Slashdot Mirror
Apple Releases Mac OS X Leopard Security Guide
Wormfan writes to share ZDNet's brief mention of and a link to "Apple's release of a ~250 page PDF of security best-practices and tips to protect Mac OS X Leopard clients. The guide is aimed at experienced users, Apple says, familiar with the Terminal application and its command-line interface."
Page 1: "Install Leopard."
Pages 2-250: "This page left intentionally blank."
citing page 52:
;)
In the Password and Verify fields, enter a new Open Firmware or EFI password, and click OK.
This password can be up to eight characters. Do not use the capital letter "U" in an Open Firmware password.
If you do, your password will not be recognized during the startup process.
For experienced users and familiar with terminal and command-line. What does that mean to 'normal' users?
or it is there to help add additional security to those of us paranoid ones not comfortable with the level of security that is already there. though it is slightly....disconcerting on one hand that they have to release such a thing; but on the other it is nice to see that they are accepting that nothing is 100% secure out of the box and that there are steps that can be taken to help with security. Any computing system that has left the box is unsecure; it is just a matter of degrees.
That is why on my grandmother's machine I put a hardware lock, set firmware password, enabled stealth network mode and secured virtual memory. I will be damned if those dirty hackers find out which bunt cake recipes she has been looking at.
Excellent!
1) Read 250 pages.
2) Charge $NNN an hour for "Security Services".
3) Profit!!!
exactly! :)
On a less sarcastic note...
Documents like this will encourage people like me to at least look at Apple when considering purchases.
I have never trusted the 'so safe you don't need protection' argument about any product, much less one as important as a computer operating system. Let's not even dig into the can 'o worms of trusting a publically traded, and therefore profit driven company, to maintain the highest production standards indefinitely.
Security vulnerabilities just take time to evolve, they will find everyone sooner or later.
Security and safety are not binary properties. Macs are perfectly safe out of the box, particularly if you're talking about security from remote exploits, which is how people generally use the term. But if you want to take it further and get even more out of it, this is how. It's probably mostly an exercise in paranoia, although I imagine there are quite a few tips in there which will help prevent data loss in the event that the machine is physically stolen.
If you mod me Overrated, you are admitting that you have no penis.
http://developer.apple.com/documentation/Security/index.html
1% APY, No fees, Online Bank https://captl1.co/2uIErYq Don't let your $$$ sit in a no-interest acct.
- Be an experienced user familiar with the terminal, and
- Read a 250 page PDF
then I wonder a little about Leopard's security.Having skimmed the document, I'm a little bit less sceptical. In a lot of places it explains why the default configuration is secure (e.g. mDNSResponder uses the MAC framework to run in a sandbox, which is why the recent security hole did not apply to Leopard, while it did to Tiger, Windows and Linux). It also told me about a few features I was completely ignorant of, such as the ability to use a smartcard to unlock File Vault images and the keychain rather than a password (would be a bit more useful if Macs included a JavaCard reader). It also covers things like completely disabling WiFi and Bluetooth, which are likely only to be required by people working in the defence industry or suffering from extreme paranoia (but I repeat myself). Sadly, although it mentions the MAC framework, it doesn't give any hints about actually using it.
It also includes one thing that made me groan slightly:
Mac OS X v10.5 supports the Mac OS X v10.4 sparse disk image format created using AES-128 encryption. In my experience, this only applies to the first boot of a Leopard system. After mounting and unmounting a Tiger File Vault disk image, you will find that it is only mountable in Tiger. I wasted many hours fixing this problem after upgrading.I am TheRaven on Soylent News
What are you talking about? Even OpenBSD has security-related documents and manuals. While OpenBSD is super safe for the out-of-the-box install, any time you open a port or enable a daemon, you are exposing yourself to some kind of vulnerability if you don't know exactly what you're doing.
Mac OS X is the same way. If you're enabling advanced services and whatnot, as per the experts this manual is aimed at, you need to know what you're doing. This manual addresses that.
make world, not war
Better Trojan horse protection. Mac OS X v10.5 marks files that are downloaded to help prevent users from running malicious downloaded applications.
The main result of this is to train people to click "OK" to security dialogs. I have observed this trend in Windows, over the past decade as a network and system admin, and there were several users who would REPEATEDLY come to me with "I clicked the wrong button again and I think I've got a virus".
Easier network security. After you've activated the new Mac OS X v10.5 application firewall, it configures itself so you get the benefits of firewall protection without needing to understand the details of network ports and protocols.
OS X is not Windows: it does not promiscuously open listening ports unless you are serving data. Unless you have installed third party software that opens additional ports, there is nothing the firewall needs to do (and indeed it has been reported that the firewall does not actually restrict access to any standard ports), and there is little point in running it. If you have, then you need to understand network ports and protocols.
I haven't gotten very far in it, but it is very interesting. It goes far beyond in security to what a standard user would ask for. I'd actually like to see Windows or Linux have a similar guide/compilation.
- Disabling kernel extensions for firewire, bluetooth and wifi among others (completely disabling those functions).
- Different privilege levels (not just admin, user and guest).
- Managing accounts through open directory.
- Configuring password complexity requirements.
- Managing keychains.
- Securing system preferences and services (just one click, not sure if that is a good thing though). Apparently you can lock down to the Dock size of your users. - Erasing data securely (35-pass erase? Really?).
- Disabling Safari functions (no downloads, cookies, autofill in forms, proxies, etc...).
- Managing services and running in stealth mode.
- Command-line for most of the above.
And I'm about half-ways. This is really nice to have for any serious admin. I consider myself an experienced mac user (yes, a fanboy too) and I'm surprised with everything Mac OS has that I didn't know about.
Just don't turn on SSH and set all your passwords to 'password'.
Saying "I'll probably get modded down for this" in a post is the best way to get it modded up.
I understand that there are environments where the default level of security of workstations is insufficient and hardening is needed. The thing is, if you're administrating such an environment and need to harden your systems a bit more, you should already have read the similar hardening guide for OS X that was published by the NSA (or at least be aware of it since it was discussed in hundreds of security forums when released). It was for Panther at the time, but not much has changed since then, at least as far as practices. Or you could use the hardening guide Apple released for Tiger. In any case, this guide probably should have little to do with your purchasing decisions.
Thanks for the links... My point, which I failed to express clearly now that I reread, was that the attention from the vendor was welcome.
I was unaware of the previous Tiger hardening guide from Apple, but had seen other materials from third parties. Long story short, I thought the oft repeated community attitudes towards OS X security were echoed by Apple: namely that there was little need for security measures.
I have not read the document fully yet (obviously, it is 240 pages!) but I have to say Apple do a damn good job in presenting their documents. The first thing I thought when I opened the PDF was how nicely formatted it is. It is a silly little thing but I much prefer a well presented document than just text dumped. Kudos to whoever put it together, I just hope the content is as good as the presentation!
Your grandmother bakes cakes that are sturdy enough to survive being hit short distances with a baseball bat? Watch for IP addresses from Goodyear and B.F. Goodrich, and the Michelin Man would like to subscribe to her newsletter.
You cannot truly appreciate Dilbert until you read it in the original Klingon.
I'm not sure you should completely abandon that conception. Apple's attitude towards security has been a bit erratic. My perception is that the old-school Apple developers and UI gurus pay little attention to security and some projects are dominated by such people. On the other hand, the people from Next and who were hired on for their UNIX experience care a lot more about security and projects they dominate fare much better.
Apple has certainly been taking steps towards better OS X security. FileVault is functional, if not perfect and OS X in general seems to have at least some security review going on for default settings. They added secure deletion and support for security cards (probably requirements for government purchases). Their new Mandatory Access Control framework and application signing frameworks in Leopard show they are committing resources to proactive security improvements, even ones that their user base as a whole really doesn't need yet. I actually have more hope for MAC in OS X than in Linux, since Jobs can make the hard decision to require it for all new software, whereas there really doesn't seem anyone capable of doing the same for Linux and consensus is hard to reach.
All these Leoptard tips are nice and all... but how do I get past the Blue Screen of Death?
This is sort of off topic, but the PDF metadata claims it was made using Adobe Framemaker 6.0 and a Macintosh version of Adobe Distiller. That strongly implies this guide to securing the latest and greatest version of OS X, was actually put together and created using a PPC Mac running classic. I wonder what Apple plans to do in this regard going forward, since none of their currently offered systems can run this software and their are really not many alternatives for said niche. Maybe Adobe will face one more Apple product as a competitor in the next year or so, if Apple decides to bring an OS X native program to market as they have in other cases like this.
They do
: )
Exactly. Well, it's a Unix, so you can secure it properly, so you should secure it. It's nice to see a vendor-approved guide to doing it that accounts for their own quirks (especially critical in the Unix realm). Scanning the NSA guide for Linux might help too, unless they did an OS X version. And is anyone else waiting for a 4th edition of Essential Unix Systems Administration ?
Veteran, Bermuda Triangle Expeditionary Force, 1992-1951
I remember running shell scripts on Slackware which will tweak lots of settings, directory permissions to more secure settings. (TIGER for Linux I think)
As Leopard has ACL out of the box, there could be some wonders to secure the machine but people aren't that advanced to do it. There is also risk. Even if I knew a single line chmod or acl command to bring wonders to security, I wouldn't post it to web as some may copy it wrong and blame you for breaking their OS.
For example on pre Leopard, just making ~/Input Managers root owned may prevent lots of future troubles. It is pro-active , doesn't require any CPU and still, Apple didn't simply do it with a security update. Instead they made Input Managers Admin owned and root dir exclusive (/Library/Input Managers). They should allow people having their own input managers in their home directory not affecting others (but secure).
We need a user friendly shell script that people may easily apply and reverse. It may require significant amount of work though. Even on Leopard, home directory is not security checked (unless when you boot from dvd), the real issue is home directory. There are some completely confused people thinking OS X is secure whatever they do and they may share their home directory with whole planet just to serve a single file.