macos-security-and-privacy-guide

# macOS Security and Privacy Guide > Skill by [ara.so](https://ara.so) — Security Skills collection. This skill provides comprehensive guidance for securing and hardening macOS systems based on the community-maintained drduh/macOS-Security-and-Privacy-Guide. It covers threat modeling, encryption, firewalls, DNS configuration, privacy settings, and security monitoring. ## Overview The macOS Security and Privacy Guide is a collection of techniques for improving security and privacy on Apple silicon Macs. It targets power users adopting enterprise-standard security and covers: - Threat modeling and asset protection - Full disk encryption with FileVault - Firewall configuration (application and kernel-level) - DNS encryption (DNSCrypt, DoH, DoT) - Browser hardening - System monitoring and audit - Privacy settings and telemetry disabling - Physical security measures **Requirements:** - Apple silicon Mac (M1 or newer recommended) - Currently supported macOS version - Administrative access ## Installation and Setup This is a guide repository, not installable software. Access it at: - Online: https://drduh.github.io/macOS-Security-and-Privacy-Guide/ - Repository: https://github.com/drduh/macOS-Security-and-Privacy-Guide ## Core Security Commands ### System Updates ```bash # Check for updates softwareupdate --list # Install all available updates sudo softwareupdate --install --all # Enable automatic updates sudo softwareupdate --schedule on # Install security updates only sudo softwareupdate --install --recommended ``` ### FileVault Full Disk Encryption ```bash # Enable FileVault (GUI method preferred for recovery key) sudo fdesetup enable # Check FileVault status sudo fdesetup status # List FileVault-enabled users sudo fdesetup list # Add user to FileVault sudo fdesetup add -usertoadd username ``` ### Firmware Password (Legacy Intel Macs) ```bash # Set firmware password (reboot to recovery mode first) # On Apple silicon, use Startup Security Utility instead # Check if firmware password is set (Intel) sudo firmwarepasswd -check ``` ### Firewall Configuration ```bash # Enable application firewall sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on # Enable stealth mode (don't respond to pings) sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on # Enable logging sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setloggingmode on # Block all incoming connections sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setblockall on # Allow signed applications sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setallowsigned on # Check firewall status sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate ``` ### Packet Filter (pf) Configuration ```bash # Create pf rules file sudo nano /etc/pf.conf # Example pf.conf rules: # Block all incoming traffic except SSH and web # scrub-anchor "com.apple/*" # nat-anchor "com.apple/*" # rdr-anchor "com.apple/*" # dummynet-anchor "com.apple/*" # anchor "com.apple/*" # load anchor "com.apple" from "/etc/pf.anchors/com.apple" # # block all # pass out proto {tcp, udp, icmp} keep state # pass in proto tcp to any port {22, 80, 443} keep state # Enable pf sudo pfctl -e # Load rules sudo pfctl -f /etc/pf.conf # Check pf status sudo pfctl -s info # View active rules sudo pfctl -s rules # Disable pf sudo pfctl -d ``` ## Privacy and Telemetry ### Disable Spotlight Suggestions ```bash # Disable Spotlight Suggestions defaults write com.apple.Safari UniversalSearchEnabled -bool false defaults write com.apple.Safari SuppressSearchSuggestions -bool true # Disable Spotlight internet search defaults write com.apple.spotlight orderedItems -array \ '{"enabled" = 1;"name" = "APPLICATIONS";}' \ '{"enabled" = 1;"name" = "SYSTEM_PREFS";}' \ '{"enabled" = 1;"name" = "DIRECTORIES";}' \ '{"enabled" = 1;"name" = "PDF";}' \ '{"enabled" = 1;"name" = "DOCUMENTS";}' # Restart Spotlight killall mds ``` ### Disable Unnecessary Services ```bash # Disable Siri defaults write com.apple.assistant.support "Assistant Enabled" -bool false launchctl disable "user/$UID/com.apple.assistantd" # Disable Handoff defaults write com.apple.coreservices.useractivityd ActivityAdvertisingAllowed -bool false defaults write com.apple.coreservices.useractivityd ActivityReceivingAllowed -bool false # Disable AirDrop defaults write com.apple.NetworkBrowser DisableAirDrop -bool true # Disable remote Apple events sudo systemsetup -setremoteappleevents off # Disable remote login (SSH if not needed) sudo systemsetup -setremotelogin off # Disable Internet Sharing sudo defaults write /Library/Preferences/SystemConfiguration/com.apple.nat NAT -dict Enabled -bool false ``` ### Privacy Settings ```bash # Clear location services cache sudo rm -rf /var/db/locationd/* # Disable Captive Portal assistant sudo defaults write /Library/Preferences/SystemConfiguration/com.apple.captive.control Active -bool false # Disable crash reporter defaults write com.apple.CrashReporter DialogType none # Disable Bonjour multicast sudo defaults write /Library/Preferences/com.apple.mDNSResponder.plist NoMulticastAdvertisements -bool true # Set hostname (prevents leaking computer name) sudo scutil --set ComputerName "MacBook" sudo scutil --set LocalHostName "MacBook" sudo scutil --set HostName "MacBook" ``` ## DNS Configuration ### DNSCrypt Installation (via Homebrew) ```bash # Install Homebrew first if needed /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" # Install dnscrypt-proxy brew install dnscrypt-proxy # Edit configuration nano /usr/local/etc/dnscrypt-proxy.toml # Example configuration: # server_names = ['cloudflare', 'google'] # listen_addresses = ['127.0.0.1:53'] # require_dnssec = true # require_nolog = true # require_nofilter = true # Start dnscrypt-proxy sudo brew services start dnscrypt-proxy # Configure system DNS to use localhost networksetup -setdnsservers Wi-Fi 127.0.0.1 networksetup -setdnsservers Ethernet 127.0.0.1 ``` ### DNS over HTTPS/TLS with Configuration Profile ```bash # Create DNS profile for Cloudflare DoH # Save as cloudflare-doh.mobileconfig cat > cloudflare-doh.mobileconfig <<EOF <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>PayloadContent</key> <array> <dict> <key>DNSSettings</key> <dict> <key>DNSProtocol</key> <string>HTTPS</string> <key>ServerURL</key> <string>https://cloudflare-dns.com/dns-query</string> </dict> <key>PayloadType</key> <string>com.apple.dnsSettings.managed</string> <key>PayloadIdentifier</key> <string>com.cloudflare.1dot1dot1dot1.dns</string> <key>PayloadUUID</key> <string>RANDOM-UUID-HERE</string> <key>PayloadDisplayName</key> <string>Cloudflare DNS over HTTPS</string> <key>PayloadVersion</key> <integer>1</integer> </dict> </array> <key>PayloadDisplayName</key> <string>Cloudflare DNS</string> <key>PayloadIdentifier</key> <string>com.cloudflare.dns</string> <key>PayloadUUID</key> <string>RANDOM-UUID-HERE-2</string> <key>PayloadType</key> <string>Configuration</string> <key>PayloadVersion</key> <integer>1</integer> </dict> </plist> EOF # Install profile (will prompt for admin password) open cloudflare-doh.mobileconfig ``` ### Hosts File Configuration ```bash # Edit hosts file for ad blocking sudo nano /etc/hosts # Add entries like: # 0.0.0.0 ads.example.com # 0.0.0.0 tracker.example.com # Use a maintained blocklist curl -o /tmp/hosts.txt https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts sudo cp /tmp/hosts.txt /etc/hosts # Flush DNS cache sudo dscacheutil -flushcache sudo killall -HUP mDNSResponder ``` ## System Monitoring ### OpenBSM Audit ```bash # Check audit status sudo audit -n # View audit configuration sudo cat /etc/security/audit_control # Enable specific audit flags sudo nano /etc/security/audit_control # Add flags: lo,aa,ad,fd,fm,-all # Restart audit system sudo audit -s # Review audit logs sudo praudit -xn /var/audit/* # Monitor real-time audit events sudo praudit /dev/auditpipe ``` ### DTrace System Monitoring ```bash # Monitor file opens (requires SIP disabled for dtrace) sudo dtrace -n 'syscall::open*:entry { printf("%s %s", execname, copyinstr(arg0)); }' # Monitor network connections sudo dtrace -n 'syscall::connect:entry { printf("%s", execname); }' # Monitor process execution sudo dtrace -n 'proc:::exec-success { trace(curpsinfo->pr_psargs); }' # Monitor DNS queries sudo dtrace -n 'syscall::getaddrinfo:entry { printf("%s", copyinstr(arg0)); }' ``` ### Network Monitoring ```bash # List listening ports and processes sudo lsof -i -P -n | grep LISTEN # Monitor network connections nettop -P -L 0 # Use Little Snitch alternative - lulu (free) brew install --cask lulu # Monitor DNS queries sudo tcpdump -i any -n port 53 # Monitor all network traffic sudo tcpdump -i any -n # View network statistics netstat -an # Check active network connections lsof -i ``` ### Process and Execution Monitoring ```bash # Monitor running processes ps aux # Real-time process monitoring top -o cpu # Monitor process launches sudo opensnoop # Monitor file system access sudo fs_usage # List loaded kernel extensions kextstat # Check for suspicious login items osascript -e 'tell application "System Events" to get the name of every login item' # List LaunchAgents and LaunchDaemons ls -la ~/Library/LaunchAgents/ ls -la /Library/LaunchAgents/ sudo ls -la /Library/LaunchDaemons/ ``` ## User Account Security ### Admin and Standard User Setup ```bash # Create standard user account sudo dscl . -create /Users/standarduser sudo dscl . -create /Users/standarduser UserShell /bin/bash sudo dscl . -create /Users/standarduser RealName "Standard User" sudo dscl . -create /Users/standarduser UniqueID 503 sudo dscl . -create /Users/standarduser PrimaryGroupID 20 sudo dscl . -create /Users/standarduser NFSHomeDirectory /Users/standarduser sudo dscl . -passwd /Users/standarduser # Create home directory sudo createhomedir -c -u standarduser # Remove admin user from admin group (after creating another admin) sudo dseditgroup -o edit -d username -t user admin # Require password immediately after sleep/screensaver defaults write com.apple.screensaver askForPassword -int 1 defaults write com.apple.screensaver askForPasswordDelay -int 0 # Set screen lock timeout (in seconds) defaults -currentHost write com.apple.screensaver idleTime -int 300 ``` ### Password Policies ```bash # Set minimum password length sudo pwpolicy -n /Local/Default -setglobalpolicy "minChars=14" # Require mixed case sudo pwpolicy -n /Local/Default -setglobalpolicy "requiresMixedCase=1" # Password history sudo pwpolicy -n /Local/Default -setglobalpolicy "usingHistory=5" # Maximum failed login attempts sudo pwpolicy -n /Local/Default -setglobalpolicy "maxFailedLoginAttempts=5" # Check current password policy sudo pwpolicy -n /Local/Default -getglobalpolicy ``` ## Browser Security ### Safari Hardening ```bash # Disable auto-fill defaults write com.apple.Safari AutoFillPasswords -bool false defaults write com.apple.Safari AutoFillCreditCardData -bool false defaults write com.apple.Safari AutoFillFromAddressBook -bool false defaults write com.apple.Safari AutoFillMiscellaneousForms -bool false # Enable Do Not Track defaults write com.apple.Safari SendDoNotTrackHTTPHeader -bool true # Disable preloading top hit defaults write com.apple.Safari PreloadTopHit -bool false # Show full URL defaults write com.apple.Safari ShowFullURLInSmartSearchField -bool true # Warn about fraudulent websites defaults write com.apple.Safari WarnAboutFraudulentWebsites -bool true # Disable plugins defaults write com.apple.Safari com.apple.Safari.ContentPageGroupIdentifier.WebKit2PluginsEnabled -bool false # Enable Develop menu defaults write com.apple.Safari IncludeDevelopMenu -bool true defaults write com.apple.Safari WebKitDeveloperExtrasEnabledPreferenceKey -bool true # Clear history and cookies on quit defaults write com.apple.Safari ClearHistoryOnQuit -bool true ``` ### Firefox Hardening ```bash # Install Firefox brew install --cask firefox # Create user.js for privacy settings mkdir -p ~/Library/Application\ Support/Firefox/Profiles/*.default-release/ cat > ~/Library/Application\ Support/Firefox/Profiles/*.default-release/user.js <<EOF // Privacy settings user_pref("privacy.trackingprotection.enabled", true); user_pref("privacy.trackingprotection.socialtracking.enabled", true); user_pref("privacy.donottrackheader.enabled", true); user_pref("privacy.firstparty.isolate", true); user_pref("privacy.resistFingerprinting", true); // Disable telemetry user_pref("datareporting.healthreport.uploadEnabled", false); user_pref("datareporting.policy.dataSubmissionEnabled", false); user_pref("toolkit.telemetry.enabled", false); user_pref("toolkit.telemetry.unified", false); user_pref("toolkit.telemetry.archive.enabled", false); // Security user_pref("security.ssl.require_safe_negotiation", true); user_pref("security.tls.version.min", 3); user_pref("network.cookie.cookieBehavior", 1); user_pref("network.cookie.lifetimePolicy", 2); // Disable WebRTC leak user_pref("media.peerconnection.enabled", false); EOF ``` ## SSH Configuration ### Secure SSH Setup ```bash # Generate ED25519 key pair ssh-keygen -t ed25519 -a 100 -C "user@hostname" # Or use RSA 4096-bit ssh-keygen -t rsa -b 4096 -o -a 100 -C "user@hostname" # Set proper permissions chmod 700 ~/.ssh chmod 600 ~/.ssh/id_ed25519 chmod 644 ~/.ssh/id_ed25519.pub # Configure SSH client cat > ~/.ssh/config <<EOF