macos-security-privacy-hardening

# macOS Security and Privacy Hardening > Skill by [ara.so](https://ara.so) — Security Skills collection. This skill provides comprehensive guidance for securing and hardening macOS systems based on the drduh/macOS-Security-and-Privacy-Guide. It covers security configurations, privacy settings, encryption, firewalls, and monitoring for Apple silicon Macs running currently supported macOS versions. ## Overview The macOS Security and Privacy Guide provides enterprise-standard security practices for: - **System hardening**: Firmware passwords, FileVault encryption, secure boot - **Privacy protection**: Disabling telemetry, configuring DNS encryption, certificate management - **Network security**: Firewalls, VPN configuration, DNS filtering - **Access control**: User account separation, authentication policies - **Monitoring**: System auditing, network monitoring, execution tracking **Important**: This guide targets Apple silicon Macs. Intel Macs have unpatched hardware vulnerabilities and are not recommended. ## Threat Modeling Before applying security measures, create a threat model: ### Identify Assets List what you're protecting: - Devices (phone, laptop) - Data (passwords, browsing history, documents) - Accounts (email, banking, social media) ### Identify Adversaries Define who you're defending against: - **Casual attacker**: Roommate, opportunistic thief - **Criminal**: Malware distribution, financial fraud - **Corporation**: Data collection, behavioral tracking - **Nation state/APT**: Targeted surveillance, advanced persistent threats ### Example Threat Model Table ```markdown | Adversary | Motivation | Capabilities | Mitigation | |--------------|-------------------|----------------------------|--------------------------------------| | Roommate | Privacy invasion | Physical access to device | Use biometrics, screen lock | | Thief | Financial gain | Steal unlocked device | Find My, device encryption | | Criminal | Financial | Malware, social engineering| Sandboxing, automatic updates | | Corporation | Data marketing | Telemetry collection | Block connections, disable telemetry | | Nation State | Surveillance | Network monitoring | E2EE, strong passwords, hardware keys| ``` ## System Installation ### Secure Installation Process 1. **Download macOS**: Use the latest supported version for your Mac ```bash # Check current macOS version sw_vers # Check for updates softwareupdate --list # Install all updates sudo softwareupdate --install --all ``` 2. **Create bootable installer** (if doing clean install): ```bash # Download macOS installer from App Store first sudo /Applications/Install\ macOS\ Sonoma.app/Contents/Resources/createinstallmedia \ --volume /Volumes/MyVolume ``` 3. **System Activation**: Apple silicon Macs require activation with Apple servers during installation for theft prevention ### Initial Setup Skip Apple Account creation during setup if not needed. You can install system updates without an Apple Account: ```bash # Set automatic updates via command line sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticCheckEnabled -bool true sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticDownload -bool true sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticallyInstallMacOSUpdates -bool true ``` ## Admin and User Accounts ### Principle of Least Privilege Separate admin and standard user accounts: ```bash # Create admin account (during initial setup) # Then create standard user account: # List users dscl . list /Users | grep -v '^_' # Create new standard user (replace USERNAME) sudo dscl . -create /Users/USERNAME sudo dscl . -create /Users/USERNAME UserShell /bin/zsh sudo dscl . -create /Users/USERNAME RealName "User Name" sudo dscl . -create /Users/USERNAME UniqueID 501 sudo dscl . -create /Users/USERNAME PrimaryGroupID 20 sudo dscl . -create /Users/USERNAME NFSHomeDirectory /Users/USERNAME sudo dscl . -passwd /Users/USERNAME sudo dscl . -append /Groups/com.apple.access_ssh GroupMembership USERNAME # Create home directory sudo createhomedir -c -u USERNAME # Verify user is not admin dscl . -read /Groups/admin GroupMembership ``` ### Require Administrator Password ```bash # Require password for system preferences sudo security authorizationdb write system.preferences authenticate-admin # Set password requirements sudo pwpolicy -setglobalpolicy "minChars=12 requiresAlpha=1 requiresNumeric=1" ``` ## Firmware Password Set a firmware password to prevent booting from external media: ```bash # Check if firmware password is set sudo firmwarepasswd -check # Set firmware password (Apple silicon) # Must be done in Recovery Mode: # 1. Restart and hold power button until "Loading startup options" appears # 2. Click Options, then Utilities > Startup Security Utility # 3. Turn on firmware password ``` ## FileVault Encryption Enable full-disk encryption: ```bash # Check FileVault status sudo fdesetup status # Enable FileVault (creates recovery key - SAVE THIS SECURELY) sudo fdesetup enable # List FileVault users sudo fdesetup list # Add user to FileVault sudo fdesetup add -usertoadd USERNAME # Change FileVault password sudo fdesetup changepassword -user USERNAME ``` **Important**: Save the recovery key in a secure location. Without it, data is unrecoverable if you forget your password. ## Lockdown Mode For high-threat models, enable Lockdown Mode: ```bash # Check Lockdown Mode status (no direct command, use UI or defaults) defaults read /Library/Preferences/com.apple.security LockdownModeEnabled # Enable via: System Settings > Privacy & Security > Lockdown Mode ``` Lockdown Mode restrictions: - Most message attachments blocked - Web technologies restricted (JIT, fonts) - Wired connections blocked when locked - Configuration profiles blocked ## Firewall Configuration ### Application Layer Firewall ```bash # Enable built-in firewall sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on # Enable logging sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setloggingmode on # Enable stealth mode (don't respond to probes) sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on # Check status sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate ``` ### Packet Filter (PF) Create advanced firewall rules with PF: ```bash # Create PF configuration sudo nano /etc/pf.conf ``` Example `/etc/pf.conf`: ```pf # Interfaces ext_if = "en0" lo_if = "lo0" # Default deny set block-policy drop set skip on lo # Scrub incoming packets scrub in all # Block all by default block log all # Allow established connections pass in quick proto tcp from any to any flags S/SA keep state pass out quick keep state # Allow DNS pass out quick proto {tcp udp} to any port 53 # Allow HTTPS pass out quick proto tcp to any port 443 # Allow NTP pass out quick proto udp to any port 123 # Block Facebook, Google, etc. (example) table <blocklist> persist file "/etc/pf.blocklist" block drop quick from any to <blocklist> ``` Create blocklist: ```bash # Create blocklist file sudo nano /etc/pf.blocklist ``` Example `/etc/pf.blocklist`: ``` # Facebook 31.13.64.0/18 66.220.144.0/20 69.63.176.0/20 # Google 216.58.192.0/19 172.217.0.0/16 ``` Enable PF: ```bash # Check syntax sudo pfctl -vnf /etc/pf.conf # Enable PF sudo pfctl -ef /etc/pf.conf # View rules sudo pfctl -sr # View blocked packets sudo pfctl -si # Flush rules sudo pfctl -F all ``` ## Disable Services Minimize attack surface by disabling unnecessary services: ```bash # Disable Spotlight suggestions defaults write com.apple.safari UniversalSearchEnabled -bool false defaults write com.apple.safari SuppressSearchSuggestions -bool true # Disable Siri defaults write com.apple.assistant.support "Assistant Enabled" -bool false launchctl disable "user/$UID/com.apple.assistantd" launchctl disable "gui/$UID/com.apple.assistantd" sudo launchctl disable 'system/com.apple.assistantd' # Disable Handoff defaults write ~/Library/Preferences/ByHost/com.apple.coreservices.useractivityd ActivityAdvertisingAllowed -bool false defaults write ~/Library/Preferences/ByHost/com.apple.coreservices.useractivityd ActivityReceivingAllowed -bool false # Disable AirDrop defaults write com.apple.NetworkBrowser DisableAirDrop -bool true # Disable Bonjour multicast advertisements sudo defaults write /Library/Preferences/com.apple.mDNSResponder.plist NoMulticastAdvertisements -bool true # Disable infrared receiver sudo defaults write /Library/Preferences/com.apple.driver.AppleIRController DeviceEnabled -bool false # Disable Bluetooth if not needed sudo defaults write /Library/Preferences/com.apple.Bluetooth ControllerPowerState -int 0 sudo killall -HUP bluetoothd ``` ## DNS Configuration ### DNS Encryption with DNSCrypt Install and configure DNSCrypt-proxy: ```bash # Install Homebrew if not already installed /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" # Install dnscrypt-proxy brew install dnscrypt-proxy # Configure DNSCrypt nano $(brew --prefix)/etc/dnscrypt-proxy.toml ``` Example DNSCrypt configuration: ```toml server_names = ['cloudflare', 'cloudflare-ipv6'] listen_addresses = ['127.0.0.1:53'] max_clients = 250 ipv4_servers = true ipv6_servers = true dnscrypt_servers = true doh_servers = true require_dnssec = true require_nolog = true require_nofilter = false force_tcp = false [query_log] file = '/var/log/dnscrypt-proxy/query.log' [nx_log] file = '/var/log/dnscrypt-proxy/nx.log' [sources] [sources.'public-resolvers'] urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md'] cache_file = 'public-resolvers.md' minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3' refresh_delay = 72 ``` Start DNSCrypt: ```bash # Create log directory sudo mkdir -p /var/log/dnscrypt-proxy # Start service sudo brew services start dnscrypt-proxy # Configure system to use DNSCrypt networksetup -setdnsservers Wi-Fi 127.0.0.1 networksetup -setdnsservers Ethernet 127.0.0.1 # Verify DNS scutil --dns ``` ### DNS Configuration Profiles Create a configuration profile for encrypted DNS: ```bash # Create DNS profile XML cat > ~/cloudflare-dns.mobileconfig << 'EOF' <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>PayloadContent</key> <array> <dict> <key>DNSSettings</key> <dict> <key>DNSProtocol</key> <string>HTTPS</string> <key>ServerAddresses</key> <array> <string>1.1.1.1</string> <string>1.0.0.1</string> </array> <key>ServerURL</key> <string>https://cloudflare-dns.com/dns-query</string> </dict> <key>PayloadType</key> <string>com.apple.dnsSettings.managed</string> <key>PayloadIdentifier</key> <string>com.cloudflare.1dot1dot1dot1</string> <key>PayloadUUID</key> <string>A1E3F4E3-5B4A-4F1E-8E3D-123456789ABC</string> <key>PayloadDisplayName</key> <string>Cloudflare DNS</string> <key>PayloadVersion</key> <integer>1</integer> </dict> </array> <key>PayloadType</key> <string>Configuration</string> <key>PayloadIdentifier</key> <string>com.cloudflare.1dot1dot1dot1</string> <key>PayloadUUID</key> <string>B2F4G5F4-6C5B-5G2F-9F4E-234567890BCD</string> <key>PayloadDisplayName</key> <string>Cloudflare DNS</string> <key>PayloadVersion</key> <integer>1</integer> </dict> </plist> EOF # Install profile (will prompt for password) sudo profiles install -path ~/cloudflare-dns.mobileconfig # Verify sudo profiles list ``` ### Hosts File Blocking Block tracking domains via hosts file: ```bash # Backup current hosts file sudo cp /etc/hosts /etc/hosts.backup # Download blocklist (using StevenBlack's hosts file) curl https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts | \ sudo tee -a /etc/hosts # Or create custom entries sudo nano /etc/hosts ``` Example custom hosts entries: ``` # Block Facebook 0.0.0.0 facebook.com 0.0.0.0 www.facebook.com 0.0.0.0 m.facebook.com # Block Google Analytics 0.0.0.0 google-analytics.com 0.0.0.0 www.google-analytics.com 0.0.0.0 ssl.google-analytics.com # Block ads 0.0.0.0 ads.example.com 0.0.0.0 tracking.example.com ``` Flush DNS cache: ```bash sudo dscacheutil -flushcache sudo killall -HUP mDNSResponder ``` ## Certificate Management Manage trusted root certificates: ```bash # List certificates security dump-keychain -d /System/Library/Keychains/SystemRootCertificates.keychain # Export certificates security export -k /System/Library/Keychains/SystemRootCertificates.keychain \ -t certs -o ~/root-certs.pem # Disable certificate (example - Chinese CA) sudo security delete-certificate -c "CNNIC ROOT" \ /System/Library/Keychains/SystemRootCertificates.keychain # Add custom CA (e.g., for corporate proxy) sudo security add-trusted-cert -d -r trustRoot \ -k /Library/Keychains/System.keychain ~/custom-ca.crt # View certificate details security find-certificate -c "Certificate Name" -p \ /System/Library/Keychains/SystemRootCertificates.keychain | \ openssl x509 -text -noout ``` ## Browser Security ### Firefox Hardening Install Firefox and configure for privacy: ```bash # Install Firefox brew install --cask firefox # Firefox config location # ~/Library/Application Support/Firefox/Profiles/*.default-release/user.js ``` Create `user.js` for privacy: ```javascript // Disable telemetry