krypted.com

Tiny Deathstars of Foulness

There are a lot of payloads that MDM and profiles can manage in iOS. Restrictions are probably the one I get the most questions about. And most are pretty self-explanatory. Sooooo, rather than open Profile Manager every time I need to see the list, here it is:
  • Allow use of Camera
  • Allow FaceTime
  • Allow screenshots and screen recording
  • Allow AirDrop (supervised only)
  • Allow iMessage (supervised only)
  • Allow voice dialing while device is locked
  • Allow Siri
  • Allow Siri while device is locked
  • Enable Siri profanity filter (supervised only)
  • Allow user-generated content in Siri (supervised only)
  • Allow iBooks Store (supervised only)
  • Allow installing apps using Apple Configurator and iTunes
  • Allow installing apps using App Store (supervised only)
  • Allow automatic app downloads (supervised only)
  • Allow removing apps (supervised only)
  • Allow in-app purchase
  • Require iTunes Store password for all purchases
  • Allow iCloud backup
  • Allow iCloud documents & data
  • Allow iCloud Keychain
  • Allow managed apps to store data in iCloud
  • Allow backup of enterprise books
  • Allow notes and highlights sync for enterprise books
  • Allow iCloud Photo Sharing
  • Allow My Photo Stream (disallowing can cause data loss)
  • Allow automatic sync while roaming
  • Force encrypted backups
  • Force limited ad tracking
  • Allow Erase All Content and Settings (supervised only)
  • Allow users to accept untrusted TLS certificates
  • Allow automatic updates to certificate trust settings
  • Allow trusting new enterprise app authors
  • Allow installing configuration profiles (supervised only)
  • Allow modifying account settings (supervised only)
  • Allow modifying device name (supervised only)
  • Allow modifying Find My Friends settings (supervised only)
  • Allow modifying passcode (supervised only)
  • Allow modifying Touch ID fingerprints (supervised only)
  • Allow modifying restrictions (supervised only)
  • Allow modifying Wallpaper (supervised only)
  • Allow pairing with non-Configurator hosts (supervised only)
  • Allow documents from managed sources in unmanaged destinations
  • Allow documents from unmanaged sources in managed destinations
  • Treat AirDrop as unmanaged destination
  • Allow Handoff
  • Allow Spotlight Suggestions
  • Allow Touch ID to unlock device
  • Force Apple Watch wrist detection
  • Allow pairing with Apple Watch (supervised only)
  • Require passcode on first AirPlay pairing
  • Allow predictive keyboard (supervised only)
  • Allow keyboard shortcuts
  • Allow auto correction (supervised only)
  • Allow spell check (supervised only)
  • Allow Define (supervised only)
  • Allow Wallet notifications in Lock screen
  • Show Control Center in Lock screen
  • Show Today view in Lock screen

February 5th, 2016

Posted In: iPhone

Tags: , , , , ,

Apple Configurator 2 is now out and there are some really cool new features available to people deploying Apple Configurator. Apple Configurator 2 now supports feature called Blueprints. A Blueprint is a set of configuration options (such as profiles, apps, etc) that are easily applied to devices by applying a given Blueprint. So basically a canned set of options that can be configured on a device. For example, you can have a Blueprint called Training that have training apps and settings for a training room network and then you can have another Blueprint for Kiosks, that have different apps for a kiosk, one app for a kiosk, an SSID for a kiosk wireless network, and throw that single app into Single User Mode. Pretty cool, since before you needed to have all this stuff in, select the appropriate options and then deploy them. Now, you can more quickly train student workers or deployment staff to get devices initially configured before deployment them in a school or company. To install the new Apple Configurator, open up the App Store, search for Apple Configurator and then click on the Get button. It’s only 61MB so installs quickly. Screen Shot 2015-10-01 at 2.51.36 PM Once installed, open Apple Configurator 2  from /Applications. Screen Shot 2015-10-01 at 2.51.14 PM Another great new feature of Apple Configurator 2 is the command line interface for Apple Configurator: cfgutil. Go ahead and click on the Apple Configurator 2 menu and select Install Automation Tools from the menu. Screen Shot 2015-10-01 at 2.55.05 PM When prompted, Screen Shot 2015-10-01 at 2.55.09 PM Once installed, you’ll find cfgutil at /usr/local/bin/cfgutil. I’ve been working on some documentation for using the command line interface, so I’ll get it posted when I’m done. But for now, let’s go back to Apple Configurator 2 and click on Blueprints to make a new Blueprint. Screen Shot 2015-10-01 at 4.09.38 PM From Blueprints, click on your new Blueprint. Screen Shot 2015-10-01 at 4.09.47 PM From the Blueprint. you can add Apps, create Profiles and assign devices. Here, we’re going to click Profiles in the sidebar. Initially there won’t be any Profiles on the device. Click on New. Screen Shot 2015-10-01 at 4.24.23 PM Click on File then click on New Profile. Screen Shot 2015-10-01 at 4.27.14 PM The General screen just requires a new name. There are a few new options for profiles, as you can see by clicking on Restrictions and scrolling to the bottom. Screen Shot 2015-10-01 at 4.26.48 PM There are a lot of new options for iOS devices. Many require device supervision. I’ll cover setting up devices and enabling supervision later. Using Advanced options, you can also clear passcode, obtain unlock tokens, start single app mode, and enable encrypted backups. Plenty of fun things to cover!

October 1st, 2015

Posted In: Apple Configurator, iPhone

Tags: , , , , , , ,

There are some new restriction payloads in iOS 9. These include the following:
allowNews Boolean Supervised only. If set to false, disables News. Defaults to true. Availability: Available in iOS 9.0 and later.
forceAirDropUnmanaged Boolean Optional. If set to true, causes AirDrop to be considered an unmanaged drop target. Defaults to false. Availability: Available in iOS 9.0 and later.
allowUIAppInstallation Boolean Supervised only. When false, the App Store is disabled and its icon is removed from the Home screen. However, users may continue to use Host apps (iTunes, Configurator) to install or update their apps. Defaults to true. Availability: Available in iOS 9.0 and later.
allowScreenShot Boolean Optional. If set to false, users can’t save a screenshot of the display and are prevented from capturing a screen recording as well. Defaults to true. Availability: Updated in iOS 9.0 to include screen recordings.
allowKeyboardShortcuts Boolean Supervised only. If set to false, keyboard shortcuts cannot be used. Defaults to true. Availability: Available in iOS 9.0 and later.
allowPairedWatch Boolean Supervised only. If set to false, disables pairing with an Apple Watch. Any currently paired Apple Watch is unpaired and erased. Defaults to true. Availability: Available in iOS 9.0 and later.
allowPasscodeModification Boolean Supervised only. If set to false, prevents device passcode from being added, changed, or removed. Defaults to true. Availability: Available in iOS 9.0 and later.
allowDeviceNameModification Boolean Supervised only. If set to false, prevents device name from being changed. Defaults to true. Availability: Available in iOS 9.0 and later.
allowWallpaperModification Boolean Supervised only. If set to false, prevents wallpaper from being changed. Defaults to true. Availability: Available in iOS 9.0 and later.
allowAutomaticAppDownloads Boolean Supervised only. If set to false, prevents automatic downloading of apps purchased on other devices. Does not affect updates to existing apps. Defaults to true. Availability: Available in iOS 9.0 and later.
allowEnterpriseAppTrust Boolean If set to false, prevents trusting enterprise apps. Defaults to true. Availability: Available in iOS 9.0 and later.
allowEnterpriseAppTrustModification Boolean Supervised only. If set to false, prevents the enterprise app trust settings from being changed. Defaults to true. Availability: Available in iOS 9.0 and later.
allowMusicService Boolean Supervised only. If set to false, Music service is disabled and the Music app reverts to classic mode. Defaults to true. Availability: Available in iOS 9.0 and later.
allowCloudPhotoLibrary Boolean If set to false, disables iCloud Photo Library. Any photos not fully downloaded from iCloud Photo Library to the device will be removed from local storage. Availability: Available in iOS 9.0 and later.

September 9th, 2015

Posted In: iPhone, Mac OS X, Mac OS X Server, Mac Security

Tags: , , ,

Recently I woke up and my daughter was sitting on me watching something on the iPad. As I woke ever so slightly I realized that she was watching Transformers the movie on Netflix. I’m not typically a helicopter dad, hovering over her every move, but I did realize amidst the explosions that ya’, I might want to take some of the things I learned writing the book on locking these things down and put a few very basic measures in place to keep her from seeing something she shouldn’t. After all, she’s gotten about as good at navigating around the thing as I am (and these days she’s getting pretty acclimated with iOS 7). So let’s look at some basic precautions that parents can take to keep their kids sandboxed into just the material they feel confident with. For starters, the built-in security precautions. These are basically all in the Security app and each comes with repercussions that I’ll go into with each step, so you can decide for yourself if you actually give a crap about them. Passcodes The nuclear option is to enable a passcode so the child can only use the device when supervised. I did not do this myself for the home iPad for a variety of reasons: sometimes she locks the device while I’m driving, sometimes she wants to use the device when she wakes up at 6am after I was up hacking stuff ’till 4am and well, because I want the device to be as much hers as mine. So I don’t want to enable a passcode that the she does not know, but you might. To set a passcode, open the Settings app from the home screen and tap on General in the Settings sidebar (or to not setup a passcode, skip to the next section). IMG_0002 Or to lock the screen when the iOS device goes to sleep, tap Passcode Lock. IMG_0003 If you’re going to enable a passcode, at the Passcode Lock screen, tap on Turn Passcode On and when prompted provide the passcode. IMG_0007 Once you’ve enabled a passcode it’s worth noting that if the passcode is entered improperly too many times the device will be wiped. However, it’s now encrypted and meets certain policy restrictions (e.g. if you use it with an Exchange server at work as well). Restrictions Restrictions allow you to disable various features of iOS, including Safari, the Camera, FaceTime, iTunes, iBookstore, App Store, App deletion, Siri and even using explicit language with poor Siri. Additionally, you can control what kind of media can be purchased on the iTunes store. To get started, tap on Restrictions in the General app. IMG_0004 Here, you will see that pretty much everything is allowed by default. You have the option to disable very specific items. IMG_0008 When you enable Restrictions you will be prompted for a Passcode, which can be used to override or disable the restrictions at a later date. This, clearly, you wouldn’t want to share with the child. IMG_0009 Tap Enable Restrictions and note that we’re going to go ahead and enable a few and then postpone a couple of others until the end of the article because they will keep us from completing steps we want to complete later. The restrictions many will want to enable (which disables the feature):
  • Safari: It’s not that we don’t want the kids using the web, we just want them to use a specific web browser we give them that doesn’t allow them to screw around.
  • Explicit Language: The kids shouldn’t be able to tell siri to use bad words, and trust me, they will if you don’t disable this.
  • Deleting Apps: This is more for us. Kids figure out how to do the wackiest things by accident. Including how to delete their favorite Angry Birds app and then crying for you to reinstall it (since later in this article we’re disabling the ability to install apps).
  • Music & Podcasts: Move to the Off position to block the device from playing content that is marked as Explicit.
  • Movies: I chose to uncheck all but G and PG. You may choose to allow PG-13 or disable PG. These options are different in other countries.
  • TV Shows: I chose to allow TV-PG and below. Some of the Saturday morning cartoons have a much higher rating than you might think.
  • Books: Move to the Off position to disable the ability for the device to open Explicit Sexual Content.
  • Apps: I chose to use 9+ although this is almost a non-issue as we’ll be disabling the App Store later in this article.
  • In-App Purchases: I turn this off more so I don’t get random emails from the iTunes Store about buying add-ons for Angry Birds than anything else.
  • Require Password: I don’t usually change this option.
  • Accounts: I don’t allow changes on my daughters iPad.
IMG_0010 Note: You can also lock the volume level here, although I usually don’t with ours as it just causes problems/arguments and a general desire not to use headphones, which I have a general desire to be used when watching many of her shows. Another Note: You can browse content that you’ve blocked but not purchase/download that content, so know that if you’re not going to put a passcode on devices, or hide them when children aren’t supposed to use them. Once you’ve enabled all the restrictions you’d like, leave the Restrictions portion of the General app and then go back in, just to verify that the passcode you used earlier still works. Also note that the Accessibility options can be great for those with disabilities, but I usually don’t enable any of them otherwise. Remove Your Stuff Still in the Settings app, tap on Mail, Contacts , Calendars. Now this is painful as it basically means that no, the iPad isn’t really yours like you thought it was, but remove your mail accounts. Otherwise, the kids will send mail to the entire Mac Enterprise list like mine did a few years ago. Yup, it will happen and thousands of people will laugh at you (or in my case they’ll just laugh at you more than usual). Once removed the  Mail, Contacts, Calendars screen in the Settings app will just show you an option to “Add Account…” as seen here. IMG_0093 Also don’t forget that Facebook, Twitter, Instagram and all the other awesome reasons you bought the thing can end up getting photobombed with pictures she took while sitting in the back seat, tinkering around with Photo Booth. I actually don’t mind these with random characters or pictures my daughter posts of her tinkering with the camera app, so I don’t bother removing them, it’s more email specifically and only because you never know who she’s gonna’ hit up there. Netflix Netflix is one of those funny places where children can spend hours, and while enamored with poster frames of interesting shows, kids can see things you might not want them to see. You can install an App and people can log into each profile and see a queue of shows, but also shows that they might be interested in. Profiles are not password protected, so users can select whichever profile they choose. But, it’s a start. I like to associate a different image with each user. To setup profiles, log into Netflix, hover the mouse over your name and then click on Manage Profiles. Here, create each desired profile and for any children who you want to try and limit, click Edit and then check the “This is a profile for kids under 12” checkbox.

Screen Shot 2013-08-26 at 8.44.40 PM

Note: Profiles have a side benefit which is that you don’t see My Little Pony on your queue and your child doesn’t see Sacha Baron Cohen movies in their queue. I also like to assign an image for each (click the red image in the lower right corner of the avatar for each user to select their own image. Make sure the whippersnapper knows which image they’re to use, and it will be awhile before they realize they can just switch profiles if something’s blocked and they want to watch it. It will be punishment enough logging into a profile that doesn’t have a bunch of cartoons on it (okay mine does) so they won’t want to use anyone elses profile. Screen Shot 2013-08-28 at 9.49.03 PM Once you’re done you’ll get a cute login prompt on the device, when you log into Netflix. IMG_0001 Anyway, next is the hard part, move all the stuff you want to watch to your profile and leave the kid stuff in their profile (after all, I’m sure that like me they have more crap in their queue than you do!). I did this by having the iPad in my hand and a laptop. I looked at the list on the iPad to see what I wanted to add to my own queue (whoops, they call them lists now) and deleted things from the other profile with the iPad. Next, we’ll perform one small change in the Settings for the Netflix app. Open the Settings app and scroll down in the sidebar until you see Netflix. Tap it and then turn the Wi-Fi Only option on. IMG_0011 This keeps you from getting an insanely high bill when the kids decide to watch Netflix using your data plan. Install a Browser Next, let’s install a browser so they can use the web with a little filter on it. Using a different browser means a slightly different look and feel, but it means we can limit what they’re able to use. To get started, open the App Store on the iOS device. Then, tap K9 in the search bar and install. IMG_0094 Once installed, try to browse a site you know to be just wrong for the kido from within the browser. Once you see the blocked page, you know you’re good. IMG_0095 K9 is a browser that is provided free of charge (well, there’s an ad bar that you can in app purchase to get rid of for $2.99 but close to free!) from Blue Coat, a company that makes proxy servers that filter and track internet traffic. I’m a big fan of their products and if you happen to do IT in a school district or company it might not be a bad idea to check their stuff out as well! Restrict Safari Now, many kids won’t need a web browser, but since you can’t access YouTube without it, you’ll end up needing one eventually. Once you’ve installed a browser it’s time to disable access to Safari. By disabling Safari you limit accessing the web to the K9 browser. To do so, open the Settings app again and tap on Restrictions. IMG_0096 From the Restrictions option in the Settings app, tap Off for Safari. IMG_0097 Then just close Safari and the app will disappear from the home screen. Disable the App Store Once you’ve purchased the K9 browser and all the fun games and educational whatnot that your children should have, it’s time to disable the App Store so that no further apps can be installed, such as another browser to bypass the K9 browser previously installed. To do so, open Settings app, tap General and then tap on Restrictions. IMG_0096 From Restrictions simply move the slider for Installing Apps to the Off position. IMG_0097 Close the Settings app and the App Store icon will disappear from the home screen. Enable Guided Access (aka Kiosk Mode) Guided Access locks a user inside a single app. Only use this if you want to hand a kid an iPad that’s in an app and not let them close the app. If you use Guided Access you likely don’t need any of the other restrictions we mentioned in this article; however, every time the kid wants to switch apps you’re going to need to provide a pin code and then open another app and then enable Guided Access mode again, which could get pretty darn annoying after awhile. Using Guided Access is a two part process. First, enable Guided Access, which does little except set a passcode. It’s never a bad thing to enable Guided Access although I’ve seen a kid set a passcode accidentally and the device had to get wiped to undo it. Oh, did I mention, you don’t want to forget that passcode? Once enabled, we’ll restrict access to the app we no longer want users to be able to leave. Once enabled, the app is locked open until the passcode is tapped. To enable Guided Access, open the Settings app and tap on General. Scroll down until you see Accessibility. IMG_0098 From the Accessibility screen, tap Guided Access. IMG_0099 From the Guided Access screen, tap ON. IMG_0100 Once enabled, you will invariably want to set a passcode (otherwise, why bother?). To do so, tap Set Passcode. IMG_0101 When prompted, provide a passcode. IMG_0102 For children I usually tap Enable Screen Sleep, which allows the device to go to sleep; however I don’t usually do so when setting these things up to actually be in a kiosk. Once you’re happy with the settings, close the app and Guided Access is working. Next, open an app and then triple-click the home button. A screen will open that allows you to Enable Guided Access, tap that from within the app you’d like to enable Guided Access for and viola, the app is locked open. Now, you can also disable certain parts of the screen and whether or not the app allows shaking the device, etc. But I find that can be a bit difficult so I don’t typically use that feature. IMG_0105 Once you’re done with the app, to disable Guided Access, simply triple-click on the home button again, provide the passcode and tap Disable for Guided Access to close. Managing Guided Access is difficult and I find it best for toddlers or bigger kids that might be finding themselves not-to-be-trusted for a short period of time. I mentioned this earlier, but don’t forget the passcode you use to enable Guided Access or you might find yourself wiping the device by the time all is said and done. Use Safe DNS Servers You can use a service like OpenDNS.com to control what Internet addresses that a device can access. To do so, first go to https://store.opendns.com/familyshield and sign up for the free account (unless you want the bells and whistles with their paid accounts). Screen Shot 2013-09-03 at 12.03.56 AM Open the Settings app and then tap on Wi-Fi in the sidebar. From the Wi-Fi screen, enter 206.67.222.123 and 208.67.220.123 in the DNS field. IMG_0109 Once you enter the DNS servers, close the Settings app. Then close and re-open your browser to delete the cache and open it again to see if the new settings are blocking the naughty sites. Get a Case Okay, so none of this is going to matter one little bit the next time the little devil decides to throw a temper tantrum. You know that shirt that says “I’m why mommy and daddy can’t have nice things” is way cheaper than an iPad, but still we let the little tykes play with the things. If we’re gonna’ do that, might as well get a good case for the thing. Otterbox makes good water and shock absorbent cases, as well as others. Biggrips.jpeg Backup Just so you don’t have to re-download all the movies you’ve bought to keep the little Cheerio-eaters busy, configure these settings again, etc. you should make a backup of the device. I wrote that up a long time ago at http://www.krypted.com/?p=8319 but it’s worth noting that you want to encrypt these backups so everything is captured. Find My iPad/iPhone Find My iPhone allows you to track the whereabouts of your iPhone, iPad and iPod Touch. To enable, first turn on iCloud if you haven’t already. To do so, open The Settings app and tap on iCloud in the sidebar. Enter the Apple ID you use to buy software along with the Password and then tap Sign In. IMG_0107 Once added, if you don’t want to sync mail, contacts, calendars, etc then flip their sliders from the ON to the OFF position. Set Find My iPad to On (or Find My iPhone if it’s not an iPad). Close the app and within a few shakes you’ll be able to track the whereabouts of devices. IMG_0108 Once installed, install the Find My iPhone app and log into your iCloud account or use your iCloud account to log into the MobileMe site. IMG_0012 When you install Find My iPhone from the App Store, you’ll use an iCloud account to view where the devices are. Mine aren’t really available in the following screen because I suck and wrote this on an airplane. But whatever… Either way, you can now chase down the bully that stole your darlings iPad and beat them with the folded up stroller, running over them four or five times in your Prius. Or maybe that’s just me. But you can’t do it on an airplane. Sorry. Screen Shot 2013-09-02 at 11.47.16 PM Get Advanced with Profiles You can actually lock down a lot of what iOS can do. A lot more than what’s available in the GUI. To do so, you would use something known as a profile. These can control the options we discussed in much of this article. But they can also lock down options that you didn’t even know were available, such as disabling apps not otherwise removable and locking users out of certain features of devices. Profiles are created manually and installed via USB or email using Apple Configurator, which I co-authored a book on, available here, or they can be deployed via an MDM solution, such as Apple’s Profile Manager or some really enterprise class ones such as Casper MDM. This is much more advanced than what I intended to write here, but I’ve written a lot about MDM over the years as have others, so feel free to dive into that if you deem it necessary. Check On the Device Routinely No matter what you do, the device can be reset back to factory defaults and set back up. You don’t have to worry about younger kids searching the Internet and finding how to do it (like here on Apple’s site). But with older kids, check out the device every now and then and just make sure your parental controls are still in place. Do Something This article is really meant to be an a la cartè listing of things you can do. If the kid is young enough, they’re not going to try to do anything on purpose but the older the child the more likely they will try to break out of the sandboxed environment you’ve created, if only because they see it as a challenge or simply because they can (kindof like when my daughter writes on the wall). But that isn’t to say that you shouldn’t try to do something. And what you do should be age appropriate with an eye on not letting them spend too much of your money on apps or too much of their time on the devices. Don’t Do Too Much But don’t do too much. Especially if the kids are older. If you do too much, then the kidos have a tendency to try and break the sandbox you build. Oddly, the less the restrictions the less they’ll try and break them. This isn’t so much an issue with the really young ones (think kindergarten and below) but as they get older it’s a bit more of a problem. Also, keep in mind that the devices are meant to allow for a maximum level of creativity. The more you allow to happen on the device, the more creativity you may allow for. Whatever’s appropriate for the age and knowledge level of your little one!

September 3rd, 2013

Posted In: iPhone, Network Infrastructure, personal

Tags: , , , , , , , , , , , , ,