Security

The most important thing to do is keep your software up to date by using the Software Update program in System Preferences. I've also gotten together a security guide. But there are some significant things you can do, especially if you run any services like httpd or sshd.

Firewalls

OS X comes with a unix firewall program called IPFW, and there are a variety of programs you can use to access it from the GUI. As of 10.2 Apple includes a tool in system preferences to enable the firewall, but it's a very simple implementation that will only enable or disable a port for the entire internet. In 10.5, an application level firewall is included--this helps, but still leaves a given port open to the internet. This isn't the best use of a firewall, which is enable access to a service for a limited range of ip numbers. Fortunately, there are ways to control this.

SSHD

SSHD is the service that starts if you have Remote Login enabled. By it's nature, it's pretty secure--all connections are encrypted, and the service will slow down login attempts as passwords fail. But it can be made more secure. The settings files for SSHD is /etc/sshd_config, and you can run:
man sshd_config
from the command line for more information. But here are some settings you can tweak: There are other things you can do. One is to modify your firewall or use tcpwrappers to control the ip numbers or range whence ssh connections are allowed. Another option is to use an add on to SSHD that monitors connection failures and takes an action when a pattern of failures is matched. My favorite (but I'm partial to it because I helped put it together) is
Timelox and thehand, which is a version of SSHD that will run a script to insert a block on an ip address in the firewall after a given number of failed login attempts.

Viruses and Malware

As a unixy operating system, OSX is not really prone to viruses. But there are a few that have shown up in the last few years. There are some commerical products out there, but for the mac, I think ClamAVX is just fine.

Other types of malware are more problematic, but as of snow leopard Apple includes a set of malware definitions. That should help protect against known malware.

These days many of the attacks attempted against a computer are initiated by getting the browser to load some malicious code. Also, you can be identified on the internet by the uniqueness your browser configuaration. So one of the more important ways to protect yourself is to segregate your browsing activity. The easiest way to do this is choose one browser, say firefox, and use that for general use on the network, and use a different browser for any access to banking accounts or other web sites where security is a concern. Even better would be to create a separate account for this kind of web access.

If you want to closely monitor your network connections, take a look at Little Snitch, this program will alert you to all network connections.


Last modified: 06 March 2010