Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
Comprehensive guide and commands for securing macOS systems, covering encryption, firewalls, DNS, privacy settings, and security hardening
triggers
["how do I secure my Mac","configure macOS security settings","harden macOS privacy","set up FileVault and firewall on Mac","macOS security best practices","disable telemetry on macOS","configure DNS encryption on Mac","lock down macOS system"]
This skill provides comprehensive guidance for securing and hardening macOS systems based on the community-maintained drduh/macOS-Security-and-Privacy-Guide. It covers threat modeling, encryption, firewalls, DNS configuration, privacy settings, and security monitoring.
Overview
The macOS Security and Privacy Guide is a collection of techniques for improving security and privacy on Apple silicon Macs. It targets power users adopting enterprise-standard security and covers:
Threat modeling and asset protection
Full disk encryption with FileVault
Firewall configuration (application and kernel-level)
DNS encryption (DNSCrypt, DoH, DoT)
Browser hardening
System monitoring and audit
Privacy settings and telemetry disabling
Physical security measures
Requirements:
Apple silicon Mac (M1 or newer recommended)
Currently supported macOS version
Administrative access
Installation and Setup
This is a guide repository, not installable software. Access it at:
# Check for updates
softwareupdate --list
# Install all available updatessudo softwareupdate --install --all
# Enable automatic updatessudo softwareupdate --schedule on
# Install security updates onlysudo softwareupdate --install --recommended
FileVault Full Disk Encryption
# Enable FileVault (GUI method preferred for recovery key)sudo fdesetup enable# Check FileVault statussudo fdesetup status
# List FileVault-enabled userssudo fdesetup list
# Add user to FileVaultsudo fdesetup add -usertoadd username
Firmware Password (Legacy Intel Macs)
# Set firmware password (reboot to recovery mode first)# On Apple silicon, use Startup Security Utility instead# Check if firmware password is set (Intel)sudo firmwarepasswd -check
Firewall Configuration
# Enable application firewallsudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
# Enable stealth mode (don't respond to pings)sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on
# Enable loggingsudo /usr/libexec/ApplicationFirewall/socketfilterfw --setloggingmode on
# Block all incoming connectionssudo /usr/libexec/ApplicationFirewall/socketfilterfw --setblockall on
# Allow signed applicationssudo /usr/libexec/ApplicationFirewall/socketfilterfw --setallowsigned on
# Check firewall statussudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
Packet Filter (pf) Configuration
# Create pf rules filesudo nano /etc/pf.conf
# Example pf.conf rules:# Block all incoming traffic except SSH and web# scrub-anchor "com.apple/*"# nat-anchor "com.apple/*"# rdr-anchor "com.apple/*"# dummynet-anchor "com.apple/*"# anchor "com.apple/*"# load anchor "com.apple" from "/etc/pf.anchors/com.apple"# # block all# pass out proto {tcp, udp, icmp} keep state# pass in proto tcp to any port {22, 80, 443} keep state# Enable pfsudo pfctl -e
# Load rulessudo pfctl -f /etc/pf.conf
# Check pf statussudo pfctl -s info
# View active rulessudo pfctl -s rules
# Disable pfsudo pfctl -d
# List listening ports and processessudo lsof -i -P -n | grep LISTEN
# Monitor network connections
nettop -P -L 0
# Use Little Snitch alternative - lulu (free)
brew install --cask lulu
# Monitor DNS queriessudo tcpdump -i any -n port 53
# Monitor all network trafficsudo tcpdump -i any -n
# View network statistics
netstat -an
# Check active network connections
lsof -i
Process and Execution Monitoring
# Monitor running processes
ps aux
# Real-time process monitoring
top -o cpu
# Monitor process launchessudo opensnoop
# Monitor file system accesssudo fs_usage
# List loaded kernel extensions
kextstat
# Check for suspicious login items
osascript -e 'tell application "System Events" to get the name of every login item'# List LaunchAgents and LaunchDaemonsls -la ~/Library/LaunchAgents/
ls -la /Library/LaunchAgents/
sudols -la /Library/LaunchDaemons/
User Account Security
Admin and Standard User Setup
# Create standard user accountsudo dscl . -create /Users/standarduser
sudo dscl . -create /Users/standarduser UserShell /bin/bash
sudo dscl . -create /Users/standarduser RealName "Standard User"sudo dscl . -create /Users/standarduser UniqueID 503
sudo dscl . -create /Users/standarduser PrimaryGroupID 20
sudo dscl . -create /Users/standarduser NFSHomeDirectory /Users/standarduser
sudo dscl . -passwd /Users/standarduser
# Create home directorysudo createhomedir -c -u standarduser
# Remove admin user from admin group (after creating another admin)sudo dseditgroup -o edit -d username -t user admin
# Require password immediately after sleep/screensaver
defaults write com.apple.screensaver askForPassword -int 1
defaults write com.apple.screensaver askForPasswordDelay -int 0
# Set screen lock timeout (in seconds)
defaults -currentHost write com.apple.screensaver idleTime -int 300
# Securely delete file (write random data)rm -P sensitive_file.txt
# Use srm (secure remove) - install first
brew install srm
srm -v sensitive_file.txt
# Wipe free space (limited effectiveness on SSD)
diskutil secureErase freespace 0 /Volumes/Macintosh\ HD
# Note: SSDs use wear-leveling, making secure deletion difficult# FileVault encryption is the best protection for SSDs
Backup Security
Time Machine Encrypted Backup
# Format external drive as encrypted
diskutil list
diskutil eraseDisk JHFS+ "Backup" GPT disk2
# Enable FileVault on backup disk via System Preferences# Or use diskutil:
diskutil apfs encryptVolume /Volumes/Backup -user disk
# Set up Time Machinesudo tmutil setdestination /Volumes/Backup
# Start backupsudo tmutil startbackup
# Exclude directories from backupsudo tmutil addexclusion ~/Downloads
sudo tmutil addexclusion ~/.Trash
# List exclusionssudo tmutil isexcluded ~/Downloads
Encrypted Archives
# Create encrypted zip
zip -er archive.zip /path/to/files/
# Create encrypted disk image
hdiutil create -encryption AES-256 -size 1g -fs APFS -volname "Secure" ~/secure.dmg
# Mount encrypted image
hdiutil attach ~/secure.dmg
# Create encrypted tar archive with gpg
tar czf - /path/to/files/ | gpg -c > backup.tar.gz.gpg
# Decrypt and extract
gpg -d backup.tar.gz.gpg | tar xzf -
Lockdown Mode
# Enable Lockdown Mode via System Settings# Security & Privacy → Lockdown Mode# Lockdown Mode disables:# - Most message attachment types# - Link previews# - FaceTime features# - Web fonts and complex web technologies# - Shared albums in Photos# - Device enrollment and configuration profiles# Check if Lockdown Mode is enabled
defaults read /Library/Preferences/com.apple.security.lockdownmode.plist LockdownModeEnabled
Certificate Authorities
Managing Trusted CAs
# List system certificates
security dump-keychain /System/Library/Keychains/SystemRootCertificates.keychain
# Export certificates
security find-certificate -a -p /System/Library/Keychains/SystemRootCertificates.keychain > system-certs.pem
# Trust custom CAsudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain custom-ca.crt
# Remove trust from CAsudo security delete-certificate -c "Certificate Name" /Library/Keychains/System.keychain
# List trusted certificates
security find-certificate -a /Library/Keychains/System.keychain
# Check if firewall is blocking connectionssudo /usr/libexec/ApplicationFirewall/socketfilterfw --listapps
# Allow specific applicationsudo /usr/libexec/ApplicationFirewall/socketfilterfw --add /Applications/MyApp.app
# Remove application from firewallsudo /usr/libexec/ApplicationFirewall/socketfilterfw --remove /Applications/MyApp.app
# Reset firewall to defaultssudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate off
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
DNS Not Working
# Flush DNS cachesudo dscacheutil -flushcache
sudo killall -HUP mDNSResponder
# Check DNS servers
scutil --dns
# Reset DNS to automatic (DHCP)
networksetup -setdnsservers Wi-Fi Empty
# Test DNS resolution
dig example.com
nslookup example.com
# Check if dnscrypt-proxy is running
brew services list | grep dnscrypt
VPN Connection Issues
# Kill stuck VPN processessudo killall openvpn
# Check VPN logstail -f /var/log/system.log | grep vpn
# Reset network settingssudo ifconfig en0 down
sudo ifconfig en0 up
# Restart network servicesudo networksetup -setnetworkserviceenabled Wi-Fi off
sudo networksetup -setnetworkserviceenabled Wi-Fi on
SIP and Security Issues
# Check SIP status
csrutil status
# To disable SIP (not recommended):# 1. Reboot into Recovery Mode (hold Cmd+R on Intel, hold Power on Apple Silicon)# 2. Open Terminal from Utilities menu# 3. Run: csrutil disable# 4. Reboot# Re-enable SIP# csrutil enable# Check code signing
codesign -v /Applications/App.app
spctl -a -v /Applications/App.app
