Securing Blog Service

It seems I have answered my own question. I am not sure if it was also necessary to do what I have already done, but in the blog itself while logged in as the blog owner, you need to enter the admin settings and choose to make the blog readable only by authenticated users. It may or may not work if that is the only place with that setting, but it works with all the previous settings and that. There sure are a lot of redundant settings in undocumented places. Too bad this security measure relies on the user and can't be enforced on the network.

Thanks for the input Harry. It is good info and much clearer than what I wrote.

It might not have been clear in my original post that I am the admin and had already set access and permissions via SA, WGM and Directory.app so that nobody other than the desired group should have had any access at all. Unfortunately it did not get the job done as expected and in spite of what is in the documentation, I did have to log into the blog itself via web browser to restrict read access to only authenticated users in the authorized group. Until then, anyone on the web could have read the blog, and I did not want that.

What still perplexes me is why when a user creates a blog it ignores the server access/permission settings and the blog is by default world readable. At least, it happens that way for some reason on my server. Now that I know about it though, I can at least fix it. Since we are a small shop, it won't be too much of a hassle to correct the blog settings each time a user creates a new blog.

Thanks again for the reply.

Dan

Harry,

I didn't know that teamserver should be owner and group for /Library/Collaboration with no other assigned ACL, but just verified that it is so. That is good info to have though. I did have myself assigned as a moderator in web site services (just deleted as I am a member of the group and we don't really need a moderator), but I (and another usid for myself) are the only admins. But, I think your post just possibly illuminated something. The problem is not on the "group" blog, but on "user" blogs. I want to allow creation of individual blogs for users who are members of the group, but I still don't want them world readable and that is where the problem (no login popup) is. Is it possible that OS X Server does not allow a system admin to impose restrictions on access to "user" blogs?

Thanks again Harry,

Dan

I never did come up with anything else other than that the system admin cannot set a default for only authenticated users, let alone make it so that is the only possibility. Preventing users from accessing admin settings would be even better, if a default could be set. It seems like it should be doable. Good luck.

Dan