
Chapter 3 User Management for Mobile Clients 55
If the user also has a Mac OS X Server user account and network access is available,
they may still prefer to log in using the local account to reduce network traffic. The user
can connect to his or her network home directory (to store or retrieve documents, for
example) via the “Go to Folder” command in the Finder’s Go menu.
Different considerations apply for a mobile account with Portable Home Directories
and a Mobile Account that is also an admin.
Using Wireless Services
You can provide wireless network service to managed clients using AirPort, for
example. When a user with a portable computer leaves the wireless area or changes to
a different network directory server (by moving out of one wireless area and into
another), client management settings may be different. Users may notice that some
network services, such as file servers, printers, shared group volumes, and so forth, are
unavailable from the new location. Users can purge these unavailable resources by
logging out and logging in again.
If you need more information about using AirPort, consult AirPort documentation or
visit the website: www.apple.com/airport/.
Security Considerations for Mobile Clients
Mobile clients can be made more secure by requiring alphanumeric passwords with
frequent expiration dates. Screen savers should activate with minimum delay and
always require a password to resume operation. Restrictions should be placed on hard
disk imaging and cold booting directly to the disk via target disk mode. For further
information about setting up open firmware passwords, see the Apple Service &
Support website article 106482 at docs.info.apple.com/article.html?artnum=106482
Make sure SSH is off to eliminate any unmanaged user logins. A user logged in via SSH
will not be covered under any managed preferences which modify his privileges.
Remote login and other external access like FTP and AFP should not be activated
unless specifically needed. Apple Remote Desktop may be used to provide secure,
remote access and management of the computers.
Directory Services
Unrestricted DHCP binding should be disabled for mobile clients because the
computer will implicitly trust any directory found on other networks. Authenticated
Directory Binding is the best security, but it requires individual setup of each computer.
Static Directory binding can be easier but it’s not as secure.
The Open Directory administration guide provides details on different directory
binding mechanisms.
Komentáře k této Příručce