Securing Mac Server after Server Admin got fired

Question

Recently our Network and Server Administrator got let go. We are a small organization and she was alone looking after Windows and Mac Servers. We have tried to secure the network by changing the firewall password and disabling her Windows account.

My question here is more about securing our Mac server. She built The Mac server on a Mac Mini running OS X 10.11 and we use it to enroll Mac devices and push apps via profile manager.

Now the challenge is I have never used Macs before and I don't have have any experience of managing or administering server. I tried to secure the Mac server by changing her account password which she gave before leaving. I don't want to disable her account on mac mini because there were loads of passwords saved in her keychain which we don't know and right now we are using the saved passwords.

Could anyone please guide me how can we secure our Mac server in case any sabotage attempt is made by her since she can still access our server via iCloud and can remotely wipe the server.

Answer 1

There's basically two things you need to do to secure your Mac from a (involuntarily) separated employee:

1. Secure from outside access
2. Change all passwords

This is an overlapping approach because neither are 100% foolproof. However, if you remove as many of the access paths from outside the organization, whatever is missed will be covered by the changed account credentials; and vice versa.

Secure from Outside Access

It sounds like you have the Admin credentials required to change/lock out her account and from accessing the firewall. So, what you need to check is:

• iCloud and AppleID. Get these changed right away.
• Any open ports on the firewall like SSH and VNC. You don't need a password for these as she can "tunnel" right through. (You will also want to close of Windows RDP (Remote Desktop, port 3389) since you said you had Windows servers.
• Turn off SSH and VNC on the Mac Mini for the time being until you can get everything locked down
• Remote control software should be removed/disabled (TeamViewer, GoToMyPC, LogMeIn, etc)

Change all Passwords

This one comes down to how "malicious" you think this person is or can be. You disabled her password, but did she have other accounts or know other people's passwords?

I run into this scenario all the time, small business customers tend to do things that larger organizations have policies against. For example, someone may be having an issue with their device and instead of remoting in, they will bring their laptop and when asked for the password by the Computer Admin, the user will write it down.

It happens because there is a higher level of trust in a smaller organization. It's usually not a problem until you have to fire the Computer Admin. That's just one example.

If you believe the person is malicious enough to do something, have all passwords changed.

Finally, as someone who does this for a living, I can't tell you how important it is to hire an outside consultant who can help mitigate these risks for you. This is a 3rd party, impartial person (company) who has a financial stake in securing your IT assets will (and should) have the same access as your admin(s). This way, should something happen, there is a person you can call that is familiar with your network and has the expertise to keep you running.

Best of all, a signed contract (SLA - Service Level Agreement) between you and a vendor is a wonderful thing for end user; they hold up very well in court.

Answer 2

Did she use an iCloud account registered to your company or to her personally? Admin accounts that require an email address to set up (like iCloud) should be using a corporate address like "[email protected]" and not an address tied to a specific user. This means that when the user leaves, a replacement will be able to use the same account without having to re-register everything. A corporate email should be used as the recovery contact email as well, so an admin leaving under less than optimal conditions cannot maliciously restore access to themselves or reset passwords (or, with iCloud, remotely wipe a system!). Even in my use case (where "admin" emails are for controlling access to shared computers in a lab, or web administration for a small nonprofit group) no one's personal email is used for any of the registrations - it's all handled by a dedicated account linked to the group.

You really should also invest in a password manager too, something aside from Keychain, with a master password that is known to the IT manager and senior leadership, to ensure that access is not lost during staff turnover. Get the passwords out of Keychain and copy them into the password manager. Use something like 1Password that can store the password archive on the local network, not just in the cloud.

Answer 3

Safest thing to do would be to log that user out of iCloud entirely (http://appsliced.co/ask/how-do-i-log-out-of-icloud-on-my-mac)

Make sure you choose "Keep on Mac" when it asks if you want to retain the data from the iCloud accounts various features.

Answer 4

Profile Manager needs an Apple ID to push profiles to devices, so you need to go into the Server application and configure profile manager with a different Apple ID (Dr. Nixon's advice will be helpful here), by going to the settings tab in the first pane that comes up (the one named for your server). Look for the "Apple Push Notification" checkbox, and select the "Edit Apple ID" button.

That should allow Profile Manager to keep working. Applications remain purchased so you can still use them, but they may not update w/o the purchaser's Apple ID.

The password for the directory admin (for Open Directory, which was set up as part of Profile Manager) might be a more tricky issue. As Allan said, your best bet is to hire someone experienced to clean up the situation.