Users network mount accessible as share

[cstcroix]

Hi there

I’ve been running a Panther server for about 2 years in a 40-user mixed Mac/Windows environment. The Mac users have not been authenticating against the server (no real need) while the Windows users have. However, we’re about to implement a new password policy for security reasons, and I want to have everyone log into the server, regardless of where their home is (network or local). The test mobile user I created was also set to automount their network home, but instead gets the Users volume.

That’s a long preamble to say that while I’m testing this, I’ve realized that the /Users folder I use as the location of all the home folders, is available as a shared volume, and that read access is enabled for Everyone! Yeesh.

I need to know the best way of ensuring that (1) no one can see files in any home folder but their own; and (2) that mobile users mounting a home directory on a mac see just their home (i.e., test) not the Users sharepoint.

Any help is appreciated. I’m using OSXS 10.3.9 with 10.3.9 and 10.4.3 clients, Windows clients are trouble free as far as I know.

[cyburk]

cstcroix wrote:

That’s a long preamble to say that while I’m testing this, I’ve realized that the /Users folder I use as the location of all the home folders, is available as a shared volume, and that read access is enabled for Everyone! Yeesh.

That’s a normal setup, isn’t it? Let’s say we have a user named tomsmith. For /Users and /Users/tomsmith the permissions are for Owner to READ & WRITE, Group to READ and Everyone to READ. (That way people can get to tomsmith’s Public and Sites folders.) The restricted directories in /Users/tomsmith (Documents, Movies, Library, etc.) will change the permissions for Group and Everyone to NONE so that only tomsmith has access.

Or have I misunderstood the question?

[cstcroix]

Okay – thanks. Clearly I’ve got a different permissions inheritance problem, because users can browse folders in other user’s homes (not just Sites or Drop Box) and open/edit/save documents in those homes. I think this is only for user created folders, so I’ll go back and look at that.

[Author]

Posts