Mac OS X Installation security measures
This is one section of an overall document. The overall publication covers the
setup of a Mac OS X Server. This part is being made public to help others
secure their machines.
This document outlines some security measures for the Mac OS X Server 1.0 - 1.2 platform.
While Mac OS X Server (OSXS) is a fairly secure environment out of the box, these basic measures
help create a more secure computing environment. They should be taken by all
personnel running a Mac OSXS on the WSU campus network.
The measures outlined here are based
on a Mac OS X Server providing Mac services to a lab environment. These measures
can be modified to work on other configurations. The goal is to provide an example
of security measures that can be applied to a Mac OS X Server. While
services may differ from server
to server, the necessary service options apply to most configurations
With time and practice, these options can be highly configured and can provide a good
degree of protection. As with all
security measures, however, one must be
diligent to keep up with updates to applications, check logs, and
There are documents scattered throughout the web about BSD security: Mac OSXS
is based on the Mach kernel and BSD UNIX. The most relevant information about Mac
OSXS was gleaned from those documents and consolidated for the following
ED: It is recommended that you revisit this page. As Mac OS X evolves,
updates will be posted for Server and the new OS X.
All services listed here, were tested on a Macintosh G4 running
Mac OS X Server 1.2. I have installed and configured the measures mentioned
in this article. It is recommended that all Mac OSXS machines be updated to the latest
release version 1.2. This update is not available from the web site; a CD must be obtained
Looking at the server
After a default installation of Mac OSXS, be sure and check the services that are
available on the machine and determine which ones are turned On. If you don't already have
a copy of Essential System Administration
by O'Reilly & Assoc., procure one. It will be
one of the best computer investments you ever make. This books goes over the basics
of system administration for UNIX systems. They cover how to setup a UNIX system
and the basics needed to run such a server.
To begin, a command to view actively running processes is ps . This
command shows any service or application that is running on the system.
The ps command is from Berkley UNIX. Is provides a method to list all processes
running on a system, among other information. There are many options for ps, check
the man pages for more
on the various options. The options I use regularly are -aux, for the command
ps aux. This lists all of the processes currently running,
the user associated with them, memory and processor usage, and the executable
associated to the process among other information. Below is an example of the
bash-2.02$ ps aux
USER PID %CPU %MEM VSIZE RSIZE TT STAT TIME COMMAND
root 547 0.4 1.4 38.7M 3.64M ? S 3:04 AppleFileServer /tmp/afpser
petey 3576 0.4 0.4 2.86M 1.04M p2 S 0:00 -bash (bash)
daemon 459 0.0 0.3 4.30M 888K ? I 0:00 -f /System/Library/RemoteAd
root -1 0.0 0.0 4K 0K ? ?W< 0:00 <mach-task>
root 0 0.0 8.1 196M 20.8M ? U 1:31 (kernel idle)
root 1 0.0 0.3 2.29M 660K ? I 0:00 /sbin/init -v
root -1 0.0 8.1 196M 20.8M ? I < 0:00 <mach-task>
root -1 0.0 0.0 0K 0K ? I 0:00 <mach-task>
root 2 0.0 0.1 2.27M 252K ? SW 0:01 /sbin/mach_init -v
root 3 0.0 0.8 4.63M 1.94M ? IW 0:00 /usr/sbin/kern_loader -n
root 65 0.0 0.2 2.28M 404K ? S 0:00 update
root 152 0.0 0.2 6.88M 628K ? S 0:00 nmserver -nonet -secure
root -1 0.0 0.0 0K 0K ? S 0:00 <mach-task>
There are several means by which you can check the services
that are started by the system on boot / reboot: the Network Manager application,
and the inetd.conf file.
Your first look at the services that are running on Mac OSXS might be from the
Network Manager application. The application is found under the Apple Menu -> Computer
Settings. From there, with root access, you can turn off and on services.
You can also use the /etc/inetd.conf to check on the services.
UNIX uses this file to get a detailed picture of the services that will or will
not run on the machine. It lists the protocol that is used, by whom it is used,
and the application it is to use. To use this approach, enter and execute:
bash-2.02$ more /etc/inetd.conf
# Internet server configuration database
# @(#)inetd.conf 5.4 (Berkeley) 6/30/90
# Items with double hashes in front (##) are not yet implemented in the OS.
#finger stream tcp nowait nobody /usr/libexec/fingerd fingerd -s
#ftp stream tcp nowait root /usr/libexec/ftpd ftpd -l
ftp stream tcp nowait root /usr/libexec/tcpd ftpd -l
#login stream tcp nowait root /usr/libexec/rlogind rlogind
#nntp stream tcp nowait usenet /usr/libexec/nntpd nntpd
#ntalk dgram udp wait root /usr/libexec/ntalkd ntalkd
#shell stream tcp nowait root /usr/libexec/rshd rshd
telnet stream tcp nowait root /usr/libexec/telnetd telnetd
#uucpd stream tcp nowait root /usr/libexec/uucpd uucpd
#comsat dgram udp wait root /usr/libexec/comsat comsat
#tftp dgram udp wait nobody /usr/libexec/tftpd tftpd /private/tftpboot
#bootps dgram udp wait root /usr/libexec/bootpd bootpd
##pop3 stream tcp nowait root /usr/local/libexec/popper popper
##imap4 stream tcp nowait root /usr/local/libexec/imapd imapd
This is just a short clip of the file. The actual file is much longer.
You can also use this later in configuring security applications.
After you check the services, open the /var/log. This file contains
the logs for most of the applications. Review the logs and note the
information that they collect. The information that they contain could
help you when you need to look for anomalies in system activity.
Services Turned Off
Turning Off any service that is not in use proves a prime starting
place in securing your
system: running services offer doorways into the system. The following
lists those services that are usually unnecessary on the WSU campus network.
Mailserver - Sendmail
BootP Server - listed in inetd.conf
TFTP Server - listed in inetd.conf
NTP - listed in inetd.conf
Remote Mach IPC
You can use the Network Manager application to turn off most services.
The application is found under the Apple Menu,
under the Computer Settings folder. While you can view the settings as any user,
you must have access to root or be root to make any changes from this application.
Note that Network Manager does not list all of the services running on Mac
Services Turned On
Some services are needed for connectivity or other applications such as serving
web pages. If services are
needed and running, it is important to know the users of those
services. Some of the daemons keep logs; these logs are commonly found under
/var/log/hosts.allow restrict file
access by hostnames
AppleShare File Services
Macintosh Manager Server
httpd - Apache
I found three packages that are of a great help when securing the Mac OS X Server.
After removing unused services, there are methods for securing the remaining services
running. In each case, a person has taken the time to lay out very good directions
for installing and configuring these packages.
The original articles can be found on the wonderful
Stepwise web site by Scott Anguish.
tcpwrappers - (Jay Swan) while installed by default in Mac OSXS, they are not setup for use. tcpwrappers
allow for restricted access and logging of services such as Telnet and FTP. The
configuration is straight forward. It uses a configuration file, a
hosts.allow and hosts.deny file to
manage who can and cannot access the service/system.
It can contain individual workstations or entire domains. General setup allows access
to WSU clients in general and no one from the outside our domain.
sshd - (Joshua Marker) used in place of Telnet. Secure shell provides an encrypted session between the
client and server. Telnet, even with tcpwrapper, is still vulnerable to packet sniffing.
The documentation is for setting up and using sshd version1. Work is progressing on
getting sshd version 2 up and running. This installation will not only install the
ssh daemon, but also the ssh client. In order to use secure shell to connect to the
Mac OSXS box, you will need a ssh client. There are a couple of them available for the
Macintosh via the web.
xinetd - this is a new package
I just learned about a couple of days ago. I have only had a chance to download
the article written about it. It seems to be a good package and another security
measure to consider if your system is on a network. It replaces tcpwrappers and inetd
while also providing rcpmapping facilities. When I have a chance to
download, build, and configure it, I will update this page with some results.
portmapper - this is a port of the secure portmapper server. This allows any RPC
ports to be remapped so outsiders cannot see which ones are being used. This is a useful
option if you are using remote mounting of volumes with NFS.
Head over to /var/log, in here is where the logs for most applications
are kept. These are files of what functions services have performed. While files
are useful for keeping information about what happens on and with a system, they
can get out of hand quickly. Mac OSXS is setup to archive all logs, it never
deletes them. It is up to the System Administrator to go through the logs, collect
any relevant information, and purge the remaining logs.
Go through each of the logs and see what information is collected. It could
help later on if you need to look for anominalies in system activity. It also
helps in determining what information should be kept from each of the logs.
Create a plan for how long logs will be kept. On a busy system the logs can
consume quite a bit of room. It would be best to back them up to tape and keep
them for some period of time. Check with the Computing and Telecommunications
Serives for guidelines on how long to keep your system's logs.
It is important to keep watch over accounts. They are the easiest way into a system.
There are some simple steps one can take to help ensure you don't get bitten
by a problem with an account. If you plan on having other people sharing your
system, you have to make sure that some ground rules are in place. Let people
know up front what you expect from usage of your system - what and what not is
The University has standard usage policies for all computer accounts.
First is to make sure that every account has a password. At times, people will
create accounts and allow the user to enter a password later, or not assign
a password at all. This allows someone easy access onto your system. An example
rule for usage could be that any accounts found with a default or no password
Second, use permissions to restrict file access. There are many approaches as to
approaching assigning permissions. Check Essential System Administration for some
of them. The theory behind permissions to to restrict if a user can read, write,
or execute any given file. As a System Administrator, one must keep an eye over
what permissions are handed out. As quickly as they can protect a file, permissions
can be set to let everyone on the system to use the file.
Watch for logins from systems or domains you are unfamiliar with. This could
be the first sign of an intruder. Remember to take a rational approach to such
a problem, it could be a colleague logging in from a remote site to check on
I have pointed one some security measures that can be applied to the Mac OS X Server
platform. There are new measures coming over to Mac OSXS on a regular basis.
These basic measures can help make your
server more secure, protecting your and your client's data. Use them as a starting
point for your own research into UNIX security. As the Mac OS moves to the UNIX
world, it is important to know what the system is capable of.
Copyright © 2000 Peter N. Hein, Wright State University - SecureMac.com
Computing and Telecommunication Services - Network Services
Jay Swan - tcpwrapper article and Joshua Marker - ssh article
tcpwrapper and ssh acrticles reprinted with permission from the authors.
All Rights Reserved
References and Sources.
Created May 2000
Revision 1.5 - 18 July 2000