Setup guide

UNCLASSIFIED

Chapter 4-

Configuring System Settings

6. Pull down the Location menu and repeat step 5 for any other locations in the

menu.

7. Click the Apply Now button.

8. Click the unlocked lock icon at the bottom of the panel to re-enable the lock

on the System Preferences panel.

Anytime a new location is added to the configuration, AirPort, Bluetooth, and

Internal Modem should be disabled as described here.

Again, all wireless capability, such as AirPort and Bluetooth, should be physically

disabled in secure environments. Disabling or modifying the hardware will likely

void the warranty on the machine if not performed by an Apple Certified Technician.

Further instructions for disabling capabilities such as Airport and Bluetooth will be

given in a later section of this chapter.

Sharing

The Mac OS X default installation has all services switched off, and services should

remain disabled unless operationally required. If these services are enabled, they

may provide a means for an unauthorized user to access the machine remotely.

The services available in this panel are:

• Personal File Sharing: Enabling this option gives users of other computers

access to each user’s Public folder.

• Windows Sharing: Enabling this option allows users to access shared files

and printers using the SMB/CIFS protocol. This option should not be used.

There are well-known risks associated with SMB/CIFS.

• Personal Web Sharing: This service allows any user on the network to

view web sites located in the Sites folders on the machine. If this service is

operationally required, the administrator must be familiar with securely

configuring the Apache web server.

• Remote Login: This service allows users to access the machine remotely

using SSH. If a remote login capability is required, using SSH is still

preferable to telnet.

• FTP Access: This service allows users on other computers to access the

computer via the File Transfer Protocol. FTP transmits passwords in the

clear. Also, if SSH is enabled on the system, encrypted methods of

transmitting files, such as scp or sftp, are available, and should be used

instead.

• Apple Remote Desktop: This allows the machine to be managed via the

Remote Desktop program. As networked management is out of scope for