Mac OS X Security Configuration for Version 10.5 Leopard
Total Page:16
File Type:pdf, Size:1020Kb
Mac OS X Security Configuration For Version 10.5 Leopard K Apple Inc. Adobe and PostScript are trademarks of Adobe Systems © 2008 Apple Inc. All rights reserved. Incorporated. The owner or authorized user of a valid copy of The Bluetooth® word mark and logos are registered Mac OS X software may reproduce this publication for trademarks owned by Bluetooth SIG, Inc. and any use of the purpose of learning to use such software. No part of such marks by Apple is under license. this publication may be reproduced or transmitted for commercial purposes, such as selling copies of this Intel, Intel Core, and Xeon are trademarks of Intel Corp. publication or for providing paid-for support services. in the U.S. and other countries. Every effort has been made to ensure that the Java™ and all Java-based trademarks and logos are information in this manual is accurate. Apple is not trademarks or registered trademarks of Sun responsible for printing or clerical errors. Microsystems, Inc. in the U.S. and other countries. Apple PowerPC™ and the PowerPC logo™ are trademarks of 1 Infinite Loop International Business Machines Corporation, used Cupertino, CA 95014-2084 under license therefrom. 408-996-1010 UNIX is a registered trademark of The Open Group. www.apple.com X Window System is a trademark of the Massachusetts The Apple logo is a trademark of Apple Inc., registered Institute of Technology in the U.S. and other countries. Use of the “keyboard” Apple logo (Option-Shift-K) for commercial purposes This product includes software developed by the without the prior written consent of Apple may University of California, Berkeley, FreeBSD, Inc., The constitute trademark infringement and unfair NetBSD Foundation, Inc., and their respective competition in violation of federal and state laws. contributors. Apple, the Apple logo, AirPort, AppleScript, AppleShare, Other company and product names mentioned herein AppleTalk, Bonjour, Boot Camp, ColorSync, Exposé, are trademarks of their respective companies. Mention FileVault, FireWire, iCal, iChat, iMac, iSight, iTunes, of third-party products is for informational purposes Keychain, Leopard, Mac, Mac Book, Macintosh, Mac OS, only and constitutes neither an endorsement nor a QuickTime, Safari, Xgrid, Xsan, and Xserve are recommendation. Apple assumes no responsibility with trademarks of Apple Inc., registered in the U.S. and other regard to the performance or use of these products. countries. 019-1255/2008-05-19 Apple Remote Desktop, Finder, MacBook Air, QuickTime Broadcaster, Spotlight, and Time Machine are trademarks of Apple Inc. .Mac is a service mark of Apple Inc., registered in the U.S. and other countries. 1 Contents Preface 11 About This Guide 11 Target Audience 11 What’s New in Version 10.5 12 What’s in This Guide 13 Using This Guide 13 Using Onscreen Help 13 Mac Help 14 The Mac OS X Server Administration Guides 15 Viewing PDF Guides on Screen 15 Printing PDF Guides 15 Getting Documentation Updates 16 Getting Additional Information 17 Acknowledgments Chapter 1 19 Introduction to Mac OS X Security Architecture 20 Security Architectural Overview 20 UNIX Infrastructure 20 Access Permissions 20 Security Framework 21 Layered Security Defense 22 Mandatory Access Controls 22 Credential Management 22 Network Security 22 Public Key Infrastructure (PKI) 23 Authorization Versus Authentication 23 Security Features in Mac OS X v10.5 23 Mandatory Access Controls 24 Sandboxing Processes 25 Parental Controls 25 Quarantine Applications 25 Application-Based Firewall 26 Signed Applications 26 Smart Card Unlock of FileVault and Encrypted Storage 3 27 Sharing and Collaboration Services 27 Enhanced Encrypted Disk Image Cryptography 28 Enhanced VPN Compatibility and Integration 28 Improved Secure Connectivity Chapter 2 29 Installing Mac OS X 29 System Installation Overview 29 Disabling the Firmware Password 30 Installing from DVD 31 Installing from the Network 31 Restoring from Preconfigured Disk Images 31 Initial System Setup 32 Using Setup Assistant 32 Creating Initial System Accounts 33 Setting Correct Time Settings 33 Updating System Software 34 Updating from an Internal Software Update Server 35 Updating from Internet Software Update Servers 36 Updating Manually from Installer Packages 37 Verifying the Integrity of Software 37 Repairing Disk Permissions 38 POSIX Permissions Overview 38 ACL Permissions Overview 38 Using Disk Utility to Repair Disk Permissions Chapter 3 41 Protecting System Hardware 41 Protecting Hardware 42 Preventing RF Eavesdropping 42 Understanding RF Security Challenges 43 OS Components 43 Removing Wi-Fi Support Software 44 Removing Bluetooth Support Software 45 Preventing Unauthorized Recording 45 Removing Audio Recording Support Software 46 Removing Video Recording Support Software 47 Preventing Data Port Access 47 Removing USB Support Software 48 Removing FireWire Support Software 49 System Hardware Modifications 49 Authorized AppleCare Certified Technicians Chapter 4 51 Securing Global System Settings 51 Securing System Startup 4 Contents 52 PowerPC-Based Systems 52 Using the Firmware Password Utility 53 Configuring Open Firmware Settings 54 Using Command-Line Tools for Secure Startup 54 Intel-Based Systems 55 Configuring Access Warnings 55 Enabling Access Warnings for the Login Window 56 Understanding the AuthPlugin Architecture 57 Understanding the BannerSample Project 57 Enabling Access Warnings for the Command Line Chapter 5 59 Securing Accounts 59 Types of User Accounts 60 Guidelines for Creating Accounts 60 Defining User IDs 61 Securing the Guest Account 62 Securing Nonadministrator Accounts 62 Controlling Local Accounts with Parental Controls 64 Securing External Accounts 64 Protecting Data on External Volumes 64 Securing Directory-Based Accounts 65 Securing Administrator Accounts 65 Securing the System Administrator Account 67 Understanding Directory Domains 68 Understanding Network Services, Authentication, and Contacts 69 Configuring LDAPv3 Access 69 Configuring Active Directory Access 70 Using Strong Authentication 70 Using Passwords 71 Using Kerberos 72 Using Smart Cards 73 Using Tokens 73 Using Biometrics 74 Setting Global Password Policies 74 Storing Credentials 75 Using the Default User Keychain 76 Creating Additional Keychains 77 Securing Keychains and Their Items 78 Using Smart Cards as Keychains 79 Using Portable and Network-Based Keychains Chapter 6 81 Securing System Preferences 81 System Preferences Overview Contents 5 83 Securing .Mac Preferences 85 Securing Accounts Preferences 88 Securing Appearance Preferences 89 Securing Bluetooth Preferences 90 Securing CDs & DVDs Preferences 91 Securing Date & Time Preferences 93 Securing Desktop & Screen Saver Preferences 95 Securing Display Preferences 95 Securing Dock Preferences 96 Securing Energy Saver Preferences 98 Securing Exposé & Spaces Preferences 99 Securing International Preferences 99 Securing Keyboard & Mouse Preferences 100 Securing Network Preferences 101 Securing Parental Control Preferences 104 Securing Print & Fax Preferences 106 Securing QuickTime Preferences 107 Securing Security Preferences 108 General Security 109 FileVault Security 110 Firewall Security 112 Securing Sharing Preferences 114 Securing Software Update Preferences 115 Securing Sound Preferences 116 Securing Speech Preferences 118 Securing Spotlight Preferences 120 Securing Startup Disk Preferences 121 Securing Time Machine Preferences 122 Securing Universal Access Preferences Chapter 7 123 Securing Data and Using Encryption 123 Understanding Permissions 124 Setting POSIX Permissions 124 Viewing POSIX Permissions 125 Interpreting POSIX Permissions 126 Modifying POSIX Permissions 126 Setting File and Folder Flags 126 Viewing Flags 126 Modifying Flags 127 Setting ACL Permissions 127 Modifying ACL Permissions 128 Setting Global File Permissions 129 Securing User Home Folders 6 Contents 130 Encrypting Home Folders 131 Overview of FileVault 132 Managing FileVault 132 Managing the FileVault Master Keychain 134 Encrypting Portable Files 134 Creating an Encrypted Disk Image 135 Creating an Encrypted Disk Image from Existing Data 136 Creating Encrypted PDFs 136 Securely Erasing Data 137 Configuring Finder to Always Securely Erase 137 Using Disk Utility to Securely Erase a Disk or Partition 138 Using Command-Line Tools to Securely Erase Files 139 Using Secure Empty Trash 139 Using Disk Utility to Securely Erase Free Space 139 Using Command-Line Tools to Securely Erase Free Space Chapter 8 141 Securing System Swap and Hibernation Storage 141 System Swap File Overview 142 Encrypting System Swap Chapter 9 143 Avoiding Multiple Simultaneous Account Access 143 Avoiding Fast User Switching Chapter 10 145 Ensuring Data Integrity with Backups 145 Understanding the Time Machine Architecture 145 Deleting Permanently from Time Machine backups 146 Storing Backups Inside Secure Storage 146 Restoring Backups from Secure Storage Chapter 11 147 Information Assurance with Applications 147 Protecting Data While Using Apple Applications 147 Mail Security 148 Enabling Account Security 149 Signing and Encrypting Mail Messages 150 Web Browsing Security with Safari 151 Verifying Server Identity 152 Client-Side Authentication 152 Managing Data Communication and Execution 152 Opening Safe Files 153 Nonsecure Forms 154 Syncing Bookmarks 154 AutoFill 155 Controlling Web Content 155 Cookie Storage or Tracking Information Contents 7 156 Proxies 156 Securing File Downloads 156 Instant Message Security with iChat AV 157 iChat AV Security 158 Enabling Privacy 158 Enabling Encryption