How to restrict External Drive access in other user accounts

Question

Level 1

9 points

How to restrict External Drive access in other user accounts

I just purchased an external HD and moved my iTunes and iPhoto libraries to it. No problem there.

My Mac mini has four user accounts and I'd like to set the permissions on the external HD so that only I can write to it from my account. I'm attempting to do this through 'Get Info' on the external drive, then setting Sharing & Permissions to 'Read and Write' for myself and 'Read only' for the other three accounts. But it seems that when I set one of these it gets set for all four accounts.

Am I doing something wrong trying to set the permissions this way, or, is there a better way to do it?

Thanks,
Andy

Mac Mini, Mac OS X (10.6.3), External HD

Posted on May 9, 2010 4:08 AM

Reply

Answer 1

Top-ranking reply

edclange

Level 5

4,956 points

May 9, 2010 5:19 PM in response to andysparks

What is the filesystem type on the external drive? The Format line of the Get Info window will show this.

If it's FAT, which is typical for an external USB drive if you haven't reformatted it, then you can't use per-user file permissions. You'll need to use Disk Utility to reformat it to Mac OS Extended. Make sure you have a full backup first.

Reply

Answer 2

May 10, 2010 12:03 PM in response to andysparks

make sure the "Ignore ownership on this volume" checkbox at the bottom of the get info window is unchecked. Set "everyone" to No Access.

Reply

Answer 3

May 11, 2010 1:40 PM in response to kisuke3

Actually
It may be better to restrict certain folders on the drive than the entire drive. And if you have a ton of folders, just create one new folder and put them all into it.

Also, when making changes with Permissions, be sure to click the gear box and check "Apply to Enclosed Items". If you haven't done that to the whole disc yet, you can try that first, but my guess is it may be better/easier/faster/more secure to button up a folder instead.

Reply

Answer 4

May 9, 2010 6:15 PM in response to andysparks

Do you see Staff and Everyone listed in the Get Info window? If so, try changing those to No Access and see if that does it.

Reply

Answer 5

Barney-15E

Level 10

122,210 points

May 10, 2010 4:27 PM in response to andysparks

Try setting an ACL "group:everyone deny delete" to the folders that you don't want anyone deleting things from.

chmod +a "group:everyone deny delete" path/to/folder

[This web page has some info on forming ACLs|http://aplawrence.com/MacOSX/acl.html].

Reply

Answer 6

kisuke3

Level 3

914 points

May 10, 2010 4:06 AM in response to andysparks

the problem is, its directly plugged in. You may get different results if its a network drive though. Out of curiousity,would the external Drive be the only limitation you want to set for the other accounts?

because you may get the job done in parental controls/managed account.

Reply

Answer 7

May 9, 2010 2:51 PM in response to andysparks

Set the other accounts to No Access. That should do the trick.

Reply

Answer 8

andysparks Author

Level 1

9 points

May 9, 2010 6:08 PM in response to edclange

I reformatted the drive to Mac OS Extended (Journaled) before writing files to it.

Andy

Reply

Answer 9

baltwo

Level 9

62,386 points

May 11, 2010 3:54 PM in response to andysparks

Dumb question. Are the other accounts admin accounts? If so, maybe that's the issue.

Reply

Answer 10

andysparks Author

Level 1

9 points

May 9, 2010 1:49 PM in response to kisuke3

I didn't realize you could set the privileges for other user accounts in the 'Get Info' box from my account. I added the names of the other three accounts and set them to 'Read Only' but I am still able to delete files from the drive when I'm logged into those accounts.

What I'm trying to do is set it up so that either (1) they can't accidentally delete files from the external disk or (2) they can't even see the disk at all from those accounts. I would have thought that 'Read Only' would not allow them to delete files, but with the privilege set to 'Read Only' I'm still able to delete files from the disk.

Maybe I'm missing a step? Or maybe there's another way to do it?

Thanks,
Andy

Reply

Answer 11

andysparks Author

Level 1

9 points

May 10, 2010 2:35 AM in response to Ben Rigsby

I'm able to set 'staff' to Read only (there is no 'No Access' option) and 'everyone' to 'No Access'. But, I can still delete files from the drive from other users' accounts with the settings done that way.

Maybe there is a whole other way to accomplish what I'm trying to do?

Andy

Reply

Answer 12

andysparks Author

Level 1

9 points

May 10, 2010 3:52 PM in response to kisuke3

Can't figure out a way to restrict access to the drive through Parental Controls.

And with 'everyone' set to 'No Access' and the 'Ignore ownership on this volume' box unchecked, I can still see and delete files from the external drive from other users' accounts.

I appreciate all the suggestions so far, but can't seem to make this work.

Andy

Reply

Answer 13

andysparks Author

Level 1

9 points

May 11, 2010 5:55 PM in response to Jeffrey Lee

Thanks all for the help. I'll get out the unix book and learn about ACLs. That seems to be the way to go.

To answer the other questions:
I don't have another mac to try this on,
The external HDD does have a format of Mac OS X extended journaled,
I have been checking the gear box and checking "Apply to Enclosed Items",
And the other accounts are not admin accounts.

Also, good suggestion to restrict access to just folders.

Andy

Reply

Answer 14

kisuke3

Level 3

914 points

May 9, 2010 6:13 AM in response to andysparks

have you tried adding the 3 other accounts in the privilege but setting them up as read only?

Reply

Answer 15

andysparks Author

Level 1

9 points

May 9, 2010 2:54 PM in response to Ben Rigsby

The only options I see are 'Read & Write', 'Read only', and 'Write only (Drop box)'. I also tried the last one and the result is the same. I don't see an option for 'No Access'.

Andy

Reply