h2g2 The Hitchhiker's Guide to the Galaxy: Earth Edition

Yeah, I recently bought an iMac. I'd like some advice from more experienced users on keeping the Mac secure for free.
And how do I stop Keychains from hassling me for passwords every 5 minutes?

Well, to start with, what in particular are you wanting to secure your iMac against? Viruses? Hacking? Theft?

And what OS are you running?

If it's OSX, do you have the firewall enabled?

Mac OS X is reasonably secure out of the box, so you really don't need to do much.

You have something called "Keychain Access" in your Utilities folder, you can change the preferences there for when and how tightly the keychain locks things up. But the Keychain is your friend, security-wise. It stops other people from accessing your stored passwords or even log-in information for web sites. First thing I do to secure my Mac is usually to *increase* how often the keychain asks for my password.

As Mikey mentioned, make sure the firewall is turned on. It's in the "Sharing" system preferences. Do not turn on any of the other "sharing" services unless you absolutely need them. Create a new account for yourself that does *not* have administration privileges, use that for your day-to-day stuff and use your "admin" account only when you need it, to install software for instance. Make sure all your accounts have passwords, and they should be decent passwords that are not easily guessed. Get a virus scanner; I use ClamAV mainly because it is free.

If you really need *super-secure* file storage, you can turn on the "File Vault" feature of OS X, but be warned that it really is tight security, and it encrypts your entire account. If you lose your password or something goes wrong with the encryption, you will not be able to recover anything at all. Consider this 007-level security, most people should never touch it.

Hi there, sorry, had to get off the PC quickly earlier, am visiting family and wanted to get my question in quickly as I wasn't expecting to get online until midweek when I hook the iMac up with the broadband at home.
The iMac is running on Tiger.
The iMac is my first Apple desktop, if you hadn't guessed. I'm finding it hard to adapt to.
I'm a bit of a technophobe at heart anyway.

I'd been debating wether to buy and iMac or a PC and just what kind of either option I'd get.
But the model I did was something of an "impulse buy" because I was fed-up with my own indecision, as might be expected I'm not entirely happy with the buy.
Am feeling I could have gotten something higher spec [my G5 has only 2000MHz and 512Mb PC3200 SDR and I really didn't need 20" of screen could have spent the money more usefully getting iSight] or at least something I was more comfortable using if I had waited and taken other factors into my choice-making process.

But, I think I'm more or less lumbered with my expensive and long-term mistake. And wish to protect the purchase from virus, spyware, adware and hijacking and hacking, y'know the kind of thing people normally want to secure their desktop against.
Though there are less viruses aim at Macs than PCs you'd be stupid to act complacenetly.

Now I hadn't even found this built in firewall, like I say, I'm a bit of technophobe and haven't been finding the Apple as accessible, intuitive or flexible as I've found PCs. Hopefully with time this will change.

Keychain Access won't let me access it or adjust anything, it demands a password and neither of the two passwords that I created when I started out seems to be the one it wants.

Given I'm a one-person household what advantage is there to having to type in a password everytime I open a document or webpage? Does it stop the desktop being taken over remotely?

The creation of 'Day Account' and a seperate 'Admin' seems like simple but cunningly effective plan. Excellent.
And thanks for the name of the free virus scanner, this all what I'm after, the benefit of other's experience and generally superior 'Mac Awareness'.

Any other wisdoms will be much appreciated. I'm a complete novice, so sorry for what I'm sure is obvious ignorance on these matters.

>>If you really need *super-secure* file storage, you can turn on the "File Vault" feature of OS X, but be warned that it really is tight security, and it encrypts your entire account. If you lose your password or something goes wrong with the encryption, you will not be able to recover anything at all. Consider this 007-level security, most people should never touch it.

d'E- How often does something go wrong with the encryption, really?

I have the File Vault feature set up to run automatically on my computer, and I haven't had a problem with it yet. I use it because I'm on the campus network. I have an always-on connection, so I'm not a moving target. The extra security makes me feel better.

PS- thanks for reminding me about the firewall. I just checked mine, and found I had forgot to turn it on!

Backups are always important, too. Consider investing in a jump drive (I picked up a 256 MB for ~$50) or a lot of CD-RWs (the cheaper option, ~$15). As good as Macs are IMHO, they're not immune to hardware problems. In case something goes horribly horribly wrong, you'll want to have another copy, maybe two copies, of all the files on the computer in a safe place.

The main issue with File Vault is that it does significantly slow your mac down, because it is constantly encrypting absolutely everything you do.

If you're just using the computer for word, internet, etc., this isn't a big deal. But if you're doing anything involving large files, it is very, very noticeable.

Early on, when it was first introduced, there were some horror stories about people losing everything because they turned on File Vault without really understanding what it did. Things normally won't go wrong, but if you turn off your Mac in the middle of saving a file or something like that, well

If you only need some encryption, lots of people use Disk Utility to create an encrypted disk image. Then you save only the documents that you really need to be encrypted to the disk image.

The username and password you use to open Keychain Access should be whatever one you logged in with. But try using your "short" username to unlock Keychain Access. I've found that sometimes that works better. If you don't know your short username, you can see it by going into the "Accounts" system preference.

Hi amorphous

I have always found Apple Discussions useful - http://discussions.apple.com/index.jspa?ft=y. If you want to post a question you have to create an Apple ID. If you bought your Mac from Apple you will have one already.

Don't dispare. I have to use a fairly modern laptop PC for work and still prefer the old Mac at home. You will soon get used to it and find it easier to use in the end - no viruses to speak of, no trojans, no worms. Much more secure!

For the Keychain problem. If you want to turn off most of the password access go to System Preferences then choose Security. Ignore File Vault and look at the bottom of the pane. There are some tick boxes. Untick them all and see if that helps (I presume this is the same between 10.3.9 and 10.4.x).

If you really want to take control of your Mac without using Terminal (the Unix command line application) the you need to set up the Root account. Here ( http://docs.info.apple.com/article.html?artnum=106290 ). Be careful though!

turvy

Hi again, is it normal for the 'help pane' to be completely unresponsive? Won't load at all.

The Mac help system is awful, yes it is too common for it to either load very slowly or not at all. It might help if you try to get at it from a different location - for instance if you used the "Help" menu when you were in the Finder, switch to Safari or another application and try again. Once it is started, you can use the "Library" menu to jump to the help file for any other software on the Mac, and I usually find that just getting it to load successfully once, even with the wrong help file, makes the problem go away. But then again I usually skip using Help and seach the Apple Knowledge Base through the "Sherlock" application.

New security setting! (actually, just one that I forgot about)
- Open up Safari, go to the preferences, turn *off* the option to automatically open "safe" files. There's no such thing as a safe file, and it's just been demonstrated that Safari can be tricked into thinking something is safe when it is not.

Re the Help system have a look here - http://discussions.apple.com/thread.jspa?messageID=689068

As for Safari I have found Camino very good - http://www.caminobrowser.org/

There are lots of other browsers out there.

turvy

Turvy, be careful saying there are no trojans, worms or viruses for OSX. Just this last week there has been an anouncement of a trojan for the macs - LeapA I think is the name. Even though it doesn't do much I'm sure people are out there looking at how to modify it to create something more destructive.

If you use FileVault, do not and I mean it, DO NOT forget or lose the password you use to create the encryption. You won't be able to get your stuff back if you forget that password. Probably best not to turn it on in the first place.
As others have said turn on the firewall and turn off the auto open safe files thing in safari (what's a safe file on the internet? there isn't one).

Hi Phil

I take the sweeping generalisation back regarding trojans etc.

I have also heard that there are Linux/Unix viruses that can affect OSX. It has to be said though that the instances are very rare especially in comparison to the Windows platform.

My understanding of LeapA is that it relies on iChat (http://www.sophos.com/virusinfo/analyses/osxleapa.html). There is also a second one - Inqtana.A that exploits an old vulnerability in Bluetooth to spread from one Mac to another.



turvy

I prefer Firefox over Camino myself when it comes to browsers, but either are a better bet than Safari.

I'm not worried about Leap.A or its variants, they require user interaction to activate. The one that worries me is not a virus, just a technical demonstration of how one could work. The file runs as soon as it downloads, there is no opportunity at all to stop it, and since it's possible to "push" a download from a web site, it could conceivable affect you simply by loading a web page. Macintouch.com has a good discussion right now about how to prevent it from launching, apart from turning off the "safe" files option in Safari. I'm guessing we see a security update from Apple before the weekend.

No worries Turvy
As d'E says it's the safe files thing in Safari that seems to me a more disturbing way for malware to get onto a computer.

Haylo folks... Last night, whilst tired and zombified, I tried to put my screen to sleep using that little trick with the power button. But in my exhausted state I must have held the button down for far too long and cut the power to the 'puter without shutting it down safey.
Now my iMac can be switched on and it tells me that MAC OS X is loading but thenit goes to a blank blue screen with no feature but for the cursor. It should be going to a screen asking me to log in as a user.
I tried putting in the OS X disc to see if I could start up some other way or even loose everything on the machine and start anew but that won't load either.
Is this a common and easily fixed problem? Or is it an idiot's graveyard?

I think you need to reboot it while holding down a certain button, but for the life of me I don't remember which. Maybe open-apple or shift?

After you put the CD in, hold down the "c" key while starting to start up from the CD. It will automatically start up the installation program, but if you look in the menus you'll find the "Disk Utility" option - switch to that and run the disk repair. If that doesn't work, give DiskWarrior a try (it's something you'll have to buy).

You can also hold down the shift key while starting up, that puts the computer in "safe mode" from the OS on your hard drive. It takes a long time to start up this way. I recommend going with the CD, but safe mode will often get you to the desktop so you can troubleshoot software problems (if you installed some wacky software that is causing the problem, for instance). Sometimes using safe mode and restarting is enough to get things back in order.

And finally, if you just want to get your data files and have access to another mac and a firewire cable, you can start up in "target disk mode" that essentially turns your mac into an external hard drive. Connect the two macs, and hold down the "t" key while you start up the broken one. You'll see an icon for the drive show up on the other mac, and you can drag all your files over to safety.

*Does that headsmacking thing*

shiftkey - safemode - fix things.

*headsmack*

Thank you sagacious one.