Sharing Remotely: Personal File Sharing

Disabling Guest Access to Personal File Sharing

By default OS X's Personal File Sharing allows Guest users—users who don't have their own account on your computer but can still connect and access a limited group of files (those in Public folders). Although this feature is quite useful for providing access to certain files for remote users without having to create local accounts for them, it also means that anyone who knows your IP address can potentially connect as a Guest user and access Public files. Although this is not a major security issue—the only "damage" a Guest user can do is to download copies of files in Public folders—you may not want to completely open up your Public files to the… um, public.

If Guest Access concerns you, you can disable it (and re-enable it at any time) using the donationware SharePoints (http://www.hornware.com/sharepoints/). A few other, simpler, utilities out there allow you to toggle Guest Access, but SharePoints does so much more, and I'll use it for so many of the examples in this section, that I consider it to be the Swiss Army Knife of Personal File Sharing utilities. (It also has other capabilities; you may have used it in Chapter 1 to set up a new group.) It's available as both a preference pane and an application. I personally prefer the preference pane version (it seems more intuitive to me to work with Personal File Sharing settings in System Preferences), but I'm going to use the application version for this discussion because the screenshots are clearer. Both versions function identically. To disable Guest Access, launch SharePoints and then follow these steps:

1. Click on the AFS Properties tab (AppleFileServer Properties in older versions of SharePoints).

2. In the Miscellaneous Properties section, uncheck the box next to Allow Guess Access.

3. Click the Update AppleFileServer Properties button. You'll be asked for your admin-level username and password.

4. Click the Restart AppleFileServer button to restart Personal File Sharing. (If it is currently disabled, this will start it up for you.)

Other users will no longer be able to log in as Guest and access user Public folders. (See "How Do Others Access Files?") To re-enable Guest Access (or if for some reason your Mac never had it enabled), use the same procedure but check the box next to Allow Guest Access instead.

Creating File Sharing Only Users

If you've disabled Guest Access, you may be wondering how you allow remote access to Personal File Sharing to individuals who don't have a local account. You could create a single, extra user account and then provide that username and password to everyone you want to be able to access files over Personal File Sharing. However, that would be a rather inconvenient and messy solution. A better solution is to create "File Sharing Only" users. Again, Share-Points is the easiest way to do this.

File Sharing Only users can connect to Personal File Sharing, but can't log in locally, don't have their own user directory, and cannot log in using the Remote Login feature (discussed later in this chapter when I cover SFTP sharing, and in the next chapter when I talk about Remote Access). These types of user accounts are ideal for users who will never actually sit down at your computer and log in, but with whom you want to share files. To create a File Sharing Only account using SharePoints:

1. Click on the Users & "Public" Shares tab.

2. Under Individual Users, fill in the user's full and short name (just as if you were setting up a new account in Accounts preferences).

3. In the Group pop-up menu, select "staff." (If you've set up any groups of your own, and you want the new user to be a member of one of those groups, you could select that group name instead.)

4. Click the Get Next UID button; SharePoints will automatically assign the new user the next available user ID (Figure 10.4).

   
   Figure 10.4: Setting up a File Sharing Only user in SharePoints

5. Ignore the Public Directory Shared? pop-up menu; users created within SharePoints do not have Public folders. (This option exists to allow you to edit existing user accounts, as described in the next section.)

6. Click Add New User (provide your admin username and password if prompted), then click Restart AppleFileServer to restart Personal File Sharing.

The new user you just created will be able to log in via Personal File Sharing and view Public folders, but will have no other system privileges.

Disabling/Enabling Sharing of Public Directories

What if you don't want remote users to be able to access certain, or all, user Public folders? You can use SharePoints to disable the sharing of individual Public folders, or you can choose to disable all Public folder sharing and then manually enable the sharing of other folders (using the next tip). For example, you could choose to disable all Public folder sharing, and then provide access to the Shared folder instead. To edit the sharing of Public folders:

1. Click on the Users & "Public" Shares tab.

2. In the User column on the left, select the user whose Public folder you want to prevent from being shared.

3. In the "Public" Directory Shares section, click Disable Selected. (Or click Enable Selected if you had previously disabled sharing for that user and want to re-enable it.) If asked, enter your admin-level username and password.

4. Repeat Steps 1–3 to disable/enable sharing for additional users' Public directories.

5. Click Restart AppleFileServer to restart Personal File Sharing.

Enabling Sharing of Additional Directories

If you want to share files in directories other than, or in addition to, Public folders, you can do this by creating what are called sharepoints. (This is actually where SharePoints got its name—it was originally just a utility to help you create new sharepoints.)

1. Click on the "Normal" Shares tab.

2. In the Share Name field, enter the name of the share. This can be the name of the folder you plan to share, or anything else. However, since this name will be included in the list of shares users see when they connect to Personal File Sharing, it should be something unique and descriptive.

3. Click the Browse… button next to the Directory field. Navigate to the folder you want to share, select it, and then click the Open button. The path to your chosen folder will appear in the Directory field.

4. Click Create New Share to create the share; if prompted, enter your username and password. Then click Restart AppleFileServer to restart Personal File Sharing.

You can delete a share by selecting it from the list of shares and then clicking Delete Selected Share. You can also use SharePoints to quickly change the permissions of the shared directory by selecting a share and then clicking then Show File System Properties button. A drawer will slide out that shows the current owner, group, and permissions for the selected share. You can change them via the pop-up menus. However, SharePoints can only change the permissions for the top level of the shared directory. To provide more or less access to the files within the directory, you should use the Finder's Get Info command or a third-party file utility.

Enabling Personal File Sharing over AppleTalk

Although Mac OS X shies away from AppleTalk (it will only use it for local networking if you specifically enable it), AppleTalk is still the predominant networking protocol for many older Macs. In fact, some older versions of the Mac OS—still in use on older Macs and in many schools—don't even support Apple's IP-based file sharing protocol. This can present a problem if you're trying to share files with these computers. However, although Apple doesn't advertise it, Mac OS X does support File Sharing via AppleTalk. To enable it, launch SharePoints, and in the AFS Properties tab, check the box next to Use AppleTalk in the Miscellaneous Properties area. You'll need to click the Restart AppleFileServer button to restart Personal File Sharing; once it starts up again, your Mac will be visible on an AppleTalk network.

Activating the Personal File Sharing Log

Users of Mac OS 9 may remember the File Sharing Monitor, which provided you with a list of connected File Sharing users. Mac OS X doesn't include such a feature (it's reserved for OS X Server); however it does include the ability to keep a detailed log of all Personal File Sharing activity. Fire up SharePoints again, and in the AFS Properties tab, look at the Logging Properties section. If you check the Enable Logging box, OS X will begin to log any or all of the types of activities checked in the boxes to the right (Logins, Logouts, etc.). By default, the log is located at /Library/Logs/AppleFileService/AppleFileServiceAccess.log. Remember that you have to click the Update AppleFileServer Properties button, and then the Restart AppleFileServer button, for your changes to be applied.

You can view the log in text editor like TextEdit at any time; however, you won't be able to automatically view updates. If you want to watch the log in real time, you can use one of the log-viewing utilities I mention in Chapter 14. In addition, a quick and easy way to view real-time updates is to open a new Terminal window and type tail -f /Library/Logs/ApplefileService/AppleFileServiceAccess.log <RETURN>. This will show the log in the Terminal window, including additions to the log (i.e., activity) as they are written.

Other Options in SharePoints

In addition to the options I've discussed here, SharePoints also provides a number of other features you'll have to explore for yourself. I mentioned the ability to create groups in Chapter 1, but you can also create a welcome message that other users will see when they connect, change the ports used by Personal File Sharing, and even set up idle timers so that users are automatically disconnected if they are idle for too long. You can also configure and customize OS X's Windows File Sharing (which I'll talk about later in the chapter).