Maccast Members #125 - Parental Cotrols & Guest Account
V Parental Controls & Guest Account
V Opening
* Recently on the Maccast I had a question from a listener about how to restrict access to the Mac and set time limits
* I thought a good, more in depth follow up would be in order to go over some of the tools that are built in to Mac OS X Lion for providing guest and restricted access to the Mac.
V Guest Account
* By default OS X Lion has a Guest account. The account is set up and cannot be removed from the Users & Groups preference pane. The account though is disabled by default.
* The reason the account exists is to allow you to provide guest access without having to set up user accounts manually.
* When enabled the guest account doesn't require a password to log on.
* Guest users can’t make changes to other user accounts or change computer settings, and they can’t log in remotely.
* You can use the Parental Controls (we'll discuss later) to further control and restrict Guest account access when it's enabled.
* It's important to note that Guest accounts can't log in or be used if you use FileVault.
* When a guest user logs in the system creates a temporary Home folder for that user. Any files or data created by the user get deleted when they log out.
V To enable the Guest User account for login
* Open System Preferences, and then click Users & Groups pane.
* Click the lock icon to unlock it, and then type an administrator name and password.
* Select Guest User in the list of accounts.
V A guest account can have a couple of different kinds of access
V To let a guest user log in to the computer, select “Allow guests to log in to this computer.”
* However, guest users can’t log in remotely.
* If you'd like you can set up parental controls for users who have Guest login privileges. This will allow you to limit the amount of access a guest account might have to specific applications, resources (like printers), web sites, etc.
* Select “Enable parental controls,” and then click Open Parental Controls button to configure the restrictions. Again, we'll be going over these setting in a minute.
V To let a guest user access shared files from another computer on your network, select “Allow guests to connect to shared folders.”
* The sharing only account doesn't have login access to the Mac and can only access shared files or folder set up in the File Sharing preferences. It uses the 'Everyone' group to control access.
* These two kinds of guest account access can be used seperately or combined.
V Starting with 10.7.2 there is a "second" form of the Guest account
* If you use iCloud and enable the Find My Mac feature a Guest Account login may still show up in the login window at boot up.
* This is a different form of the Guest account and will appear even if you have Guest login disabled in the User & Groups System Preferences
* The iCloud/Find My Mac version of this account allows someone to reboot into a Safari only secure connection to access the internet. The account has no access privileges other than for Safari.
* The reason? It's kinda like a trap for would be thieves that gives them a way to get on-line so that Find My Mac feature can potentially see and track your Mac revealing it's location.
* In many ways if you plan to use Find My Mac you might want to leave this version of the Guest account enabled even if you don't want to allow full Guest Access.
V If you want to disable this access though, here is how:
* Go to System Preferences > Security & Privacy
* Click the Lock icon and enter an Administrator username and password to make changes
* Click the 'Advanced…' button
* Check the option for 'Disable restarting to Safari when screen is locked'.
* Click OK and exit the System Preferences
V Now keep in mind with this off Find My Mac will not be able to locate the Mac if it is shut down and you have it set up to boot into the login screen (which I recommend).
* You will still be able to use the remote wipe and remote lock features though.
V Parental Controls
V Setting up user account
* Go to System Preferences > Users & Groups
* Click the lock icon (if locked) to unlock it, and then type an administrator name and password.
* Create a new user by clicking on the “+” sign in the lower left corner of the window.
* Under 'New Account:' select the 'Managed with Parental Controls' option
* Enter the account settings, like account name and password, etc. and click 'Create User'
* Back in the main Users & Groups control panel make sure your new account is selected and verify that the 'Enable parental controls' checkbox is checked
* Click the 'Open Parental Controls…' button to begin setting up the controls.
V You can actually also create a new Parentally controlled account directly from System Preferences > Parental Controls
* Click the "+" button in the lower left corner and enter the account setting into the sheet that drops down.
V Enabling Parental Controls
* If you already have an account set up can want to enable the Parental controls you can do that too
* Go to System Preferences > Users and Groups
* Click the lock icon (if locked) and then type an administrator name and password to unlock the settings
* Select the existing account from the users list and then in the main settings window check the 'Enable parental controls' checkbox.
V At anytime you can access the Parental Control settings by going to System Preferences > Parental Controls
* Click the lock icon (if locked) and then type an administrator name and password to unlock the settings
V Also, when you first open Parental controls there is a 'Manage parental controls from another computer' checkbox
* Turn this on and you can manage the parental controls from another Mac on your LAN
* Macs with this feature turned on will show up in System Preferences > Parental Controls on other Macs on your network
* Select the remote Mac and enter the administrator account credentials to be able to remotely set parental controls.
V Apps
V Use Simplified Finder
* Simplifies the Dock and Finder interface
* Dock will have just the Finder, Applications, Documents, Shared, and Trash icons
* Finder windows are just an icon view with no sidebars and right+clicks are disabled
* Single click only will open documents, apps, etc.
* Can switch out of the simple mode temporarily by going under Finder > Run Full Finder and entering admin credentials
V Limit Applications
V App Store apps can be globally restricted by their age rating.
* Don't allow
* up to 4+
* up to 9+
* up to 12+
* up to 17+
* Allow all
V You can also limit Apps individually under 'Allowed Apps:'
V These are sorted into groupings:
* App Store - Apps purchased from the App Store
* Other Apps - Non-App Store apps from the Applications folder
* Widgets - Dashboard widgets
* Utilities - Apps in Applications > Utilities
* Developer - If you have Xcode and Developer tools installed.
* There is a search box to help locate apps to enable quickly
* Any check on app is allowed to be accessed
V In playing with this I ran into trouble with a number of menubar and background apps that had daemons
* iStat menus
* Logmein
* Sophos Anti-virus
* Even Apple's AppsStore updater engine
* They would display an error message asking for access.
* Canceling would just put the error messages in a loop.
* You can grant one-time access or 'Allow Always' by entering your Admin Account credentials
* Allow Always adds the app to the list of approved apps and the Apple will be visible and accessible from the Applications folder
* Launchpad didn't seem to function properly on an account with the Simplified Finder enabled.
V If you don't have the Simplified Finder on all of the Applications seems to be visible regardless of if you have access or not.
* When you attempt to launch a restricted App you get the dialog to allow access once or always.
* Canceling resulting a a perpetually bouncing Dock icon for me until I clicked the app again
V Allow User to Modify the Dock
* Let's the account add, move, or rearrange items in the Dock.
* You can check this on, log into the account, set up the Dock, and then log out and turn it off to pre-set the Dock for the account.
V Web
* This tab allows you to determine what website and URLs can be accessed.
* Unrestricted access will block nothing
V Try to limit access to adult websites automatically
* Not sure what mojo is deployed here
V There is a "Customize…" button that gives additional options
* You can further tweak the lists by adding approved sites to the "Always allow" section and restricting specific site by using the "Never allow" section"
* 'Allow access to only these websites:' lets you set up an approved "whitelist" of specific sites.
* When a site that isn't allowed is accessed it will pop up a dialog asking if you want to add it to the approved list. Have to enter admin credentials to do so.
* The site page will be blocked and show an 'Allow access' button and also a list of links to the approved sites if you have a whitelist.
V A side benefit (or detriment depending on your perspective) is that content from 3rd party servers is also blocked.
* Things like Facebook and Twitter like buttons
* Ad server content, etc.
V Also image and media servers that may be on a 3rd party service. This is one that might be an issue as these sites don't pop-up asking for approval
* You can use the Window > Activity menu in Safari to try and determine the URL to add to your white list to allow this content
V People
* This allows you to limit the people that a user can exchange email and instant messages with.
* Check the "Limit Mail" and/or "Limit iChat" checkboxes
V Add approved users and buddies to the the "Allowed" contacts list by clicking the "+" icon
* You can add these manually by filling out the First and last name and then entering the email address or AIM account name.
* Check the 'Add person to Address Book' to (surprise) add them to your Address Book
* You can also add people who are already in your Address Book by clicking the disclosure triangle next to the last name field and selecting a contact from the Address Book
V The 'Send permission requests to:' checkbox allows you to enter an email address that will receive a message anytime the user sends or receives a message from someone not on the approved list.
* The messages they can then be approved or disapproved for delivery
V Logs
* At the bottom of the Apps, Web, and People tabs is the 'Logs' button
* Clicking it opens a sheet that allow you to see Websites visited, Websites Blocked Application, and iChat logs
* These items can be filtered by time period and grouped by content or date
V You can select items from the lists and click 'Open' to open them.
* Applications
* Websites
* iChat logs (transcript)
V You can select individual items and restrict or allow it's access from the log sheet
* So if you see an iChat conversation that is inappropriate you can select that log and restrict access to that contact
* Or if a website was blocked but shouldn't have been you can select it and click the 'Allow' button to allow access.
* The log also show for how long a particular item was accessed.
V Time Limits
* In this pane you can control when and for how long the account has access
* You can set separate limits for Weekdays and Weekends
V For time limits check on the appropriate limit, Weekday, Weekend, or both and adjust the slider
* Slider goes from :30 minutes to 8 hours in :30 minute increments
V "Bedtime" allows you to set a time of day when the account cannot be accessed. Say 10:00 PM to 8:00 AM for example.
* Set a school night and/or weekend window separately.
* User will not be able to access their account during the bedtime window.
* The user will get a warning 15 minutes before the account becomes inaccessible due to time limits
* Also in the pop-up and Administrator can extend the time for that one instance.
* Clicking the clock in the menubar in a time restricted account will show the time remaining or the "Bedtime" time. The login window will also show the time the account can be accessed again.
V Other
V Hide profanity in Dictionary
* Works for dictionary, thesaurus, and Wikipedia
* If Wikipedia is not allowed in the web it is also blocked in the Dictionary app
* The profanity filter is selective, so it will still return what it considers the non-vulgar version of words.
V Limit printer administration
* Can't add, change. or set up printers or their settings
* Limit CD and DVD burning
* Disable changing password
V Last thoughts
V Little "cog" at the bottom of the user list
* Copy and paste Parental control settings from one account to another
* Turn off parental controls completely. seems to retain the settings which is good if you want to temporarily disable the controls to access the account and preset some of the settings.
* Turn on or off remote access of the Parental control settings
V System Preferences
* No way that I can see to restrict access to individual System Preferences
* All or nothing access to the System Preferences app.
* Can go into System Preferences in the account and go under View > Customize and hide individual panes, but a knowledgeable user could just use the search or spotlight to get access or even just unhide them
* These controls are not the best and a little quirky but do give you some control over specific user accounts and their capabilities.
* You can spend a lot of time playing with and managing them and while the could help you set some computing ground rules in the end it may just be easier to work out a trust relationship with your kids. Now that may not be possible and practical in all situations and that why it's good these control are here to help.
* Finally, if you need more control or options there are 3rd party tools like Intego Content Barrier available.