Apple Mac OS X v10.3.x “Panther” Security Configuration Guide

109 Pages·2005·2.47 MB·English

UNCLASSIFIED

Report Number:I331-009R-2004


Apple Mac OS X v10.3.x
“Panther”

Security Configuration Guide

Guide Version 1.1

Systems and Network Attack Center (SNAC)

National Security Agency
9800 Savage Rd.
Ft. Meade, MD 20755-6704
UNCLASSIFIED
UNCLASSIFIED

This Page Intentionally Left Blank
UNCLASSIFIED
UNCLASSIFIED
Warnings
(cid:131) Do not attempt to implement any of the settings in this guide without
first testing in a non-operational environment. W
a
(cid:131) This document is only a guide containing recommended security settings. rn

i
It is not meant to replace well-structured policy or sound judgment. n
g
Furthermore this guide does not address site-specific configuration s

issues. Care must be taken when implementing this guide to address
local operational and policy concerns.
(cid:131) The security changes described in this document only apply to Apple Mac
OS X v. 10.3.x “Panther” and should not be applied to any other Mac
OS versions or operating systems.
(cid:131) This document is current as of July 8, 2005. See http://www.apple.com
for the latest changes or modifications to the Mac OS X v10.3.x
“Panther” operating system.

iii
UNCLASSIFIED
UNCLASSIFIED

This Page Intentionally Left Blank
UNCLASSIFIED
UNCLASSIFIED

Trademark Information
T
Apple, Macintosh, Mac OS X, and “Panther” are either registered r
a
trademarks or trademarks of the Apple Computer Corporation in the d
e
U.S.A. and other countries. m
a
All other names are registered trademarks or trademarks of their r
k
respective companies.
I
n
fo
r
m

a
t
i
o
n

v
UNCLASSIFIED
UNCLASSIFIED

n
o
i
t
a
m
r
o
f
n
I
k
r
a
m

e
d
a
r
T

This Page Intentionally Left Blank

UNCLASSIFIED
UNCLASSIFIED

Table of Contents
Warnings......................................................................................................................iii
Trademark Information................................................................................................v
T
Table of Contents........................................................................................................vii a
b
l
e
Introduction.................................................................................................................xi

o
Getting the Most from this Guide...........................................................................xi f
C
About this Guide.....................................................................................................xii o
n
t
Scope of Guidance.........................................................................................................1 e
n
t
Introduction to Mac OS X Security..............................................................................3 s

Multi-user, UNIX-based system..............................................................................3
Security Features......................................................................................................4
Secure Configuration by Default.........................................................................4
Secure Network Services......................................................................................4
Keychain...............................................................................................................4
Security Support for Applications.......................................................................5
Smart Cards .........................................................................................................5
Initial Installation.........................................................................................................7
System Installation and Configuration....................................................................7
Before Installation...............................................................................................7
Begin Installation.................................................................................................8
Continue Through Installation Screens...................................................................9
Initial System Configuration..................................................................................12
Create First Administrative Account.....................................................................13
System Updates......................................................................................................14
Downloading and Verifying Updates ................................................................15
Installing Updates..............................................................................................17
Fix Disk Permissions..............................................................................................19
Configuring System Settings......................................................................................21
Removing Registration Information......................................................................22
Managing System Preferences...............................................................................22
Desktop and Screen Saver.................................................................................23
Security Settings................................................................................................25
FileVault.............................................................................................................25
Additional Security Settings..............................................................................28
Bluetooth........................................................................................................... 30
CDs & DVDs.......................................................................................................31
Energy Saver......................................................................................................32
Sound.................................................................................................................34
vii
UNCLASSIFIED
UNCLASSIFIED

Network..............................................................................................................36
Sharing...............................................................................................................37
Accounts.............................................................................................................42
Date and Time....................................................................................................44
Software Update.................................................................................................45
s
t
n Setting the Global umask.......................................................................................46
e
t Securing Initial System Accounts..........................................................................46
n
o
C Restricting Administrator’s Home Folder Permissions....................................47

f Securing the Root Account................................................................................47
o
Using sudo ........................................................................................................49
e
l
b Securing Single-User Boot.................................................................................49
a
T Logon Warning Banners........................................................................................52
Auditing and Log File Configuration.....................................................................53
Configuring syslogd...........................................................................................54
Local Logging.....................................................................................................55
Remote Logging.................................................................................................56
Disabling Hardware Components..........................................................................56
Disabling Mac OS 9................................................................................................57
Configuring User Accounts.........................................................................................61
Guidelines for Creating Accounts..........................................................................61
Creating User Accounts..........................................................................................62
Granting Administrative Privileges.......................................................................64
Limiting a User Account ........................................................................................65
Managed User: Some Limits .............................................................................65
Managed User: Simple Finder.......................................................................... 68
Securing Users’ Accounts...................................................................................... 68
Restrict Home Folder Permissions................................................................... 68
System Preferences Settings..............................................................................69
Overriding the Default umask...........................................................................74
Setting Up Keychains for a User Account..............................................................74
Keychain Access.................................................................................................75
Configuring the login keychain..........................................................................75
Creating Multiple Keychains.............................................................................79
Keychain Examples............................................................................................79
Setting the Default Keychain............................................................................ 84
Additional Notes on Protecting Keychains........................................................85
Using an Account Securely.................................................................................... 86
Future Guidance.........................................................................................................87
Encrypting Files and Folders..................................................................................... 89
Using Disk Utility.................................................................................................. 89
Creating a New, Blank Disk Image With Encryption....................................... 89
viii
UNCLASSIFIED
UNCLASSIFIED

Creating an Encrypted Image From Existing Data...........................................92
References...................................................................................................................95
Additional Resources..................................................................................................97

T
a
b
l
e

o
f

C
o
n
t
e
n
t
s

ix
UNCLASSIFIED
UNCLASSIFIED

s
t
n
e
t
n

o
C

f
o

e
l
b

a
T

This Page Intentionally Left Blank
x
UNCLASSIFIED