3

I have a iMac running 10.6 where I have been tasked with creating two different users who can use different network profiles(locations).

User 1 will be connecting via Ethernet through a filtered network, all other connections are disabled, which works fine.

User 2 needs to connect to the unfiltered Wi-Fi but no access to any other connections.

I have most of this implemented in Network Locations, the problem is that both of these locations are available to both Users.

What I'd like to be able to do is assign the customized Location as a Default for each user.

From a security standpoint it isn't perfect, but if I can get this sort of thing working, I'd like to assign the Wi-Fi connection to the guest user, so they can navigate without the filters. Then the Regular user will have Ethernet, and will not be able to switch Locations, or enable Wi-Fi.

The trick with this is that the User will be a single user. They will know both user passwords, they will just need to switch users to perform different tasks.

Is it possible with plain OSX, or will I need external software/scripts?

  • Network routing is at the OS level, and doesn't allow for differentiating users. What you could do is force all users to proxy through a gateway that controls access based on user authentication. But doing that would depend either on defining a network proxy in the application you're using, or to route all traffic through such a gateway. (for apps that don't have provisions for proxying) – Tim B Sep 4 '13 at 12:29
  • Yeah, you can force traffic through proxies in the networking panels, possibly with a SOCKS proxy I could set up authentication, but really in the end, I'd prefer to be able to assign different network profiles to users. As you can set programs on launch startup/login (even daemons) and many other options, it just surprises me that you can't do something similar in the networking bit.. – Nick Sep 4 '13 at 13:17
  • BTW, I found a way (I hope) using loginHooks, I start a script that executes /Users/$1/network.sh ($1 is the user shortname) and in User1's context I run 'networksetup -setairportpower airport off' in user2's I run 'networksetup -setairportpower airport on; ifconfig en0 down' and hopefully, that should enable and disable the ports I need. – Nick Sep 6 '13 at 11:46
  • Ah, you didn't need these two network states to be simultaneous. That wasn't clear in your question. I assumed you wanted different behavior simultaneously, though my assumption depended on remote/non-console users, which might be an uncommon case. – Tim B Sep 6 '13 at 14:52
  • Sometimes I forget that people can't read my mind :P Thanks for the help though! – Nick Sep 10 '13 at 16:06
2

Well, I cracked it, it wasn't loginHooks I needed, but launchctl.

Basically, create two scripts (executable of course, you can make em root only too):

User1.sh

!/bin/bash ifconfig en0 up; ifconfig en1 down;

User2.sh

!/bin/bash ifconfig en1 up; ifconfig en0 down;

These of course make the assumption you're using an imac, en0 is the enthernet, en1 is the WiFi.

Then create a plist file (with root ownership, 644), mine was this:

User1's went in /Users/user1/Library/LaunchAgents/org.user1.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>org.user1.plist</string>
    <key>ProgramArguments</key>
    <array>
        <string>/Users/user1/bin/User1.sh</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
</dict>
</plist>

User2's in /Users/user2/Library/LaunchAgents/org.user2.plist

 <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
        <key>Label</key>
        <string>org.user2.plist</string>
        <key>ProgramArguments</key>
        <array>
            <string>/Users/user2/bin/User2.sh</string>
        </array>
        <key>RunAtLoad</key>
        <true/>
    </dict>
    </plist>

After that run

sudo launchctl load -w /Users/user1/Library/LaunchAgents/org.user1.plist

and

sudo launchctl load -w /Users/user2/Library/LaunchAgents/org.user2.plist

as each user.

That's it, it's quick, simple, and if you set the owner of the scripts as someone else (and on another path), it's fairly secure (not bulletproof, but that's not in my scope at the moment).

  • Where the runs of launchctl are described as "… as each user …", the suggested use of sudo for those runs strikes me as peculiar. – Graham Perrin Mar 18 '15 at 12:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .