Slashdot Mirror
Securing Mac OS X
LogError writes "This paper addresses operating system hardening in terms of patching, administration roles, and setting passwords. It also provides information on Mac OS X network security: namely, basic firewall configuration and hardening of network services such as FTP, SSH, and Apache."
While OS X is quite secure by default, it is good to recognize that OS X, like any OS, isn't without vulnerability. The fact that the OS is getting a thorough look-over for security concerns is just one more step in getting it taken seriously. I'm going to have a full of the paper now.
just in time for the machines I'm about to install.
...because they mention antivirus software and do not claim that it will be of any value other than possibly satisfying corporate IS requirements.
....is here. This for those of you who read the comments before reading the article ;)
What is the point of the internet?
Step 1: Turn on the Mac.
Step 2: There is no step 2!
Scoff if you want to, but I've never had to spend a couple hours trying to pry any malware out of my Macs-- but most of my billable time lately has been spent doing just that on clients' Windows boxes.
When Norton Antivirus, Spybot S&D, Ad-Aware and CoolWebShredder together aren't enough to delouse the average PC and keep it clean, IMHO it's just time to give up on Windows.
1. Put on oversized trench-coat
2. walk into the apple store
3. Insert Mac OS X into trench-coat
4. Walk calmly to your car
5. Drive home
Latewire
You're like 45 levels of trolling coolness below GNAA. You *should* be embarrassed.
lol. and your the first person who will be infected when mac osx is hit hard.
some of us like to know our system's are protected, and osx will one day get hit best be secure BEFORE that happens, not trying to bolt the door after the horses have escaped.
Right now -- Today, anti-virus software for Mac OS X is worthless. There are no viruses to check for on OS X for it to protect against. IF or when a virus or a worm comes out for OS X then anti-virus software will have a use. Until then, you are just wasting money.
Just like anti-virus software for Linux, it is the modern day snake oil.
seSales, Point of Sale software for OS X.
2. Install OpenBSD/macppc
Next on Neill's Slashdot Comments: How to secure Linux.
... can be found in this blog entry. ... I'll try and link to higher-modded comments to his post in comments on my blog. I think the more people cross-pollinate ideas about end-user operating system security, the better-off we could all be :)
Extraordinary Vacations. Exceptional Prices
Not quite true, particularly in a corporate setting. Let me state first off that I run OS X and don't have any anti-virus software, but I can see a use for it.
Chances are that the email you're sending is getting read on a Windows box. If you're forwarding along a mail containing an attachment, you might be unwittingly forwarding a Windows virus which is totally harmless to you, but not so to your recipient. I had one the other day - README.CPL. Mac users don't need to care that that's a Windows control panel, and might not even know. Your virus checker might not prevent you from catching non-existent viruses, but it will help you be nicer to the Windows-using world by catching anything you're sending out. Can also help with macro viruses I imagine, though I don't have MS Office on my machine so I can't be certain of that.
Cheers,
Ian
shut down, pull the plug and fill with concrete. wait for it to harden. machine secured.
Do anti-virus programs on the client scan email that you send out? I was under the impression they scanned files that were copied to the hard disk, it would have to be very closely integrated with the email software to scan incoming email, and frankly there are better enterprise products for scanning mail attachments on the server side anyway.
Not forwarding attachments that you don't recognise/need is common sense - why would you possibly forward an email like that??? So I think the grand-parent's point stands - until there is a virus in the wild for OS X, installing anti-virus software is not going to help anyone.
The only possible use I can see is to scan for word macro viruses which you might pass on to windows users, however there is another solution to that problem. Also, if they have anti-virus software (which they should have) it should pick that up.
The article gives a brief overview of SSH, explains AllowUsers, tunnelling, and recommmends disabling SSHv1. However, it misses other details. The most important is disabling root login (which is allowed by default) with: PermitRootLogin no and it would also have been nice to see them suggest changing the Ciphers list from the default, choosing SHA1 MACs, and giving a rundown of public-key-based authentication rather than merely sending readers onward to the OpenSSH website.
Can't you see that everyone is buying station wagons?
Sorry, but the Windows-using world can kiss my ass. I don't see how I should be expected to buy antivirus software for Mac OS X simply as a courtesy to Windows users with whom I may communicate. Frankly, as a longtime Mac user I'm fucking sick and tired of bending over backwards to accommodate Windows users, and not getting a fraction of that courtesy in return.
They should be running their own damned antivirus software so any file that I pass them gets checked/disinfected on their end.
If Windows users want me to run antivirus software on my Mac which does not need it, then they are more than welcome to buy it for me-- surely they can afford it, since they saved soooo much money by buying a Windows PC, right?
There is a very easy way to secure any operating system. Turn your computer off. Other than that, there will always be venurabilities, and while you do want to make sure that if you need the security, you have it, most people don't need it. I have no fear that some hacker is going to come in to my computer and steal all of my personal files. Besides, even if he did, so what? I have nothing of real importance that isn't backed up. If you need the security that badly, hire an IT team.
Got a problem? Call a monkey!
what makes you think that anit-virus software written for OS X will even be able to detect a windows virus lying dormant in a file. The code wont even execute on the processor. the anti-virus software is not going to have deffinitions for viruses that dont exist on the platform that the software was designed for.
"In America, first you get the sugar, then you get the power, then you get the women..." -H. Simpson
It does have definitions for them. As it stands, that is the entire purpose of OSX antiviral software.
Yes, they do have definitions for other platforms. Doesn't matter in the slightest what processor the virus was meant for, virus scanners don't check things are viruses by running the code, they do it by pattern recognition.
I have Clam anti-virus software running on a Linux server. It's happily catching Windows viruses all day long...
Cheers,
Ian
Yes, because we have anti-virus software that can see into the future, and protect against viruses that haven't been written yet.
There are no tiger attacks in my area and it's all because this rock I'm holding keeps the tigers away.
the anti-virus software is not going to have deffinitions for viruses that dont exist on the platform that the software was designed for.
That isn't true, I don't think. Virex on the Mac recognizes Windows virii signatures.
Tuus crepidae innexilis sunt.
As a paying .Mac member, I downloaded and installed McAfee Virex 7.2, and it's actually found a few viruses: Windows viruses in software installers backed up on my OS X fileserver! It also tripped across a really ancient Mac virus on a very old Zip disk from about five years ago, and since I've got a pretty healthy collection of old pre-G3 Macs, Virex has done it's job very nicely.
Learn from the mistakes of others. You won't live long enough to make them all yourself.
well, ill have to take your words for it for now. I have never seen Norton Anti virus catch a windows virus but maybe that is pure conicidence.
I never would have thought that anti-virus software would bother with viruses that dont effect the client machine. I do wonder how they can be sure that the patterns they are matching to dont have a legitimate use on the platform (like say, a datafile) and only happen to have the same binary values in the right places to also be a windows virus.
still... not much of an argument for running mac anti virus software, even in an office environment. you should realy be scanning for email viruses on the email server and never let it get down to the client. shelling out for anti-virus software for the mac and for windows seems like a waste when simply running the windows versions would cost less and be just as effective.
"In America, first you get the sugar, then you get the power, then you get the women..." -H. Simpson
I've learned my one thing for the day: an admin can control who can and who cannot execute the sudo command.
/etc/sudoers file by typing: sudo visudo Insert a hash (#) character, in front of the line
/usr/bin/kill, but only with the privileges of user tim. See the sudoers man page for more details on tightening access controls through sudo."
"Sudo
Since the root user is disabled, it is not possible to use the su command to obtain root privileges; instead, OS X makes use of the sudo program. By default Panther allows all administrative users access to the sudo command and it allows these users to run any program with sudo. In some circumstances, this may contravene system usage policies. In these cases, it is possible to disallow sudo access to the administrator group and instead, enable it on a per user basis.
From the terminal, edit the
%admin ALL=(ALL) ALL
To allow only the user 'bob' access to sudo add the line:
bob ALL = (ALL) ALL
Make sure that at least one user has permissions to run sudo before saving the file! Access controls within the sudoers file can be specified minutely, for example, it is possible to grant the user james access to the file
Who'da thunk?
d a v e
"Hmmm...upgrades."
virii isnt a real word
there is nothing healthy about having a collection of pre-G3 Macs..
not that I dont have one too... but its certainly not healthy.
"In America, first you get the sugar, then you get the power, then you get the women..." -H. Simpson
That's really funny, in a "who the hell thought that would be a good idea?" sort of way...
Most people just copy and paste the
[user list] ALL=(ALL) ALL form, without considering what limits can be imposed. Really, that's
[user list] [host list]=([run-as-user list]) [command list]
What is the robbing of a bank, compared to the founding of a bank? -- Bertolt Brecht
False positives are problems with all pattern matching systems, but it doesn't seem to come up that often. The anti-virus vendors seem to do a pretty good job of finding unique strings to match on.
It is possible for anti-virus software to detect unknown viruses by monitoring for suspicious activity. Several viruses for classic Mac OS were file infectors that attached themselves to an existing application on your machine. Thus, you don't need to have specific rules to catch these viruses, you simply monitor for and alert on attempts to write to files of type APPL.
End of Line.
"Dear Bob,
I received this attachment from a nice Nigerian man - he suggested I open it and put my credit card numbers in to the box that appears to register it. However, being a Mac user, I can't open it. Would you please do so, and put your credit card numbers in?
Thanks!"
Seriously? How many people forward emails with attachments that they can't open?
A new user entering the internet is like your first time using the communal prison showers.
Those with previous experience (Custom Linux installation) will know there's security options and will pick, for example, "buttcheeks=open" or "buttcheeks=closed" depending on what they plan to do.
The new users won't know there's an option until it's pointed out to them some time in the future.
MacOSX follows "recommended best practice" and starts you off with buttcheeks=closed, and if that ever becomes a problem, hopefully you'll look into it yourself and figure out which option needs changing to enhance your experience.
Windows apparently starts with buttcheeks=open, because they don't want to deny their users the full internet experience. Or something.
I thought the Catholic Church declared that "the Internet" didn't exist?
Seriously though, Windows bigots are funny. Maybe they're taking abreak from SpyBot S&D trolling for adbots?
While I admire your desire to be nice to the folks running Windows by not passing on infected messages...
Email anti-virus needs to be done by the server to be reliable. That way it doesn't matter who or where the infected message came from, if it has a virus it gets quarantined on the server, no bounce messages, just quarantined.
If someone was expecting something and it doesn't get through, you will hear about it and you can look into it to find that it has a virus and the sender needs to clean up their mess before it gets into your network.
The majority of the virus infected email I see in my quarantine is purely viral, I don't know that I have ever seen a "valid" email with a virus, but I tend to deal mostly with computer adept folks.
Goofy wording, but the guy has a point. Windows comes out of the box like a boat made of mesh, while OS X comes built like a warship. You can drill holes in the bootom of the warship if you want, but the mesh on Windows will take alot more effort to patch. :) Sorry for the goofy analogy, but that's the basic point. ....OpenBSD on the other hand is kind of like a Nuclear Missile Sub. ;) - just a thought.
Whether it's based on magic number-like signatures, or something like md5 hashes, or whatever, any way of recognizing a file, based on less than the full file for comparison, will always lose some information.
Note that this was clamav running on a knoppix boot disk, scanning a windows HD. It did detect a couple of legit bits of malware too.
What is the robbing of a bank, compared to the founding of a bank? -- Bertolt Brecht
If you were interested in this topic of discussion ...
n th er.txt.html
maybe this will appeal ?
http://packetstormsecurity.org/filedesc/applePa
My Virex found MS Office viruses hidden in ancient Word documents from the OS 7 era -- on an OS X computer. They were still able to damage Word X's menu layout. These viruses may originate on Windows, but affect both systems.
Incidentally, I posted this information some time back, and my post was branded "flamebait". Go figure...