1

Recently our Network and Server Administrator got let go. We are a small organization and she was alone looking after Windows and Mac Servers. We have tried to secure the network by changing the firewall password and disabling her Windows account.

My question here is more about securing our Mac server. She built The Mac server on a Mac Mini running OS X 10.11 and we use it to enroll Mac devices and push apps via profile manager.

Now the challenge is I have never used Macs before and I don't have have any experience of managing or administering server. I tried to secure the Mac server by changing her account password which she gave before leaving. I don't want to disable her account on mac mini because there were loads of passwords saved in her keychain which we don't know and right now we are using the saved passwords.

Could anyone please guide me how can we secure our Mac server in case any sabotage attempt is made by her since she can still access our server via iCloud and can remotely wipe the server.

  • Based on what do you assume that she can still access the server remotely via iCoud/Find My Mac? – nohillside Jul 10 '16 at 5:20
  • 2
    If you truly want to be safe the only option is to reinstall the server from scratch. Related: serverfault.com/questions/171893/… – André Borie Jul 10 '16 at 13:25
3

There's basically two things you need to do to secure your Mac from a (involuntarily) separated employee:

  1. Secure from outside access
  2. Change all passwords

This is an overlapping approach because neither are 100% foolproof. However, if you remove as many of the access paths from outside the organization, whatever is missed will be covered by the changed account credentials; and vice versa.

Secure from Outside Access

It sounds like you have the Admin credentials required to change/lock out her account and from accessing the firewall. So, what you need to check is:

  • iCloud and AppleID. Get these changed right away.
  • Any open ports on the firewall like SSH and VNC. You don't need a password for these as she can "tunnel" right through. (You will also want to close of Windows RDP (Remote Desktop, port 3389) since you said you had Windows servers.
  • Turn off SSH and VNC on the Mac Mini for the time being until you can get everything locked down
  • Remote control software should be removed/disabled (TeamViewer, GoToMyPC, LogMeIn, etc)

Change all Passwords

This one comes down to how "malicious" you think this person is or can be. You disabled her password, but did she have other accounts or know other people's passwords?

I run into this scenario all the time, small business customers tend to do things that larger organizations have policies against. For example, someone may be having an issue with their device and instead of remoting in, they will bring their laptop and when asked for the password by the Computer Admin, the user will write it down.

It happens because there is a higher level of trust in a smaller organization. It's usually not a problem until you have to fire the Computer Admin. That's just one example.

If you believe the person is malicious enough to do something, have all passwords changed.

Finally, as someone who does this for a living, I can't tell you how important it is to hire an outside consultant who can help mitigate these risks for you. This is a 3rd party, impartial person (company) who has a financial stake in securing your IT assets will (and should) have the same access as your admin(s). This way, should something happen, there is a person you can call that is familiar with your network and has the expertise to keep you running.

Best of all, a signed contract (SLA - Service Level Agreement) between you and a vendor is a wonderful thing for end user; they hold up very well in court.

  • Thanks a lot all for your advice. She used her personal email address as Apple ID. Now I can sign her out and sign in myself but the trouble is the apps that she configured like server app etc will be connected to her Apple ID. Is there a way I can signin by my Apple ID but apps doesn't get disturbed and I keep using the existing server without rebuilding. Thanks – DickDale Jul 12 '16 at 1:07
  • You can change the email address associated with an Apple ID but you cannot change the Apple ID nor move apps from one ID to the next . Can you log into her Apple ID? If you can, I would do so, change the email on the account and the password. Until you can setup a new Apple ID and repurchase all the apps. – Allan Jul 12 '16 at 1:14
  • Allan - I really appreciate all of your help. I don't have the password for Apple ID nor for Cloud. Apparently she used two different accounts and domain names one for cloud and one for app store. If I create another admin account on mac mini and purchase the apps and then disable her account will it work? What else should I look for. Many thanks – DickDale Jul 13 '16 at 19:08
  • It should work. Without actually seeing what's going on, it's tough to give you a definite answer. Let me know how I can help. – Allan Jul 13 '16 at 23:17
1

Did she use an iCloud account registered to your company or to her personally? Admin accounts that require an email address to set up (like iCloud) should be using a corporate address like "admin@company.com" and not an address tied to a specific user. This means that when the user leaves, a replacement will be able to use the same account without having to re-register everything. A corporate email should be used as the recovery contact email as well, so an admin leaving under less than optimal conditions cannot maliciously restore access to themselves or reset passwords (or, with iCloud, remotely wipe a system!). Even in my use case (where "admin" emails are for controlling access to shared computers in a lab, or web administration for a small nonprofit group) no one's personal email is used for any of the registrations - it's all handled by a dedicated account linked to the group.

You really should also invest in a password manager too, something aside from Keychain, with a master password that is known to the IT manager and senior leadership, to ensure that access is not lost during staff turnover. Get the passwords out of Keychain and copy them into the password manager. Use something like 1Password that can store the password archive on the local network, not just in the cloud.

  • Whether the account was to a group account like admin@compnay.com or to a personal accout like myname@compnay.com, you still need to change the password because obviously, the fired admin will still have it. A password manager still doesn't change the fact that you need to change passwords if the admin knew them or created accounts that weren't synced to the password manager. – Allan Jul 10 '16 at 13:21
  • "We can't disable her account because of the saved passwords" - they need a manager to stop this from being an issue. And the admin account should be tied to the company, not the person, with only company emails for setup and recovery. The instant a person leaves, the passwords are changed. – dr.nixon Jul 10 '16 at 13:24
  • SMH. You are confusing convenience with security. You can change the admins password and still have access to the account without disabling it. Anyway, you would want to dump the keychain to get access to everything. A password manager does not preclude someone from storing separate passwords in a keychain; it's just convenient. – Allan Jul 10 '16 at 13:37
  • If the worry is that she could log in and wipe the account, they lose all passwords - should not rely on a single storage point for critical information like this. It also allows access to the passwords from a non-Mac system, which you can't do with a Keychain export. Network includes Win and Mac systems, so solution should be compatible with all. – dr.nixon Jul 10 '16 at 13:41
  • How exactly does a person log into a system when their password is changed? What also makes you think a centralized file is not accessible cross platform? Everything else in that comment is a feature/benefit (aka convenience) of having a password manager; nothing to do with actual security. – Allan Jul 10 '16 at 13:44
0

Safest thing to do would be to log that user out of iCloud entirely (http://appsliced.co/ask/how-do-i-log-out-of-icloud-on-my-mac)

Make sure you choose "Keep on Mac" when it asks if you want to retain the data from the iCloud accounts various features.

  • When I signed out - it doesnt give me option to save data on mac instead it says delete data from Mac. If I sign in with my iCloud ID will the server keep working fine. Will it have any implications on Apps which were downloaded using different Apple ID. – DickDale Jul 13 '16 at 18:58
0

Profile Manager needs an Apple ID to push profiles to devices, so you need to go into the Server application and configure profile manager with a different Apple ID (Dr. Nixon's advice will be helpful here), by going to the settings tab in the first pane that comes up (the one named for your server). Look for the "Apple Push Notification" checkbox, and select the "Edit Apple ID" button.

That should allow Profile Manager to keep working. Applications remain purchased so you can still use them, but they may not update w/o the purchaser's Apple ID.

The password for the directory admin (for Open Directory, which was set up as part of Profile Manager) might be a more tricky issue. As Allan said, your best bet is to hire someone experienced to clean up the situation.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .