I am using Mac OS Leopard (10.6.8). This computer has only one Administrative account which i use. When the Mac is idle for five minutes the screen saver is automatically activated and when resuming, it asks for a password. Note: Setting the idle time under five minutes is not practical for me.
The problem here is that if i leave the Mac unattended for a while, any arbitrary user can disable the screen saver password from the system preferences pane, after which any user can get full access to the computer. I have therefore deleted the necessary preference pane which is used to disable the password but even then it can be disabled from the Terminal by typing the command given below and restarting the Mac:
defaults -currentHost write com.apple.screensaver askForPassword -int 0
Is there any way in which i can prevent this by logging in as the super user (root user) and disabling certain permissions for the Administrator, whereby an Administrator cannot disable the screen saver password? Please note that locking the Mac is not an option.
Note: I only wish to use an Administrative account to operate the Mac. Moreover, even if i hide the Terminal app, another app by the name iTerm can simply be used to disable the screensaver password. So this too will not work.
Suppose i login as the superuser and make the changes directly to the plist, would this possibly change the file permissions so that the Administrator cannot write to it.
Please have a look at:
Here it is said: "The lockfile makes this a lot harder than it used to be. Easiest way I've found so far:
Execute your changes against the plist file as opposed to the domain, and execute as the superuser. This will alter the permissions on the file so that only root can read and write..."
Does this mean that the Superuser can be used to restrict access to the screensaver plist file?
Moreover, in the current situation, the only method i am comfortable with is to use the superuser to set the needed permissions for the Administrator. Is there any way this particular method will work?
I am also ready to upgrade the OS to Mountain Lion if needed. Here i understand there are lock files present, which prevent access to the plist files. So if any such route is possible please let me know.
Please note that this is an important security issue so i cannot leave anything to chance. Whatever be the solution, if at all there is one, i would like to use the Superuser account to set the needed privileges for the Admin. This is important.
Moreover if there is no solution to this problem, please let me know so that i can take the needed precautions. But this is only if the Superuser really cannot be used at all for sure.
Thanks a lot.