TweetFollow Us on Twitter

Mac OS X Security Volume Number: 17 (2001)
Issue Number: 4
Column Tag: Mac Security

Mac OS X Security

By Jesse Corbeil, Montréal Québec

Securing a Mac OS X workstation for stand-alone or home use out of the box

Note: Mac OS X is currently in Public Beta. The final version may invalidate any or all of this paper. That's just a chance we take when we write how-tos about beta operating systems

In the world of operating systems, the Macintosh platform has traditionally been everybody else's secure neighbour. Not many virii or cracks affected the Mac (unless we counted cross-platform Word macros), and we were generally spared the heaps of abuse that were laid onto our Windows-using brethren. Whether this has been due to the brotherly Mac community or the simple fact that there aren't enough Mac OS computers out there to make it worthwhile is up for debate. The truth will become clear when we all trash our old Macs and buy brand-new Cubes to run Apple's swank new OS. Why is that? Because Mac OS X is nothing more than a shiny interface on top of a tweaked BSD core, and BSD is very much slugging it out at the centre of the cracks and exploits blattleground. With that in mind, this article will discuss how to secure the default installation for a workstation or for home use.

BSD

Unix-cowboys have it all over us Mac users. They trade in the ease-of-use and smooth operation to which we are accustomed on the Mac side for raw, unlimited power over their machines. The easy Mac or Windows click-to-install approach is shunned in favour of the ability to tweak the code of an app that didn't install properly; cutting, thwacking, and generally forcing the code until the app clicks smoothly into place. Further, whereas we tend to troubleshoot by twiddling the knobs and banging the pipes, Unix-gurus crawl under the sink to pull the works apart. They know their machines better than we know our mothers.

Now, all that is about to change- at least for those of us who actually want to dig about under the hood and still enjoy the Mac OS experience.

With the change to Mac OS X, Apple reduces the number of major-player non-Unix OSes by one, while simaultaneously giving the Unix world something it has been trying to develop with imperfect solutions like KDE and Gnome: a distro with a polished and usable GUI.

What the BSD core (fetchingly called 'Darwin') gives back to the Mac is a rock-solid OS with all the buzz-technologies incorporated: multi-this, protected-that, and the new-to-Mac concept of an application crashing without taking down the OS. Unfortunately, what else we get is a security headache. Suddenly, all those Unix-savvy hacks and virii are mac-savvy too. Added to that (and I feel safe in going out on this particular limb), the country-bumpkin image that the Mac OS has enjoyed in hacker circles is about to be replaced by a perception of the OS as the sexy new Unix. Eager crackers will want to try out all the exploits and probe the nooks and crannies.

The Swiss-Cheese OS

Once they've been properly set up, the BSDs are generally pretty secure. They are developed by security-conscious communities and tend to be deployed in sensitive areas like networking and databasing. The Calgary-based OpenBSD is regarded as the most secure BSD distribution, incorporating many crypto and security features that would be non-exportable had it been an American distro subject to US export laws. Obviously, Apple could not have based Mac OS X in Open BSD and still sold the OS outside the US, but the more freely-exportable BSDs are still very secure, and the choice to base Mac OS X on the platform is still a solid one.

OpenBSD aside, any distro must be properly hardened to close up some of the dozens of holes left open by a default installation. This is where Darwin shows its BSD roots, and where a certain familiarity with Unix system hardening comes in. On a typical BSD system, one of the things an admin would do to secure the system is to edit the inetd.conf file to disable unneeded services. Mac OS X comes with the inetd.conf file already set up in a pretty secure configuration, but that doesn't mean that the OS is completely tight. There are other security holes in the default setup (such as services not covered by inetd.conf) that must be addressed before deploying the OS in a secured environment. When configuring services, the general rule of thumb is If you're not using it, turn it off.

There are some cool gewgaws in Mac OS X, though their default configurations can be pretty insecure. Running dmesg, for instance, reveals that there is an IP packet filter initialised but that it's wide open; The NFS daemon is active by default, which opens up a security hole, as does the Portmap daemon. There's an NTP daemon enabled, which opens a very slight security risk: though one wouldn't generally try to compromise the system through NTP, it is theoretically possible to muck about with it to make time-sensitive apps do one's bidding. But by far the coolest feature of the OS in terms of un-fubar-ability is the separation of admin accounts from the central, all-powerful root user. As part of the OS installation, I was asked to create an administrator account for myself. I set the system up as "jcorbeil," which is the account I generally use. From there I can administer just about anything on the machine - so long as the function is GUI accessible. However, if I try to enter rm -rf * in a Terminal window, the system will tell me to stuff myself. Why is this? It's due to Apple's approach to Mac OSX's design. Apple has made it as difficult as possible to hose your system by limiting GUI access to most of the really dangerous functions. That's a smart move on Apple's part, as it effectively stops non-gurus from inadvertently committing atrocities.

Another safety feature was revealed when I checked out the NetInfo application, which is where all system and user information is centralised. I discovered (and verified via a quick etc/passwd check) that even though my account is an administrator account, the system still pledges its allegiance to a separate root account that was automatically generated during installation. In other words, "jcorbeil" may be the system admin, but he doesn't have the same set of priviledges as the bonafide root user. To do something that only the root can (like erase the works), I have to su to root in Terminal, then do my damage. It's not hard, as the root account shares jcorbeil's password by default, but there's a certain level of know-how involved in getting to the 'destroy-the-OS' point that is beyond the ken of most new users coming from a classic Mac OS background.

Openings and Closings

To get a bit of an aperçu of what ports are open on your system, open a Terminal window and enter netstat -an (Figure 1). This will display your machine's ports and whether they are listening, established, or closed. If you want to see the ports' names, use the netstat -a command. It's a safe bet that you'll find ports you don't recognise. That's normal, but for for those who want to know all about ports, http://www.doshelp.com/trojanports.htm has some resources for the inquisutive firewall admin.


Figure 1. What comes up when you type netstat -an

Chances are, you'll find two local addresses near the bottom of the list, called *.111 and *.514. These are our first two security issues. *.111 is portmap, which is a daemon for making RPC calls. It is also lousy for security, and is best turned off. *.514 is the syslog daemon, which listens on UDP and receives log broadcasts from other servers. Sounds pretty innocuous, right? Well, UDP is not a two-way protocol, so there's no way for syslog to verify whether or not the sender of a given datum is who he says he is, which opens up the potential for a denial of service attack. Nasty stuff. Tighten *.514 up by using IPF to stop connections other than 127.0.0.1 (more on this later).

After that, run a search for any files that are either world-writeable or owned by the "nobody" user or group. Every one of these opens up a little security hole, and should therefore be viewed with great circumspection. You might need a couple of them, you might not. Look about and clean up what you can by tightening up the access control to world-writeable files or files with 'nobody' ownership.

IPFilter: Built-in Security

IPFilter is a firewall that gets installed with the kernel, and is where some of the power of a BSD-based OS comes to the fore. IPFilter alone warrants a book or two, but there are some basics that everyone can use as a springboard to using IPF fairly quickly.

IPF works by processing a rules file. The rules file is a text file of conditions and actions for IPF to take when those conditions come to pass, for example blocking packets, letting packets through, and logging them. Set up IPF's rules file for blocking, passing, and logging based upon the criteria you want to employ. For example, say you don't want TCP packets coming in. You would edit the ipf.rules file by entering the following line of text:

block in on ed0 proto tcp from any to any

If you wanted the above to block only one port (say *.514), you would change the text to read:

block in on ed0 proto tcp from any to any port = 514.

Fiddle with the file, blocking and unblocking ports until you have a tight system from which you can still run the transactions you need. It is generally a good idea to start off your rules file with a command to block all ports. That way, any port that doesn't have a rule expressly attributed to it is covered by the first rule, and is blocked.

IPF is quite powerful, and it's a good idea to become well-acquainted with it. More in-depth information can be found at http://coombs.anu.edu.au/ipfilter.

SSH and Kerberos

Two things that I haven't touched on in this article are SSH and Kerberos. That has been done on purpose, as there is very little to be done with either of them for a home or standalone system set-up. SSH comes as part of the standard installation and is an extremely effective tool for keeping your system tight. For our purposes, you won't need to change the configuration. Just be serene in the knowledge that it's running and it has your safety in mind. Accordingly, you don't need to run services like rsh, telnet, rlogin, or ftp. They represent unneeded security risks, so unless you expressly need one of them for something, shut them down.

Kerberos uses a client/server setup, and you would only worry about Kerberos if you were on a network that uses the protocol. Since we're securing a home machine, we'll leave Kerberos alone.

Take it to the Bone

These solutions are not the be-all, end-all secret to how to secure your home system from a brilliant hacker, but they do form a solid foundation from which you can do further research into the methods and tools available to secure your computer. If you want to read further, check out the IP FilterFAQ at http://coombs.anu.edu.au/ipfilter/ipfilfaq.html, or read O'Reilly's Practical UNIX & Internet Security by Garfinkel and Spafford.

Whether or not you decide to delve into the deep, dark depths of computer security, a basic knowledge will still help you understand the basics. Basic knowledge will at least let you understand the theory behind a security breach that might nail your machine, and understanding will hand you the keys you need to get the problem fixed. Computer security doesn't have to be scary, indeed, it can even sometimes be fun. Getting caught unawares by a cracker, on the other hand, can cause you immeasurable pain.


Jesse Corbeil is the Director of Documentation at SecureOps, a network security consulting firm in Montréal, Canada. He has written for beoscentral.com and several other information sites, and is involved in the Marathon Open Source project.

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

iExplorer 4.1.9 - View and transfer file...
iExplorer is an iPhone browser for Mac lets you view the files on your iOS device. By using a drag and drop interface, you can quickly copy files and folders between your Mac and your iPhone or... Read more
PCalc 4.5.3 - Full-featured scientific c...
PCalc is a full-featured, scriptable scientific calculator with support for hexadecimal, octal, and binary calculations, as well as an RPN mode, programmable functions, and an extensive set of unit... Read more
Slack 2.9.0 - Collaborative communicatio...
Slack is a collaborative communication app that simplifies real-time messaging, archiving, and search for modern working teams. Version 2.9.0: Slack now officially, and fully, supports Japanese.... Read more
Microsoft Office 2016 15.40 - Popular pr...
Microsoft Office 2016 - Unmistakably Office, designed for Mac. The new versions of Word, Excel, PowerPoint, Outlook and OneNote provide the best of both worlds for Mac users - the familiar Office... Read more
Apple iOS 11.1.2 - The latest version of...
iOS 11 sets a new standard for what is already the world’s most advanced mobile operating system. It makes iPhone better than before. It makes iPad more capable than ever. And now it opens up both to... Read more
Adobe InCopy CC 2018 13.0.1.207 - Create...
InCopy CC 2018 is available as part of Adobe Creative Cloud for as little as $19.99/month (or $9.99/month if you're a previous InCopy customer). Adobe InCopy CC 2018, ideal for large team projects... Read more
Adobe InDesign CC 2018 13.0.1.207 - Prof...
InDesign CC 2018 is available as part of Adobe Creative Cloud for as little as $19.99/month (or $9.99/month if you're a previous InDesign customer). Adobe InDesign CC 2018 is part of Creative Cloud.... Read more
Tor Browser Bundle 7.0.10 - Anonymize We...
The Tor Browser Bundle is an easy-to-use portable package of Tor, Vidalia, Torbutton, and a Firefox fork preconfigured to work together out of the box. It contains a modified copy of Firefox that... Read more
OmniOutliner Pro 5.2 - Pro version of th...
OmniOutliner Pro is a flexible program for creating, collecting, and organizing information. Give your creativity a kick start by using an application that's actually designed to help you think. It's... Read more
iShowU Instant 1.2.3 - Full-featured scr...
iShowU Instant gives you real-time screen recording like you've never seen before! It is the fastest, most feature-filled real-time screen capture tool from shinywhitebox yet. All of the features you... Read more

Latest Forum Discussions

See All

Fight terrible monsters and collect epic...
Released on Western markets early last month, Dragon Project, created by Japanese developer COLOPL, brings epic monster hunting action to mobile for the very first time. Collect a huge array of weapons and armor, and join up with friends to fight... | Read more »
I Am The Hero (Games)
I Am The Hero 1.0 Device: iOS Universal Category: Games Price: $1.99, Version: 1.0 (iTunes) Description: I Am The Hero is a pixel art, beat 'em up, fighting game that tells the story of a "Hero" with a glorious but mysterious past.... | Read more »
Kauldron (Music)
Kauldron 1.0 Device: iOS Universal Category: Music Price: $3.99, Version: 1.0 (iTunes) Description: Kauldron is our warmest sounding, punchiest synth yet! A completely new modeling technology, combined with carefully designed... | Read more »
Lineage II: Revolution is mobile’s bigge...
NCSoft’s hit fantasy MMORPG series has just made the leap to mobile with the help of Netmarble in Lineage II: Revolution. With over 1.5 million players having already pre-registered ahead of the game’s launch, Revolution hit the app stores... | Read more »
Swing skilfully in new physics-based pla...
Sometimes it’s the most difficult of obstacles that can be the most rewarding. One game hoping to prove this is OCMO, the new tough but fair platformer from developers Team Ocmo. Primed to set every speedrunner’s pulse racing, as an otherworldly... | Read more »
RPGolf (Games)
RPGolf 1.0 Device: iOS Universal Category: Games Price: $2.99, Version: 1.0 (iTunes) Description: Once upon a time, the kingdom was a land of peace, harmony, and an all-consuming passion for the greatest sport - GOLF. Everyone in the... | Read more »
Everything you need to know about Fire E...
Fire Emblem Heroes is getting its biggest update yet as Nintendo unveiled Book II last night, featuring a whole new set of story missions and yes, collectible heroes. The update's not out just yet, but here's what you can expect when the new... | Read more »
The biggest updates out this week - Nove...
A big game update is always a treat. Multiply that by four and you're having a really good week. Those weeks don't come around very often, but you're in luck. This chilly mid-November is chock full updates for some of your favorite titles, and they... | Read more »
Ocmo (Games)
Ocmo 1.0.13 Device: iOS Universal Category: Games Price: $4.99, Version: 1.0.13 (iTunes) Description: Ocmo is an award winning ninja rope platformer that challenges even hardcore gamers. Fluid movement, physics based gameplay and... | Read more »
White Night (Games)
White Night 1.0 Device: iOS Universal Category: Games Price: $4.99, Version: 1.0 (iTunes) Description: After your car mysteriously crashes in the forest, you find shelter in an old and sinister mansion. As you explore your... | Read more »

Price Scanner via MacPrices.net

Early Black Friday sale: Apple iMacs for up t...
B&H Photo has 27-inch iMacs in stock and on sale for up $130-$150 off MSRP including free shipping. B&H charges sales tax in NY & NJ only: – 27″ 3.8GHz iMac (MNED2LL/A): $2149 $150 off... Read more
Apple restocks refurbished Mac minis starting...
Apple has restocked Certified Refurbished Mac minis starting at $419. Apple’s one-year warranty is included with each mini, and shipping is free: – 1.4GHz Mac mini: $419 $80 off MSRP – 2.6GHz Mac... Read more
Save on 12″ MacBooks, Apple refurbished model...
Apple has Certified Refurbished 2017 12″ Retina MacBooks available for $200-$240 off the cost of new models. Apple will include a standard one-year warranty with each MacBook, and shipping is free.... Read more
Early Holiday sale: 12″ iPad Pros for up to $...
B&H Photo has 12″ iPad Pros on sale today for up to $130 off MSRP. Shipping is free, and B&H collects no sales tax outside NY & NJ: – 12″ 64GB WiFi iPad Pro: $749, save $50 – 12″ 256GB... Read more
Holiday sale prices on Apple 13″ MacBook Pros...
B&H Photo has 2017 13″ MacBook Pros in stock today and on sale for $100-$150 off MSRP, each including free shipping plus NY & NJ sales tax only: – 13-inch 2.3GHz/128GB Space Gray MacBook Pro... Read more
Sale: 13″ MacBook Airs starting at $899, $100...
B&H Photo has 2017 13″ MacBook Airs on sale today for $100 off MSRP including free shipping. B&H charges NY & NJ sales tax only: – 13″ 1.8GHz/128GB MacBook Air (MQD32LL/A): $899, $100 off... Read more
Week’s Best Deal on 13″ MacBook Pros: Apple r...
Apple has a full line of Apple Certified Refurbished 2017 13″ MacBook Pros available for $200-$300 off MSRP. A standard Apple one-year warranty is included with each MacBook, and shipping is free.... Read more
Deal: 15″ 2.6GHz MacBook Pro for $1799 w/free...
B&H Photo has clearance 2016 15″ 2.6GHz Touch Bar MacBook Pros in stock today and available for $600 off original MSRP. Shipping is free, and B&H charges NY & NJ sales tax only: – 15″ 2.... Read more
Black Friday pricing on the 1.4GHz Mac mini....
MacMall has the 1.4GHz Mac mini on sale for $399 including free shipping. Their price is $100 off MSRP (20% off), and it’s the lowest price for available for this model from any reseller. MacMall’s... Read more
Early Black Friday deal: 15″ Apple MacBook Pr...
B&H Photo has 15″ MacBook Pros on sale for up to $200 off MSRP. Shipping is free, and B&H charges sales tax in NY & NJ only: – 15″ 2.8GHz MacBook Pro Space Gray (MPTR2LL/A): $2199, $200... Read more

Jobs Board

AppleCare Support Engineer for *Apple* Medi...
…Summary AppleCare Engineering, Software & Services, is a group that works to represent Apple 's World Wide contact centers and Apple 's customers to groups within Read more
Site Reliability Engineer, *Apple* Pay - Ap...
Job Summary The Apple Pay Site Reliability Engineering Team is hiring for multiple roles focused on the front line customer experience and the back end integration Read more
*Apple* Solutions Consultant - Apple (United...
# Apple Solutions Consultant Job Number: 86078534 Fairless Hills, Pennsylvania, United States Posted: 07-Jul-2017 Weekly Hours: 40.00 **Job Summary** As an Apple Read more
Digital Marketing Media Planner, *Apple* Se...
Job Summary Apple is looking to add a hyper-organized, strategic, and fast-learning member to its Digital Marketing team to help support Apple Services ( Apple Read more
*Apple* Retail - Multiple Positions - Apple...
SalesSpecialist - Retail Customer Service and SalesTransform Apple Store visitors into loyal Apple customers. When customers enter the store, you're also the Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.