Comments on: Let's restrict the internet!

Question: Let's restrict the internet!

COBRA! — Thu, 21 Aug 2008 08:37:16 -0800

Help me lock down a Mac!

I need to set up a web-connected (Leopard) Mac in a university art gallery; it'll be there to allow people to access a couple of web sites related to an exhibit that's going up. Since this is on campus, though, the odds are high that random students will be setting the browser to butts.com and walking away giggling.

So: how can I lock down the browser so that it can only access a couple of pre-approved sites (preferably, this'll be in Firefox, but Safari's possible, too).

(I've done some googling, but everything talks in terms of blacklisting a few sites, rather than whitelisting a couple and blocking everything else)

By: COBRA!

COBRA! — Thu, 21 Aug 2008 08:46:36 -0800

Bonus question: How can I restrict which applications get opened, to prevent enterprising students from firing up Word and leaving an epic poem about butts on the screen?

By: damn dirty ape

damn dirty ape — Thu, 21 Aug 2008 08:47:14 -0800

This thread has a lot of advice on locking down OS X.

By: lia

lia — Thu, 21 Aug 2008 08:53:08 -0800

what you're looking for is called kiosk mode—here are four options:

real kiosk, a firefox extension
saft, a safari plugin
wkiosk, a safari-powered browser (costs $$)
instructions for opera's kiosk mode

By: mccarty.tim

mccarty.tim — Thu, 21 Aug 2008 08:54:29 -0800

You could run a Linux live CD set up to only run Firefox or whatever, and then set that up to blacklist every site but your own. Slax would probably let you do that. This may be a bit more work, but that's what I would do.

By: edd

edd — Thu, 21 Aug 2008 08:57:17 -0800

Under Parental Controls in the System Preferences there's an option to limit an account's access to only particular websites (you can give a list). I've never tried this, and don't know whether it's generic or only applies to Safari however.

By: edd

edd — Thu, 21 Aug 2008 08:58:57 -0800

You'll also find that Parental Controls limits what applications you can start from the Finder. But this is rather trivial to circumvent last time I tried that. Probably good enough to stop random jokers passing through though.

By: COBRA!

COBRA! — Thu, 21 Aug 2008 09:01:34 -0800

Gracias! Looking through the Slashdot thread, it looks like Parental Controls will accomplish most of what I need to do. I feel like such an authority figure!

By: COBRA!

COBRA! — Thu, 21 Aug 2008 09:02:02 -0800

Whoops. Yep, what edd said.

By: advicepig

advicepig — Thu, 21 Aug 2008 09:10:10 -0800

Oh and you can also remove the DNS entry in the network config and use a hosts file.

http://docs.info.apple.com/article.html?artnum=88158

Oh, and don't underestimate mow much the general public knows about getting around these things. We do our best to lock things down and for years, we were finding that people would get around the more common ways to do things rather routinely. (A popular route around was to pull up the help system, since that often runs in an unjailed web browser.)

By: devbrain

devbrain — Thu, 21 Aug 2008 10:04:55 -0800

http://research.corsaire.com/whitepapers/technical.html has whitepapers on securing 10.3, 10.4 and (just released a few days ago) 10.5.

By: fourcheesemac

fourcheesemac — Thu, 21 Aug 2008 10:27:16 -0800

Or be absolutely safe and load the websites locally, no internet connection. Bonus is that they will run faster as well.

By: tjenks

tjenks — Thu, 21 Aug 2008 10:46:26 -0800

Plainview is a nice app that can be used to give access to the internet only while preventing access to the machine itself.

By: jim.christian

jim.christian — Thu, 21 Aug 2008 12:33:30 -0800

Also, OpenDNS has nice content filtering.