How to I prevent Guest User access to external hard drive?

Question

Level 1

5 points

How to I prevent Guest User access to external hard drive?

We have an 27" iMac running OS 10.10.5 and noticed that when logged in as "Guest User" that our two external hard drives and completely accessible.

In the Apple Community I found a post from Linc Davis that said to uncheck the "Ignore ownership on this volume" box at the bottom of the hard drive "Get Info" window. This worked for one hard drive (Mac OS Extended format) but not the other (ExFAT format).

The ExFAT format hard drive "Get Info" window does not even have the "Ignore ownership" box.

How can I prevent Guest User access to this drive?

iMac (27-inch, Late 2013), OS X Yosemite (10.10.5)

Posted on May 4, 2017 7:20 AM

Reply

Answer 1

rccharles

Level 6

13,037 points

May 5, 2017 10:45 AM in response to sahjmc

The ExFAT format hard drive "Get Info" window does not even have the "Ignore ownership" box.

I think your going to be out of luck here. This is a windows format and doesn't have the macos, read unix, permissions nor would it have ntfs permissions. There is no way to control access to this device.

While macos places drive in /Volumes, they don't need to be there. You could move the exFat drive to some other location. I don't know if this would prevent guest users from gaining access to the drive or not, but it would make it harder for the "guest". This would make things complicated for all users. And you would have to figure out how to do it 😉. I'd start by trying sudo mv ...

Why the guest account?

Change the exFat drive to ntfs. Install commercial ntfs drivers on your mac. I don't know if the "ignore ownership" box appears. Need to check.

Maybe you could move the exfat data to some server.

You could play around with permissions on /Volumes. Change the group to some group all you regular user have and guests do not.

R

Reply

Answer 2

VikingOSX

Level 10

123,422 points

May 5, 2017 12:01 PM in response to sahjmc

The exFAT drive format does not support settable access control metadata. Everything is permissioned 777 or read/write/execute and open to everybody. It simply does not support changing this setting. Thus, you cannot restrict anyone from accessing it while it is mounted, and when a guest is signed in, it should not be mounted.

Reply