FILE SERV IC ES in Font

Creation QR Code JIS X 0510 in Font FILE SERV IC ES

It is common in a networked Mac environment to have a handful of computers, each with file-sharing enabled, with users trading files back and forth between each other without a central repository for the files. This type of environment is known as peer-to-peer networking (P2P). Security in a P2P environment is generally straightforward and tends to be rather loose. Anyone with access to the computer usually has access to files on that machine. As environments mature and grow larger, the distributed file sharing of P2P will give way to centralized file servers in what is typically described as a client-server, or two-tier, environment. Client-server environments offer a single and centralized location for users to access files that are needed by multiple users. In a client-server environment, backup and security begin to play a much more critical role because files are now accessible by multiple users who have access to that repository. File permissions are critical to maintaining security. There are some inherent challenges to migrating from a P2P to a server-based file-sharing environment. Some users might have a hard time moving away from their old method of sharing files. The proper permission controls are often not set up correctly on the centralized data, if they are set up at all. Client machines might continue to share files after the transition simply because they weren t configured to not share them. This can lead to security issues that can be disastrous if not managed appropriately. Before we dive into how to properly secure file services, let s discuss some fundamentals of file security in Mac OS X.

Mac OS X is a fully POSIX-compliant operating system. POSIX is a standardized feature set developed to make operating systems compatible with Unix-based operating systems. POSIX permission levels are divided into three categories: read (users can access the file), write (users can write data to it), and execute (users can run the file, such as an application). When viewing these permissions from the command-line application ls, read is indicated by an r, write is indicated by a w, and execute is indicated by an x. When you look at the permission designations for files, you ll see they are displayed in the order of owner, group, and (if needed) everyone. The owner is the user who owns a file, can set permissions on files, and is listed in the text following the permissions of a file. The group of a file is listed next. The everyone group is every user accessing a file who is not listed in either the owner or the group slot and who is also known as a guest user of that file.

Note When looking at file permissions, you might find that an admin or wheel group is listed in a file s

permissions. These are part of the built-in users and groups that a system starts out with upon installation of the operating system. We discuss these in more depth in 3.

The output of the permissions for a file will use the following syntax: (permissions) (owner) (group) (everyone) (file size) (last modified) The ls command followed by the al option can show you the permissions, as indicated in the following example: cedge:/Users cedge$ ls -al

8 35 1 1 16 10 38 12

272 1292 6148 0 544 340 1292 408

24 13 23 1 26 23 13 24

22:07 20:27 13:55 2006 2006 13:14 15:40 22:22

Note The d in front of the permissions in the previous example indicates that the item is a directory rather

Traditionally, Mac OS X has been limited to the standard POSIX permission model of read, write, and execute. This system has served UNIX-based operating systems well for many years now; however, it is starting to show its age. The main concern is that it isn t very flexible, and several special modes, such as the sticky bit (a setting that indicates that only the owner can delete a file from the respective folder), have been added over time. For more complicated permission structures, access control lists (ACLs) provide you with the most granular control available over permissions for files and folders. An ACL is a list of permissions attached to files and folders. These replace POSIX permissions in the traditional sense of Mac OS X security. ACLs give the Mac an equal set of permissions that is found in Microsoft Windows. ACL information is stored in the extended attributes of the Mac OS Extended file system (HFS+). It s easiest to understand the ACLs if we break down how they work and are applied. These are the three key system properties that allow ACLs to function: The generated unique identifier (GUID) a number value that is used many times in Mac OS X because it can be guaranteed to be unique across computer systems and, in fact, time and space. Your user account has both a traditional Unix-style UID and a new GUID. An access control entry (ACE) is the individual rule that determines what access is given to any particular user or group. An ACL is a list of ACEs that can be attached to a directory or file.