB and IOFireWireSerialBusProtocolTransport.kext for FireWire).
One caveat seems to be that these files may be restored through system updates, so you need to write a login script (script provided in Leopard PDF) to ensure they are removed or simply be aware of the issue when installing system updates.

Similar Messages

  • Read Only for "Group" and "Others" via SMB

    I see when Windows vista users of my OS X 10.5.8 server save a file to the server, the permissions show on the server as Read & Write for the owner and Read Only for 'Group' and 'Others'.
    Is there a way I can make the OS X server always make 'Group' and 'Others' always be Read & Write?
    Thanks!

    It's using a shared component LOV cleverly called LOV_YN which consists of a static LOV with
    1 Display=Yes, Return=Y
    2 Display=No, Return=N
    The settings in the LOV section on the item iteself:
    Named LOV: LOV_YN
    Display Extra values: No Dynamic translation: Not translated
    Number of columns: 2 Display null: No
    Null display value is blank as is null return value
    Item was setup as a radio group and was only converted over to a select list to work around this issue. Let me know what else you need and thanks again.
    Rgds/Mark M.

  • Change public share access to read only for public and full access to selected users

    Hi, new to the community just purchased a recertified WDMyCloud 2TB after my 2 years old MyBookLive 2TB HD died due to accidental power cable unplugging. I've got everything setup including MiniDLNA by following instructions on this forum and everything is working  exactly as I want it to except public share. I want public share to be set to read only access for public and full access to certain users (just myself at the moment) and having a "upload" folder within this share with full public access to everything in this folder would be a bonus. I tried login in to ftp with root user and removing write permission for public but that blocks me out as well. I'm sure it's possible by doing some majic on SSH but I wouldn't have a clue so hoping someone here would be able to help me out.

    Mr_Khan wrote:
    What i want is public to have read only access to file server. Public as in users who do not have a user account on mycloud. E.g someone who connects to to my home network for the first time and is able to browse and download content from public share. I'm aware of being able to set indivual access to shares for users like full access, read only and no access but public users won't have a user account.Through the My Cloud UI interface what you seek to do is not possible. The public share like all other share folders are an all or nothing affair when using the adminstration UI. When using the administration UI you do not have granular control on shared folders to limit non users to read only access or set permission levels for subfolders. The workaround to do what you seek and have the public folder set for read only is to change the folder settings via SSH. It may take some work to set the folder security so that users can read/write to the public folder while the guests only have read access. However, if you reboot the WD My Cloud or update the WD My Cloud firmware those settings may be reset back to the default settings where the entire public folder is read/write for all. There are way to prevent this but again it will take a bit of coding to do so via SSH. See this link (even though its for the WD My Book Live) for a starting point on how to use SSH to change the permission levels on the public folder. Another option if one doesn't go the SSH route is to turn off public sharing for the public folder then create a "guest" user account and give that "guest" account read only access to the public folder while all other user accounts have full read/write access.

  • Recommendations for USB and FireWire Card

    Hi -
    I am looking for recommendations for a USB 2.0 expansion card, and a Firewire expansion card for the
    Mac Pro.
    Thanks,
    Dan Powers

    The Sonnet PCI USB Express cards have this problem too - for the record. Sonnet know about the MacPro not waking with it installed, as do Apple. I am sure Apple willl come up with something, I may even find a workaround, but it has always seemed that expansion cards with all my Macs [ waaaay too many] have produced unpredicatable problems.

  • All USB drives mount as read only for user

    I have searched a bunch and thee results I find seem to be irrelevant to my situation. Most relate to a single USB media that is a problem and won't read or write.
    On a new Arch install on a new computer (my third base system install). Running Gnome.
    All USB mass storage devices mount as read only for the logged in user. Root has write permissions and I can mkdir no problem. It is not an issue with the USB drive itself as this occurs with multiple USB media (I've tested several SD cards on a reader and at least two drives, all the media works correctly on my existing installations)
    I'm posting the contents of my /etc/group file in case there's an obvious error there I don't see, and my dmesg output upon plugging in the drive. User name is changed in the group file posted to "archie"
    This is a single-user system.
    /ect/group
    root:x:0:root
    bin:x:1:root,bin,daemon
    daemon:x:2:root,bin,daemon
    sys:x:3:root,bin
    adm:x:4:root,daemon
    tty:x:5:
    disk:x:6:root
    lp:x:7:daemon
    mem:x:8:
    kmem:x:9:
    wheel:x:10:root,archie
    ftp:x:11:
    mail:x:12:
    uucp:x:14:archie
    log:x:19:root
    utmp:x:20:
    locate:x:21:
    rfkill:x:24:
    smmsp:x:25:
    http:x:33:
    games:x:50:
    lock:x:54:
    uuidd:x:68:
    dbus:x:81:
    network:x:90:
    video:x:91:
    audio:x:92:
    optical:x:93:
    floppy:x:94:
    storage:x:95:
    scanner:x:96:
    power:x:98:
    nobody:x:99:
    users:x:100:archie
    systemd-journal:x:190:
    archie:x:1000:
    avahi:x:84:
    polkitd:x:102:
    rtkit:x:133:
    gdm:x:120:
    brlapi:x:999:
    kvm:x:78:
    ntp:x:87:archie
    dmesg output
    [ 968.044188] usb 4-3: new high-speed USB device number 4 using ehci-pci
    [ 968.170628] usb-storage 4-3:1.0: USB Mass Storage device detected
    [ 968.171435] scsi7 : usb-storage 4-3:1.0
    [ 969.174450] scsi 7:0:0:0: Direct-Access Generic USB SD Reader 1.00 PQ: 0 ANSI: 0
    [ 969.175068] scsi 7:0:0:1: Direct-Access Generic USB MS Reader 1.03 PQ: 0 ANSI: 0
    [ 969.939417] sd 7:0:0:0: [sdb] 15572992 512-byte logical blocks: (7.97 GB/7.42 GiB)
    [ 969.941028] sd 7:0:0:0: [sdb] Write Protect is off
    [ 969.941037] sd 7:0:0:0: [sdb] Mode Sense: 03 00 00 00
    [ 969.944664] sd 7:0:0:1: [sdc] Attached SCSI removable disk
    [ 969.945509] sd 7:0:0:0: [sdb] No Caching mode page found
    [ 969.945517] sd 7:0:0:0: [sdb] Assuming drive cache: write through
    [ 969.952682] sd 7:0:0:0: [sdb] No Caching mode page found
    [ 969.952693] sd 7:0:0:0: [sdb] Assuming drive cache: write through
    [ 969.956396] sdb: sdb1
    [ 969.965003] sd 7:0:0:0: [sdb] No Caching mode page found
    [ 969.965011] sd 7:0:0:0: [sdb] Assuming drive cache: write through
    [ 969.965015] sd 7:0:0:0: [sdb] Attached SCSI removable disk
    I'm sure I'm just missing something in user management, but I can't find what.
    Last edited by hooya (2014-04-27 03:10:49)

    I am also having the same problem. Root can read and write to automounted drives, but my user cannot. I've tried with a variety of drives, I am assuming they are being automounted by root instead of the logged-in user somehow. (I am running x directly, and am not using a display manager, if that has anything to do with it).
    When I look at how it is mounted it is as follows:
    /dev/sdc1 on /run/media/myuser/drivename type vfat (rw,nosuid,nodev,relatime,uid=1000,gid=1000,fmask=0022,dmask=0077,codepage=437,iocharset=iso8859-1,shortname=mixed,showexec,utf8,flush,errors=remount-ro,uhelper=udisks2)

  • USB and Firewire Card for Mac Pro 3.0

    I am running out of USB and Firewire Ports. Any suggestions on expansion cards for Firewire and USB??
    Thanks
    John

    The Sonnet PCI USB Express cards have this problem too - for the record. Sonnet know about the MacPro not waking with it installed, as do Apple. I am sure Apple willl come up with something, I may even find a workaround, but it has always seemed that expansion cards with all my Macs [ waaaay too many] have produced unpredicatable problems.

  • Possible to make an item editable for certain users and read only for other

    Is it possible to make an item editable for certain users and read only for others?
    I've been able to accomplish this by taken the select statement that I used to define an authorization scheme, placing it in the Read Only condition of the item. However, I would like to simply reference the authorization scheme to utilize caching, and to help keep things cleaner for future maintenance.
    Is it possible to reference an authorization scheme in an item condition similar to the way another item can be referenced by preceding it with a colon (i.e. :P1_First_Name)?

    Thank you, your suggestion worked.
    It would be nice on a future release of APEX if a drop-down box existed under the Ready Only section that would allow an existing Authorization Scheme to be selected or negated when applying the Read Only attribute to a form item.

  • MY Hard Drive says_"YOU CAN READ ONLY" for the OWNERSHIP AND PERMISSSIONS!

    I cannot add anything to my EXTERNAL (SimpleDrivePS) hard drive. When I try to copy something to it, it says "The item cannot be moved because SimpleDrivePS cannot be modified."
    Upon control-clicking this external hard drive's icon, under "Get info" it says "You can read only" for it's "Ownership and Permissions."
    I have used this hard drive with Windows-based computers, but not with this new Apple yet.
    What do I need to do so that I can move or copy things to this external hard drive?
    Also, is there a discussion room for just general questions? - There are many little things that I wonder how to do from time to time as I am trying to become accustomed with Apple, like shortcut key for desktop, or where is control panel or link to "my computer" or other shortcut keys - things like that.

    Hi newsppler;
    Since I have never had a disk that was formatted NTFS, I am not absolutely sure exactly how you can discover how it is formatted. I think if you look at the disk with Disk Utility that should tell you.
    Yes. If you reformat you will lose everything that is currently on that disk.
    To reformat open Disk Utility and then select the disk. You then click the partition tab. This will allow you to select what format you wish to use. I would suggest Mac OS Extended +
    Allan

  • Recognising USB and Firewire works only on startup

    A short while ago I noticed that none of my USB or FireWire devices were recognised if I plugged in the cable while the computer was on. The devices are listed in System Profiler but not mounted/usable.
    If I plug devices in before powering up, everything works fine.
    There have been some recent posts about similar problems with USB and FireWire, however, I haven't seen one with the exact same symptoms.

    Reinstalling the 10.5.4 update fixed all of my problems. Apparently something had gone wrong the first time.

  • External video projector - How can I hook up my Mini DisplayPort to DVI Adapter onto my new MacBookAir if the machine does not have a mini port (but only 2 USBs and 1 Thunderbolt)?

    Hi
    How can I hook up my DVI Adapter onto my new MacBookAir if the machine does not have a mini port (but only 2 USBs and 1 Thunderbolt)?
    Is there a DVI adaptor already for Thunderbolt?
    Thanks,
    JFR

    The Mini Display port and Thunderbolt port use compatible connector bodies. Your current Mini Display to DVI or VGA adapter will still work as before on the newer Thunderbolt capable machines.

  • Can a Column in a Project Plan be set to Read Only for everyone except Admins

    At my company the Project Server Admins create the initial project plans.  We want to add a new column that will designate each task in the plan as Capital or Operational.  We do not want anyone to have the ability to change these.
    When the Project Managers need additional tasks on their plans they will need to copy an existing one in order to have this piece of information pre-populated on their new tasks, since we do not want them deciding what the task should be themselves and populating
    the field as they create tasks.

    In addition to Dale's excellent answer, I'd mention that it is possible to make a column "read-only" for certain security groups in MS Project Pro with VBA code. 
    That being said, I'd suggest to follow Dale's advice using a "soft" solution.
    Hope this helps,
    Guillaume Rouyre, MBA, MCP, MCTS |

  • What is wrong with my 30" Cinema Display?  The USB and FireWire ports still work, but the screen is pitch black. When you plug it into the computer, it detects that it's a Cinema Display.

    When you plug it into the computer, it detects that it's a Cinema HD but the screen is pitch black.
    For some reason, the USB and FireWire ports still work.

    If you shine a really bright light directly into the screen can you then see a faint image on the screen? If so, that would indicate the backlight has died (hardware failure) and the unit needs repairing.

  • (MacOSX Lion 10.7.4) The problem of connecting the audio interface (USB and FireWire), grained acoustic distortion!?

    When you connect the audio interface to usb or firewire grained acoustic distortion, there is no loud noise in the acoustics! In the old "iMac24 Snow Leopard" was not like this!
    Just bought the iMac21 lion, installed the new drivers and the two interfaces of different firms is presented, this acoustic problem.
    I understand it comes from a usb and firewire!?
    Help Me_____
    Sorry for my english

    Well, it's been a few days and with no response I thought I'd look for another solution. I've been trying this software called iVPN, apparently it's like a front-end to OS X's built-in VPN server. Anyway, I disabled the VPN Server from the Server app, turned on iVPN and was VPN-ing from my iPhone over 3G in notime. It's a great app, though it kinda ***** that the server can't do what it's built to do. Since VPN was the big reason I got Server in the first place, I'll probably uninstall it and stick with OS X's built-in file sharing and iVPN.

  • Is it safe to plug and unplug USB and Firewire cables with the computer on?

    Is it safe to plug and unplug USB and Firewire cables with the computers on? I have a Mac G4 and a newly purchased IMac and I use one printer for both computers. Should I shut down the computers when I unplug the printer and connect to the other computer? How about when switching firewire drives.
    Is there an easy way to have both computers connected to the same printer? I have an Epson 1280 printer.

    Yes, you can unplug a printer without shutting down the computer, but if you are switching the printer to another computer then you should first turn off the printer, unplug it, re-connect to the other computer, then turn on the printer. This will assure that the printer will be properly recognized.
    If you have your computers networked via Ethernet then you can leave the printer connected to one computer and share it with the other via the network connection. Printer sharing is turned on using the Sharing preference in System Preferences. You will need to Add the printer on both computers so you will need the appropriate printer driver installed on both computers.
    See the following articles for more:
    http://members.cox.net/18james/osxprintersharing.html
    http://docs.info.apple.com/article.html?artnum=58028
    http://www.apple.com/support/tiger/network/
    http://docs.info.apple.com/article.html?artnum=106658
    Also select Mac Help from the Finder's Help menu and search on "printer sharing."
    Why reward points?(Quoted from Discussions Terms of Use.)
    The reward system helps to increase community participation. When a community member gives you (or another member) a reward for providing helpful advice or a solution to their question, your accumulated points will increase your status level within the community.
    Members may reward you with 5 points if they deem that your reply is helpful and 10 points if you post a solution to their issue. Likewise, when you mark a reply as Helpful or Solved in your own created topic, you will be awarding the respondent with the same point values.

  • Expanding USB and Firewire

    Anyone have a good recommendation for expanding my USB and Firewire capability on my iMac 5gen (isight). I keep reading mixed reviews on belkin.
    Thanks,
    Jim

    Oh dear, it is one thing after another for you, isn't it Jim!
    +DLX-182 Dual Link Hub front view+
    +4 FireWire ports on the front of the hub. Connect one to your computer and have 3 additional FireWire ports conveniently located on your desktop! Connecting FireWire cable included.+
    It looks, once again, as if you have done everything correctly. Are you saying that the red power light on the hub isn't lighted? If that's the case, check the power cord and if it has a power brick, see if that's lighted. It sounds as if the hub itself is faulty (just what you needed to hear). You did connect the hub to the computer using the far right-hand port? Check your firewire cable and see if it's working properly. Also, try switching the ports on the hub that you have your 2 externals connected to. In addition, make sure that if you plug each of the externals directly into the computer, they show up.

Maybe you are looking for