Tag Archives: Security

Mac OS – SIP or System Integrity Protection

SIP (System Integrity Protection) isn’t a bad thing. It actually protects your mac from a whole host of otherwise nasty infections. However, it can sometimes get in the way of doing important mac management tasks.

To disable SIP:

  1. Boot the mac to recovery mode (boot while holding down control-R)
  2. In Terminal enter the command: csrutil disable
  3. Then reboot the mac to it’s normal OS.

Remember to re-enable SIP when you are done by booting back into recovery mode and giving the command: csrutil enable

Java Config file and excepted sites deployment

Some older Java-based websites are so out-of-date that Java refuses to run unless the web site is in the “excepted sites” list. This is normally a user-specific setting however you can set this up as a system wide exception list.

On windows —-
in c:\Program Files (x86)\Java\\lib\
(replace with the correct java release directory for your system)
place a file called “deployment.config”

deployment.system.config= file:///c:/williams/java/deployment.properties
deployment.system.config.mandatory=true

Then in c:\williams\java\
place a file called “deployment.properties”

deployment.webjava.enabled=true
deployment.security.level=MEDIUM
deployment.security.level.locked
deployment.user.security.exception.sites=c:\williams\java\exception.sites

(There are many, many properties you can use here …)

And in c:\williams\java\
place another file called “exception.sites”

http://phet.colorado.edu/
http://csi.chemie.tu-darmstadt.de/
http://winter.group.shef.ac.uk/

Once configured this way, you can update the excepted sites by pushing out a new “exception.sites” list to the computers.

For additional documentation see the websites at:

http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/jcp/properties.html

http://www.adminarsenal.com/admin-arsenal-blog/manage-javas-control-panel-and-exception-site-list/

For Macs :

Create a folder called “Deployment” in: /Library/Application\ Support/Oracle/Java/

In that folder create another folder called “Security”

The files “deployment.properties” and “deployment.config” go in the “Deployment” folder, while the “exception.sites” file goes in the “Security” folder. Here is a screen shot of what you’ll have when you are done:

Keep in mind the Mac OS is always case sensitive on file names you should a plain text editor like “Atom” to edit these files (avoids RTF crap that TextEdit adds by default) and the URL file pointer for the deployment.config files looks like:
deployment.system.config=file:////Library/Application\ Support/Oracle/Java/Deployment/deployment.properties

For Williams College peeps – Current copies of these files can be found in macsus and JAMF.

Windows 10 – Windows Update Delivery Optimization – OFF !

Under Windows Updates “Advanced Options” then “Choose How Updates are delivered” and you get to “Updates from more then one place”

Apparently, now, Microsoft believes it is wise to allow random PCs on the internet to distribute windows updates. Here is their information about this option: http://windows.microsoft.com/en-us/windows-10/windows-update-delivery-optimization-faq

I am much less trusting of random PCs on the inter-webs so, I have turned this new “feature” off.

Mac – Disable/Enable Gatekeeper from command line

GateKeeper is the application on Mac OS 10.8 and above that prevents running applications from unknown sources. On the “Lab” image this can not be enabled since many of the older academic software programs would not be able to run.

Get current status of this setting: sudo spctl --status
Disable GatetKeeper to allow all apps to run: spctl --master-disable
Enable GateKeeper to prevent unknwon apps from running: spctl --master-enable

To see more see:
http://osxdaily.com/2015/05/04/disable-gatekeeper-command-line-mac-osx/