Slashdot Mirror
Securing Mac OS X Tiger
Stephen de Vries writes "Mac OS X is one of the most secure default installations of any OS. But it is still possible to lock the OS down further, in order to meet corporate security guidelines or to securely use network services. Corsaire has released a guide to Securing Mac OS X Tiger (long pdf) which addresses the new security features introduced through Tiger and presents some security good practice guidelines."
I put a tiger on a leash once. It didn't work. Don't try this at home, kids!
Ah, good Slashdot.... Now it warns us that TFA is "long", even.
But of course, I don't think anyone ever tries to RTFA, so the thoughtful gesture is lost on us....
If you're going for corporate security, you're probably going to look at every aspect you need to lock down. Security by default matters for 90% of desktop users, but don't you disable services/add firewalls as soon as you set up your OS?
Send email from the afterlife! Write your e-will at Dead Man's Switch.
Nice to see Roy Horn has recovered enough to post on slashdot.
Oops, guess it was the NSA
One of the features that this article highlights is the Secure swap space, which allows you to have your swap space encrypted so that it cannot be read either unintentionally or intentionally. FileVault is fairly secure for storing business documentation, etc also. Article is well worth a read for any mac user, and non mac user who may have macs in their environment
Security still depends on the user of the software, even the most secure system can be opened WIDE up if someone chooses (or chooses without knowing) to make it so. You can have everything encrypted, but if your password is easily guessable then your encryption is weak. This goes with the thought that "A system is only as secure as it's weakest point."
Law enforcement agencies annouce that "OS X Tiger" stands in the way of forensic investigation. Story at eleven.
Mildly funny, but also a bit irresponsible without a warning:
Folks, sudo puts you into superuser mode and executes a command, rm. rm removes files, in this case, all of them.
Unless you enjoy completely rebuilding a system and losing all your data files, don't run this command.
Another tip: never enter console commands you don't understand.
http://www.nsa.gov/snac/
M ac_OS_X.pdf
http://www.net-security.org/dl/articles/Securing_
http://eq.rsug.itd.umich.edu/software/radmind/
http://homepage.mac.com/hogfish/PhotoAlbum2.html
Best tip (not a flame) - simply don't run any Microsoft software, support open or other vendors software please, also W3C standards, thanks.
Grab it by the toe.
Wear good earplugs.
NSA did a pretty good writeup of Securing Mac OS X Panther Server earlier this year. One can still apply all the recommendations to Tiger Server.
The future is in beta
In Tiger, when enabling samba sharing, you have to choose which accounts to use and you are also warned about storing the passwords in a less secure way.
Cortana: "By default, OS X stores your password as a nice secure hash. However, it also stores it using Windows' shitty hash method, that takes approximatly 0.000000001 seconds to brute force with John the Ripper"
On Tiger, this is not true. In Tiger, one has to explicitly check a checkbox for each user, and enter that user's password, to allow those users to use Windows sharing. The sheet with these checkboxes states:
"Sharing with Windows computers requires storing your password in a less secure manner. You must enter the password for each account that you want to enable."
So, Windows file sharing is there, but Apple has not exactly made it easy to enable it.
Given this UI, I guess that there is no way to secure this weakness in Windows file sharing without breaking compatibility.
London-based mi2g Intelligence Unit on Tuesday released a report that says Mac OS X and Berkeley Standard Distribution (BSD) Unix are the "world's safest and most secure 24/7 online computing environments." Linux operating systems offer the worst track record, according to mi2g, with Windows coming in second.
x .php
http://www.macworld.com/news/2004/11/02/mi2g/inde
You can specify any keychain file as your default, and it can be anywhere. If that's a CF card in the PCMCIA slot, your keychain is removable. Thumb drives also work, of course, but the CF card doesn't protrude beyond the case.
I had already applied some of the security recommendations, such as enabling security on Open Firmware, but I've just learned there are a plethora of other security options available on Mac OS X 'out of the box'.
There are options in Tigers security preferences that allow swap space to be encrypted and to avoid passwords being accessible in the clear when stored in memory and swapped to disk. Kernel core dumps can be be disabled for similar reasons.
Password policies! I had no idea Tiger could do that.
After going through this article and learning a bit more about how KeyChain works, I've started creating my own keychains to store 'Secure Notes' and I've finally accepted that Safari does do 'auto-logon' securely in the way it uses KeyChain.
This is a very good article.
Without even R'ing the FA, I can tell you that truly securing the Mac OS is just as easy as truly securing any other OS.
1) Unplug it from any network.
2) Strictly control whoever gets physical access.
3) ???
4) Security!
Seriously... after watching some dipshit try over 4,000 times within the span of a couple hours to attempt buffer overflows on every listening port on my honeypot last Friday afternoon, before I finally blacklisted his entire class C from my router, I've come to the same conclusion that the DoD has... that NO computer connected to the Internet can be made secure... period... that you should only connect disposeable devices to the public Internet.
I even wonder if I'm not the bigger dipshit for sitting there watching this idiot half the afternoon, throwing the kitchen sink at my poor machine in vain, before pulling the plug on him and banishing his whole netblock.