Mac OS X Server Security Configuration For Version 10.5 Leopard Second Edition

2009·5.4 MB·English

by  Apple Inc.

Mac OS X Server
Security Configuration
For Version 10.5 Leopard
Second Edition
K Apple Inc. Adobe and PostScript are trademarks of Adobe Systems
' 2009 Apple Inc. All rights reserved. Incorporated.
The owner or authorized user of a valid copy of The Bluetoothfi word mark and logos are registered
Mac OS X software may reproduce this publication for trademarks owned by Bluetooth SIG, Inc. and any use of
the purpose of learning to use such software. No part of such marks by Apple is under license.
this publication may be reproduced or transmitted for
Intel, Intel Core, and Xeon are trademarks of Intel Corp.
commercial purposes, such as selling copies of this
in the U.S. and other countries.
publication or for providing paid-for support services.
Java(cid:153) and all Java-based trademarks and logos are
Every effort has been made to ensure that the
trademarks or registered trademarks of Sun
information in this manual is accurate. Apple is not
Microsystems, Inc. in the U.S. and other countries.
responsible for printing or clerical errors.
PowerPC(cid:153) and the PowerPC logo(cid:153) are trademarks of
Apple
International Business Machines Corporation, used
1 Infinite Loop
under license therefrom.
Cupertino, CA 95014
408-996-1010 UNIX is a registered trademark of The Open Group.
www.apple.com
X Window System is a trademark of the Massachusetts
The Apple logo is a trademark of Apple Inc., registered Institute of Technology
in the U.S. and other countries. Use of the (cid:147)keyboard(cid:148)
Apple logo (Option-Shift-K) for commercial purposes This product includes software developed by the
without the prior written consent of Apple may University of California, Berkeley, FreeBSD, Inc., The
constitute trademark infringement and unfair NetBSD Foundation, Inc., and their respective
competition in violation of federal and state laws. contributors.
Apple, the Apple logo, AirPort, AppleScript, AppleShare, Other company and product names mentioned herein
AppleTalk, Bonjour, Boot Camp, ColorSync, ExposØ, are trademarks of their respective companies. Mention
FileVault, FireWire, iCal, iChat, iMac, iSight, iTunes, of third-party products is for informational purposes
Keychain, Leopard, Mac, Mac Book, Macintosh, Mac OS, only and constitutes neither an endorsement nor a
QuickTime, Safari, Xgrid, Xsan, and Xserve are recommendation. Apple assumes no responsibility with
trademarks of Apple Inc., registered in the U.S. and other regard to the performance or use of these products.
countries.
019-1386/2009-10-01
Apple Remote Desktop, Finder, MacBook Air, QuickTime
Broadcaster, Spotlight, and Time Machine are
trademarks of Apple Inc.
MobileMe is a service mark of Apple Inc., registered in
the U.S. and other countries.
Contents
2
Preface 18 About This Guide
18 Target Audience
18 What(cid:146)s New in Leopard Server
19 What(cid:146)s in This Guide
21 Using This Guide
22 Using Onscreen Help
22 Leopard Server Administration Guides
24 Viewing PDF Guides on Screen
24 Printing PDF Guides
24 Getting Documentation Updates
25 Getting Additional Information
25 Acknowledgments
Chapter 1 26 Introduction to Leopard Server Security Architecture
27 Security Architectural Overview
27 UNIX Infrastructure
27 Access Permissions
28 Security Framework
28 Layered Security Defense
29 Credential Management
29 Network Security
29 Public Key Infrastructure (PKI)
30 Authorization Versus Authentication
30 Security Features in Leopard Server
30 Mandatory Access Controls
31 Sandboxing
32 Managed Preferences
32 Quarantine Applications
32 Application-Based Firewall
33 Signed Applications
33 Smart Card Unlock of FileVault and Encrypted Storage
34 Sharing and Collaboration Services
34 Enhanced Encrypted Disk Image Cryptography
3
35 Enhanced VPN Compatibility and Integration
35 Improved Secure Connectivity
Chapter 2 36 Installing Leopard Server
36 System Installation Overview
37 Disabling the Firmware Password
37 Preparing an Administrator Computer
38 The Server Installation Disc
38 Setting Up Network Services
39 Connecting to the Directory During Installation
39 Installing Server Software on a Networked Computer
39 Starting Up for Installation
39 Before Starting Up
40 Remotely Accessing the Install DVD
41 Starting Up from the Install DVD
42 Starting Up from an Alternate Partition
46 Starting Up from a NetBoot Environment
47 Preparing Disks for Installing Leopard Server
54 Identifying Remote Servers When Installing Leopard Server
55 Installing Server Software Interactively
55 Installing Locally from the Installation Disc
57 Installing Remotely with Server Assistant
58 Installing Remotely with VNC
59 Installing Server Software from an Image
59 Using the installer Command-Line Tool to Install Server Software
62 Installing Multiple Servers
63 Upgrading a Computer from Leopard to Leopard Server
63 How to Keep Current
63 Using Interactive Server Setup
66 Setting Up a Local Server Interactively
67 Setting Up a Remote Server Interactively
68 Setting Up Multiple Remote Servers Interactively in a Batch
69 Updating System Software
70 Updating from an Internal Software Update Server
71 Updating from Internet-Based Software Update Servers
71 Updating Manually from Installer Packages
72 Verifying the Integrity of Software
72 Repairing Disk Permissions
73 Kinds of Permissions
73 POSIX Permissions Overview
73 ACL Permissions Overview
74 Using Disk Utility to Repair Disk Permissions
4 Contents
Chapter 3 75 Protecting System Hardware
75 Protecting Hardware
76 Preventing Wireless Eavesdropping
76 Understanding Wireless Security Challenges
77 OS Components
77 Removing Wi-Fi Hardware
78 Removing Bluetooth Support Software
79 Removing IR Support Software
80 Preventing Unauthorized Recording
80 Removing Audio Recording Support
81 Removing Video Recording Support Software
82 Preventing Data Port Access
82 Securing USB Hardware
83 Removing FireWire Support Software
84 System Hardware Modifications
84 Authorized AppleCare Certified Technicians
Chapter 4 86 Securing Global System Settings
86 Securing System Startup
87 PowerPC-Based Systems
87 Using the Firmware Password Utility
88 Configuring Open Firmware Settings
89 Using Command-Line Tools for Secure Startup
89 Intel-Based Systems
90 Configuring Access Warnings
90 Enabling Access Warnings for the Login Window
91 AuthPlugin Architecture
92 The BannerSample Project
93 Enabling Access Warnings for the Command Line
Chapter 5 94 Securing Local Server Accounts
94 Types of User Accounts
95 Guidelines for Securing Accounts
95 Defining User IDs
96 Securing the Guest Account
97 Securing Nonadministrator Accounts
97 Securing Administrator Accounts
98 Securing the Directory Domain Administrator Account
98 Securing the System Administrator Account
99 Restricting sudo Usage
100 Understanding Directory Domains
101 Understanding Network Services, Authentication, and Contacts
102 Configuring LDAPv3 Access
Contents 5
102 Configuring Active Directory Access
103 Using Strong Authentication
103 Using Password Assistant to Generate or Analyze Passwords
104 Using Kerberos
105 Using Smart Cards
105 Using Tokens
106 Using Biometrics
106 Setting Global Password Policies
107 Storing Credentials in Keychains
108 Using the Default User Keychain
108 Creating Additional Keychains
110 Securing Keychains and Their Items
111 Using Smart Cards as Keychains
111 Using Portable and Network Keychains
Chapter 6 112 Securing System Preferences
112 System Preferences Overview
114 Securing MobileMe Preferences
116 Securing Accounts Preferences
119 Securing Appearance Preferences
120 Securing Bluetooth Preferences
121 Securing CDs & DVDs Preferences
123 Securing Date & Time Preferences
125 Securing Desktop & Screen Saver Preferences
127 Securing Display Preferences
127 Securing Dock Preferences
128 Securing Energy Saver Preferences
130 Securing ExposØ & Spaces Preferences
131 Securing International Preferences
132 Securing Keyboard & Mouse Preferences
132 Securing Network Preferences
133 Disabling Unused Hardware Devices
133 Disabling IPv6
135 Securing Print & Fax Preferences
137 Securing QuickTime Preferences
138 Securing Security Preferences
139 Securing Sharing Preferences
141 Securing Software Update Preferences
142 Securing Sound Preferences
143 Securing Speech Preferences
145 Securing Spotlight Preferences
147 Securing Startup Disk Preferences
149 Securing Time Machine Preferences
6 Contents
150 Securing Universal Access Preferences
Chapter 7 151 Securing Data and Using Encryption
151 Permissions
151 Setting POSIX Permissions
152 Viewing POSIX Permissions
153 Interpreting POSIX Permissions
154 Modifying POSIX Permissions
154 Setting File and Folder Flags
154 Viewing Flags
154 Modifying Flags
155 Setting ACL Permissions
156 Enabling ACL Permissions
156 Modifying ACL Permissions
157 Changing Global Umask for Stricter Default Permissions
158 Restricting Setuid Programs
161 Securing User Home Folders
162 Encrypting Home Folders
163 Overview of FileVault
164 Managing FileVault
164 Managing the FileVault Master Keychain
166 Encrypting Portable Files
166 Creating an Encrypted Disk Image
167 Creating an Encrypted Disk Image from Existing Data
168 Creating Encrypted PDFs
169 Securely Erasing Data
169 Configuring Finder to Always Securely Erase
170 Using Disk Utility to Securely Erase a Disk or Partition
170 Using Command-Line Tools to Securely Erase Files
171 Using Secure Empty Trash
171 Using Disk Utility to Securely Erase Free Space
172 Using Command-Line Tools to Securely Erase Free Space
Chapter 8 174 Securing System Swap and Hibernation Storage
174 System Swap File Overview
175 Encrypting System Swap
Chapter 9 176 Avoiding Simultaneous Local Account Access
176 Fast User Switching
176 Shared User Accounts
Chapter 10 177 Ensuring Data Integrity with Backups
177 The Time Machine Architecture
177 Deleting Permanently from Time Machine Backups
Contents 7
178 Storing Backups Inside Secure Storage
178 Restoring Backups from Secure Storage
Chapter 11 179 Securing Accounts and Share Points
179 Open Directory and Active Directory
180 Configuring Share Points
180 Disabling Share Points
181 Restricting Access to a Share Point
183 AFP Share Points
183 SMB Share Points
183 FTP Share Points
183 NFS Share Points
185 Controlling Network Views
185 Securing Accounts
185 Configuring User Accounts
187 Configuring Group Accounts
188 Configuring Computer Groups
Chapter 12 189 Managing Certificates
189 Understanding Public Key Infrastructure
190 Public and Private Keys
190 Certificates
191 CAs
191 Identities
191 Self-Signed Certificates
191 Obtaining Certificates
192 Using Certificate Manager
193 Requesting a Certificate from a CA
194 Creating a Self-Signed Certificate
194 Importing a Certificate
195 Managing Certificates
195 Editing a Certificate
195 Deleting a Certificate
196 Renewing an Expiring Certificate
196 Creating a CA
196 Creating a CA Using Certificate Assistant
198 Creating a CA from the Command Line
199 Create a Certificate for Someone Else
199 Storing the CA Private Key
199 Creating Folders and Files for SSL
200 Distributing a CA Public Certificate to Clients
8 Contents
Chapter 13 201 Setting General Protocols and Access to Services
201 Setting General Protocols
201 Configuring NTP
202 Disabling SNMP
202 Enabling SSH
203 Remote Management (ARD)
203 Restricting Access to Specific Users
204 Remote Apple Events (RAE)
204 Restricting Access to Specific Users
205 Setting the Server(cid:146)s Host Name
205 Setting the Date and Time
205 Setting Up Certificates
205 Setting Service Access Control Lists
Chapter 14 207 Securing Remote Access Services
207 Securing Remote Login (SSH)
208 Configuring Secure Shell
209 Modifying the SSH Configuration File
209 Generating Key Pairs for Key-Based SSH Connections
211 Updating SSH Key Fingerprints
212 Controlling Access to SSH
212 SSH Man-in-the-Middle Attacks
213 Transferring Files Using SFTP
213 Securing VPN Service
214 VPN and Security
215 Configuring L2TP/IPSec Settings
216 Configuring PPTP Settings
217 Authentication Method
218 Using VPN Service with Users in a Third-Party LDAP Domain
218 Offering SecurID Authentication with VPN Service
219 Encrypting Observe and Control Network Data
219 Encrypting Network Data During File Copy and Package Installations
220 Remote Apple Events (RAE)
220 Restricting Access to Specific Users
Chapter 15 221 Securing Network and Host Access Services
221 Using IPv6 Protocol
222 IPv6-Enabled Services
222 Securing DHCP Service
223 Disabling Unnecessary DHCP Services
223 Configuring DHCP Services
224 Assigning Static IP Addresses Using DHCP
225 Securing DNS Service
Contents 9
226 Understanding BIND
226 Turning Off Zone Transfers
227 Disabling Recursion
227 Understanding DNS Security
228 DNS Cache Poisoning
228 Server Mining
229 DNS Service Profiling
229 Denial of Service (DoS)
230 Service Piggybacking
230 ARP Spoofing
231 Securing Firewall Service
231 Planning Firewall Setup
232 Starting Firewall Service
232 Creating an IP Address Group
233 Creating Firewall Service Rules
234 Creating Advanced Firewall Rules
235 Enabling Stealth Mode
236 Viewing the Firewall Service Log
237 Securing NAT Service
238 Configuring NAT Service
239 Configuring Port Forwarding
240 Securing Bonjour Service
Chapter 16 242 Securing Collaboration Services
242 Securing iCal Service
243 Disabling iCal Services
243 Securely Configuring iCal Service
244 Viewing iCal Service Logs
245 Securing iChat Service
245 Disabling iChat Service
245 Securely Configuring iChat Service
249 Viewing iChat Service Logs
249 Securing Wiki Service
249 Disabling Web Service
250 Securely Configuring Wiki Services
250 Viewing Wiki Service Logs
250 Securing Podcast Producer Service
251 Disabling Podcast Producer Service
251 Securely Configuring Podcast Producer Service
252 Viewing Podcast Producer Service Logs
Chapter 17 253 Securing Mail Service
253 Disabling Mail Service
10 Contents