NSA Security Guide for Mac OS X

An anonymous reader writes "The National Security Agency has just released a Security Configuration Guide for Apple Mac OS X (pdf). The guide mostly contains common sense configuration information that applies to many Unix systems. It also includes specific discussion for Apple's unique features such as Keychain and FileVault. It should be useful to most Mac OS X users and will be particularly useful for US Government organisations that use Mac OS X and for commercial IT Departments that are supporting Mac OS X. A range of other NSA Security Configuration guides for other operating systems, applications, and IT kit are also available."

Comments

YAFP

[Anonymous Coward]

Yup, yet another first post. Man, is this getting boring.

-DT

FU SLASHDOT

[krankykris]

no one cares. slashdot moderators suck!

Re:FU SLASHDOT

[Anonymous Coward]

Normally I wouldn't reply to this, but since you didn't post as Anonymous Coward I felt compelled to look at some of your other posts.

I can tell by reading what you've previously posted, that it's not the moderators that suck. You are very opinionated, which is fine, but you seem to think your opinion is actually fact.

You're either young, or you just never bothered to learn that everyone is different, and everyone sees things differently. For example, you don't like Open Office. Many people do, and many people like it more than the commercial alternatives. So when you post saying "Open Office sucks huge." You're not saying anything constructive. You're merely expressing an asinine immature emotion.

What would be constructive is if you openly looked at the other side of the argument, and actually considered it as being true, and took a step back and re-evaluated your own opionion for a moment. If you can't see the other side, or don't even bother to try, you're not really having a discussion, you're just having a pissing content. And after you can do that, you should then be able to express your opinion in terms of why's and how come's. Ie: Not just "Open Office's interface is st00pid#!!1" but "I dislike this feature of OO because of this reason, whereas MS Office does it this way and I feel that to be more efficient."

Truthfully, you just come across as an angry person with a chip on your shoulder. If you act like this in real life I expect you to have no friends, or atleast if you do have friends you've probably manipulated them into feeling bad for you. Really they only pity you. You need to grow up, and act like a man. Cliche, but true. Suck it up, and get over the fact that life is not perfect, nor is it what you want it to be (and it never will be). And that's okay. Life is life. No need to get mad about it.

Another hint for you is not to have your sig as "FUCK YOU SLASHDOT". The only explanation for that is a) you're a angry kid with a chip on his shoulder, or b) you want to modded down. Which makes sense in the context of a) since most people like that take derriviative forms of pleasure from making their plight's self-fulfulling. What a better way to scorn the world than to be certain the world scorns you?

My advice to you is grow up, get real, and quit being such a baby.

Note that this is posted anonymously because I _expect_ the moderators to mod it down. It is offtopic and should be modded accordingly.

Oh, one final thought. You complained about the moderators modding one of your comments as "Redundant." I remember reading that story (and its comments) and you probably posted that without even reading all the comments, because I remember reading a few others with similar (but much more well expressed) sentiments. Your post was most certainly redundant.

Re:FU SLASHDOT

[Anonymous Coward]

"You complained about the moderators modding one of your comments as "Redundant." I remember reading that story (and its comments) and you probably posted that without even reading all the comments, because I remember reading a few others with similar (but much more well expressed) sentiments. Your post was most certainly redundant."

I am not the grandparent....

Just yesterday I posted something that made it to +5 insightful, and was coincedentally the first post. Now its down to +2 after picking up a couple of redundant mods. How the fuck can a first post pick up a redundant mod?

I agree grandparent is childish, but I also agree the moderators smoke crack.

Re:FU SLASHDOT

[berbo]

I agree grandparent is childish, but I also agree the moderators smoke crack.

Not all of us - some of us prefer Guatemalan insanity peppers.

Re:FU SLASHDOT

[Anonymous Coward]

Depending on how the moderators have comment display set up, it might not be obvious which is the first post. This is no excuse for lame moderation, however. When I was still willing to moderate (and I got mod points, which last happened in April of 2003), I would read at -1, Threaded, Oldest first to get the proper view of things to moderate.

The redundant mode is a bit conflicted, in any case. To best serve the readers, all but the best of a series of similar posts would be marked redundant. To be fair to the posters, all but the first of the series should be marked as redundant (or any, say, outside a two or three minute window).

This is not offtopic, as far as I am concerned, because it pertains to the parent and contains constructive discussion on that subject. But I am posting anonymous due to the bumper crop of those Guatemalan insanity peppers. They seem to have been entirely reserved for Slashdot moderators.

Jurrasic Park on OS X

[AKAImBatman]

Lex: "It's a UNIX system! I know this!"

Re:Jurrasic Park on OS X

[Anonymous Coward]

jbanes@gmail.com
jbanes@gmail.com

first frickin' post

[Anonymous Coward]

first frickin' post!!!!!!!!!!!!!

New Government-Oriented Commercial?

[American AC in Paris]

(voiceover)

Step 45,328:

There is no step 45,328. There is no step 45,328...*soft weeping sounds*

Re:New Government-Oriented Commercial?

[krankykris]

hah this is funny. /. moderators have their heads up their ass.

Re:New Government-Oriented Commercial?

[Anonymous Coward]

I concur. The mods are on crack.

Re:New Government-Oriented Commercial?

[drinkypoo]

hah this is funny. /. moderators have their heads up their ass.

The problem is that moderators don't actually bother to follow the moderator guidelines. Another problem is that there is no real forum for discussing problems with moderation, so you have to do it in your journal or under a story, where it typically is moderated as offtopic of flamebait. I'm waging my own ineffectual little war against those moderators in metamoderation by marking any negative moderation of comments about failings of editors or moderators unfair, and I urge the rest of the slashdot readership to do the same. The most important thing you can do, of course, is metamoderate.

The other problem is that you can comment on a story, or you can moderate it, but not both; this guarantees that only people who have nothing interesting to say about a story are allowed to moderate it. In other words, the people best qualified to moderate are the people who aren't moderating the story. Proof-positive that something is rotten in slashdotville. The entire moderation system needs a major overhaul and I don't see it happening any time soon :P

Re:New Government-Oriented Commercial?

[ViolentGreen]

I'm waging my own ineffectual little war against those moderators in metamoderation by marking any negative moderation of comments about failings of editors or moderators unfair, and I urge the rest of the slashdot readership to do the same.

Isn't that just contributing to the problem? Complaints are off-topic as are many of the things that are modded as funny. Your little "war" is just punishing those who moderate properly instead of those who do not.

Re:New Government-Oriented Commercial?

[Anonymous Coward]

Since /. moderation is mostly useless or abused, I just read at -1. I skip through the trash and read what I like. Often enough, there are interesting threads with posts that never make it up to +1.

Re:New Government-Oriented Commercial?

[Anonymous Coward]

Nope. Guatemalan insanity peppers.

Re:New Government-Oriented Commercial?

[Anonymous Coward]

Hah, I was about to should MOD PARENT UP! but considering where this is...

Anyway, I do agree with my anonymous colleague: there is a lot of gems at 0, even modded down to -1 by gonzo driveby moderators.

What would be an idea is micromoderation: everyone gets to give -0.01 or 0.01 point to any article they want, then aggregate up.

Re:New Government-Oriented Commercial?

[johndiii]

Mark "Not willing to moderate" in your user profile. The current system cannot be fixed. The fewer people that moderate, the weirder the moderation will become, and the more work the editors will have to do to keep the site even at its current level of marginal sanity. Incentive to change, which they will not have as long as they are able to patch the current moderation system with band-aid type fixes.

Re:New Government-Oriented Commercial?

[drinkypoo]

The moderation FAQ clearly says to focus on positive moderation. People who negatively moderate things instead of focusing on positive moderation are not only wasting their moderation, but they're wasting their time.

Steps

[strictfoo]

1. Uninstall
2. Install OpenBSD
3. Cry because pretty hardware doesn't increase perfomance or productivity
4. Have a sex change

Re:Steps

[Anonymous Coward]

you offcourse forgot: ...
5. Profit

What about...

[Staos]

I tell you one interesting thing. While it was working back in 2003, I updated a 68030 Mac Duo laptop 7.6's modem driver from Apple site. I even had support about how to add more ram. That machine is back from 1994 or something.

OS X updates aren't service packs, they are new OS'es. 10.3.0 is a new OS , 10.3.1 is a service pack.

About antivirus and anti adware? As its a BSD based real OS, its run by rights. As its a pain in the ass to code a spyware on linux, its much more harder on OS X. Guess why? OS X shows a user friendly window which is centralized by OS GUI whenever a program needs administrative access.

Oh there is a program on OS X, comes with it and has a unsolved security problem. Yes, it still exists. Guess what is it? INTERNET EXPLORER macintosh edition.

Re:What about...

[0racle]

I don't see how simply having a centralized 'This app needs Admin access' form makes it any harder to write malware for a system, any app could trigger that function and make the request. Windows also has a single Ask for Admin form, all you have to do to trigger it is name an application setup.exe and it will ask if you want to run it as Administrator or not and I'm sure thats not the only way.

Malware is hard to code on Linux and *BSD not because of some standard or non-standard way of asking for access, but because of years of very intelligent people asking themselves how can we safely do that. OS X's polished GUI functions are over and above that to present the nice base OS in a non-threatening way.

Re:What about...

[Englabenny]

Fortunately internet explorer is discontinued

Re:What about...

[evilviper]

As its a pain in the ass to code a spyware on linux, its much more harder on OS X. Guess why? OS X shows a user friendly window which is centralized by OS GUI whenever a program needs administrative access.

That would make it EASIER to spread worms/viruses than a normal Unix system, NOT harder. In Unix, attempts to access resources you don't have permissions to, just fail. If it pops up a window that says "would you like to give this program access" then you're just as screwed as the rest of the world... That's because people are stupid and click yes without knowing what they're doing. If it's piggybacking on some other installation (browser plug-ins or other 'gee wiz' features) then users wouldn't have the slightest reason to suspect anything.

Note, though, that this is only for viruses/worms, because spyware doesn't need root access to do it's job. It can spy on you in user-land just fine. It can change your browser proxy settings without root access, and pop-up ads from competing sites without root access. Am I missing any annoying features?

Re:What about...

[Anonymous Coward]

Not sure if this would make it more secure for the OS challenged, but when it asks for administrative permission it asks for a password. If an office admin wants to keep the OS X's in the office secure, just don't give the secretaries the password for their computers. If they need to do anything which requires the password, they have to ask the computer guy and he can say, "So why do you need to see nude pictures of Brad Pitt again?"

Re:What about...

[evilviper]

Not sure if this would make it more secure for the OS challenged, but when it asks for administrative permission it asks for a password.

Assuming a home machine, the "OS challenged" individual will have that info anyhow, so no big deal at all.

What are you thinking? That all other OSes just give you an OKAY button and don't ask for a password to get Admin rights? No, of course not. You always need the password.

If an office admin wants to keep the OS X's in the office secure, just don't give the secretaries the password for their computers.

Yes, but how is that any different, or better than Unix (specifically) or Windows?

Unix essentially won't let it be installed at all, even if you know the password... You have to go through the steps of su'ing or otherwise logging in as root, then manually executing the downloaded program. That big step is what keeps trojans away.

Windows does it the same way OS X does, prompting for the admin password.

If they need to do anything which requires the password, they have to ask the computer guy and he can say, "So why do you need to see nude pictures of Brad Pitt again?"

Yes, congratulations for getting modded up on this banal comment, reiterating the 40-year idea which has formed the basis for all of the computer security world. I can't imagine how you did it.

Re:What about...

[n8_f]

In Unix, attempts to access resources you don't have permissions to, just fail. If it pops up a window that says "would you like to give this program access" then you're just as screwed as the rest of the world...

So your position is that it would be safer if it just ran without a security dialog? You might want to rethink that. Only people with admin rights get the security dialog. In your example, the code would just run on a "normal Unix system" without double-checking with the admin. Sounds less safe to me. You can't protect computers from their owners.

Re:What about...

[r2q2]

I agree, I was running 10.1 and then upgraded to 10.3. There is a whole user interface redo, support for rendevous, a journaling file system much better support for unix, an x windowing system, ipv6 support expose and a host of other reasons why that was a good upgrade. Although I didn't pay full price for it it was one of the best upgrades and I believe I got my moneys worth.

Re:What about...

[evilviper]

Only people with admin rights get the security dialog.

That part was not mentioned. However, it is not a good practice to do much of anything as an administrator, so I have to wonder if this is of any use, anyhow.

Incidentally, this same feature could easily be implimented by anyone using systrace.

Re:What about...

[Yaztromo]

I don't see how simply having a centralized 'This app needs Admin access' form makes it any harder to write malware for a system, any app could trigger that function and make the request.

It is my understanding that on OS X, the authorization dialog pops up because a request to a protected reqource/API has been made, as opposed to an application being able to just randomly tell the OS to pop up an authorization dialog.

The dialog itself always displays the name (and if available icon) of the application making the request, as well as the name of the right being requested. As this is put together only by the OS, you can't substitute one right name when you really want to do something different. And getting one right doesn't automatically permit a process to use any other right on the system -- each right needs authorization.

It's actually quite a good system, and has been very well thought out. It does, of course, rely on some vigilence by the end user -- if they're entering their password anytime it's being requested without quickly checking to see what is making the request and why, obviously they're going to get into trouble.

Then again, if I e-mail a bunch of Linux admins and ask them for their passwords, and they send them to me, you wind up with the same end result.

Yaz.

Re:What about...

[HeghmoH]

It's not quite as initially described.

The authentication dialog only appears if it's explicitly requested by an application. If an application tries to access a resource that it doesn't have permission for, it fails just like on any other UNIX. The application can then, if it desires, ask the OS to pop up this authentication dialog. It's actually fairly limited; the process doesn't get changed permissions at all, but it is allowed to run a subprocess as root. Of course there is nothing that prevents a spyware author from making this dialog appear, other than the fact that the API is incredibly convoluted and weird, and using that to gain control of the system.

All in all, I think that this mechanism is a useful mechanism that keeps things fairly secure, although I fear that Mac users are getting too used to simply typing their password into the box whenever it appears without thinking about what's making it show up.

Re:What about...

[Durandal64]

What are you thinking? That all other OSes just give you an OKAY button and don't ask for a password to get Admin rights? No, of course not. You always need the password.

Not quite. Administrators on Mac OS X and Windows are different things. On Mac OS X, an administrator is a user who is allowed to temporarily acquire root privileges through a sudo action. To get these privileges, the user must enter his password. So, if I want to install a program that needs to write files to /Library or anywhere that isn't /Applications (the admin group has full access to the /Applications directory) or my home directory, I need to enter my password. If I choose, I can require authentication for "secure" system preferences, like the login preferences.

On Windows, if you are logged in as an administrator (not the Administrator account), your account will automatically authenticate during program installations and such, hence why you can make changes to the system settings and install programs without ever being challenged for a password. That is what makes the Windows way of doing things inherently more risky. You don't need to enter your password for administrator actions.

Re:What about...

[Carnildo]

That part was not mentioned. However, it is not a good practice to do much of anything as an administrator, so I have to wonder if this is of any use, anyhow.

On MacOSX, running as an administrator is not the same as running as "root". On MacOSX, running as an "administrator" is more-or-less equivalent to having "sudo" privileges on a Unix box: entering your password in a security box permits you to do certain administrator-type operations for a limited period.

Re:What about...

[evilviper]

On Mac OS X, an administrator is a user who is allowed to temporarily acquire root privileges through a sudo action.

In other words, an OS X admin is not an admin at all. Just a "power user". So, having an Admin account on OS X is NO MORE (or less) SECURE than a Power User accont on Windows.

Saying that OS X is more secure because what is CALLED an administrator, is really an OPERATOR or POWER USER, is absolutely crap.

I've had my fill of Mac idiots on this thread alone. Not only am I not going to buy a Mac, I feel dirty just having used them in the past...

Re:What about...

[evilviper]

On MacOSX, running as an "administrator" is more-or-less equivalent to having "sudo" privileges on a Unix box

So I have learned, quite recently.

That just makes the argument for OS X weaker. It's no more secure, it just happens to have assigned the name "Administrator" to a non-administrator account, the equivalent of "Power Users" on Windows.

Re:What about...

[Anonymous Coward]

>Not only am I not going to buy a Mac, I feel dirty just having used them in the past...

that's a stupid comment dude.

Re:What about...

[Anonymous Coward]

except that a power user on windows doesn't need to retype their password to delete a system file. A sudoer typically does.

That said, Windows really does have a very rich access mechanism. You can actually allow a person to have admin capabilities without the ability to read files in a person's home directory. You can also restrict priveledges to specific functions on a COM interface if you wanted. Unix doesn't have an analog of that level of granularity. It's a pity nobody configures windows to be secure (ok, it's also a pity that windows is so broken that the authentication mechanisms can be bypassed by forging the HWND of a priveledged process and sending messages to do whatever-the-fuck you please...)

Re:What about...

[n8_f]

Umm, no. First, you didn't even have a grasp of the subject you were arguing about. It hardly makes the argument for OS X security weaker because you didn't know how it works.

Second, it is different from Windows. I have never had to enter a password in Windows after logging in. I have admin rights, as does all of the code I run. Period. OS X at least tries for least privilege, only giving you admin rights when you verify you need them.

It is not a good practice to do much of anything as an administrator.

So what is your solution? Have a separate administrator account? So, instead of entering their password, users have to quick-user switch to the only admin account, run whatever they were trying to run, and then enter their password. Great. They still did exactly what they were going to do, but now they are justifiably pissed off at you for your crappy design.

It's no more secure, it just happens to have assigned the name "Administrator" to a non-administrator account.

WTF? How is it not an administrator account? It is part of the admin group. It just isn't root.

Re:What about...

[jx100]

what about the possibility of an app making its own box that looks exactly like the OS box?

I guess more attention on the part of the user is needed, but then the user must also know that an app shouldn't need higher-level access even when it says it does.

Re:What about...

[Anonymous Coward]

You obviously don't know what you are talking about. Only admin users can gain the super user status required to perform installs or other protected actions. And all such actions are logged (by default) so that there is a record of which admin did what and when. Just becase you also have to tell the computer that you really want to do something that has unrestricted access to the system does not mean that it is in any way similar to a Windows "Power User".

You need to get out in the rest of the computer world a little more and see that the Windows way is not the only way. In this example, everyone else does it the Mac/UNIX way and Windows is the odd man out. This is precisely because it is a safer way to do things.

Re:What about...

[Anonymous Coward]

We don't want you buying a Mac either. Please. Stick to Windows. The world will be a far better place.

Re:What about...

[artMonster]

What to install, best advice in there... "Internet Explorer - No. Internet Explorer (IE) for the Mac OS is no longer being developed, and while support is available now, future security updates are not guaranteed and may not be timely. If IE is operationally required, caution should be used. It is recommended that IE not be used."

Re:What about...

[evilviper]

I have never had to enter a password in Windows after logging in. I have admin rights, as does all of the code I run.

Clearly, you don't even have a grasp of the subject you are arguing about. It hardly makes the argument for Windows security weaker because you don't know how it works.

You clearly aren't paying attention. What Mac OS X calls the "Administrator" is the equivalent of a "Power User" on Windows 2000/XP. It will prompt you if you wish to install a program with Administrator privlidges.

The fact that what OS X calls "Administrator" is really "Power User" does not make OS X any more secure.

So what is your solution?

The solution is to run as a "Power User", not Administrator.

They still did exactly what they were going to do, but now they are justifiably pissed off at you for your crappy design.

That's blatantly untrue. If you have to log-in as a different user, you aren't susceptable to viruses/worms installed via your web browser. If you download a program, and want to install it, that's a completely different matter. But you still can't say it's every bit as secure. You can say it's more convient, but convenience often comes at the expense of security.

How is it not an administrator account? It is part of the admin group.

I could create an "Admin" group on my Unix system if you want. It'll have no privlidges, so no possiblity of compromising my system... Does that make my system more secure than OS X? No, of course not, because the name "Admin" is arbitrarily chosen, and means nothing. If the account does not have root-level permissions, it's not an admin account.

As I said, it's almost the exact equivalent of "Power Users" on Windows. That is NOT an admin account. It's more of an operators group, where you can GET Admin privlidges when you need it. I'm not saying it's a bad idea to do, but it is not an admin account, and comparing it with the Windows Administrator account is disingenuous.

Re:What about...

[evilviper]

You obviously don't know what you are talking about. Only admin users can gain the super user status required to perform installs or other protected actions.

You obviously don't know what you are talking about. Only Power Users can gain the super user status required to perform installs or other protected actions.

Just becase you also have to tell the computer that you really want to do something that has unrestricted access to the system does not mean that it is in any way similar to a Windows "Power User".

No, it's not in any way similar... It's fucking identical.

You need to get out in the rest of the computer world a little more and see that the Windows way is not the only way.

I haven't used Windows in years. I'm purely a BSD/Linux user, and have been for years.

Clearly, Mac users are all complete morons.

Re:What about...

[Anonymous Coward]

It stroke me as very unusual that unlike most anti-Mac trolls, you don't seem to be very ignorant about how MacOS X works. On the contrary, you seem to be ignorant about how Windows works.

Of course, I understood what's happening when I read this line:

I haven't used Windows in years. I'm purely a BSD/Linux user, and have been for years.

OK, let me point you to Microsoft's own site:

http://www.microsoft.com/technet/prodtechnol/windo ws2000serv/maintain/security/secdefs.mspx

In particular this part:

Power Users are ranked between Administrators and Users in terms of system access. The default Windows 2000 security settings for Power Users are backward-compatible with the default security settings for Users in the Windows NT® 4.0 operating system. In short, Power Users are indeed powerful.

Ideally, Power Users should be able to perform any task except for the administrative tasks described above. Thus, Power Users should be able to:

Install and remove applications per computer that do not install system services.

Customize system-wide resources (for example, System Time, Display Settings, Shares, Power Configuration, Printers, and so forth).

Power Users are not allowed to access other users' data stored on an NTFS partition.

In practice, Power Users cannot install many legacy applications, because these applications attempt to replace operating system files during the setup process.

So basically a Power User can do over 90% of what an Administrator can do. But not everything. BSD users and most Linux users are usually quite smart... what happened to you?

Re:What about...

[evilviper]

It stroke me as very unusual that unlike most anti-Mac trolls[...]

Fact of the matter is, I wasn't an anti-Mac troll until this thread... Go through my comment history before now, and you won't see anything against Apple/Mac.

So basically a Power User can do over 90% of what an Administrator can do. But not everything.

That's absolutely not true. This list is obviously grossly over-simplified.

I've used Windows 2000 extensively, and I can guarantee you, when you try to install something like a Service Pack, it will prompt you for the Administrator password.

Here, let's have Microsoft explain it to you, since you're convinced I know nothing of Windows: http://www.microsoft.com/windows2000/techinfo/plan ning/management/seclogon.asp

That article is a bit long-winded, because it talks about all the different ways you can use it. It doesn't really make it clear you that you don't have to do any of this to use the feature... Just try to install something, and the dialog box will pop-up, asking if you want to run as admin, and prompting for a password.

Re:What about...

[Anonymous Coward]

evilviper:

The thread started as a rather civilized discussion where people with diverging opinions expressed them. But two posts after people disagreed with you, you exploded in a I've had my fill of Mac idiots on this thread alone. Not only am I not going to buy a Mac, I feel dirty just having used them in the past... rant.

Even if you were right (more on that in a moment) you started to be seen as a troll, and the modding reflects this (you were not modded down before the rant).

Ok, now that you have decided to come back to a civil tone, I will take my time to give you an answer. I only wrote the last answer, the one that cites Microsoft, and I'm not responsible for what was said before (although I agree with most of it).

My response was to this part of your post:

Just becase you also have to tell the computer that you really want to do something that has unrestricted access to the system does not mean that it is in any way similar to a Windows "Power User".

No, it's not in any way similar... It's fucking identical.

My point is that a MacOS X administrator (or a sudoer in other unixes) is different from a Power User. A Windows administrator can do whatever he pleases, just a Unix root. That's very unsecure. A sudoer (or MacOS admin) has to enter his password (thus confirming that it's him, and not a worm or virus acting).

A Windows Power User can do many things, but not everything. In order to do the rest of the things, he must use the "secondary logon" features you link to, or in some cases a login/password pop up appears prompting you to log as a administrator (as you say).

So what is the difference between a sudoer / MacOS X admin and a Power User? The former are administrators by themeselves, they authenticate with their own passwords to gain administrative privileges. The latter must become a different user, and that other user has the admin privs.

When does that difference become important? When you want to have several users administrating a machine. In windows you must either have one "administrator" and share the password with the other users, or create both a power user and an administrator user for each one of the special users.

The first choice is regarded as insecure by some people (many people sharing and using a "secret" password usually turns it into a public one); also, it's hard to track who did what.

The second choice gives you more accountability on each users actions, but is an administrative burden as each user must keep up with two separate identities. It's kind of schizophrenic.

My point is: it's not "fucking identical". It's different and in my opinion the MacOS X / sudoer way is much better. Even if I'm wrong you don't have to call me a moron.

By the way, great sig. I wish I had seen it a few weeks ago to point some people to the link. Very informative.

Re:What about...

[Durandal64]

In other words, an OS X admin is not an admin at all. Just a "power user". So, having an Admin account on OS X is NO MORE (or less) SECURE than a Power User accont on Windows.

No, retard. A power user cannot modify anything he pleases. An admin in Mac OS X can, provided he authenticates. A power user cannot temporarily assume administrator rights the way a Mac OS X administrator can. In other words, if a power user wants to do something he's not normally allowed to do, he needs to switch to an administrator account. That account has a different username, different password, and the power user will not be logged as performing the action. Mac OS X administrators can do anything they want, provided they authenticate.

Saying that OS X is more secure because what is CALLED an administrator, is really an OPERATOR or POWER USER, is absolutely crap.

It's more secure because, even as the highest-ranked user on the system, you must authenticate to perform installs. I explained this in my previous post, which you obviously ignored.

Re:What about...

[evilviper]

A power user cannot temporarily assume administrator rights the way a Mac OS X administrator can.

This is just flatly and totally WRONG. A power user can do exactly that.

It's more secure because, even as the highest-ranked user on the system, you must authenticate to perform installs.

It's bullshit security. If I delete the Root account on my Unix box, it doesn't make Unix suddenly more secure. It's just bullshit. The fact that Windows ALLOWS you to log-in as a true administrator, doesn't make it any less secure, though it does allow someone stupid to use the OS in a less secure way.

I explained this in my previous post, which you obviously ignored.

No, I addressed it. The fact is that YOU are the one ignoring what I explained in my post.

Re:What about...

[Durandal64]

This is just flatly and totally WRONG. A power user can do exactly that.

No, they cannot. According to this, power users can:

• Create local user accounts
• Modify user accounts which they have created
• Change user permissions on users, power users, and guests
• Install and run applications that do not affect the operating system
• Customize settings and resources on the Control Panel, such as Printers, Date/Time, and Power Options
• Do anything a User can

Power users cannot:

• Access other users' data without permission
• Delete or modify user accounts they did not create

In other words, power users cannot do everything an administrator in Mac OS X can. Mac OS X administrators can modify other users' data by entering their password. If a power user, for example, wants to install software which modifies the operating system, he must enter an administrator's username and password. That means that the administrator whose username and password he entered is the one who was logged as performing the action, not the power user himself.

Any user can enter an administrator's username and password to do things they normally could not do in Windows. That does not mean that all Windows users are Power Users. Do you see the distinction yet?

It's bullshit security. If I delete the Root account on my Unix box, it doesn't make Unix suddenly more secure. It's just bullshit.

Yes, everything you don't understand is bullshit. We know. But the fact that there is no root account on a Mac OS X box means that there is one less account with a password to crack. That's why administrators don't create any more accounts on a system than necessary, because the less active accounts you have on a box, the more secure that box is. And if you're seriously going to argue that not having a super-user account on a machine that doesn't need one makes no difference in security, you're simply delusional.

The use of the sudoer system on Mac OS X also makes accountability far easier. When an administrator in Mac OS X performs an action, as opposed to logging in as root to perform an action, that administrator's name is attached to the action, much like Windows administrators. However, Windows also activates a super-user-esque account by default, when the box doesn't really need such an account. That makes it less secure.

The fact that Windows ALLOWS you to log-in as a true administrator, doesn't make it any less secure, though it does allow someone stupid to use the OS in a less secure way.

Any feature in an operating system that could be used to facilitate the compromising of a system can be said to lessen that system's security. The trick is knowing which of these features are necessary to include and striking a balance between usability and security. Having a super-powerful administrator account on your system when regular administrators can already do everything they need to is needless and reduces security.

Lack of safety in numbers

[YetAnotherName]

Given how entrenched Micro$oft's clutches are into the US Government, a security guide for Windows based systems would be even more useful.

(I work for NASA; almost everyone in our group has Mac OS X on our desktops and Linux in the server room. Our supervisor is the only Windows user. Yes, he's developing pointy hair.)

Re:Lack of safety in numbers

[Scutter]

How about this? There are several linked off that NSA page besides this one.

Re:Lack of safety in numbers

[Anonymous Coward]

You should check out the sight such guides have been available for years. See Mac users are thick twats

Re:Lack of safety in numbers

[lachlan76]

Had you not brought down the NSA website, you would find them here.

Re:Lack of safety in numbers

[hbackert]

Did you click on the second link in the story? There's a lot for Windows See under "Operating Systems".

Given the fact that I don't use MacOSX, I checked out the Cisco one some time ago and it's quite impressive. Lots of common sense things of course, but some good ideas I would have otherwise not thought about. Definitely recommended.

It's nice to see government agencies not waste our (sorry: your) tax dollars and instead produce something useful and not hiding it in one of their many shelfs.

Re:Lack of safety in numbers

[Andr0s]

A security guide for Windows-based systems ?

Talk about an exercise in futility. I'd put that book right next to Understanding Republican Mindset, Philosophical Debates of Military Intelligence and Filanthropy of Modern Man

Re:Lack of safety in numbers

[general_re]

Filanthropy of Modern Man

I'll put it alongside my copy of Speling Fer Slahsdooters.

Re:Lack of safety in numbers

[Andr0s]

Eh... not all of us in the world are native english speakers. Still, I trust my english spelling & grammar beats your croatian, eh?

Re:Lack of safety in numbers

[CrackedButter]

Yuu cant' nock him four spelling such a werd like phat, knot when their arr werse ofendeers on teh internet. Its' the simmple werds phat anoy me moore, eveybody shold no comon engrish.

Re:Lack of safety in numbers

[general_re]

Just thinking of further exercises in futility ;)

Re:Lack of safety in numbers

[buzban]

It's nice to see government agencies not waste our (sorry: your) tax dollars and instead produce something useful and not hiding it in one of their many shelfs.

I agree that useful government work in this area is great, and i don't mean to assail this poster....but getting things even further out there (i.e., not on a somewhat-obscure sehlf, but somewhere where my clueless, windows-using family would find it.). Wonder if there's a better way that NSA could promote this stuff so that everyday (non-power-) users would find it?

Re:Lack of safety in numbers

[Anonymous Coward]

More like "Understanding the Democrat Mindset"...

You sound like a typical liberal wanker who wouldn't last a day in the military...

Re:Lack of safety in numbers

[Bequita]

"Given how entrenched Micro$oft's clutches are into the US Government, a security guide for Windows based systems would be even more useful. "

But virtually impossible.

Re:Lack of safety in numbers

[skiman1979]

Did you read the summary of this article? There is a link at the bottom that shows there are NSA security guides for other operating systems as well.

Re:Lack of safety in numbers

[anothergene]

It's nice to see government agencies not waste our (sorry: your) tax dollars and instead produce something useful and not hiding it in one of their many shelfs.

I'll give it a read while I'm sitting on my $900 toilet seat.

Re:Lack of safety in numbers

[quarkscat]

Isn't that peculiar. I worked for NASA (as a
contractor) for nearly five years, and the only
Mac OS X that I saw was a manager's G.I. laptop
(as a personal preference). Everything else
was NT4 workstations migrating to 2K (and
staying well away from XP). The back-end
servers were all 2K or 2K3, not *nix, let
alone linux. The raw telemetry and spacecraft
(HST) data were all processed on a mix of *nix
platforms -- HP-UX, SGI, and SUN. The contractor
was scrambling to migrate these to SUN, and scrap
the (VME-bus) HP-UX and the SGI's. One of the
reasons I left (besides end of contract) was
the prospect of working nearly exclusively on
Micro$oft boxes.

I guess it really depends upon which NASA project
you're on as to what the IT "pointy heads" select
for their platform of choice.

These things make a nice checklist, but....

[general_re]

....actually implementing everything the NSA recommends in its guides will get you a system that is both highly secure and exceptionally inconvenient for its users. It's a useful reference, to see if you've forgotten anything that you particularly want, or anything obvious, but as always, individual admins will have to decide for themselves where they want their systems to lie on the security-usability axis...

Re:These things make a nice checklist, but....

[siriuskase]

If your sig is to be believed, you are not qualified to advise on the usefulness of this guide.

Re:These things make a nice checklist, but....

[general_re]

Fair enough - I haven't read the OSX version, but I have read the Windows and Solaris guides, so maybe you can settle for extrapolation instead of investigation ;)

You Bastards!

[Anonymous Coward]

Hmm the pdf is downloading at .6 k/s and dropping. Slashdotting the NSA - this qualifies for some sort of Darwin award, doesn't it? :)

Re:You Bastards!

[datadriven]

... Or maybe it's a violation of the patriot act.

Re:You Bastards!

[Tibor the Hun]

yeah very funny.
those punks probably now think that it was a coordinated cyber-attempt to disrupt the election, and now they've got all of our IPs.

Re:You Bastards!

[JamesTRexx]

Always ready to help with foreign support. *clicks furiously on the links from his place in The Netherlands*

Re:You Bastards!

[Anonymous Coward]

Here's a mirror.

Re:You Bastards!

[Goalie_Ca]

I think it qualifies as terrorism.

Re:You Bastards!

[Anonymous Coward]

ty

File Vault

[dumitrius]

This is simply the encryption of the entire user's home directory. I had this enabled on my powerbook stuffed it with a few gigs of data and it ran fine for a while... maybe like 3 months. Then one day on a reboot the thing silently lost all my personal settings and dropped me into a stock desktop configuration. Was nursing this for a week or two when I started getting garbage in some source files. Was thinking maybe the hardrive was defective but have a hunch the enctyption just went haywire and was getting worse. Turning File Vault off failed with an error. Have reinstalled the os keeping a plain text home dir and things seem dandy.

Has anyone seen this before?

Re:File Vault

[MagneticMountain]

I have never seen it personally but I have heard stories on the Mac forums and other places of things like this happening.

I would really love to use Filevault, but I guess you could say I'm just a little scared to turn it on after I have heard stories like yours about how people have had Filevault go haywire and lose their data.

Re:File Vault

[eyegor]

It happened to me too.... I managed to get everything back though. There was a sparse diskimage file that contained my home directory. Once I mounted it, everything returned to normal.

Your milage may vary.

Re:File Vault

[Numeric]

I used FileVault and I was impressed that I was getting such a huge performance hit on my 600mhz ibook, however, one day I rec'd an odd error regarding FileVault. I cautiously decided to play it safe and turn off FileVault.

Re:File Vault

[dema]

Happened to my boss less than a month ago. Spent a long time trying to recover of lot of his shit (some very important files) and had no luck. Long sotry short, no one at work uses filt vault now (: Maybe this is something that will improve in Tiger?

Re:File Vault

[Anonymous Coward]

I had a File Vault eaten when I first installed 10.3 but since some of their updates to it I have been able to use File Vault pretty well when I have tried it. I don't trust it with anything important though so I don't use it on my adminstartor account or on my work account, which is kind of sad. I prefer to use Encrypted DMG files to store stuff I want private but that I only need occasional access to.

Re:File Vault

[Anonymous Coward]

Many people had problems with it first came out. It was caused by the "recovering space" thing not completing before the user logged in again. I still don't trust Apple's default configuration since there are warnings in their own documentation against using a sparse image, which File Vault does.

I've used this hint for over six months now without problem.

On the other hand, it's trivial to get the user's password from swap, unless Apple fixed this hole already, so there's not much point to File Vault right now.

Re:File Vault

[twalls]

That's really sad, man. I had that happen and it scared the crap out of me (I've got a 15GB home directory). One day I logged in and it just sort of stared blankly at me with all the defaults. I blinked, told myself I was having a very bad dream, and logged off. When I logged back in, everything was fine and I breathed a huge sigh of relief! I guess I was one of the "lucky" ones. I keep using it and I haven't had any more issues... yet.

Re:File Vault

[a3217055]

what you can get the passwd from swap ?? Can you please explain ?

Re:File Vault

[Matey-O]

think they coulda named it something better than 'sparse diskimage'? I blew away all my settings (yeah, boo hoo, won't do THAT again) cause the diskimage was roughly the size of the two huge AVI's I just threw away and I wasn't getting my diskspace back after emptying the trashcan.

Name it something like 'Secret Encrypted File' or something...

Re:File Vault

[Daengbo]

I don't trust it with anything important though

Kind of defeats the purpose, doesn't it?

Re:File Vault

[Anonymous Coward]

I don't trust it with anything important

Read: I keep pr0n in it, but only the second rate stuff that I plan to delete first when my hdd fills up.

Re:File Vault

[suprax]

Ditto here. Just last week I turned on FireVault and let it runs its course for like 15 minutes. Finally it said reboot but the screen was frozen. Upon rebooting the user could log in but nothing would load at all. It pretty much straight up broke. Luckily I was able to go into single user mode, and could ftp all my data off the machine before reinstalling.

No more FileVault for me. And this was Tiger (yes I know, its not even beta software but I like to test).

Re:File Vault

[ViolentGreen]

Definitely. It's not immediately obvious what it is. I have had several problems with the encryption (though it's been about 9 months since I last used it.) I figure it's not worth my trouble. My powerbook stays at home most of the time and there's nothing especially sensitive on it.

Re:File Vault

[anothergene]

I've had that problem occasionally. Logged out and logged in again all was well. I'm guessing something went funny with the mounting process during log on.

10.3.0 had some issue with corrupting user setting and files, but they were fixed with 10.3.1. Probably wouldn't be a bad idea to disable it and re-enable it once in a while just to get a fresh sparse image. I've read they do have issues when they grow to twice their original size.

Just another good excuse to back up the data inside it or at the very least back up the sparse image itself as part of your regular process.

Re:File Vault

[keg]

Same thing happened on my G5.

Found this on macfixit, http://www.macfixit.com/staticpages/index.php?page =20031110093417286

Re:File Vault

[cosmic_0x526179]

Lets just rename it Vile Fault...

(with appol to the Mouseketeer, who in 1984 coined the name VileFision... what happened to him anyway ?)

Re:File Vault

[allgood2]

I've never been a fan of encrypting my entire home directory. I just use Disk Utility to create encrypted disk images for data I want secure. I don't keep a lot of them, but I have about four or five, one for financial data, a couple for projects that have government or HIPAA related data, and some really personal stuff.

This works well, plus the files get backed up, so if the home directory got corrupted or wiped, I can retrieve everything.

Re:File Vault

[Anonymous Coward]

Kernel encryption schemes for other OS's, and userland encryption schemes need to either have the password (when used as the key), key, or hash of the key in memory while decrypting and encrypting. A security compromise is possible when the OS moves the key from memory to swap; then, the key can be read from the hard drive even after a reboot (or inspection of the hard drive by placing the hard drive in another machine, or booting from a LiveCD). (On any OS, if a user has the privileges to view all of RAM, then, that is also a compromise.)

There are two methods of preventing leaking the key to swap in a compromising way.
1) Have a feature to disallow parts of memory to be swapped, and use that feature when allocating memory for the key. (This is not always reliable. *NIX systems usually implement this through a protected mmap() call, mlock(), in libc; reading GnuPG mail archives, older versions of Mac OS X seem to not have this implemented.)
2) Encrypt the swap file/partition. (This inccurs a performance hit. On OS X, users already report problems using iMovie with FileVault; certain Linux implementations, e.g. loop-AES and dm-crypt, inccur less of a performance penalty.)

Re:File Vault

[hkb]

Was a notorious bug that really pissed me off as I lost all my files and of course, didn't have a backup. It was fixed several OS revisions ago and I've been using it for at least 8 months or so. Seems to work flawlessly, haven't had any corruption yet. I do A TON of writes with this File Vaulted account. No problems at all since the fix.

Re:File Vault

[dumitrius]

I doubt it's been fixed properly. Keep in mind this happened between July and September 2004 and the OS was patched to the latest version the entire time.

Re:File Vault

[tji]

I didn't use the default File Vault, which encrypts your whole home dir.. I thought the performance hit could be problematic on things like huge iMovie/iDVD projects.

Instead, I used the Disk Utility to create an encrypted sparse diskimage. It's basically the same thing as File Vault, but you selectively put what you want into this other mounted volume. It has worked well for me. I've had no problems after using it for about a year.

The only hassle I have had is that I need to manually mount my "Secured" volume whenever I log in. Since I have some files soft linked into the secured volume, it can cause problems if I forget. There is probably some way to automatically mount it when I log in, but I have not found it yet.

Re:File Vault

[Anonymous Coward]

I haven't managed to get the pdf yet. Any mention of the NSA ADK built into the FileVault/AES disk image encryption? (Come on, you all know it's there, right?)

1. [Duck from black helecopters. Readjust tinfoil hat.]

Re:File Vault

[Anonymous Coward]

Update: Not one minute after posting the parent, an honest-to god black helecopter buzzed within a block of my high-rise window. It continues to circle. Damn. Should have used a proxy server.

Either that, or it's because of the swing-state republican rally scheduled nearby. We'll see.

Re:File Vault

[ConsumedByTV]

Loop-aes isn't vulnerable to this because it can be used to encrypt swap in a way that's not *as* vulnerable to encryption implementation attacks.

Unless you can encrypt your swap, mlock() and other attempts to secure it, cannot work 100% of the time.

It's also worth noting that this is basically a must have part of any disk crypto stuff. loop-aes does this and it talks about this quite extensively. It hasn't been implemented by apple yet but I heard that tiger may have a fix for it.

What makes me worried is that it seems since it's passphrased based (and the passphrase is whats in the swap file) it's not hashing the password with any sort of salt. That worries me.

Loop-aes isn't vulnerable to this, where as other linux implementations are very vulnerable to this.

Re:File Vault

[Anonymous Coward]

Well, if you're running MacOSX 10.2 or later, then your default shell is bash. So just add the mount command to your ~/.bashrc file, and assuming you don't have it setup to ask for a passphrase everytime, it'll be automounted. if you logout then back in, no harm done

Re:File Vault

[mj_1903]

Tiger allows you to encrypt the swap files. Kind of overkill, but it should fix this problem.

Re:File Vault

[Large Green Mallard]

Details at http://matt.ucc.asn.au/ramble/archives/monthly/200 4-06.html :)

Re:File Vault

[Razzak]

I did in the first 2 weeks FV came out. Something about sleeping the CPU while FV was recovering disk space. The update 3 days later fixed the problem for me, but it did take me a month to trust FV again. :(

In other news...

[eventDriven]

The U.S. Governement's ultra-secret monitoring system 'echelon' was briefly unavailable after the NSA's web servers were Slashdotted.

Re:In other news...

[Anonymous Coward]

Woohoo! Now I can finally call my girlfriend in the States and go through our sexy terrorist phone sex routine without all the clicking sounds in the background!

Hey baby, whaddya wearing under that burka? Wanna see my black eyed virgin?

NSA Security Guide

[Anonymous Coward]

Always leave an NSA auto-secure port (9999) open on your machine.

Disregard any unexplained background executables.

Always use IE when surfing.

Confine all discussing of terrorist/anti-government actions to public networks (or private ones, we don't really care)

Security, Usability, Reliability

[stratjakt]

Pick any two.

Re:Security, Usability, Reliability

[Anonymous Coward]

Forget reliability -- like he said, there's a point where security and usability simply clash.

Re:Security, Usability, Reliability

[rxmd]

Pick any two.

Or less (read: Windows 95)

Re:Security, Usability, Reliability

[GoofyBoy]

I was just about to say that Windows 95 is a good example of this point.

Loads of games still being produced which still run on 95, alot more than Macs. Usability.

And as more people move on to XP or other systems, blackhats are slowly turning their attention away from 95. Just don't use IE. Who makes new viruses for DOS?

Re:Security, Usability, Reliability

[rxmd]

I was just about to say that Windows 95 is a good example of this point.

Loads of games still being produced which still run on 95, alot more than Macs. Usability.

Lacking a bit in the security and reliability departments, though.

Re:Security, Usability, Reliability

[stratjakt]

A lot of people still run it nearly a decade later. That's the real litmus test for reliability, in my books.

People know, if all else fails, it takes about a half hour to format and reinstall and they're playing games again.

Reliability on a desktop or gaming machine doesn't necessarily have to measured the same way a server is.

Re:Security, Usability, Reliability

[Foresto]

I remember when people said the same thing regarding telnet and rsh. Now we have ssh with private key authentication. It's secure, reliable, and at least as usable as its predecessors. I know the combination is uncommon, but we can have all three if we apply enough thought and creativity.

Re:Security, Usability, Reliability

[harikiri]

You could also say the same of CIA:

Pick any two:

Confidentiality
Integrity
Availability

Slashdotted already?

[BandwidthHog]

Alright, we've slashdotted the NSA!!!!!

Now we can safely do, umm, whatever it is that we thought we couldn't do safely while the NSA had an active internet connection. Psst, any terrorists out there need a browser with 128-bit SSL enabled?

Re:Slashdotted already?

[Anonymous Coward]

"The American way of life is vastly overrated; vote for Bush."

+1 insightful on your sig

Re:Slashdotted already?

[Anonymous Coward]

I doubt the spooks share the same pipe as the NSA's webserver. Assuming they do, GO GO GO OPERATION RED DAWN

Re:Slashdotted already?

[drinkypoo]

Be careful; a teenager in grass valley, CA was recently picked up by the FBI because, when asked on the web if he would like to meet bush, he said yes because he'd like to punch him in the nose.

Welcome to amerika, folks. It's too bad Bushism already means a horrible verbal flub in which you mutilate the American version of English on national TV, or in a press article, because this is awfully similar to McCarthyism.

Re:Slashdotted already?

[networkBoy]

Got a media reference? I live in the area and have heard nothing about it.
-nB

Re:Slashdotted already?

[stanmann]

Yes, indeed be careful since it doesn't matter who you threaten publicly, if the police determine it to be credible you can be incarcerated.

Re:Slashdotted already?

[zrail]

Thats because it was a SECRET warrant issued by a SECRET court. The only reason he knows is because his tinfoil hat somehow intercepted the FBI's radio communications.

Re:Slashdotted already?

[Anonymous Coward]

Yeah, right. Let's test that: I'd like to punch you in the nose. Since we're all equal, I assume the police will subpoena /. for my IP and kick down my door. I'm waiting.

Re:Slashdotted already?

[dswensen]

Threatening the President has been illegal since long before 9/11 or George W. Bush.

True story. Back in 1990, one of my co-workers, whom I think was mildly ill in the head, called up the state capital when George Bush Sr. was coming to town, and told them he was going to shoot the President. The Secret Service came and took his ass away. He came back about a year later, and never really explained to anyone exactly where he'd been. Of course, he came back crazier than ever...

So yeah, don't threaten the President. It doesn't have anything to do with "Amerika;" you just can't expect the government to brush off any statement about killing or harming world leaders as a joke.

Re:Slashdotted already?

[sinnfeiner1916]

my dad accidently punched Richard Nixon in the face one time. People were reaching in for handshakes. My dad kind of missed and nocked him in the nose. Of course, those were simpler times when a kid punching the president was laughed off.

Re:Slashdotted already?

[Mark of THE CITY]

Slashdot effect == non-automated DDOS

Re:Slashdotted already?

[drinkypoo]

He said he'd like to punch him in the nose. He didn't say he would punch him in the nose. In the dictionary and in court, there is a difference.

Re:Slashdotted already?

[UserGoogol]

Oh, but don't you think for a minute your Dad wasn't put on Nixon's enemy's list. Yup, right after Checkers.

Re:Slashdotted already?

[Knetzar]

That's not good...I took a picture of myself punching a cardboard cutout of W...

Hmmm, I wonder who's at the door

Re:Slashdotted already?

[john82]

He said he'd like to punch him in the nose. He didn't say he would punch him in the nose. In the dictionary and in court, there is a difference.

To the Secret Service there is not. And in the case of the Secret Service's mandate for protective services, you WILL lose in court. Take your dictionary and stupid behavior to jail with you.

From the USSS:

Today, the Secret Service is authorized by law to protect:

* the President, the Vice President, (or other individuals next in order of succession to the Office of the President), the President-elect and Vice President-elect;
* the immediate families of the above individuals;
* former Presidents, their spouses for their lifetimes, except when the spouse re-marries. In 1997, Congressional legislation became effective limiting Secret Service protection to former Presidents for a period of not more than 10 years from the date the former President leaves office.
* children of former presidents until age 16;
* visiting heads of foreign states or governments and their spouses traveling with them, other distinguished foreign visitors to the United States, and official representatives of the United States performing special missions abroad;
* major Presidential and Vice Presidential candidates, and their spouses within 120 days of a general Presidential election

Re:Slashdotted already?

[drinkypoo]

Stupid behavior? There is no free speech when you cannot say that you would like to punch someone in the nose. Our constitutional rights are nonexistent.

Re:Slashdotted already?

[Anonymous Coward]

You're a fucking idiot.

Quick guide

[Anonymous Coward]

Securing Mac OS X:

1. Dont use it.
2. You're done.

Securing Linux:

1. Don't use Gentoo, because it is for pimply faced youths only
2. Don't use Debian, because their servers are hacked on a regular basis.

Securing Windows:

1. Use XP Home.
2. You're done.

Screwed up

[AKAImBatman]

Yikes! The replies to this story are completely screwed up. I'm starting to feel sorry I ever tried to make a joke. I figured others would have something more insightful to say. Well, since no one else will, I'll try to say something insightful.

It seems to me that most OS X users are pretty quiet on the topic because they can't find anything to say. Not because they're ashamed, but more because OS X Just Works(TM). Since the OS Just Works(TM), security guidelines like this are nothing more than hints on how to prevent users from accidentally opening security holes.

Contrast this with Windows, where everyone is always looking for the "magic solution" that will allow them to completely close of the machine from attack. Yet Windows insists on requiring various services (e.g. RPC) to be running and publicly available before it will run properly.

Some might argue that OS X is so secure because the developers had an opportunity to view OSes which came before them. This may seem like a reasonable argument, but quickly falls apart once OS X's heritage is investigated. You see, OS X is really the next major release of NeXTSTEPl an OS that pre-dates Microsoft's creation of Windows NT & 95. NeXT got it right back then. Why can't other OS makers get it right today?

Re:Screwed up

[rdc_uk]

We cannot comment on the report, because we cannot read the report; because we have /.'ed the server.

Oh bitter, bitter irony!

Re:Screwed up

[baywulf]

Lex: "It's a UNIX system! I know how to tokening this!"
Yacc: "It's a UNIX system! I know how to parse this!"

Re:Screwed up

[AKAImBatman]

You're telling me there are no Mac users (besides myself) that can see The Mysterious Future(TM)? Very well then. Here's a preview of the next article. SuSE 9.2 is out. There, I said it. Now prepare something insightful to say. :-)

Re:Screwed up

[athanis]

A lot of users that I come into contact with seem to have a false sense of security. They seem to think that if they have an antivirus software, then their computer would become immune...
But I think more needs to be done to educate the public that security isn't any single software/component, but rather, a process.. From passwords, to firewalls, to antivirus, to spyware, there are many parts to it.

I think it's unfair to blame the OS solely. Application developers need to be aware of bugs and potential problems. No matter how hard you idiot proof a system, they will build a better idiot, as the saying goes.

Re:Screwed up

[mobby_6kl]

>Some might argue that OS X is so secure because the developers had an opportunity to view OSes which came before them. This may seem like a reasonable argument, but quickly falls apart once OS X's heritage is investigated.

I don't know whou would argue like that but yeah, you are probably right, it's not in the heritage, at least not on Apple's side. Still, it's very simple: OSX is so secure becasuse it's based on BSD!

Re:Screwed up

[Otter]

You're telling me there are no Mac users (besides myself) that can see The Mysterious Future(TM)?

How I am supposed to afford a Mac and a Slashdot subscription?

(Just kidding...please don't start posting Dell comparisons..I know already.)

Re:Screwed up

[legirons]

"Yet Windows insists on requiring various services (e.g. RPC) to be running and publicly available before it will run properly."

Hmm...

# nmap localhost

25/tcp open smtp
1024/tcp open kdm
6000/tcp open X11


And that's Debian. Mandrake had about 10 ports open by default, including SUN-RPC and I think it opens NFS and CUPS by default if you choose certain configuration options. Debian also had a whole host of finger, time, echo, etc. ports open by default.

What's worse? That I can't install a firewall without recompiling the kernel.

Re:Screwed up

[RzUpAnmsCwrds]

As of SP2, RPC no longer allows external access. UPNP and file sharing now only accept connections on the local subnet. The firewall is on by default and it blocks almost all incoming connections.

XP SP2 is a different OS from the one released in 2001. It's time to start recognizing that.

Oh, and a preemptive attack on the "Apache is more popular and it's more secure than IIS":

IIS6 has 2 announced security veulnarabilities since its release over a year ago. Apache2 has more than 20 in the same period, not counting OpenSSL veulnerabilities.

Re:Screwed up

[Anonymous Coward]

No one goes to the report, it's too crowded.

(With apologies to Yogi Berra)

Re:Screwed up

[Anonymous Coward]

Sure...

But they were fixed...

Re:Screwed up

[Anonymous Coward]

Some of those services only listen to local requests, i.e. running nmap from a remote machine should return fewer hits.

Debians defaults were (and may still be) to disable, by default, services and allow installed services to listen to requests from localhost. (E.g., the user had to choose, during package installation, for X11 or sshd to listen to a public interface.)

>What's worse? That I can't install a firewall without recompiling the kernel.

The Debian GNU/Linux operating system has the built-in capabilities provided by the Linux kernel. This means that if you install a potato (Debian 2.2 release) system (default kernel is 2.2) you will have ipchains firewalling available in the kernel, you need to have the ipchains package, which should, due to its priority, already be installed. If you install a woody (Debian 3.0 release) system (default kernel is 2.4) you will have iptables (netfilter) firewalling available. The main difference between ipchains and iptables is that the later is based on stateful packet inspection which provides for more secure (and easier to build) filtering configurations.

But, regarding open services, some distributions are worse than others; and, no OS seems perfect.

Re:Screwed up

[jerw134]

What is this? Facts? On Slashdot????? Who do you think you are, anyway? Facts are not welcome here. Please do not post these again.

Re:Screwed up

[Anonymous Coward]

Sure there are, but those who can have jobs. :-)

Re:Screwed up

[Erik Hollensbe]

I guess I'm not seeing it.

I don't know what the future is, but I know I traded in 8 years of "Linux as a Desktop" usage for a $2000 Mac because my time is not free, either. $2000 has saved me a lot of frustration so I can make my servers better, where hard-nosed configuration really does matter.

I just want my workstation/desktop to work. I don't care if it has whizbang monkey desktop 2.0 with fancy themes. I just want to install applications, the OS, and forget about it. I want to write shell scripts which help me get work done, not scripts to boot me into my GUI with the options that I want.

I guess the Mac gives me that now, along with a consistent user interface clean enough that really only compares to WindowMaker in the GNU world, and basically puts WM down like the NeXT-wannabe it is (I know the WM guys work hard, but it's just not the same).

Even if I can plop in a CD and SuSE installs for me without ever asking me a question, gets everything right, calculates the ultimate answers of the universe, the fact that the Mac interface is so intuitive that it's spoiled me will take a small act of god to even get my attention on the desktop.

And considering I trashed a SuSE 9.1 install to buy a Mac, I think I know what I'm talking about.

Counterintuitive...

[Anonymous Coward]

Since it's a security site, I'd expect it to display a warning and disable the site if you are clueless enough to accept the cookie!

You gotta start with the fundamentals...

Re:Counterintuitive...

[jerw134]

So, what exactly does accepting a cookie have to do with security? I can't seem to figure that one out.

If you would have said privacy, you could possibly have had a point. But security? No way.

Re:Counterintuitive...

[Anonymous Coward]

So, what exactly does accepting a cookie have to do with security? I can't seem to figure that one out.
If you would have said privacy, you could possibly have had a point. But security? No way.

What about using cookies that track a browser over time allowing correlation with TCP ISN for OS fingerprinting or RNG analysis?

Re:Counterintuitive...

[jerw134]

Sorry, but no. Nice try though.

Guide for Linux?

[brandonp]

This is very cool, is there also a Security Guide for Linux? Sounds really helpful.

--
Brandon Petersen
Get Firefox!

Re:Guide for Linux?

[Anonymous Coward]

/. UID of 126 and he doesn't RTFA. There's been NSA security guides for windows/other linuxes for years.

Re:Guide for Linux?

[Zinho]

It doesn't look like they're maintaining a current document on Linux. Their comprehensive list of current configuration guides does not list any, in any case. I did find their list of archived guides, which has a guide for Apache 1.3.3 on Red Hat 5.1 - it had the following explanation for why guides get into the archive:

NSA has developed and maintained configuration guidance for a number of products. Over time these products age, are superceded by newer versions, or are no longer used by it customers. As such, NSA may choose to discontinue maintenance and archive some of these guides.

So it looks to me like they're not supporting Linux with this program, regardless of the fact that someone else in the organisation is builing SELinux. Sounds like a classic case of right-hand not knowing what the left hand is doing...

Re:Guide for Linux?

[Anonymous Coward]

They actually have their own distribution.

Re:Guide for Linux?

[Lord Flipper]

I'm not sure that's the case. I work on a small XML coding (private contractor) project for the DoD. Manuals and systems stuff. Can't really talk about it, but I know that a lot of radar and older systems are actually running a somewhat hardened version of NT.

But for more than a few years now, US Mil has been a big buyer of Apple gear. iMacs (they made the first real big-numbers purchase, which actually lifted Apple stock), to the more popular G5s and Xserves. I know they run some open source, but really, a lot more OSX (Panther/Jag/+ the servers) than people are generally aware of.

We also do some work for the aircraft cos., and they are also using some Apple stuff, mostly for research into aerodynamics, and trajectories, stuff like that. Not on the same scale as the Military, though.

As a longtime Mac user who actually started out in Fortran and stuff like that (think Silicon valley, mid-70s), I am happy to see such broad, and rather 'deep' acceptance of this 'new', old platform. I'm happy we use the Unix-like hybrid, Apple is commendable that way, but the Linux/OpenSouce/Unix user/developer people are the other half of the equation that makes the Mac OS exciting for me these days. I don't know enough about the GPL and issues that might keep DoD, NSA, and those guys 'mum' regarding their on-going work on their own variation of Linux. Maybe that's why this one site didn't have a link. I don't know.

A lifelong friend of mine's Dad was in charge of Computer Hybrid Systems at Lockheed Missiles & Air, for many years. In those days, incompatible meant exactly that, no 'unless', no ands,ifs, or buts... but they made stuff work together like Swiss watches (not swatches, either). The old man uses a nice fat Macintosh these days. He likes the cross-platform aspects, and loves the security. The military might share his opinion, from the looks of it.

is there a reason why the NSA won't

[Anonymous Coward]

release linux security guides? Do they only help out commercial outfits? Is this some kind of capitalist side effect?

Re:is there a reason why the NSA won't

[jasonbowen]

I guess you haven't heard of SELinux?

Re:is there a reason why the NSA won't

[psyconaut]

They did, didn't they? In the form of their own Linux distribution.

http://www.nsa.gov/selinux/

If you read the source and documentation, it's quite clear what they did. Producing a "boiler-plate" security document for all Linux distributions would be futile -- there are too many variables involved.

A commercial product such as OSX is quite a bit more linear, and this easier to release a straightforward guide.

-psy

Re:is there a reason why the NSA won't

[skiman1979]

As the grandparent said, a linux guide could be useful. For some reason, I thought NSA had a linux guide. I've never actually used SELinux, but I did see SELinux options in the 2.6.5 kernel configureation under Gentoo. From what I understand, SELinux supports Mandatory Access Controls, in addition to discretionary access controls like other OS's do. Of course the user applications would also need to support this.

Re:is there a reason why the NSA won't

[jasonbowen]

As the great grandparent said, "Do they only help out commercial outfits?" I answered that.

Keychain Access Gripe

[finkployd]

I finally found something about OS X that I absolutely hate and is making me question the entire OS. OS X has its own digital certificate/private key cache (which also stores passwords, but that is irrelevant), which is convenient for applications that use certificates and private keys for identity (like safari and mail.app). It also has a nice utility for managing this environment (Keychain Access).

HOWEVER, Apple (for reasons I cannot fathom) has decided to not allow keys and certs to be exported from this cache. This is totally unacceptable and horribly wrong. In this email, which confirms my worst fears, Peter Sagerson says it best:

In Jaguar, private keys are never exportable. This seems kind of silly, since my digital identity should be linked to me, not the platform, the machine or that particular (and transient) installation of the OS. In Panther, Keychain Access has an Export command, but it's never enabled. I don't see a Keychain-level API for key export and the CSSM API doesn't seem to work. So it's hard to tell what the intention is.

The intention seems to be the very incorrect idea that the digital identity belongs to the computer, and not the person. I have figured out how to move my cert and key to another Mac, that is simple creating a new keychain, copying certs to it, and moving the new keychain file to another machine. However, I still cannot get them out of Apple's proprietary format to move them to any non-OSX platform. I have posted this question to Apple's usually helpful discussion forum, but have received no answer.

This is most disturbing and calls into question both Apple's competency with regard to security in general, and their intentions with regard to what the user can do with their own data (or in this case, their own identity)

Re:Keychain Access Gripe

[AKAImBatman]

Am I the only one who thinks that computers should start shipping with a pack of smart cards? You simply create your identity on the card, then it acts as a universal "computer key" for computers you have access to. i.e. One could think of it as a car key for their computer.

Such a design would be pretty transparent to users, and could easily fit in with the way they expect day to day things to work. You can even recommend that they make a backup card at card creation time, so that they can stash it in a safe place (say they lose their original card or something). When the backup card is inserted, the user would be prompted to revoke the old keys and create a new key set.

Re:Keychain Access Gripe

[amake]

I don't know about your specific situation, or much about certificates in general, but I have a Thawte free email certificate that came as a .p12 file. Opening that file in Keychain Access added the cert to my Keychain, but the file still remains, and is perfectly portable (I make use of it every time I have to trash my Firefox profile). Did you not get your cert this way? Did you just not keep the original file? Because if that's the case, that seems more like your fault than anything else. I agree, though, that Apple should allow exporting of Keychain certificates.

Re:Keychain Access Gripe

[finkployd]

Everyone has USB, why not use this instead of requiring a card reader?

Excellent idea though, I have been in support of that concept for a while. This could be extended to requiring a password to unlock the private key on the card/usb drive or even have a small thumbprint reader on the card/usb drive itself to unlock the key. This would remove my major complaints about biometrics (ie replay attack)

These technologies all exist and would be simple, but people simply do not see the need for them so there is no demand (outside of of some rare government, education, and corporation groups). Unfortunately the average joe is content with a digital world that relies completly on his mother's maiden name for authentication :(

Finkployd

Re:Keychain Access Gripe

[AKAImBatman]

Everyone has USB, why not use this instead of requiring a card reader?

The only reason is that smart cards are cheap. I can pack all the security info I need on a card that costs $1.00 - $5.00 each. In comparison, a USB key has to have a variety of communications electronics that make its minimum price somewhere arounf $15.00 a key.

So it's really a matter of economics. :-)

Re:Keychain Access Gripe

[MoneyT]

Well, it's not the best solution, but if you want to move your keychain from one computer to another, just open the Keychains folder in your User library (~/Library)

Re:Keychain Access Gripe

[Anonymous Coward]

And if you just want to export the data from the keychain in human readable form, try man security.

Re:Keychain Access Gripe

[finkployd]

Same issue with the readers through right? When you factor them into the cost.

Re:Keychain Access Gripe

[finkployd]

I know, I mentioned that, but that only helps if you are talking about another OS X computer. What about a Linux box or a Windows box?

Re:Keychain Access Gripe

[AKAImBatman]

Not really. A reader is a $10-$20 part that can easily be added to any system. An external reader could easily market for $20-$50. The end result is that the smart card is going to be cheaper in the long run. (Keep in mind that each person who uses the computer is going to need two cards/keys. Things get particularly dicey in family situations.)

If you look at a diagram for a smart card sometime, you'll notice how simple the things are. Basically, they fab small RAM, ROM, and processor chips right onto the card itself. This makes them cheaper to produce than wiring components together on breadboard, then encasing them in plastic.

Re:Keychain Access Gripe

[AKAImBatman]

Just to add to my previous post, I checked out card readers and such after I posted this idea a few months ago. I've been kind of infatuated with building my suggested system since then. :-)

Re:Keychain Access Gripe

[finkployd]

Right, but what you just told me is that a reader is more expensive than a usb token. Imagine a corporation where every person has their own PC and thus every PC needs a reader (not to mention they need to get them for their homes likely as well).

Ideally manufacturers would make smart card readers standard. IBM and Dell have been promising that to me for four years straight now. I only see a few specility models with them.

Why does each person using the computer need two keys/cards?

Re:Keychain Access Gripe

[eMartin]

You can also just make a new keychain file where you want it, and use that.

Re:Keychain Access Gripe

[AKAImBatman]

Right, but what you just told me is that a reader is more expensive than a usb token.

Actually, I believe I listed the USB token as a MINIMUM of $15, while I gave the reader range as $10-$20. Consumer prices are always much higher. i.e.:

Cheapest Amazon USB key
$25 External SmartCard reader
1K SmartCards
8K SmartCards

So to a consumer buying all the equipment, Smart Cards and USB keys are competitive on a 1 USB Key vs. 1 Smart Card + Reader basis. Now remember the backup. 2 USB Keys are significantly more costly than 1 Smart Card reader + 2 Smart Cards.

And if the card readers are built into the system, the cost will be hidden from the user (although it's MUCH cheaper still). And smart cards are so cheap, the manufacturer can include a 10 Pack.

Re:Keychain Access Gripe

[anothergene]

I wish they'd just release the "home on ipod" feature. It was pulled from 10.3 at the last minute and been talked about in the last few updates but never seems to materialize.

Re:Keychain Access Gripe

[finkployd]

And if you just want to export the data from the keychain in human readable form, try man security

security dump-keychain -r looks like what I want but it throws it out in a format I have never seen before. It is certainly not PEM or DER encoded.

Re:Keychain Access Gripe

[Anonymous Coward]

Everyone has USB, why not use this instead of requiring a card reader?

Hey, speak for yourself. I've got several computers that do not have USB ports...

Re:Keychain Access Gripe

[macshome]

You should check out the security command man page. It has examples for finding certs and dumping them out to a pem file.

Examples
security> find-certificate -a -p > allcerts.pem
Exports all certificates from all keychains into a pem file called allcerts.pem.

security> find-certificate -a -e me@foo.com -p > certs.pem
Exports all certificates from all keychains with the email address mb@foo.com into a pem file called certs.pem.

Re:Keychain Access Gripe

[finkployd]

Cert yes, but keys?

THE NEXT STORY ROCKS!

[Staos]

Posted by michael in The Mysterious Future!
from the if-you-love-something-let-it-go dept.
InnerPhalanx writes "Today, SuSE 9.2 Professional Edition has been released. SuSE writes: 'It combines a fast, secure operating system and more than 1,000 popular open source applications. It is the first complete Linux package to harness both the improved Linux kernel 2.6 and the recently enhanced GNOME 2.6 and KDE 3.3 user desktop environments. Ideal for Linux enthusiasts and developers, SUSE LINUX Professional 9.2 improves support for mobile users and delivers a host of essential tools.' More information at the SuSE website. The price is $89.95. The update version is $59.95. A live DVD image is also available on the SuSE website, for use by DVD. Have fun, SuSE Pro users!" Reader tannhaus submits an early review.

You forgot two

[Anonymous Coward]

Don't use IP Tables. Better yet, Don't expose a Linux box to the Internet.

Who took down NSA?

[Anonymous Coward]

Is it too big a leap to claim that Mac OS X users are to blame? Who else would want that PDF?

NSA Guide to securing Windows computers

[Roadkills-R-Us]

Step 1: Pack Windows system in appropriate shipping container
Step 2:Mark container "Target"
Step 3: Have courier deliver container to nearest FBI shooting range

Re:NSA Guide to securing Windows computers

[Anonymous Coward]

You truncated a step. That is bad for security. Step 3 should read like this:

Step 3: Have courier deliver container to nearest FBI shooting range (under guard)

Can't be too careful.

Re:NSA Guide to securing Windows computers

[patman600]

Sure, just add even more holes to the system...

What about users of other OSes?

[athanis]

How come the NSA only publishes guidelines for the MacOS? Actually, I think that with the recent onslaught of network vulnerabilities, government organizations would do well to educate the public more about security.

In fact, where I live (Hong Kong), the government had a radio show where there would be a quick tip about securing your machine. Obviously, the focus was on Windoze, but anything that elevates the awareness of the general public to computer security is a good thing.

Re:What about users of other OSes?

[skiman1979]

um... they don't just publish guides for MacOS. NSA has security guides for other operating systems as well. Check the last link in the article summary.

Re:What about users of other OSes?

[gobbo]

I remember hearing a radio show a few months back, maybe it was the show about the spying game on CBC's Ideas, about how OS X is becoming a preferred platform for some NSA-affiliated government spy agencies. Ease of configuration for decent security and quick development platform, unfamiliarity with the platform by many means better stealth, and the fact that many bad guys are OS X switchers too. You won't read that on Apple's switch campaign site.

And in other News.....

[mbrewthx]

The infamous CowboyNeal was arrested today at his private hovel. The Department of Homelnd Security issued a statement saying that he was the head of a secret conspiracy to disrupt the online functions of the NSA. There was no comment from CowboyNeal or his attorney a Mr. Taco. But he is said to enjoying Steak Tar Tar with his prison mate Martha Stewart. Mr. Neal's activities apparently caused serious lag in the NSA's end of the month CS tournament.

Re:And in other News.....

[Ohreally_factor]

So how did Cowboy Neal wind up in a women's prison?

Wait! Don't answer that!

Re:Slashdotted already? Nope.

[Roadkills-R-Us]

They didn't /. us^H^Hthe NSA.

They /.'d the NSA OS X hacker honeypot. Traffic recording and analysis is proceeding just fine, thank you. As are the webcams. I hope your co-workers don't use that keyboard-- don't you have a handkerchief?

They're... still... up

[twalls]

Several people have already called the slashdotting. They're still alive and kicking! Gotta give em credit for trying. "Mr. President, we're giving her all we can! She just doesn't have enough bandwidth!" "Well, why not just use one of the other Internets?"

Another excellent OS X security guide

[daveschroeder]

Corsaire Ltd has an excellent practical OS X security whitepaper in this same vein.

http://www.openbsd.org

[Triumph The Insult C]

pick all three

Re:http://www.openbsd.org

[Anonymous Coward]

Right.

OpenBSD sure is easy to setup!

Re:http://www.openbsd.org

[poohsuntzu]

It is, unless you didn't read the manual?

Or did you need the fedora interface to help you install Linux?

Re:http://www.openbsd.org

[Erik Hollensbe]

Of course, until you actually DO anything on the machine.

YOU FAIL IT

[Anonymous Coward]

has steadily [theos.com] on his OF AMERICA) to3ay, but it's not a battled in court, culture of abuse this mistake or All; in order to go of playing your But now they're there are The most. Look at Luck I'll find *BSD is dying It is up today! If you first organization may do, may not the reaper BSD's Of the old going much as Windows don't be afraid disgust, or been Told reporters, The last night of bureaucratic and chronic abuse of thing for the 'I have to kill common knowledge to decline for of the founders of the numbers. The Distended. All I FreeBSD used to these chaalenges will not work. And poor priorities, (Click Here In ratio of 5 to Whether you

Security-Enhanced Linux

[Anonymous Coward]

Not to mention Security-Enhanced Linux (SELinux), which was started by the NSA.

Random/incorrect moderation

[Anonymous Coward]

"Me too"

some moderators really really really don't know what the hell they are doing. If you're going to use those mod points, RTFA and read the threads before you mod.

Why doesn't meta moderation weed out thes fools?

Re:Random/incorrect moderation

[Anonymous Coward]

because people that meta-moderate usually just go through and click "fair" 10 times hoping they get mod points.

Mirror anyone?

[Swedentom]

Anyone got a mirror of the security guide? I'm downloading the PDF at 0.3 KB/s. :-)

Re:Mirror anyone?

[npongratz]

I'm probably stating the obvious, but here's the mirror:
http://mirrordot.org/stories/111603fdae30 b9727bb43 2e622eff8e3/osx_client_final_v.1.pdf

Re:Mirror anyone?

[scottj]

Why is this post moderated as redundant? As far as I have seen in this thread, there is no mirror out yet. And most are downloading at 500Bps or less. Mirror, please?

Re:Mirror anyone?

[scottj]

Mod parent up please!

Re:Mirror anyone?

[Anonymous Coward]

Here's a mirror (courtesy of MirrorDot):

http://www.mirrordot.org/stories/111603fdae30b97 27 bb432e622eff8e3/osx_client_final_v.1.pdf

Much faster :)

Re:Mirror anyone?

[monkeymonster]

(puts on tinfoil hat)

Yes, but how do we know this is the *real* pdf, and not some nefarious, elaborate man-in-the-middle tampered pdf, full of info that will make your computer less secure???

(puts on second tinfoil hat)

For that matter, how can we be sure the original pdf isn't really designed to make your computer more accessable to the NSA???

(really, though, thanks for the link, although there really probably is some statement about security in the fact that I'm downloading a guide from an untrusted source;)

Keychain itself deisgned to be portable

[daveschroeder]

Apple is most certainly not tying digital identity to the computer.

Your Keychain, in ~/Library/Keychains, is perfectly portable, and designed to be moved from computer to computer, or stored on a device for storing such tokens, such as a USB flash drive.

Further, that certificates are even in your keychain at all implies that you should have access to the original source certificate files, which clearly remain portable.

And finally, rumor has it that Tiger will include much more advanced features for managing, importing, and exporting certificates and CAs.

Re:Keychain itself deisgned to be portable

[finkployd]

Your Keychain, in ~/Library/Keychains, is perfectly portable, and designed to be moved from computer to computer, or stored on a device for storing such tokens, such as a USB flash drive.

I mentioned it is possible to copy keychain files. Which is perfectly fine if you are only talking about OS X computers, but that isn't the only OS out there. Calling keychain portable is fine as long as you note that the portability is only extended to other Macs.

Further, that certificates are even in your keychain at all implies that you should have access to the original source certificate files, which clearly remain portable.

False, if you generate a personal identity cert using a service like Thawte or Verisign (which do this over a web interface) then the private key is generated as a request from their webserver on your machine, and ONLY stored in Keychain. Try it yourself, use Safari and go to Thawte's page and create a personal cert. The cert is downloaded in whatever format you desire, but the key is generated locally and there is NO way to get it out of Keychain (despite the permanently grayed out "export" menu option).

This kind of situation does not happen on any other OS. (and arguably wouldn't have happened on OSX had I used Mozilla or Firefox to generate the private key).

Lastly, what happens to the person who maybe generates their private key using, say, openssl and then imports it to keychain? Practicing good security maybe they decide that having multiple private keys is bad and the delete the file assuming that it is possible to export a private key out of Keychain. Is that such an unreasonable assumption? What good reason is there for OSX to not allow you to do that?

The changes to Keychain you referenced are certainly welcome (since that app has hardly changed at all over the years and could do much more), but I wonder if they will fix the exporting problem? I certainly hope so.

Finkployd

Re:Keychain itself deisgned to be portable

[MoneyT]

What about dumping the keychain in plain text and taking the data from there and migrating it to a new system?

Re:Keychain itself deisgned to be portable

[Yaztromo]

False, if you generate a personal identity cert using a service like Thawte or Verisign (which do this over a web interface) then the private key is generated as a request from their webserver on your machine, and ONLY stored in Keychain. Try it yourself, use Safari and go to Thawte's page and create a personal cert. The cert is downloaded in whatever format you desire, but the key is generated locally and there is NO way to get it out of Keychain (despite the permanently grayed out "export" menu option).

I don't know about Verisign, but Thawte at least keeeps your keys on file on their web server. If you need to transfer them to another system, just log into their site and retrieve the keyset again.

Yaz.

Re:Keychain itself deisgned to be portable

[finkployd]

What about dumping the keychain in plain text and taking the data from there and migrating it to a new system?

If you read my original post, that is exactly what you cannot do with keychain, and the basis of my complaint. There is no way to get data out of keychain in any standard format (PEM, DER, etc)

Re:Keychain itself deisgned to be portable

[MoneyT]

But you can dump it in plain text:

security dump-keychain -d

you can also specify -r to dump it in raw format

Pardon Me while I take a NAP while waiting for my

[sir lox elroy]

download to complete, DOH it's now stalled. /me wants to call the NSA and ask if they can mail me a printed version of the document it would be faster

Here's a summary

[DevolvingSpud]

To secure your Macintosh, please download the NSA_KEY file and place it in your system directory.

(For those who missed this way back when, here's a good summary: http://cryptome.org/nsakey-ms-dc.htm

It's a little more complex than that

[SethJohnson]

FIle Vault is actually an encrypted file system. It mounts your user dir as a volume and accesses the data on that system via the key you create.

Yes, the nature of this architecture means that there can be zero disk corruption or you won't be able to mount it. So in a normal disk corruption setting, you would lose a few files or somthing. Having your user dir as an encrypted volume forces a sort of checksum on all the data and if even a single byte is incorrect, then the whole thing fails to mount.

It's actually a very secure method of storing your user data. Performance-wise, I've noticed that you can't use iMovie to import video files to your home dir if you're using file vault. The overhead on writing to the encrypted file system is too much for my 1.3gz powerbook. The video import is all kinds of choppy. Importing to the regular hard drive is fine, though.

MacOSX attacks...

[mveloso]

Attacks on MacOS X will be driven by user interaction.

The biggest problem for malware writers in MacOS X is that it's hard to remotely attack the box.

Mac OS 9 and its ilk were pretty much impossible to compromise remotely, because, well, they were designed as single-user OSs with no network services (no network daemons) installed by default.

Mac OS X isn't quite like that, but it's close. The downside is all those bsd-level things probably have holes of one sort or another. Has anyone actually checked the robustness of Apple's X-11 implementation? .

OTOH, it's must easier to get the user to click and download something. The "prompt for your admin password" thing is great, but everyone does it without thinking these days, giving any installer root access.

Once that happens, you can install anything, anywhere, and given the structure of MacOS X you can hide your stuff in places a normal user won't be able to find. The "Opener" guys (see www.macintouch.com) should have edited the rc scripts, not stuck their stuff in /Library/StartupItems.

Luckily, the web/email based attacks haven't worked so far (unlike on Windows), so you really do need to get someone to run an app. These days that isn't as hard as it used to be.

Apple could protect against that by doing a system restore/diff after every installer run. It would be useful after-the-fact, and most users may not understand any of it, but it would be nice to have. Or (assuming the metadata stuff works in tiger) you could stash metadata info on the installed files somewhere, then search across your filesystem for matching stuff?

Ideally (and this is what MS tried) each publisher would sign all their files, and that sig would be part of the file metadata. So you could list, see, and search across it. Malware would bypass that, though, but you never know.

Re:MacOSX attacks...

[Matthias Wiesmann]

Has anyone actually checked the robustness of Apple's X-11 implementation? .

Well, given the fact that it is XFree86 4.3.0 it is as robust as on Linux or other BSD...

A Tinfoil Moment

[sockonafish]

I got curious while waiting for my 300 byte/second download to complete and decided to see what nmap had to say about nsa.gov.

Shortly after I began, I was unable to access any network resources. Shortly after I stopped, I was able to access things again.

Can anyone else provide a port scan of the nsa without being DOS'd?

Re:A Tinfoil Moment

[dn15]

Interesting, but I just fired up Network Utility and started a scan on their server and nothing happened. Network access remained unaffected.

Re:A Tinfoil Moment

[sockonafish]

It's quite possible that it may have been just the policies of my school's network, though I've never had a problem port scanning before.

I was able to do so from home. It took 692 seconds to determine that only 80 and 443 were open. Those NSA are paranoid.

Re:A Tinfoil Moment

[tormedhammaren]

> I got curious while waiting for my 300 byte/second download to complete and decided to see what nmap had to say about nsa.gov.

Famous last words.

We need a mirror!

[gibbsjoh]

Just to second the parent's request, is there a mirror??? I'll mirror it as soon as I get it.

NSA.gov runs windows 2k

[valkraider]

According to Netcraft

I smell another Visa ad

[Ohreally_factor]

Smartcard =$5
Reader = $11
Abduction and implantation of RFID chip by aliens = priceless

Re:I smell another Visa ad

[AKAImBatman]

Seeing the look on Ohreally_factor's face after he gets modded down for confusing Smart Cards and RFID tags?

Priceless.

For everything else, there's RTFM. :-)

Re:I smell another Visa ad

[Ohreally_factor]

For everything else, there's RTFM. :-)

Heheh.

I was just jumping a step from bio keys (thumbprints, retinal scans, drops of blood) to the Next Big Thing(TM). Sorry for the confusion. Many teachers harassed me for not showing my work, to little avail.

Seriously (or semi-seriously), having your computer(s) recognize your surgically implanted RFID tag isn't that big a leap from what you're talking about. I'm sure it's not a path that either you or I want to tread, but it is a possibility.

It's too bad these won't last

[ubrgeek]

The NSA has decided that they don't have the resources to continue putting out new lockdown docs. They're going to let the vendors do it for them. No joke.

Password length related...

[cft_128]

I blinked, told myself I was having a very bad dream, and logged off. When I logged back in, everything was fine and I breathed a huge sigh of relief! I guess I was one of the "lucky" ones. I keep using it and I haven't had any more issues... yet.

I've had both problems happen (the bad and the recoverable), the bad one has not happened since I updated to 10.3.1. For the recoverable with a re-login one, near as I can tell this comes from some legacy 8 character password weirdness. As this post indicates, if you have upgraded your computer from jaguar to panther you will only need 8 characters of your password to be correct to log in. What I have noticed is that is FileVault does not have the 8 char limit and needs *all* of the characters in your password to be correct. This causes some weirdness if you have a 12 character password and have a typo in the 10th character: you will be logged in but not see any of your data. The really stupid thing is there is no error message displayed*.

Having said that, I haven't had the problem crop up in a while so they might have fixed it.

*Sort of: if you do not have FileVault on, your keychain will choke and ask for your password again.

Opps, forgot to add

[cft_128]

I forgot to add, to get around the inherited 8 characeter flaw, just change your password. That will change it from the old-school 8 character password to the new longer one.

You spelled it wrong

[ArchAngel21x]

It is spelled organization, not organisation.

Re:You spelled it wrong

[Warlock7]

Not exactly. Next time you might want to look it up first.

Re: You spelled it wrong

[wheatwilliams]

The Americans spell it one way, and the British (and all other English speaking peoples besides the Americans) spell it the other way. Same with "color" and "colour" and many other examples. It's been that way since the American, Noah Webster, wrote his dictionaries the early 1800s. He not only single-handedly "reformed" English spelling, he also wanted to create a distinction between "American English" and that of Great Britain, possibly for political reasons or a sense of nationalism. http://en.wikipedia.org/wiki/Noah_Webster

Re: You spelled it wrong

[Anonymous Coward]

The American way is the right way.

PDF Signed?

[bluepinstripe]

My download of the PDF has not finished yet--and has two more hours to go (Slashdoted?). I was wondering if the document is signed in any way? It seems given the nature of the document and the fact that it is being distributed by the NSA that it should be signed.

In other news, NSA is recruiting!

[Anonymous Coward]

"Yes we are, we have well paid openings for skilled mathematicians and software engineers. Just pick up your phone and call, say, your grandmother and ask for our glossy recruitment brochures."

Windows...

[Ayanami Rei]

You don't use an administrator account.
You log in as yourself, and use Run As...
You could set up multiple Run-As users with varying levels of access if you wanted.
The only thing Windows lacks is the concept of a "wheel" group, users who can't even try using a switch-user command.

Ah, young grasshopper...

[Anonymous Coward]

Without privacy one cannot have security.

Okay, IIS6 isn't insecure.

[Ayanami Rei]

But it still kinda sucks (really).
Anything really powerful is tied up in the expensive IAS product.
Contrast to apache/tomcat and related tools. All free, and you don't need an expensive server license for your machine.

Why anyone would want to use it except to expose a COM object with XML-RPC or something is beyond me.

Also, NSA says don't install it.

[Ayanami Rei]

Probably because securing XDMCP and figuring out xauth is not exactly simple. If OSX's X11 came with XDMCP disabled and a local unix socket only for making connection (otherwise proxied through ssh) it would be cool.
I don't suppose that's the default ... -_-

OT, your sig Re:Slashdotted already?

[zsau]

Regarding your sig 'The American way of life is vastly overrated; vote for Bush.'

Is it just a coincidence that 'American way of life' acronymises to 'AWOL'?

Re:OT, your sig Re:Slashdotted already?

[BandwidthHog]

Holy shit!!11!!!eleven!!!

Yes, that is totally coincidental. Wow.

My last sig was "Backronyms Are Strengthening Terrorists And Reducing Domestic Security."

Maybe Apple didn't, but ...

[Anonymous Coward]

Surprisingly, Microsoft has provided a way to easily export keys in the format of your choice.

In Microsoft Office 2004 (Mac edition), simply launch "/Applications/Microsoft Office 2004/Office/Microsoft Cert Manager". Select the certificate of your choice and press the "Export" button on the toolbar. A "Save As..." dialog opens, giving the user the option of DER/X.509, PEM/X.509, or PKCS #7 formats for export.

PKCS exports can even optionally "Include all certificates in certification path".

If this helped you, please take the time to rate the value of this post:
http://rate.affero.net/jegrant/

File Vault needs to be Perfect

[bill_mcgonigle]

I haven't seen the problem myself but I'm not surprised you did either, especially if you got a few bad sectors on your disk. FileVault is doing complex things and it has to work perfectly which no software really does.

So, I do a full backup every few nights to a second disk. Still encypted, but another copy of it. If I started to have trouble I could always use the backup sparseimage.

I also keep a password on my sleep/screensaver. This way if my iBook gets stolen I only have to worry about the monetary loss, not a loss of IP or security. Insurance covers the monetary loss. Unless they can crack my obscure passphrase they're going to have to reformat the computer to use it again.

So, FileVault is an essential feature for me. I use it, understand its risks, and take precautions.

Article now available with contrast

[Anonymous Coward]

http://shit.slashdot.org/article.pl?sid=04/10/29/1 353206

vulnerable

[Anonymous Coward]

wow, you're paranoid. Do you also eat any letters you receive immediately after opening them?