The Information Assurance Mission at NSA - Hardening Tips for Mac OS X 10.6 "Snow Leopard"

The following trifold contains, in order of importance, high- • Require password "5 seconds" after sleep or screen saver Filename: Needed for:impact tips designed for use by an administrative user of Mac begins com.apple.blued.plist BluetoothOS X 10.6 Snow Leopard. • Disable automatic login com.apple.IIDCAssistant.plist iSightApples official Snow Leopard Security Guide can be found at • Use secure virtual memory com.apple.nis.ypbind.plist NIShttp://www.apple.com/support/security/guides/ • Disable Location Services (if present) com.apple.racoon.plist VPNImportant: System updates may override many of these • Disable remote control infrared receiver (if present) com.apple.RemoteDesktop.PrivilegeProxy.plist ARDconfiguration changes. Achieve their persistence through In the FileVault tab, read the warnings and consider activating com.apple.RFBEventHelper.plist ARDvigilant re-application or management software. FileVault. Consult the Apple Snow Leopard Security Guide com.apple.UserNotificationCenter.plist User notifications for more information. FileVault is recommended for portable com.apple.webdavfs_load_kext.plist WebDAVDont Surf or Read Mail Using Admin Account systems since it can protect data even if the system is stolen. org.postfix.master email serverCreate a non-administrator user in the Accounts pane of System In the Firewall tab, click "Start" to turn firewall on. Next, clickPreferences and use this account for everyday tasks. Only log on "Advanced..." and enable "Block all incoming connections." The following services can be found in /System/Library/in with an administrator account when you need to perform LaunchAgents. Disable them in the same way.system administration tasks. Secure Users Home Folder Permissions Filename: Needed for: com.apple.RemoteUI.plist Remote ControlUse Software Update To prevent users and guests from perusing other users home com.apple.RemoteDesktop.plist ARD folders, run the following command for each home folder:Regularly applying system updates is extremely important. sudo chmod go-rx /Users/usernameFor Internet-connected systems: Open the Software Update Disable Setuid and Setgid Binariespane in System Preferences. Ensure that "Check for Updates" Firmware Password Setuid programs run with the privileges of the files owneris enabled, and set it to "Daily" (or the most frequent setting Set a firmware password that will prevent unauthorized users (which is often root), no matter which user executes them.possible in your environment). There is a command line from changing the boot device or making other changes. Bugs in these programs can allow privilege escalation attacks.version available as well, called softwareupdate. Read its To find setuid and setgid programs, use the commands:man page for more details. Apple provides detailed instructions for Leopard (which apply to Snow Leopard) here: http://support.apple.com/kb/ht1352 find / -perm -04000 -lsFor systems not connected to the Internet: Retrieve updates find / -perm -02000 -lsregularly from www.apple.com/support/downloads. Be sure Disable IPv6 and AirPort when Not Neededto verify that the SHA-1 digest of any download matches the After identifying setuid and setgid binaries, disable setuid anddigest published there, using the following command: Open the Network pane in System Preferences. For every setgid bits (using chmod ug-s programname) on those that network interface listed: are not needed for system or mission operations. /usr/bin/openssl sha1 download.dmg • If it is an AirPort interface but AirPort is not required, The following files should have their setuid or setgid bitsAccount Settings click "Turn AirPort off." disabled unless required. The programs can always have their • Click "Advanced." Click on the TCP/IP tab and set setuid or setgid bits re-enabled later if necessary.Open the Accounts pane in System Preferences. "Configure IPv6:" to "Off" if not needed. If it is an AirPort interface, click on the AirPort tab and enable For more information see Apples Snow Leopard Security GuideDisable Automatic Login and User List: Click on "Login chapter 7.Options." Set "Automatic login" to "Off." Set "Display login "Disconnect when logging out." Filename: Needed For:window as" to "Name and password." Disable Unnecessary Services /System/Library/CoreServices/ RemoteManagement/ARDAgent.app/Contents/ Apple Remote DesktopDisable guest account and sharing: Select the Guest Account MacOS/ARDAgentand then disable it by unchecking "Allow Guest to log in to The following services can be found in /System/Library/ /System/Library/Printers/IOMs/LPRIOM. Printingthis computer." Uncheck "Allow guests to connect to shared LaunchDaemons. Unless needed for the purpose shown in the plugin/Contents/MacOS/LPRIOMHelperfolders." second column, disable each service using the command below, /sbin/mount_nfs NFS which needs the full path specified: /usr/bin/at Job SchedulerSecurity Pane Settings sudo launchctl unload -w /System/Library/ /usr/bin/atq Job SchedulerOpen the Security pane in System Preferences. LaunchDaemons/com.apple.blued.plist /usr/bin/atrm Job Scheduler /usr/bin/chpass Change user infoIn the General tab, ensure that the following are checked: /usr/bin/crontab Job Scheduler

/usr/bin/ipcs IPC statistics from /System/Library/Extensions: The Information /usr/bin/newgrp Change Group IO80211Family.kext Assurance Mission at NSA /usr/bin/postdrop Postfix Mail /usr/bin/postqueue Postfix Mail See the note below for information about removing kext files. /usr/bin/procmail Mail Processor /usr/bin/wall User Messaging Disable Integrated iSight and Sound Input /usr/bin/write User Messaging Hardening Tips The best way to disable an integrated iSight camera is to have /bin/rcp Remote Access (Insecure) an Apple-certified technician remove it. Placing opaque tape /usr/bin/rlogin over the camera is less secure but still helpful. A less persistent /usr/bin/rsh but still helpful method is to remove /System/Library/ /usr/lib/sa/sadc System Activity Reporting Quicktime/QuicktimeUSBVDCDigitizer.component, for /usr/sbin/scselect User-selectable which will prevent some programs from accessing the camera. Mac OS X Network Location To mute the internal microphone, open the Sound preference /usr/sbin/traceroute Trace Network /usr/sbin/traceroute6 Trace Network pane, select the Input tab, and set the microphone input volume level to zero. To disable the microphone, although it disablesConfigure and Use Both Firewalls the use of the sound system, remove the following file from /System/Library/Extensions: 10.6The system includes two firewalls: the ipfw packet-filtering IOAudioFamily.kextfirewall, and the new Application Firewall. The ApplicationFirewall limits which programs are allowed to receive incoming Note on removing kext files: To make the system reflect the removal of kext files, run the following command and reboot: "Snow Leopard"connections, and it should be configured as described in theearlier section Security Pane Settings. sudo touch /System/Library/ExtensionsConfiguring the ipfw firewall configuration requires moretechnical expertise and cannot be fully described here. It Safari Preferencesrequires creating a file with manually written rules (traditionally, Safari will automatically open some files by default. This/etc/ipfw.conf), and also adding a plist file to /Library/ behavior could be leveraged to perform attacks. To disable,LaunchDaemons to make the system read those rules at boot. uncheck "Open safe files after downloading" in the General tab.These rules depend heavily on the network environment and thesystems role in it. To learn more about ipfw rules, see: Unless specifically required, Safaris Java should be disabled to reduce the browsers attack surface. On the Security tab,• the ipfw man page uncheck "Enable Java."• Apples Snow Leopard Security Guide• http://www.freebsd.org/doc/en/books/handbook/ Au Revoir, Bonjour! Bonjour is Apples implementation of Zeroconf which providesDisable Bluetooth and AirPort Devices a network service discovery protocol. Using Bonjour, manyThe best way to disable Bluetooth hardware is to have an Apple- programs advertise their services on the local network tocertified technician remove it. If this is not possible, disable facilitate configuration. While this may be beneficial in someit at the software level by removing the following files from cases, from the security perspective this makes the computer/System/Library/Extensions: unnecessarily visible and generates unwanted network traffic. IOBluetoothFamily.kext Disable Bonjours multicast advertisements with the following Systems and Network Analysis Center IOBluetoothHIDDriver.kext command and reboot: National Security Agency sudo defaults write /System/Library/ 9800 Savage RoadThe best way to disable AirPort is to have the AirPort card LaunchDaemons/com.apple.mDNSResponder Ft. Meade, MD 20755physically removed from the system. If this is not possible, ProgramArguments -array-add http://www.nsa.gov/snacdisable it at the software level by removing the following file "-NoMulticastAdvertisements" 1.0, March 2010

The Information Assurance Mission at NSA - Hardening Tips for Mac OS X 10.6 "Snow Leopard"

by Gianfranco Conti

Accessibility

Upload Details

Usage Rights

Statistics

The Information Assurance Mission at NSA - Hardening Tips for Mac OS X 10.6 "Snow Leopard" Presentation Transcript