Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Most of your staff uses OSX as main operation system. The problem is that recently we were attacked with some odd malware: users are getting zip-file via mail, and when they open this zip file, they execute a binary keylogger malware, that is inside this zipped file. (One click is enough).

We have some non-technical limitations and due this limitation we can't configure user's mail servers. But actually we have physical access to their laptops.

As far as I know, there is possible to mount user's home directory without "x" (execution) permission in Linux and *BSD. So users can't run some binary file inside home directory.

Is it possible to configure OS X so that user can't execute files inside /Users/?

share|improve this question
3  
Whether your users are technical or not, you should try to educate them to be much more suspicious and careful about opening attachments they weren't expecting. –  John Gardeniers Oct 8 '12 at 9:33

1 Answer 1

If /Users is on a separate filesystem you can mount that with the noexec option. Otherwise you can remove the x permission by running something like chmod -R a-x,u+X /Users. You need the u+X to re-apply the x permission on directories otherwise the users would be unable to cd into them.

Note that I do not recommend doing this (at least not without extensive testing). I consider it likely to break stuff for your users, and it may not have thwarted the attack anyway (e.g. if files were extracted to /tmp rather than a user's home directory).

If you want to apply measures against some attack, it's imperative to first understand how exactly the attack worked. You can't shotgun issues like this without significant collateral damage.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.