Those annoying freshman! >:( -cliffs at bottom

A

Absentee

[H]F Junkie
Joined
Aug 27, 2004
Messages
9,410
Well, I'm a senior in my shop (Commercial Art), and the resident Mac genius :)rolleyes: ). That leaves me with the task of setting up the freshman accounts so that they can only access the apps they need, so thats all they can use.

Here's my story. it's a story, not really a problem, because I can handle it, it's just annoying:
I used the "accounts" pref. panel to create the account, set it to limited, and only allow the programs they need. I also enable fast account switching to I could easily go between the two to use the system preferences (since it was disabled on the "Fresh" (Freshman) account)

The main program I needed to block was iTunes and Safari, for obvious reasons.

After I did all that, they figured out they can go into any Adobe program and open the help to bypass the block on Safari (since I allowed "supporting applications"). Fine, Disable that.

Now They figure out that they can go to *App Name (Finder)*>Services>Search With Google to bypass the Safari restriction (at this point I'm pissed at apple for missing that. :mad: )

Fine. A simple download and run of Service Scrubber gets rid of that (nevermind that I have 19 computers to run it on...)

After that, they figure out that they can open up the dashboard and pull up the google widget to get safari to open that way. (WTF APPLE!)
This was partially my fault, since I had disabled dashboard on most of them....but missed 1 or 2, which had the problem kids on them, oops.

After thats done, I find one kid figured out how to bypass the dashboard block, but using the spotlight to find the google widget directly and open that.
Fine. delete that completely. (school computers, nobody uses dashboard...so meh)

Now I have them trying to open up my personal account which has all my project files on it, since I showed them that the program used to disable the services was in there.

no problem there, I have a 11 digit password that is a bitch to learn but cake to remember.

so really the only question of the thread: any other ways that you can open Safari.
it can either be a way that bypasses the block or just a way to generally open the program. I wanna find out all the ways possible to open Safari inside OS X, so I can check them all out and kill any methods that DO get Safari open if its blocked. (short of applescript, cus I highly doubt a kid will learn applescript exists, then learn the correct code to open a program with it, in the 1 week they are in the shop)

they still can't open iTunes yet....


oh, the reason I keep blocking it from them? 1) I was told to 2) it's a damn ego thing, why should I let a freshman beat me? 3) It's a good learning experience.

cliffs:
- my job to block freshman from using certain programs, specifically iTunes and Safari
- after doing the normal parental controls thing, kids keep bypassing the block and opening safari
- Apple has several built in ways to get around the block very easily
- I hate freshman.
 
wy not just setup a local proxy server on that particular network?

Let them run safari to their hearts content, and all they get is access denied!
 
KaosDG said:
wy not just setup a local proxy server on that particular network?

Let them run safari to their hearts content, and all they get is access denied!
Click to expand...
not under my control, plus the other people who use the computers (me, and the rest of the senior class) need to use Safari sometimes
 
4b5eN+EE said:
not under my control, plus the other people who use the computers (me, and the rest of the senior class) need to use Safari sometimes
Click to expand...


Hmm. well you could setup ACLs on the proxy (login, user based, etc)

But since it's not in your control, i guess it's out. (I'm more of a net engineer/admin... instead of securing the machines i just cripple the networks :D )

You could trash the local safari app, and run it from an administrator-only location when you need it?
I dunno if that would break anything (never really needed to restrict mac users)
 
Well, changing permissions is a last ditch effort thing, since I won't be here next year if they need to know what I did, and how to undo anything that they may need (not counting dashboard or services menu, since they don't need those.)
 
^ High school, at least get it right :rolleyes:
Black Morty Rackham said:
Give them the root password next year, then? :p
Click to expand...
They have it, it's just a matter of them not knowing crap about Macs beyond what they need to know....
besides, that's not the point...I don't wanna change any permissions or move applications around, except as a last resort.

I'm really just looking to find if anyone has found any other ways to get safari to open, so that I can sort of, "head them off at the pass"....
 
or just severely discipline them if they get caugt I.E. kick them out of the class for they day, fail a quiz grade or something. It sucks to be an asshole but sometimes you have to do it.....
 
plop the icon(program or whatever) in any of the icons in the dock then it appears on recent program? or something like that because thats wat my lil bro does because his account cant use firefox so he just does that everytime and it opens for him, other unusable things for his account too kinda funny lol
 
As most others have said, this is exactly what the permission controls are for. The GUI is inherently insecure as it contains an unimaginable number of ways to do the exact same thing. Changing the permissions on an item is so easy that anyone can do it after being instructed on the procedure a single time. I find it funny that you're concerned about people being knowledgeable enough to change the permissions on an item, though you've done a bunch of adjustments to the system that are far more confusing and difficult to undo than a simple permission changes. The UNIX permissions that are part of the OS are the crux of its security. You can't thwart the GUI, and time spent trying to do so is simply wasted. Developing a comprehensive and documented set of permissions on the machine is all that's required. As soon as any of your students figure out how to use the terminal, all the work you've done goes out the window, because none of your clever tricks work anymore.
 
Sysadmins shouldn't be afraid of permissions. It's sorta a mutually exclusive thing.
 
As interesting as your problem is, remember, we were all freshmen at one point. You KNOW that if you were in their shoes you would be posting a thread that says "That annoying sys admin won't let us use safari! :mad: -cliffs at bottom". Just sayin', look at it from both sides.....both sides. :D
 
mwarps said:
Sysadmins shouldn't be afraid of permissions. It's sorta a mutually exclusive thing.
Click to expand...
their more teachers than system admins....well...teachers, NOT system admins.

The thing's I have done, are just something that they won't notice at all (trust me). But I know screwing with permissions could cause some problems later on, and I don't want to be held responsible for it.

bottom line: I know how to change permissions, I'm not new to this by any means, but I don't want to be held responsible if something happens, so I'm just gonna go with anything besides changing permissions for now

[H]ard On said:
As interesting as your problem is, remember, we were all freshmen at one point. You KNOW that if you were in their shoes you would be posting a thread that says "That annoying sys admin won't let us use safari! :mad: -cliffs at bottom". Just sayin', look at it from both sides.....both sides. :D
Click to expand...
well, see, I was them at that point, but a lot has changed(in the shop that is), and they didn't have me to secure the computers, so it was pretty easy to get past anything they did.

But I did think of it that way, and I just laughed I would hate myself too, but I don't care :p
 
4b5eN+EE said:
their more teachers than system admins....well...teachers, NOT system admins.

The thing's I have done, are just something that they won't notice at all (trust me). But I know screwing with permissions could cause some problems later on, and I don't want to be held responsible for it.

bottom line: I know how to change permissions, I'm not new to this by any means, but I don't want to be held responsible if something happens, so I'm just gonna go with anything besides changing permissions for now
Click to expand...

So instead, you'd rather be held responsible for permanently removing a dashboard widget and using ServiceScrubber to make changes that are difficult to reverse (without the tool or knowledge of it)? You're lucky you don't work for me, because you wouldn't be after pulling shit like that.

Bottom line: permissions are there for a reason. Use them. If you need to take a few minutes out of your time to show someone what you did and how they can change it back later, so be it. That's your job.
 
Why no access to safari? I have unblocked plenty of Macs (and PCs) when the network admin decided that P2P sites should be blocked.
 
CEpeep said:
So instead, you'd rather be held responsible for permanently removing a dashboard widget and using ServiceScrubber to make changes that are difficult to reverse (without the tool or knowledge of it)? You're lucky you don't work for me, because you wouldn't be after pulling shit like that.

Bottom line: permissions are there for a reason. Use them. If you need to take a few minutes out of your time to show someone what you did and how they can change it back later, so be it. That's your job.
Click to expand...
I think you missed the part about me being a student, no pay involved.

and as I mentioned: services and dashboard are two things that aren't used, and SHOULDN'T be used by the students (and teachers have their personal laptops to use), whereas Safari DOES need to be used, just not by the Freshman, which is why I don't want to change permissions, believe me, I've already thought of it and decided against it, way before I even posted this thread.


No access to Safari, because the freshman only have a week in our shop (sort of an evaluation time) before they choose their permanent shop. My teacher wants them working the entire week, not surfing google video (which isn't blocked for some reason, yet youtube is? :confused: ) for the entire day. Not to mention, potentially getting the teacher in trouble by visiting, uhm..."certain" websites that have yet to be caught by the IT shop. Since most freshman don't want the shop, they usually just slack off all day, and instead of giving them something to do while they slack off, they can just sit and stare at the ceiling all day, till they get kicked out 10 minutes later (teachers a real hard-ass on kids like that, but he's a cool guy, well, to us :p )
 
You must log in or register to reply here.
Back
Top