Disabling USB thumbdrive access on an OSX account - for security issues

Question

Level 1

0 points

Disabling USB thumbdrive access on an OSX account - for security issues

Hi
I have series of 'secure' meeting rooms with Macs for taking notes and developing and viewing documents.
The documents are transferred by specific admin staff to and from the machines to a secure network server located in a nearby location.
The machines are not networked in any way at all ie. no ethernet or wireless allowed and consequently not connected to any server.
They have usb connected laser printers, for basic record keeping and proofs etc, a keyboard and mouse, and they are spec'ed with CDROM drives only so that burning CD's and DVD's is impossible.
As well as english commonly used software like MS word, CS studio etc. I have several non-english page design/layout software packages running on them that allow multiple different languages to be viewed in them - so we dont use simple finder - just the basic OSX parental controls - which works fine atm.

Currently the admin staff have an admin account and we let them do all the transfer of files on and off the mcahines - wipe the files etc using the admin account.

However - now due to issues with 'unauthorised' USB drives being taken in to these 'secure' rooms 'inadvertently' and possibly purposely - I now need to disable completely the ability to access USB thumbdrives from the controlled account - ie. no read or write access. [except on the admin account]

How can i do this? .
..and still maintain read/write access to them via the Admin account?

Parental controls seems rather limited for this purpose of limiting device access for saving etc.
Is there an alternative way to limit access to USB devices?

Any suggestions welcome.
Thanks

Message was edited by: fluids

Towers, Powerbooks, Xserves, iMacs etc., Mac OS X (10.4.10)

Posted on Oct 10, 2007 3:55 AM

Reply

Answer 1

roam

Level 6

13,637 points

Oct 10, 2007 4:35 AM in response to fluids

I don't think you can hobble your Macs any further.
Any USB device that was connected would be logged in the system.log as a volume.

Use that record as a means of establishing whether anyone is circumventing your strict policy.

Reply

Answer 2

Oct 10, 2007 5:16 AM in response to fluids

Two suggestions would be to write a login script that loads/unloads the IOUSBMassStorageClass.kext (maybe even move it to a different directory and ecplicitly load it with a script for the admin user).

Alternatively, I believe you can download the Apple Workgroup Manager application from OS X server from apple.com (I haven't searched for it) which permits you to restrict privileges to mount USB mass storage devices per user or group.

Reply

Answer 3

Király

Level 6

10,035 points

Oct 10, 2007 9:43 AM in response to fluids

If you are running OS X Server, you can use Workgroup Manager to disable the mounting of external drives, or to allow them to be mounted as read-only devices. Go to Preferences -> select user or group -> Media Access -> Other Media tab -> adjust settings to your needs.

Unfortunately I can't get these settings to do anything with the client version of OS X. But if you have OS X Server it should do what you want.

Reply

Answer 4

fluids Author

Level 1

0 points

Oct 10, 2007 9:40 PM in response to J D McIninch

Thanks for the suggestion...

I pretty much expected this would be the only way to do it - creating and using a shell script or similar to disable the devices.

But I was hoping for something simple built in to the Mac interface.
It seems like it would be a simple addition to parental controls [by Apple] and very useful with machines placed in public places like imacs used as Kiosks etc.

Workgroup manager is only available if you use OSXServer... and it may not be all that useful in this scenario to install a copy of server on every one of the meeting rooms machines - although i guess it's a valid option that does use the GUI to control it. ie. no handbuilt scripts required.

Reply