kristovatlas / osx-config-check

Verify the configuration of your OS X machine.

osx-config-check

Checks your OSX machine against various hardened configuration settings.

You can specify your own preferred configuration baseline by supplying your own Hjson file instead of the provided one.

Disclaimer

The authors of this tool are not responsible if running it breaks stuff; disabling features of your operating system and applications may disrupt normal functionality.

Once applied, the security configurations do not not guarantee security. You will still need to make good decisions in order to stay secure. The configurations will generally not help you if your computer has been previously compromised.

Configurations come from sites like:

• drduh's OS X Security and Privacy Guide

Usage

You should download and run this application once for each OS X user account you have on your machine. Each user may be configured differently, and so each should be audited.

Download this app using Git, GitHub Desktop, or the "download as zip" option offered by GitHub. If you choose the zip option, unarchive the zip file after.

In the Terminal application, navigate to the directory that contains this app. You can use the cd command (see example below) to change directories. If you've downloaded the file to your "Downloads" directory, you might find the app here:

cd ~/Downloads/osx-config-check

If that directory doesn't exist because the folder you retrieved is named slightly different (such as 'osx-config-check-master' or 'osx-config-check-1.0.0'), you can always type in a portion of the directory name and hit the [TAB] key in Terminal to auto-complete the rest.

Next run the app as follows:

python app.py

This will take you through a series of interactive steps that checks your machine's configuration, and offers to fix misconfigurations for you.

Intermediate users and advanced users can also invoke various command-line arguments:

Usage: python app.py [OPTIONS]
OPTIONS:
	--debug-print        Enables verbose output for debugging the tool.
	--report-only        Only reports on compliance and does not offer to fix broken configurations.
	--disable-logs       Refrain from creating a log file with the results.
	--disable-prompt     Refrain from prompting user before applying fixes.
	--skip-sudo-checks   Do not perform checks that require sudo privileges.
	--help -h            Print this usage information.

Sample Output

osx-config-check v1.1.0 (ivysaur)
Download the latest copy of this tool at: https://github.com/kristovatlas/osx-config-check
Report bugs/issues:
	* GitHub: https://github.com/kristovatlas/osx-config-check/issues
	* Twitter: https://twitter.com/kristovatlas
------------------------------------------------------------------------------------------


CHECK #1: Homebrew is installed.... PASSED!

CHECK #2: Binaries installed to /usr/local/bin are preferred over those in /usr/bin (Note: If this check does not pass, other tests will fail)... PASSED!

CHECK #3: Java Runtime Environment is up to date.... PASSED!

CHECK #4: The System Preferences application is currently closed.... PASSED!

CHECK #5: Current user is a non-admin account.... FAILED!

CHECK #6: The OSX application firewall is enabled (system-wide).... PASSED!

CHECK #7: The OSX application firewall is enabled (current user only).... PASSED!

CHECK #8: A password is required to wake the computer from sleep or screen saver (system-wide).... PASSED!

CHECK #9: A password is required to wake the computer from sleep or screen saver (current user only).... PASSED!

CHECK #10: There is no delay between starting the screen saver and locking the machine (system-wide).... PASSED!

CHECK #11: There is no delay between starting the screen saver and locking the machine (current user only).... PASSED!

CHECK #12: Logging is enabled for the operating system.... PASSED!

CHECK #13: Homebrew analytics are disabled.... PASSED!

CHECK #14: Stealth mode is enabled for OSX: Computer does not respond to ICMP ping requests or connection attempts from a closed TCP/UDP port. (system-wide)... PASSED!

CHECK #15: Stealth mode is enabled for OSX: Computer does not respond to ICMP ping requests or connection attempts from a closed TCP/UDP port. (current user only)... PASSED!

CHECK #16: Automatic whitelisting of Apple-signed applications through the firewall is disabled (system-wide).... PASSED!

CHECK #17: Automatic whitelisting of Apple-signed applications through the firewall is disabled (current user only).... PASSED!

CHECK #18: Captive portal for connecting to new networks is disabled to prevent MITM attacks.... PASSED!

CHECK #19: OpenSSL is up to date.... PASSED!

CHECK #20: Hidden files are displayed in Finder.... PASSED!

CHECK #21: All application software is currently up to date.... PASSED!

CHECK #22: Automatic check for software updates is enabled.... SKIPPED!

CHECK #23: GateKeeper protection against untrusted applications is enabled.... PASSED!

CHECK #24: Bluetooth is disabled.... FAILED!

CHECK #25: The infrared receiver is disabled.... PASSED!

CHECK #26: AirDrop file sharing is disabled.... PASSED!

CHECK #27: File sharing is disabled.... PASSED!

CHECK #28: Printer sharing is disabled.... PASSED!

CHECK #29: Remote login is disabled.... FAILED!

CHECK #30: Remote Management is disabled.... PASSED!

CHECK #31: Remote Apple events are disabled.... FAILED!

CHECK #32: Internet Sharing is disabled on all network interfaces.... PASSED!

CHECK #33: Wake on Network Access feature is disabled.... FAILED!

CHECK #34: Automatic setting of time and date is disabled.... FAILED!

CHECK #35: IPv6 is disabled on all network interfaces.... PASSED!

CHECK #36: An administrator password is required to change system-wide preferences.... PASSED!

CHECK #37: Documents are not stored to iCloud Drive by default. (May be mistaken if iCloud is disabled)... PASSED!

CHECK #38: The File Vault key is protected when going to standby mode.... PASSED!

CHECK #39: The system will store a copy of memory to persistent storage, and will remove power to memory.... PASSED!

CHECK #40: git is up to date or is not installed... PASSED!

CHECK #41: Apple Push Notifications are disabled.... PASSED!

CHECK #42: Google DNS servers are used by default on all network interfaces.... PASSED!

CHECK #43: The curl utility is up to date or absent from the system.... PASSED!

CHECK #44: FileVault file system encryption is enabled.... PASSED!

CHECK #45: FileVault file system encryption is enabled at the root directory.... PASSED!

CHECK #46: The idle timer for screen saver activation is set to 10 minutes or less.... PASSED!

CHECK #47: System Integrity Protection (SIP) is enabled.... PASSED!

CHECK #48: The Safari application is currently closed.... PASSED!

CHECK #49: Safari will not auto-fill credit card data.... PASSED!

CHECK #50: Safari will not auto-fill your contact data.... PASSED!

CHECK #51: Safari will not auto-fill miscellaneous forms.... PASSED!

CHECK #52: Safari will not auto-fill usernames or passwords.... PASSED!

CHECK #53: Files downloaded in Safari are not automatically opened.... PASSED!

CHECK #54: Cookies and local storage are always blocked in Safari.... PASSED!

CHECK #55: Safari extensions are disabled.... PASSED!

CHECK #56: The Safari web browser will warn when visiting known fraudulent websites.... PASSED!

CHECK #57: JavaScript is disabled in the Safari web browser.... PASSED!

CHECK #58: JavaScript is disabled in the Safari web browser (Legacy version).... PASSED!

CHECK #59: Pop-up windows are blocked in the Safari web browser.... PASSED!

CHECK #60: Pop-up windows are blocked in the Safari web browser (Legacy version).... PASSED!

CHECK #61: The WebGL plug-in is disabled in the Safari web browser.... PASSED!

CHECK #62: Plug-ins are disabled in the Safari web browser.... PASSED!

CHECK #63: Plug-ins are disabled in the Safari web browser (Legacy version).... PASSED!

CHECK #64: Plug-ins are blocked by default in the Safari web browser unless a site is explicitly added to a list of allowed sites.... PASSED!

CHECK #65: The Java plug-in for Safari web browser is blocked unless a site is explicitly added to a list of allowed sites.... PASSED!

CHECK #66: The Java plug-in is disabled in the Safari web browser.... PASSED!

CHECK #67: The Java plug-in is disabled in the Safari web browser (Legacy version).... PASSED!

CHECK #68: The Safari web browser is configured to treat SHA-1 certificates as insecure.... PASSED!

CHECK #69: The Safari web browser will not pre-load webpages that rank highly as search matches.... PASSED!

CHECK #70: The Safari web browser will not include search engine suggestions for text typed in the location bar.... PASSED!

CHECK #71: The Safari web browser's search suggestions are disabled.... PASSED!

CHECK #72: The Safari web browser uses the Do-Not-Track HTTP header.... PASSED!

CHECK #73: PDF viewing is disabled in the Safari web browser.... PASSED!

CHECK #74: Full website addresses are displayed in the location bar of the Safari web browser.... PASSED!

CHECK #75: The Mail application is currently closed.... PASSED!

CHECK #76: Apple Mail does not automatically load remote content in e-mails.... PASSED!

CHECK #77: Mail identified by Apple Mail as junk is sent to the Junk mailbox.... PASSED!

CHECK #78: GPGMail is in use.... PASSED!

CHECK #79: New e-mails composed in Apple Mail are encrypted by GPGMail if the receiver's PGP is present in the keychain.... PASSED!

CHECK #80: New e-mails composed in Apple Mail and saved as drafts are encrypted by GPGMail.... PASSED!

CHECK #81: New e-mails composed in Apple Mail are signed by GPGMail.... PASSED!

CHECK #82: Apple Mail automatically checks for updates to GPGMail.... PASSED!

CHECK #83: The Google Chrome browser is currently closed.... FAILED!

CHECK #84: All Google Chrome web browser profiles prevent information leakage through navigation errors.... PASSED!

CHECK #85: All Google Chrome web browser profiles prevent information leakage through URL suggestions.... PASSED!

CHECK #86: All Google Chrome web browser profiles prevent information leakage through network prediction.... PASSED!

CHECK #87: All Google Chrome web browser profiles prevent information leakage by blocking security incidents reports to Google.... FAILED!

CHECK #88: All Google Chrome web browser profiles have Google Safe Browsing enabled.... FAILED!

CHECK #89: All Google Chrome web browser profiles prevent information leakage through spell-checking network services.... FAILED!

CHECK #90: All Google Chrome web browser profiles prevent information leakage through reporting usage statistics to Google.... PASSED!

CHECK #91: All Google Chrome web browser profiles use the Do-Not-Track HTTP header.... PASSED!

CHECK #92: All Google Chrome web browser profiles prevent pop-ups.... PASSED!

CHECK #93: All Google Chrome web browser profiles prevent geolocation by websites.... PASSED!

CHECK #94: All Google Chrome web browser profiles block unsandboxed plug-in software.... PASSED!

CHECK #95: All Google Chrome web browser profiles prevent filling personal information into forms automatically.... PASSED!

CHECK #96: All Google Chrome web browser profiles have disabled Password Manager.... FAILED!

CHECK #97: All Google Chrome web browser profiles have disabled automatic sign-in for stored passwords.... FAILED!

CHECK #98: All Google Chrome web browser profiles have disabled Google CloudPrint.... PASSED!

CHECK #99: All Google Chrome web browser profiles block Flash cookies.... PASSED!

CHECK #100: All Google Chrome web browser profiles have disabled the Chrome Pepper Flash Player plug-in.... PASSED!

CHECK #101: All Google Chrome web browser profiles have disabled the Adobe Shockwave Flash plug-in.... FAILED!

CHECK #102: All Google Chrome web browser profiles have disabled the Adobe Flash Player plug-in.... PASSED!

CHECK #103: All Google Chrome web browser profiles have disabled the Native Client plug-in.... FAILED!

CHECK #104: All Google Chrome web browser profiles have disabled the Widevine Content Decryption Module plug-in.... PASSED!

CHECK #105: All Google Chrome web browser profiles have enabled the uBlock Origin extension.... FAILED!

CHECK #106: All Google Chrome web browser profiles have enabled the Ghostery extension.... FAILED!

CHECK #107: All Google Chrome web browser profiles have enabled the ScriptSafe extension.... FAILED!

CHECK #108: Google Chrome is the default web browser.... PASSED!

CHECK #109: OSX/Keydnap malware is not present.... PASSED!
Configurations passed total:                 91 (83.49%)
Configurations failed or skipped total:      18 (16.51%)
Configurations passed without applying fix:  91 (83.49%)
Configurations passed after applying fix:    0 (0.00%)
Configurations failed and fix failed:        0 (0.00%)
Configurations failed and fix skipped:       17 (15.60%)
Configurations failed and fix declined:      0 (0.00%)
Configuration checks skipped:                1 (0.92%)
Wrote results to '~/Documents/osx-config-check_2016-09-15_17-44-48.log'. Please review the contents before submitting them to third parties, as they may contain sensitive information about your system.
==========================

Troubleshooting

Errors related to "sudo" or "sudoers"

If you receive an error message referencing these terms, the user you are currently logged in as may not be permitted to temporarily assume elevated privileges, preventing this tool from fully auditing and/or fixing your user's configuration. If you have added a non-Administrator user to your machine to help secure it, you will find that your non-Administrator user is not part of the "sudoers" list by default. To learn about how to add your user to the "sudoers" list, please refer to this link.

Trouble Connecting to Wi-Fi

This tool encourages users to use DNS servers run by the Google corporation. This can break some wi-fi networks that use "active portals" to login, like those found at cafes, airports, etc. If you're having trouble connecting to a wi-fi network after using this tool, please use the "dns_helper" tool included. From the terminal application, run:

bash dns_helper.sh

And follow the instructions on the screen carefully.

Something in OS X broke!

A few users have observed that features like screen saver activation with hot corners stopped working after applying configuration fixes. These problems have so far been remedied simply by restarting the system.

Contributing

Please read CONTRIBUTING.md before submitting pull requests to the repository.

Similar Projects

• https://github.com/SummitRoute/osxlockdown

Contributors

• Kristov Atlas (maintainer)

osx-config-check's Issues

review osxlockdown for configs

• "Verify all application software is current"
• "Enable Auto Update"
• "Disable Bluetooth"
• "Disable infrared receiver"
• "Disable AirDrop"
• "Disable automatic setting of time and date"
• "Set an inactivity interval of 10 minutes or less for the screen saver"
• "Enable secure screen saver corners"
• "Require a password to wake the computer from sleep or screen saver"
• "Ensure screen locks immediately when requested"
• "Disable Remote Apple Events"
• "Disable Remote Login"
• "Disable Internet Sharing"
• "Disable Screen Sharing"
• "Disable Printer Sharing"
• "Disable Wake on Network Access"
• "Disable File Sharing"
• "Disable Remote Management"
• "Enable FileVault"
• "Destroy File Vault Key when going to standby"
• "Enable hibernation mode (no memory power on sleep)"
• "Enable Gatekeeper"
• "Enable Firewall"
• "Enable Firewall Stealth Mode"
• "Disable signed apps from being auto-permitted to listen through firewall"
• "Disable iCloud drive"
• "Require an administrator password to access system-wide preferences"
• "Disable IPv6"
• "Disable Previews"
• "Secure Safari by crippling it"
• "Disable automatic loading of remote content by Mail.app"
• "Disable Captive Portal"
• "Enable logging"
• "Verify no HTTP update URLs for Sparkle Updater"

config check: automatic updates are configured

enhancement: check osx version

Must be executable on stock OSX machines with very little user setup

This must be very easy for the average OSX user to run. There are a few enhancements that can help

• Reduce number of non-standard imports to as few as possible, preferably zero
  • HJson can be turned into a JSON file as a build step, and the pre-built JSON can be included in the repo. This requires a user who only wants to use the default config file to only import the standard json module.
  • We can code a substitute for Enum so that non-standard enum34 is not required.
• Turn into a neat Python package
• Turn into a Mac .app package
• Alleviate the need for user to be in sudoers by executing app with OSX Administrator privileges?

enhancement: check that SIP is enabled

https://github.com/drduh/OS-X-Security-and-Privacy-Guide

Feature idea: Allow HJson to specify multiple profiles, and allow user to select a profile at the beginning

This could, for example, spare non-developer users from checks related to dev tools such as homebrew and git. Another example: Lock down browsers less for QA engineers and developers who do not use VMs. H/T @KMHouk

IPv6 disabling sometimes does not stick after logging in/out

cause unknown currently; first step is to try to find steps to reproduce dependably.

if only one thing out of several (user, network interface, etc.) is config broken attempt fix on only one

This requires passing some information between the results of the check command and the fix command, or to create really long fix commands that check first before fixing.

OS-X-Security-and-Privacy-Guide

• Basics
• Preparing and Installing OS X
• First boot
• Full disk encryption
• Firmware password
• Firewall
  • Application layer firewall
  • Third party firewalls
  • Kernel level packet filtering
• Services
• Spotlight Suggestions
• Homebrew
• DNS
  • Hosts file
  • dnsmasq
    • Test DNSSEC validation
  • dnscrypt
• Captive portal
• Certificate authorities
• OpenSSL
• Curl
• HTTP
• Web browsing
• Plugins
• PGP/GPG
• OTR
• Tor
• VPN
• Viruses and malware
• System Integrity Protection
• Gatekeeper and XProtect
• Passwords
• Backup
• Wi-Fi
• SSH
• Physical access
• System monitoring
  • OpenBSM audit
  • DTrace
  • Execution
  • Network
• Miscellaneous
• Related software
• Additional resources

UI enhancement: prompt user [Y/n] when about to perform a required fix that requires sudo privs

Evaluate these Safari configurations for checking

• AlwaysShowFavoritesBarInFullScreen
• AlwaysShowTabBar
• AlwaysShowTabBarInFullScreen
• AutoFillCreditCardData
• AutoFillFromAddressBook
• AutoFillMiscellaneousForms
• AutoFillPasswords
• AutoOpenSafeDownloads
• AutoShowToolbarInFullScreen
• BlockStoragePolicy
• CachedBookmarksFileDate
• CachedBookmarksFileSize
• DefaultBrowserPromptingState2
• DidDisableIndividualExtensionsAfterRemovingOnOffSwitchIfNecessary
• DidMigrateNewBookmarkSheetToReadingListDefault
• DidMigrateTabsToLinksForReaderKey
• DidMigrateToMoreRestrictiveFileURLPolicy
• DidMigrateWebKit1Preferences
• DidReportHistorySettings
• DidUnsubscribeFromRSSFeeds
• ExtensionsEnabled
• GEOUsageSessionID
• GEOUsageSessionIDGenerationTime
• LastApplicationCacheMessageTraceTime
• LastExtensionMessageTraceTime
• LastInstalledPlugInsMessageTraceTime
• LastOSVersionSafariWasLaunchedOn
• LastSafariVersionWithWelcomePage
• LastSharedLinksMessageTraceTime
• LocalFileRestrictionsEnabled
• NSNavLastRootDirectory
• NSNavPanelExpandedSizeForOpenMode
• NSPreferencesContentSize
• NSPreferencesSelectedIndex
• "NSTableView Columns Passwords Preferences"
• "NSTableView Hidden Columns Passwords Preferences"
• "NSTableView Sort Ordering Passwords Preferences"
• "NSToolbar Configuration BrowserToolbarIdentifier-v2"
• "NSToolbar Configuration NSPreferences"
• "NSWindow Frame BrowserWindowFrame"
• "NSWindow Frame Preferences"
• NewestLaunchedSafariVersion
• OpenWindows
• PreloadTopHit
• RecentWebSearches
• RemoteConfigurationLastUpdateFailed
• RemoteConfigurationLastUpdateTime
• SearchProviderIdentifierMigratedToSystemPreference
• SearchProvidersNotAllowedToPromptToBeMadeDefault
• SendDoNotTrackHTTPHeader
• "ShowFavoritesBar-v2"
• ShowFullURLInSmartSearchField
• SidebarViewModeIdentifier
• SkipLoadingExtensionsAtLaunch
• StartPageViewControllerMode
• Storefront
• SuccessfulLaunchTimestamp
• SuppressSearchSuggestions
• TestDriveOriginBrowser
• TestDriveStartDate
• TestDriveState
• TreatSHA1CertificatesAsInsecure
• UserStyleSheetEnabled
• WebKitJavaEnabled
• WebKitJavaScriptEnabled
• WebKitPluginsEnabled
• WebKitRespectStandardStyleKeyEquivalents
• WebKitStorageBlockingPolicy
• WebsiteSpecificSearchEnabled
• "com.apple.Safari.ContentPageGroupIdentifier.WebKit2JavaEnabled"
• "com.apple.Safari.ContentPageGroupIdentifier.WebKit2JavaScriptEnabled"
• "com.apple.Safari.ContentPageGroupIdentifier.WebKit2PluginsEnabled"
• "com.apple.Safari.ContentPageGroupIdentifier.WebKit2StorageBlockingPolicy"
• "com.apple.Safari.ContentPageGroupIdentifier.WebKit2WebGLEnabled"

Add private directory where people can drop HJSON and/or JSON configs for their private use

• app checks this directory for configs
• add directory to .gitignore

Enhancement: Allow HJson file to specify a failure state to avoid running check command with sudo unnecessarily

Currently, if a config has a command version and a sudo_command version and the output of the command version does not meet the desired output, the sudo_command version will be tried. However, in some cases it's clear from the output of the non-sudo version that the config has failed, and running with sudo is unnecessary.

Enhancement: add command line argument to disable interactivity

This would make the tool more friendly to automation, if that's a use case people are interested in.

add config checks for Thunderbird

Need to decide how to handle both Enigmail (PGP) and non-PGP users.

TODO: checklist of configurations.

review configuration checks in osxlockdown

https://github.com/SummitRoute/osxlockdown

organization: define criteria for required/recommended/experimental configs

enhancement: Clarify limits of the tool in README

E.g. you still have to follow best practices, and there's lots of stuff that you should do that can't be checked such as online activities, how you handle passwords, etc. Maybe refer peeps to this guide: https://github.com/drduh/OS-X-Security-and-Privacy-Guide

config to consider: check gpg is up to date

need to consider potential side effects first

https://github.com/drduh/OS-X-Security-and-Privacy-Guide

consider adding DNSSEC stuff as experimental config check

https://github.com/drduh/OS-X-Security-and-Privacy-Guide#third-party-firewalls

enhancement: at the top, print to the user where they can submit bug reports

add config checks for Apple Mail

Need to handle both PGP users and non-PGP users.

• General
  • Add invitations to Calendar: Never (recommended)
• Accounts
  • for each account: SSL enabled (required)
  • for each account: Allow insecure authentication disabled (required)
  • Junk Mail
  • Enable junk filtering
  • When junk mail arrives, move it to the Junk mailbox (recommended) -- this will kill some phishing attacks
  • Disable exempting junk when message is addressed using my full name (recommended)
• Viewing
  • Disable load remote content in messages (Required)
• GPGMail
  • Encrypt drafts (required)
  • Encrypt new messages by default (recommended)
  • Sign new messages by default (recommened)
  • Automatically check for updates (required)
  • Download updates automatically -- this is debatable of course, but best option for majority of users I think

can this three-profile configuration for chrome be checked?

enhancement: add field to hjson that specifies text displayed to user before prompting for fix

for example, if no command-line fix is available, that can be expressed in this string rather than a do-nothing fix that may or may not catch the user's attention.

also, config checks should be allowed to have no fix as long as they have a string as described above.

decide how to deal with sudo/administrative issues

It's probably a good practice to mostly use a non-admin account, but the non-admin won't be able to change configurations unless at least added to the sudoers list. Need to decide how to resolve this catch-22.

review CIS Apple OSX benchmark doc for configurations

CIS_Apple_OSX_10.10_Benchmark_v1.0.0.pdf

Review "The Ultimate OS X Hardening Guide Collection" for config

https://isc.sans.edu/forums/diary/The+Ultimate+OS+X+Hardening+Guide+Collection/12616/

Disable iCloud

Don't have a command for this yet, but iCloud is just generally evil and should be disabled altogether as a "recommended" config.

config check: Tor browser is missing or up to date.

config check: Tor is missing or up to date via homebrew

enhancement: disable printer sharing

Printer sharing should be disabled -- computers can connect to their own damn printer.

osxlockdown checks with this command: if [ -n "$(system_profiler SPPrintersDataType | grep Shared | grep Yes)" ]; then exit 1; fi; exit 0

This will tell you if one of your printers is currently being shared, but not whether printer sharing has been enabled as a service.

Here's the output from system_profiler if you have no printers currently added but have enabled printer sharing as a service:

$ system_profiler SPPrintersDataType
Printers:

      Status: The printers list is empty. To add printers, choose Apple menu > System Preferences…, click Printers & Scanners, and then click Add (+).
      CUPS Version: x.x.x (cups-xxxx.xxxx)

No useful info there.

Here's what it looks like if you have printer sharing enabled, but have not shared the single printer you've added to your system's list:

$ system_profiler SPPrintersDataType
Printers:

    My Fancy Printer X9001:

      Status: Idle
      Print Server: Local
      ...
      System Printer Sharing: Yes
      Shared: No

The fix for both is the same, borrowed from osxlockdown: cupsctl --no-share-printers

So the only thing I'm doing differently here is checking both for the service being active and whether printers are being shared, rather than just the latter. This will be condensed into one command.

config check: consider checking for third party app firewalls

https://github.com/drduh/OS-X-Security-and-Privacy-Guide#third-party-firewalls

enhancement: avoid sudo when possible

add field to HJson specification that states whether the command should be tried again with sudo if the first configuration attempt fails due to lack of sudo.

then, attempt all fixes up to 2 times -- once without sudo, and once with if specified in the HJson.

This will eliminate unnecessary use of sudo.

Craft a command that disables Safari from being opened, but allows it to be updated

Ideally I would encourage the user to disable Safari from being opened altogether.

Safari should still be updated normally in case the user enables it in the future.

It should come with an "undo" command to reverse the effect.

Previously I tried chmoding the .app folder, but no dice.

config check: allow apps downloaded from Mac store and identified devs

confidence level: recommended, not required.

Enhancement: Consider removing `regex match` type

The grep command can be used to replace the regex match type in the config HJson.

https://github.com/SummitRoute/osxlockdown/blob/master/commands.yaml does it this way, and it would probably make the HJson simpler.

consider use of privoxy

As described here:
https://github.com/drduh/OS-X-Security-and-Privacy-Guide#http

At a glance, this seems to be of limited use. This might lead to unnecessary logging of sensitive info in HTTP requests/responses.

bug: no explanation provided to user when prompted for password for `sudo_command`

Bug: warning about sudo_command printed multiple times when checking if fix worked

Example output:

The next configuration check requires elevated privileges; you may be prompted for your current OS X user's password below. The command to be executed is: 'sudo softwareupdate --schedule | grep 'Automatic check is on''
Password:
CHECK #11: Automatic check for software updates is enabled.... FAILED!
    Apply the following  fix? This will execute this command:
        'softwareupdate --schedule on' [Y/n] 
The next configuration check requires elevated privileges; you may be prompted for your current OS X user's password below. The command to be executed is: 'sudo softwareupdate --schedule | grep 'Automatic check is on''
    Attempting configuration fix with elevated privileges; you may be prompted for your OS X login password...
The next configuration check requires elevated privileges; you may be prompted for your current OS X user's password below. The command to be executed is: 'sudo softwareupdate --schedule | grep 'Automatic check is on''
CHECK #11: Automatic check for software updates is enabled.... PASSED!

Just need to add a state variable to check whether the command is being executed for the first time or not -- just clutters the screen to have this printed multiple times.

enhancement: audit keychain for non-default SSL certificates

Enhancement: Write results of audit to log file

review this list of commands for interesting configs to check

https://github.com/herrbischoff/awesome-osx-command-line

consider checking for blacklist of bad domains in hosts files

Some linked here:
https://github.com/drduh/OS-X-Security-and-Privacy-Guide#dns

However, glancing at these -- they are very long. Unless we can establish a high degree of trust in their integrity, I'm not sure how you can avoid getting hosed by one of them. :-/

Review these Mac Hardening Guidelines for config

https://techwiki.uwm.edu/display/SecOfficeStandGuide/Mac+Hardening+Guidelines

Add Sparkle Updater detection script

Adapt from the script here:
https://raw.githubusercontent.com/macmule/JSS-Extension-Attributes/master/Sparkle-MITM-Vuln-Apps.py

I'd like to eliminate the dependency on CoreFoundation, however.

config check: disk encrypted with FileVault

review this list for interesting configs

http://forums.macrumors.com/threads/can-a-mac-be-hacked-how-do-i-know-if-it-happens-security-advise-welcome.1087922/page-3#post-11835313

Bug: some configurations don't stick between logins

I think #29 broke some config fixes; By not running as sudo by default, we temporarily change the defaults value but it doesn't persist.

I've noticed this with the application firewall and stealth mode.

enhancement: lock down google chrome

• perform checks for each Chrome profile
• Chrome is the default browser (recommended)
• Chrome is installed (recommended) fix via homebrew? (recommended)
• For all Chrome checks, test passes if Chrome not installed
• Default search engine set to DuckDuckGo (recommended)
• Guest browsing not enabled (or ought it be?) (recommended)
• Disable "Let anyone add a person to Chrome" (required)
• Disable "use a web service to resolve errors" (required)
• Disable "use a prediction service to help complete..." (required)
• Disable "use a prediction service to load pages more quickly" (required)
• Disable "Automatically report issues..." (required)
• Enable "Protect you and your device from dangerous sites" -- recommended level since likely privacy tradeoff
• Disable "Use a web service to help resolve..." (required)
• Disable "Automatically send usage statistics" (Required)
• Enable Do-Not-Track (recommended)
• Disable auto-fill forms (recommended)
• Disable offer to save your web passwords (recommended)
• Disable Google CloudPrint (Recommended)
• Content Settings
  • Key generation: disable (recommended)
  • Do not allow any protocol handlers (recommended)
  • Plugins: Let me choose when to run plugin content (required)
  • Do not allow popups (required)
  • Do not allow any site to track physical location (required)
  • Do not allow unsandboxed plugins (recommended)
  • Plugins
    • Disable flash (recommended)
    • Disable native client (recommended)
    • Disable widevine DRM thingy (Recommended)
• Extensions
  • Check for uBlock Origin (recommended)
  • Check for Ghostery (Recommended)
  • ScriptSafe (experimental)

consider running dylib hijack scanner as a config check

https://objective-see.com/products/dhs.html