Dealing with Security Risks

File sharing poses security risks. Allowing other users to connect as guests is a relatively low risk if you are careful. If your computer has multiple administrator login accounts, the risk is much greater. The risks are magnified if your computer has a public IP address and is thus directly exposed to the Internet, as opposed to being Network Address Translated and having a private IP address.

Assessing the risks of guest access

Mac OS X normally allows everyone on your network to access your Public folder as a guest, without supplying a name and password (if file sharing is turned on). Therefore, you should be careful what you put in your Public folder. The Public folder itself is normally Read-only, and you can set restricted access privileges individually for items that you put into your Public folder. However, if everyone has Write access to a folder inside your Public folder, such as to the Drop Box folder, a guest can still cause mischief by filling your disk with file after file.

Assessing the risks of administrator access

An administrator’s special ability to connect to all disks and work without certain restrictions can threaten the computer’s security much more than guest access does. In Mac OS X 10.1 and earlier, someone who connects to your computer for file sharing with an administrator’s name and password can actually access the contents of all home folders and the main Library folder on your computer. This is more freedom than Mac OS X allows when you log in as an administrator. Under Mac OS X 10.2 and higher, an administrator logged in through file sharing has the same privileges and restrictions as that user would if logged into the machine locally.

Assessing the risk of your Internet connection

The security risks of file sharing are amplified by the fact that file sharing is normally available via the Internet’s TCP/IP protocol. A potential hacker does not have to be physically near your Macs. The hacker could enter over an Internet connection. If your computer is connected directly to the Internet, anyone in the world who learns your computer’s IP address can access your Public folder anonymously via the Internet. Someone who also knows the name and password of an administrator account on your computer has very broad access via the Internet. The Internet exposure is relatively high if your computer has a static IP address from your ISP. The Internet exposure is relatively low if your ISP assigns your computer a different IP address every time you connect, as is usually the case with a modem connection, a cable modem connection, or a PPPoE connection. If you share a connection via an Internet router, your computer may have a private IP address that can’t be accessed from the Internet unless the router is explicitly configured to allow such access.

Improving file-sharing security

Here are some techniques you can employ to improve file-sharing security:

• Be very sure to turn off the administrator option on any account that does not absolutely require it.

• Don’t allow Write permission for guests, even to Drop Box folders. Set the Others category of every shared folder to read only.

• Do not overvalue the security of passwords. Someone may connect to your computer with a password and then leave his or her computer without disconnecting. A passerby can then use this computer to access all your shared files (subject to the access privileges you set). Remind people who connect to your computer for file sharing that they must put away all your shared folders (by ejecting them) when they are finished. Also, remind users to lock their keychains or log out of the Mac when they leave it unattended. If they do not, unauthorized users may be able to access shared folders using their account, even if they do not know the password.

  Particularly if you have high-speed Internet access, such as cable-modem, or DSL, you might want to set up a firewall to protect your local network. Firewalls provide a barrier to unauthorized access from outside your local network.

Cross Reference

The Internet gateways covered in Chapter 15, including the Apple AirPort Base Station, generally can be configured to provide some forms of firewall protection.

Using a personal firewall to improve security

A firewall is an application that runs on a computer or a piece of separate network hardware that exists to improve security by blocking access to that computer or network. Mac OS X includes a firewall application that is integrated in the Sharing preference pane. To see the firewall configuration, open System Preferences, open the Sharing pane, and then click the Firewall subpane, as shown in Figure 10-23.

Figure 10-23: Use the Firewall subpane of the Sharing pane to turn the built-in firewall on and off and to change its settings.

To turn on the firewall, click the Start button. The firewall automatically stops all incoming network traffic for all services, such as Personal File Sharing, that are not turned on in the Services tab. Turning on a service in the Services tab opens the port in the firewall to allow incoming connections for that service. If you want to allow access through the firewall for a given port, either select the checkbox in the Firewall list to open that port or (if what you are looking for isn’t there) click the New button. A dialog sheet appears, as shown in Figure 10-24, in which you can add less-common access or custom access to ports that Mac OS X does not specify outright.

Figure 10-24: The New button on the Firewall tab of the Sharing pane enables you to add specific ports to be opened through your system’s firewall.