Security
The most important thing to do is keep your software up to date by using the Software Update program in System Preferences. I've also gotten together a security guide. But there are some significant things you can do, especially if you run any services like httpd or sshd.
Firewalls
OS X comes with a unix firewall program called IPFW, and there are a variety of programs you can use to access it from the GUI. As of 10.2 Apple includes a tool in system preferences to enable the firewall, but it's a very simple implementation that will only enable or disable a port for the entire internet. In 10.5, an application level firewall is included--this helps, but still leaves a given port open to the internet. This isn't the best use of a firewall, which is enable access to a service for a limited range of ip numbers. Fortunately, there are ways to control this.
- Tweaking the firewall: Using a
bash script to write a complex firewall
- WaterRoof and Noobproof: Firewall configuration tools for OSX
- Flying
Buttress: A great firewall configuration tool
- Tunneling through ssh: A general guide to tunneling connections through an encrypted ssh connection.
SSHD
SSHD is the service that starts if you have Remote Login enabled. By it's nature, it's pretty secure--all connections are encrypted, and the service will slow down login attempts as passwords fail. But it can be made more secure. The settings files for SSHD is /etc/sshd_config, and you can run:man sshd_configfrom the command line for more information. But here are some settings you can tweak:
- Port: This is the port that SSHD listens on. Personally, I'm not a fan of changing this, but many people believe that changing the port is a good way to hide from most attackers. Change the port to some arbitrary number above 1024, and then tell your SSH client that port number when you login.
- AllowUsers: Set this to the user name that you want to allow to login, usually yourself.
- MaxAuthTries: This is how many failed logins will be accepted before the connection is dropped. The default is 6, but unless you're using something else to block failures (see TimeLox below), it's better to set this to 3. MaxStartups: This controls how many unauthenticated connections are allowed, that is to say, connections that have been made, but for which no authetication has not yet succeded. Default is 10, but for a single user machine 2 is fine.
- PermitRootLogin: Root is not enabled by default in OSX, but if you are the kind of person that might enable root to do something, set this to either "no" or "without-password". The latter disallows root login with a password, but will allow root to login with a key (generally much safer than using a password).
Viruses and Malware
As a unixy operating system, OSX is not really prone to viruses. But there are a few that have shown up in the last few years. There are some commerical products out there, but for the mac, I think ClamAVX is just fine.
Other types of malware are more problematic, but as of snow leopard Apple includes a set of malware definitions. That should help protect against known malware.
These days many of the attacks attempted against a computer are initiated by getting the browser to load some malicious code. Also, you can be identified on the internet by the uniqueness your browser configuaration. So one of the more important ways to protect yourself is to segregate your browsing activity. The easiest way to do this is choose one browser, say firefox, and use that for general use on the network, and use a different browser for any access to banking accounts or other web sites where security is a concern. Even better would be to create a separate account for this kind of web access.
If you want to closely monitor your network connections, take a look at Little Snitch, this program will alert you to all network connections.
Last modified: 06 March 2010