Slashdot Log In
Apple Releases Mac OS X Leopard Security Guide
Posted by
timothy
on Tue Jun 03, 2008 09:49 AM
from the to-prevent-worms dept.
from the to-prevent-worms dept.
Wormfan writes to share ZDNet's brief mention of and a link to "Apple's release of a ~250 page PDF of security best-practices and tips to protect Mac OS X Leopard clients. The guide is aimed at experienced users, Apple says, familiar with the Terminal application and its command-line interface."
Related Stories
[+]
Mac OS X Leopard Edition: The Missing Manual 130 comments
jsuda writes "The preeminent general reference source for Mac OS X has always been the Missing
Manual Series written by David Pogue. The latest iteration in the series
is its Mac OS X Leopard Edition, completely revised, and it is the biggest,
most comprehensive, and most useful of all the editions in the series. It covers
the Mac OS X desktop and file system, the free applications included with the Mac OS
X installation, the system components and technologies, networking and online
features and components, and includes welcome appendices on installation, troubleshooting,
Windows/Mac comparisons, and a Master Keystroke list." Read on for the rest of John's review.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
argh: all my passwords contain a capital "U" (Score:5, Interesting)
In the Password and Verify fields, enter a new Open Firmware or EFI password, and click OK.
This password can be up to eight characters. Do not use the capital letter "U" in an Open Firmware password.
If you do, your password will not be recognized during the startup process.
Re: (Score:3, Funny)
Re: (Score:3, Interesting)
Anybody know the reason for this?
Re:argh: all my passwords contain a capital "U" (Score:5, Funny)
From this page [apple.com] on Open Firmware passwords, they list the following:
Blocks the ability to use the "C" key to start up from an optical disc.
Blocks the ability to use the "N" key to start up from a NetBoot server.
Blocks the ability to use the "T" key to start up in Target Disk Mode (on computers that offer this feature).
I wonder if the missing U has something to do with those... : p
Parent
Re: (Score:3, Funny)
Re:argh: all my passwords contain a capital "U" (Score:5, Funny)
Only in Soviet Russia, passwords contain U.
Parent
More OSX Security: (Score:4, Informative)
What happened to 'Secure by Default?' (Score:5, Interesting)
- Be an experienced user familiar with the terminal, and
- Read a 250 page PDF
then I wonder a little about Leopard's security.Having skimmed the document, I'm a little bit less sceptical. In a lot of places it explains why the default configuration is secure (e.g. mDNSResponder uses the MAC framework to run in a sandbox, which is why the recent security hole did not apply to Leopard, while it did to Tiger, Windows and Linux). It also told me about a few features I was completely ignorant of, such as the ability to use a smartcard to unlock File Vault images and the keychain rather than a password (would be a bit more useful if Macs included a JavaCard reader). It also covers things like completely disabling WiFi and Bluetooth, which are likely only to be required by people working in the defence industry or suffering from extreme paranoia (but I repeat myself). Sadly, although it mentions the MAC framework, it doesn't give any hints about actually using it.
It also includes one thing that made me groan slightly:
A couple of issues on the very first page. (Score:3, Interesting)
The main result of this is to train people to click "OK" to security dialogs. I have observed this trend in Windows, over the past decade as a network and system admin, and there were several users who would REPEATEDLY come to me with "I clicked the wrong button again and I think I've got a virus".
Easier network security. After you've activated the new Mac OS X v10.5 application firewall, it configures itself so you get the benefits of firewall protection without needing to understand the details of network ports and protocols.
OS X is not Windows: it does not promiscuously open listening ports unless you are serving data. Unless you have installed third party software that opens additional ports, there is nothing the firewall needs to do (and indeed it has been reported that the firewall does not actually restrict access to any standard ports), and there is little point in running it. If you have, then you need to understand network ports and protocols.
Re:A couple of issues on the very first page. (Score:4, Informative)
What you are referring to is often called the "OK/Cancel problem" and is a classic HCI issue to avoid. This is different from Windows though in several ways. First, OS X does not have other, identical dialogue boxes that routinely have to be clicked in order to "make Windows work". This means users are not being conditioned to click "ok" in response to any dialogue box that appears. OS X does not present useless dialogue boxes that only have the OK option to further condition users. Second, the options are not "OK" and "Cancel" like any other such dialogue box, but "Cancel" and "Open". This is better than Windows, but not ideal. Open is an action verb, one of the primary requirements for bypassing this problem. It means even if the user does not read the dialogue box, they still know what the button they are clicking is going to do, it will open something. I'd argue "Run program" would be a better label for the button, but it is not a complete disaster. Third, this option only applies to programs, not data and as such differentiates the two. This box does not appear when you double click a file from the internet the first time; it only appears when you do so with an application, making it much less frequent (less conditioning) and informing users that this is an application and not data, so they can't be tricked into thinking it is just a movie file or a zip file of images. Fourth, on Windows, when the OK/Cancel box appears, people need to choose and may not have all the information they need. On OS X, there is also a button to open the Website from which the application was downloaded, thus giving users the option of easily looking into it and helping to resist the temptation to just run it and see what happens.
To summarize, OS X does not fall afoul of the OK/Cancel problem to anywhere near the same degree as Windows, but there is room for improvement. Ideally, the user should know what is an application and what is an executable before clicking on it. Ideally, they should be able to run it without a warning and the OS should appropriately sandbox it, by default, so that it can be run safely, even if it is malware. I suspect that is the direction of the future, but we're not there yet. Apple's design seems like a pretty good compromise to me. It's not great and revolutionary, but it is better than, well, anyone else's solution I've seen.
With regard to Leopard's new firewall, the idea is layered security. If malware slips onto the machine, the Firewall may still be able to limit the damage it can do. If a worm can't connect to its control channel, it basically does nothing. I'd also note that the new firewall is application based, not port based. That means it can restrict some new game from accessing port 80, while allowing your Web browser to do so. Sadly, it is not used to its full potential, but having it on any running can save your butt. Just be careful to note that the new firewall is not the old firewall and running both can be better yet. There are a lot of ports I don't want to communicate on and even if I don't knowingly run a service on one, does not mean some trojan has not done it for me. The firewall is a way to detect and stop that action.
Parent
Re: (Score:3, Interesting)
Absolutely not.
It doesn't matter WHAT the dialogs say. The Windows dialogs I'm talking about do NOT in general actually read "OK", there are a variety of approval buttons in use, most of them completely descriptive of what they are going to do.
The problem is NOT what the dialogs say. This is not the "OK/Cancel" problem in any way, shape, or form.
The problem is that unnecessary approval dialogs are being use
Presentation (Score:4, Insightful)
Framemaker 6 (Score:5, Interesting)
This is sort of off topic, but the PDF metadata claims it was made using Adobe Framemaker 6.0 and a Macintosh version of Adobe Distiller. That strongly implies this guide to securing the latest and greatest version of OS X, was actually put together and created using a PPC Mac running classic. I wonder what Apple plans to do in this regard going forward, since none of their currently offered systems can run this software and their are really not many alternatives for said niche. Maybe Adobe will face one more Apple product as a competitor in the next year or so, if Apple decides to bring an OS X native program to market as they have in other cases like this.
Re: (Score:3, Insightful)
Re:Ooooh (Score:5, Informative)
* Make sure that you have 'Open "Safe" files after download' disabled in Safari.
* Use a tool such as "More Internet" to change the default application for FTP: URLs from Finder to either an FTP-aware web browser like Firefox or a dedicated FTP client.
* Consider disabling Dashboard if you have any doubt over your ability to recognize when third party Dashboard applets are installed via Safari.
* Don't open attachments from inside Mail. It's a dangerous habit to get into, the extra second spent saving them to a file is worth it.
* Don't let the stupid warning dialogs lull you into a false sense of security. These were a bad idea when Microsoft started using them, and it doesn't make it any better for Apple to follow.
Parent
Re:Ooooh (Score:4, Informative)
Parent
Re:They lied! (Score:4, Funny)
1) Read 250 pages.
2) Charge $NNN an hour for "Security Services".
3) Profit!!!
Parent
Re:They lied! (Score:5, Interesting)
Documents like this will encourage people like me to at least look at Apple when considering purchases.
I have never trusted the 'so safe you don't need protection' argument about any product, much less one as important as a computer operating system. Let's not even dig into the can 'o worms of trusting a publically traded, and therefore profit driven company, to maintain the highest production standards indefinitely.
Security vulnerabilities just take time to evolve, they will find everyone sooner or later.
Parent
Re: (Score:3, Informative)
Documents like this will encourage people like me to at least look at Apple when considering purchases.
I understand that there are environments where the default level of security of workstations is insufficient and hardening is needed. The thing is, if you're administrating such an environment and need to harden your systems a bit more, you should already have read the similar hardening guide for OS X [nsa.gov] that was published by the NSA (or at least be aware of it since it was discussed in hundreds of security forums when released). It was for Panther at the time, but not much has changed since then, at least a
Re: (Score:3, Interesting)
Long story short, I thought the oft repeated community attitudes towards OS X security were echoed by Apple: namely that there was little need for security measures.
I'm not sure you should completely abandon that conception. Apple's attitude towards security has been a bit erratic. My perception is that the old-school Apple developers and UI gurus pay little attention to security and some projects are dominated by such people. On the other hand, the people from Next and who were hired on for their UNIX experience care a lot more about security and projects they dominate fare much better.
Apple has certainly been taking steps towards better OS X security. FileVault i
Re: (Score:3, Informative)
Re:They lied! (Score:5, Funny)
Parent
Re:They lied! (Score:5, Insightful)
Mac OS X is the same way. If you're enabling advanced services and whatnot, as per the experts this manual is aimed at, you need to know what you're doing. This manual addresses that.
Parent
Re:They lied! (Score:5, Informative)
- Disabling kernel extensions for firewire, bluetooth and wifi among others (completely disabling those functions).
- Different privilege levels (not just admin, user and guest).
- Managing accounts through open directory.
- Configuring password complexity requirements.
- Managing keychains.
- Securing system preferences and services (just one click, not sure if that is a good thing though). Apparently you can lock down to the Dock size of your users. - Erasing data securely (35-pass erase? Really?).
- Disabling Safari functions (no downloads, cookies, autofill in forms, proxies, etc...).
- Managing services and running in stealth mode.
- Command-line for most of the above.
And I'm about half-ways. This is really nice to have for any serious admin. I consider myself an experienced mac user (yes, a fanboy too) and I'm surprised with everything Mac OS has that I didn't know about.
Parent
Re: (Score:3, Insightful)
Page 1: "Install Leopard." Pages 2-250: "This page left intentionally blank."
Thank you for enforcing the stereotype that all Mac users believe they are completely invulnerable because of a perference in computing.
As it is, there is a great false sense of security that comes with owning a Mac. It's like Anti-FUD. Most of it comes from a believe that the OS is "just safe", when that's not the case, especially now that programs like Darwine can run your Windows executables right out of the box. The lack of general malware can most likely be attributed to the Mac OS X file structure