Take Your Mac OS X Security to NSA Standards

While doing research for another article, I came across NSA’s security setup for Mac OS X. No, the information gained was not from a clandestine hack, or some form of Wiki-Leaks. All the data you see here is readily available from the public version of NSA’s website, and will boost OS X Security on a Mac. We will be discussing a document that appears to have been designed as a three-fold double-sided pamphlet. Though this document may resemble a “Quick Start Guide”, don’t let its diminutive size lead you astray, there is a lot of information about how the NSA wants processes and settings used on their Mac OS X computers. Sadly, their instructions are a bit dated, as the latest document for this topic is for Snow Leopard, 10.6; however, many of their processes and settings are still viable, making further investigation worthwhile. So that you may refer to them, the NSA Pamphlet, entitled “Hardening Tips for Mac OS X 10.6 ‘Snow Leopard’”, can be seen in Figure 1 and Figure 2, below(1).

How you find a balance between security and convenience depends entirely on you. Clearly, the NSA needs to keep their computers as “hard” as possible. The trade-off for them is the loss of some functionality for their computers, but they end up with very secure computers from the process. A balance for security and convenience for home use is a computer sitting behind a router with a hardware “firewall”, a software “firewall” activated on the computer, updated and patched software, safe password and internet surfing habits. For those of you that feel the need for more security (and less concern about convenience), the number of processes and settings on the following pages will be helpful.

Finally, I could not find any more current documents available from the NSA for OS X security for the Mac. As mentioned earlier, the info at hand will be for OS X 10.6, we are using 10.9, with the introduction of 10.10 just around the corner. As a result, not everything mentioned here will work on current versions of OS X. Where changes exist, to the extent of my knowledge, they will be discussed. Before you continue, a word of caution: Don’t attempt something that does not make sense to you, or you feel is beyond the scope of your skill sets. I once had a Linux distribution on one of my desktop computers so secure that I couldn’t log into it. It took me hours to diagnose and undo the damage I had done. Please don’t follow my example.

Don’t Surf or Read Mail Using an Admin Account

For 10.7 and up, go to System Preferences > Users & Groups. Click on the Padlock icon in the lower left corner of the window, to “unlock” the window. Click the “+” button in the lower left corner of the sidebar to add a new User. Be sure not to grant this account Administrator privileges. This should be your daily “go to” account, using only the Admin account to do system wide processes and settings. On the left side of the window click on the new User; in the right side of the window, click the Change Password button, and follow the instructions. The password should be unique, and not used anywhere else (if you use the same password in several locations, like your computer, access to your bank account on the internet, Netflix, etc., a Bad Guy that obtains your password now has access to all the places we have just mentioned). The password should be 10 or 12 digits, and have both upper and lower case letters, numbers, and punctuation. Your new user account will make getting your Mail and using the web safer as installing malware, trojans, etc., are now much more difficult for bad guys to carry out. While you are at it, you might want to reset passwords for each of your users, using the process for developing safer passwords. Be sure to click the Padlock in the lower left hand corner of the window when you are done, to lock in your changes.

Home Folder Permissions

From the original document:

To prevent users and guests from perusing other users’ home folders, run the following command for each home folder(3):

sudo chmod go-rx /Users/username

Firmware Password

NSA’s instructions here no longer work. Boot into the Recovery partition by pressing Command-R, while the Mac is booting. Then select Utilities>Firmware>Password Utility and set the password. You will need it when you boot into a recovery mode or from an external drive(4).

Disable IPv6 and Airport When Not Needed

Disable Airport

1. Go to System Preferences > Network
2. Unlock the window (Padlock)
3. Click Wi-Fi in the sidebar
4. Click the Gear icon in the bottom part of the sidebar
5. Select Make Service Inactive

Disable IPv6

1. On the lower right side of the window, click the Advanced button.
2. Set the drop down box next to Configure IPv6 to Link-local only.
3. Lock the Padlock

Unnecessary Services

Disabling unnecessary services affects your computer by limiting some functionalities. I can see where being slightly paranoid about unneeded services is logical for a security branch of the government, but for us mortals, it is best to follow the adage: “if it ain’t broke, don’t fix it”.

Disable Setuid and Setgid Binaries

Unless you really really really know what you are doing (in which case you probably aren’t reading this), do not disable any of these binaries. There are far more inherent risks in doing this than there are benefits.

Configure and Use Both Firewalls

You are sitting behind a hardware firewall in your router, and we have already turned on and configured the Mac’s firewall. Granted the ipfw (Mac) firewall we just set up is not overly feature rich, so there are two more robust options you can use, and they can both run at the same time….then you will have three firewalls running!!! To get to this new level of security, download the latest version of Icefloor (versions 2.0 or higher.  Find out more about IceFloor, here).

Disable Bluetooth and Airport Devices

We already disabled Wi-Fi (Airport) above, in System Preferences > Network. Disable Bluetooth the same way.

Disable iSight and Sound Input

Disable iSight

A script from MacUpdate that will turn on and off access to iSight can be found Here(5):

Disable Sound

1. Go to System Preferences > Sound
2. Select the Input tab
3. Move the Microphone Input slide to the left

Safari

Open Safari, then go to Safari > Preferences > General and uncheck Open safe files after downloading. Now leave the General tab, and go to the Security tab, and uncheck Enable Java.

To surf the net more safely you might consider an anonymous proxy, either web-based, direct, or software based. The Tor network is an example of an anonymous proxy. You can find out more about anonymous proxies here.

Au Revoir, Bonjour!