Mac OS X Server Security Configuration For Version 10.4 or Later Second Edition K Apple Inc. Apple, the Apple logo, Airport, AppleShare, AppleTalk, © 2007 Apple Inc. All rights reserved. FireWire, Keychain, Mac, Macintosh, Mac OS, QuickTime, WebObjects, Xgrid, and Xserve are trademarks of Apple The owner or authorized user of a valid copy of Inc., registered in the U.S. and other countries. Apple Mac OS X Server software may reproduce this Remote Desktop and Finder are trademarks of Apple Inc. publication for the purpose of learning to use such software. No part of this publication may be reproduced Adobe and PostScript are trademarks of Adobe Systems or transmitted for commercial purposes, such as selling Incorporated. copies of this publication or for providing paid-for support services. The Bluetooth® word mark and logos are owned by the Bluetooth SIG, Inc. and any use of such marks by Every effort has been made to ensure that the Apple Inc. is under license. information in this manual is accurate. Apple Inc., is not responsible for printing or clerical errors. Intel and Intel Core are trademarks of Intel Corp. in the U.S. and other countries. Apple 1 Infinite Loop UNIX is a registered trademark in the United States and Cupertino CA 95014-2084 other countries, licensed exclusively through 408-996-1010 X/Open Company, Ltd. www.apple.com Other company and product names mentioned herein The Apple logo is a trademark of Apple Inc., registered are trademarks of their respective companies. Mention in the U.S. and other countries. Use of the “keyboard” of third-party products is for informational purposes Apple logo (Option-Shift-K) for commercial purposes only and constitutes neither an endorsement nor a without the prior written consent of Apple may recommendation. Apple assumes no responsibility with constitute trademark infringement and unfair regard to the performance or use of these products. competition in violation of federal and state laws. 019-0923/02-15-07 2 Contents Preface 15 About This Guide 15 Target Audience 15 What’s New in Version 10.4 16 What’s in This Guide 18 Using This Guide 18 Using Onscreen Help 19 The Mac OS X Server Suite 20 Getting Documentation Updates 21 Getting Additional Information 22 Acknowledgments Chapter 1 23 Introducing Mac OS X Server Security Architecture 24 Security Architecture Overview 24 UNIX Infrastructure 24 Access Permissions 24 Security Framework 25 Layered Security Defense 26 Built-In Security Services 26 Keychain Services 26 Secure Transport Services 26 Certificate, Key, and Trust Services 26 Authorization Services 27 Smart Card Services 27 Directory Services 27 Open Directory Authentication Architecture 28 Policy Management 28 Authorization versus Authentication 29 Network Deployment Considerations 29 Network Isolation 29 Functional Separation 30 Using Accounts Securely 3 Chapter 2 31 Installing Mac OS X Server 31 System Installation Overview 32 Disabling the Open Firmware Password 33 Installing Locally from CD or DVD 34 Installing Remotely from Disks or Images 35 Installing Remotely from the Installation Discs 36 Installing Remotely from an Image 37 Installing from the Command Line 38 Using the installer Command Tool for Installation 38 Using the asr Command Tool for Installation 39 Initializing Server Setup 39 Using Server Assistant 39 Setting Up a Secure Local Server 41 Setting Up a Secure Remote Server 42 Updating System Software 43 Updating from an Internal Software Update Server 43 Updating from Internet-Based Software Update Servers 44 Updating Manually from Installer Packages 45 Verifying the Integrity of Software 45 Repairing Disk Permission 45 Kinds of Permissions 46 POSIX Permissions Overview 46 ACL Permissions Overview 46 Using Disk Utility to Repair Disk Permissions Chapter 3 49 Protecting Hardware and Securing Global System Settings 49 Protecting Hardware 50 Disabling Hardware 51 Removing Mac OS 9 52 Using the Command Line to Remove Mac OS 9 52 Running Mac OS 9 from a CD or DVD 53 Running Mac OS 9 from a Disc Image 54 Securing System Startup 55 Using the Open Firmware Password Application 56 Configuring Open Firmware Settings 58 Using Command-Line Tools to Secure Startup 58 Requiring a Password for Single-User Mode 59 Configuring Access Warnings 59 Enabling Access Warnings for the Login Window 60 Enabling Access Warnings for the Command Line 61 Securing Fast User Switching 61 Displaying a Login Warning Banner 61 Setting a Local Login Warning Banner 4 Contents 62 Setting a Login Warning Banner for Remote Services Chapter 4 63 Securing Local Server Accounts 63 Types of User Accounts 64 General Guidelines for Securing Accounts 64 Defining User IDs 67 Securing Local Nonadministrator Accounts 69 Securing Local Server Administrator Accounts 70 Securing a Local Directory Domain Administrator Account 70 Securing the Local System Administrator Account 71 Restricting sudo Usage 72 Using Strong Authentication 73 Using Password Assistant 74 Using Smart Cards 74 Using Tokens 74 Using Biometrics 75 Storing Credentials 76 Using the Default User Keychain 77 Securing Keychain Items 77 Creating Additional Keychains 79 Using Portable and Network-Based Keychains Chapter 5 81 Securing System Preferences 83 Securing .Mac Preferences 85 Securing Accounts Preferences 88 Securing Appearance Preferences 89 Securing Bluetooth Preferences 90 Securing CDs & DVDs Preferences 90 Securing Classic Preferences 93 Securing Dashboard and Exposé Preferences 94 Securing Date & Time Preferences 95 Securing Desktop & Screen Saver Preferences 97 Securing Displays Preferences 97 Securing Dock Preferences 98 Securing Energy Saver Preferences 99 Securing International Preferences 99 Securing Keyboard & Mouse Preferences 100 Securing Network Preferences 102 Securing Print & Fax Preferences 103 Securing QuickTime Preferences 104 Securing Security Preferences 105 Securing Sharing Preferences 106 Securing Software Update Preferences Contents 5 107 Securing Sound Preferences 108 Securing Speech Preferences 109 Securing Spotlight Preferences 111 Securing Startup Disk Preferences 112 Securing Universal Access Preferences Chapter 6 113 Securing Data and Using Encryption 113 Understanding Permissions 113 Setting POSIX Permissions 114 Viewing POSIX Permissions 114 Interpreting POSIX Permissions 116 Modifying POSIX Permissions 116 Setting File and Folder Flags 116 Viewing Flags 116 Modifying Flags 117 Setting ACL Permissions 117 Setting ACL Permissions Using Workgroup Manager 118 Setting ACL Permissions for a File 119 Setting Global File Permissions 120 Securing Your Home Folder 120 Encrypting Home Folders 121 Using FileVault Master Keychain 122 Centrally Managing FileVault 123 Encrypting Portable Files 123 Creating a New Encrypted Disk Image 125 Creating an Encrypted Disk Image from Existing Data 125 Securely Erasing Data 126 Using Disk Utility to Securely Erase a Disk or Partition 127 Using Command-Line Tools to Securely Erase Files or Folders 127 Using Secure Empty Trash 128 Using Disk Utility to Securely Erase Free Space 128 Using Command-Line Tools to Securely Erase Free Space Chapter 7 129 Securing Accounts, Share Points, and Network Views 129 Open Directory and Active Directory 130 Configuring Share Points 131 Configuring Workgroup Manager for Working with Share Points 131 Disabling Share Points 131 Restricting Access to a Share Point 133 Configuring AFP Share Points 133 Configuring SMB/CIFS Share Points 133 Configuring NFS Share Points 134 Configuring FTP Share Points 6 Contents 135 Controlling Network Views 136 Securing Accounts 136 Configuring User Accounts 138 Configuring Group Accounts 139 Configuring Computer Lists 140 Managing Preferences 141 Understanding Managed Preference Interaction 142 Choosing How to Manage Preferences 143 Setting the Permanence of Management 145 Managing Applications Preferences 146 Managing Classic Preferences 147 Managing Dock Preferences 149 Managing Energy Saver Preferences 150 Managing Finder Preferences 152 Managing Internet Preferences 155 Managing Login Preferences 159 Managing Media Access Preferences 161 Managing Mobility Preferences 163 Managing Network Preferences 165 Managing Printing Preferences 167 Managing Software Update Preferences 168 Managing System Preferences Preferences 169 Disabling Widgets 169 Managing Universal Access Preferences Chapter 8 171 Managing Certificates 171 Understanding Public Key Infrastructure 172 Public and Private Keys 173 Certificates 173 Certificate Authorities 173 Identities 173 Self-Signed Certificates 174 Readying Certificates 174 Using Certificate Manager 175 Requesting a Certificate from a CA 176 Creating a Self-Signed Certificate 176 Importing a Certificate 177 Modifying Certificates 177 Editing a Certificate 178 Deleting a Certificate 178 Creating a Certificate Authority 178 Using Certificate Assistant 178 Creating a CA Using Certificate Assistant Contents 7 180 Creating a CA from the Command Line 180 Signing a Newly Created CA 181 Storing the CA Private Key 181 Creating Folders and Files for SSL 182 Deploying Server Certificates to Clients Chapter 9 183 Setting General Protocols and Access to Services 183 Setting General Protocols 184 Disabling NTP and SNMP 185 Enabling SSH 186 Setting the Server’s Host Name 187 Setting the Date and Time 187 Setting Up Certificates 188 Setting Service Access Privileges Chapter 10 191 Securing Remote Access Services 191 Securing Remote Login 192 Configuring Secure Shell 192 Modifying the SSH Configuration File 194 Generating Key Pairs for Key-Based SSH Connections 195 Updating SSH Key Fingerprints