Chapter 3 Initial Installation

Initial Installation

Although secure configuration of an existing Mac OS X installation is possible, securely configuring a fresh installation is much simpler. Although this may not always be practical, it is the recommended way to configure Mac OS X. This section details the steps involved in such an installation. If it is not possible to re-install the system, much of this chapter will not be applicable. The guidance in this chapter can still be used, however, to determine any differences between the previous installation and the recommended one. Wherever differences exist, the previous installation should be modified to match the recommended one; this may entail deleting installed packages, deleting registration information, changing an administrative account name, installing updates, and fixing disk permissions. This guide does not provide instructions on making these types of modifications to a previously installed system. Also, administrators should be aware that applying these recommendations to an existing system might cause the system to operate incorrectly. System Installation and Configuration
THE SYSTEM SHOULD BE DISCONNECTED FROM NETWORK UNTIL IT IS COMPLETELY AND SECURELY CONFIGURED!
Before Installation If the Open Firmware password had been enabled, it should be disabled before beginning installation. To do this: 1. Hold down command-option-O-F while restarting the system to enter Open Firmware mode. (Note: The command key has an apple symbol on it, and is located next to the space bar on the keyboard.) 2. Enter the Open Firmware password when prompted. 3. At the Open Firmware prompt (>) enter: reset-nvram reset-all The following installation process will destroy all information on the hard drive. If there is any information on the system that should be retained, it should be backed up to an alternate location before beginning this installation. When backing up and restoring any information, the following guidelines should be used:
Only user files and data should be saved and later restored; restoring system settings or previous accounts may change the system configuration specified in this guidance. Applications should be re-loaded from the original media, not restored from a backup. An Archive and Install option is available during installation. This option saves the current user accounts and restores them once the system has been re-installed. It is recommended that this option not be used, and that a completely new installation is performed. If it is necessary to retain the previous accounts using this option, each account should be configured according to this guide. Additionally, any restored files and directories may not have permissions set as recommended in this guide. All restored accounts should be examined carefully for potential security problems.

Begin Installation To begin a system installation, it is necessary to boot from the CD/DVD drive. All data on the target drive will be lost during the installation process.
The following instructions will cause all information on the target drive to be lost. Backup any data on the system that should be retained.
To begin the installation, use the following steps: 1. Insert the first Mac OS X v10.3.x installation disk in the CD/DVD drive. 2. Boot or reboot the system while holding down the C key on the keyboard. This will cause the system to boot from the CD/DVD drive and will start the installation process. The following list of screen titles appears during the installation of Mac OS X. Each bulleted item is the title of a separate screen. All screens are included so the administrator can gauge installation progress. Instructions are provided only for those screens where the administrator will need to perform configuration according to these guidelines. If instructions are not included for a screen, the installer should select default values (if any) and continue on to the next screen.
Continue Through Installation Screens
Any necessary partitioning of the hard drive can be performed at this point, by selecting Disk Utility from the Installer menu. Only experienced administrators who understand how to properly partition a drive should perform disk partitioning. For information on using Disk Utility to partition a drive, see Disk Utility Help. All startup disks on a system should be securely configured. If Mac OS X is to be installed on multiple partitions, each installation should be configured according to this guidance.
Select Language Install Mac OS X Welcome to the Mac OS X Installer Install Mac OS X Important Information Install Mac OS X Software License Agreement The installer must accept the agreement to continue. Install Mac OS X Select a Destination 1. Click on the drive or partition where the system is to be installed to highlight it. 2. Click the Options button. 3. Select the Erase and Install button.

Figure 5: FileVault Panel
5. Enter the master password for the system in the Master Password field, and again in the Verify field.
Do not enter anything into the hint field. The hint information could be used to compromise the account.
6. Select the OK button to return to the FileVault screen.
At this point, FileVault may now be activated for any user or administrative account. Enabling FileVault for individual users is addressed in Chapter 5. To enable FileVault for the current administrative account: 1. Click Turn on FileVault. A window will open asking for the users password. Since this is the administrators account, this password will be the administrators password. 2. Read the warning message that appears. To continue, click Turn on FileVault in the dialog, or click Cancel to stop. It is recommended that FileVault be enabled at this time; however, realize that this may take a while, depending on how much space is currently being used in the administrators account, since everything currently in the account will now have to be encrypted. Also, the system will require all users to log out during the conversion process, except the user for whom FileVault is being enabled. 3. Before beginning the conversion process, the system will log the user out of the system. Once the machine is done encrypting the users home folder, log back into the administrators account to continue configuring the machine. Additional Security Settings The first setting in the bottom section of the Security panel, Require password to wake this computer from sleep or screen saver, affects only the account currently logged in, and can be changed by any user for his own account. The remaining settings in that section of the panel affect all user accounts on the computer. These settings should be configured as follows: 1. Click on the Show All icon in System Preferences, or restart System Preferences if necessary. 2. Click the Security icon located on the Personal row (Figure 6).
Figure 6: Security Panel Additional Settings
3. Place a check in the box for Require password to wake this computer from sleep or screen saver. Note that the lock icon has no effect on this particular option. This means that any user may disable this capability for his own account, even if the administrator has enabled it. 4. Unlock the window for editing if necessary. 5. Place a check in the box for Disable automatic login to ensure that anyone using the machine must first enter a valid user ID and password. 6. Place a check in the box for Require password to unlock each secure system preference. 7. The Log out after x minutes of inactivity box should be unchecked for three reasons. First, automatically logging out a user can become extremely annoying to the user. Second, it can cause operational difficulties if a user runs processes that may be killed by the automatic logout process. Third, the automatic logout process can sometimes fail to complete without intervention, leaving the user with a false sense of security. If a program is hung or cannot quit properly, the logout process may be blocked from completing. For example, if an unsaved document is open in Microsoft Word, the automatic logout process will 29 UNCLASSIFIED

not complete until the user makes a decision about whether to save the file. Chapter 4 Configuring System Settings Automatically activating the screen saver after a certain period of inactivity is preferred, even though the user can disable it. Administrators should periodically verify that users have not disabled the capability. 8. Click the unlocked lock icon at the bottom of the window. Bluetooth The Bluetooth panel in the System Preferences program facilitates configuration of Bluetooth, the standard used in Mac OS X to allow wireless devices, such as wireless keyboards, wireless mice, and cellular phones to communicate with the machine. This panel will not appear on machines not equipped with Bluetooth. If this icon does not appear in the System Preferences panel of the machine being configured, skip the Bluetooth settings section, and move on to the next section. Bluetooth should not be used. Though System Preferences may be used to disable Bluetooth, there are a few notes about the management of Bluetooth in Mac OS X: This panel only disables Bluetooth for the currently logged in user. An administrator will need to log on as each user and disable Bluetooth for that account. Even if an administrator does ensure that Bluetooth has been disabled for every user, a user will be able to go back and re-enable the capability at any time, unless the users accounts have been severely limited. If the account is limited to the point where the user will not be able to change settings such as Bluetooth and the screen saver, he will also be unable to do more important things, such as change his own password. Limitations of user accounts such as this will be discussed in further detail in Chapter 5. Bluetooth, IR ports, CD writers, and any other hardware capability that could be dangerous in a secure environment should be physically disabled if possible; however, disabling or modifying the hardware will likely void the warranty on the machine if it is not performed by an Apple Certified Technician. For information on becoming an Apple Certified Technician, send a request for information to the Apple Federal e-mail address: AppleFederal@apple.com.
Settings for Bluetooth should be configured in System Preferences as given below. Additional steps for disabling Bluetooth are presented in a later section of this chapter on disabling hardware. To disable Bluetooth for the administrators account using this panel: 30
1. Click on the Show All icon in System Preferences, or restart System Preferences if necessary. 2. Click on the Bluetooth icon in the Hardware row of options. If there is no Bluetooth icon, Bluetooth capability is not installed on the machine. In this case, skip to the next section. 3. Click the Turn Bluetooth Off button (Figure 7).

If the root account has been enabled, it should now be disabled using the following procedure. There are multiple methods of enabling root access, and this procedure is designed to disable the root account regardless of the method used to enable it. To perform this procedure: 1. Log into an administrator account and start the NetInfo Manager application found in /Applications/Utilities.
2. Click on the users item located in the second column at the top of the NetInfo Manager panel. This will open the list of users in the third column.
3. Click on the root item in the users column. The root users properties and any associated values will appear in the bottom panel of the window (Figure 19).
Figure 19: NetInfo Manager
4. Click on the lock in the lower left corner of the NetInfo Manager window. Type an administrator's short name and password into the authentication dialog that appears and click the OK button. 5. If the property authentication_authority is listed in the bottom list in the window, click on it to highlight that property. 6. Go to the top of the NetInfo Manager window and click the Delete icon to remove that property and value. 7. Double click on the value associated with the passwd property located in that bottom property list, and the value should become highlighted for editing. This value will be a single asterisk if the root password has never been set, and either a string of asterisks or a password hash if a password has been set for root. (Which of these appear as the value for passwd depends upon how the root account was enabled.) 8. Type a single asterisk (*), replacing the current value of the passwd property.
9. Click the lock icon in the lower left corner of the NetInfo Manager window to re-lock the window. 10. When the Confirm Modification dialog box appears, select Update this copy. 11. Quit the NetInfo Manager application. Root login is now disabled. Using sudo The sudo program allows an administrator to perform command line functions that require root privileges. To use sudo, bring up a Terminal window and type sudo followed by the command to be performed with root privileges. For more detailed information on sudo, enter man sudo in a Terminal window to display its manual pages. The system uses a file called /etc/sudoers to determine which users have the authority to use the sudo program. This file initially contains the root account and all administrative accounts. The format for entries to this file can be found by entering man sudoers in a Terminal window; editing this file correctly can be a complex process. All administrative functions can be performed from an administrator account, using sudo when necessary. None of the administrative functions performed through the graphical interface require root privileges, but some command-line administrative procedures must be performed as root. Securing Single-User Boot On Apple systems running Mac OS X, Open Firmware is the software executed immediately after the computer is powered on. This boot firmware is analogous to the BIOS on an x86-based PC. To prevent users from obtaining root access by booting into single user mode or booting from alternate disks, the Open Firmware settings should be altered. For desktop systems, the Open Firmware security mode should be set to command. To configure the Open Firmware settings: 1. Boot the machine while holding command-option-O-F (all four keys at the same time) to enter the Open Firmware command prompt. 2. At the prompt, enter the command: password A prompt will appear requesting a new password. 3. Enter and verify the password to be used as the Open Firmware password. This password is limited to eight characters. A strong password should be chosen; in this instance, a machine-generated random password would be a good choice. This password should be written down, and secured in the same location as the Master FileVault password. This password will not be needed except for situations where the system must be booted from an alternate disk, such as if the boot disk fails or its filesystem is in need of repair. Chapter 4Configuring System Settings

6. Open a new terminal window and issue the following command, replacing <xx> with two random characters and <password> with an appropriate 8-character password: openssl passwd -salt <xx> <password> A hash of the password will be displayed after executing the command. 7. Type or paste the password hash where the asterisk was deleted in step 10. 8. Exit, saving changes. Logon Warning Banners A logon banner can be used to provide notice of the systems ownership, warn away unauthorized users, and remind authorized users of their consent to monitoring. The text displayed in the logon banner should be determined by site policy. Warning banners should be displayed on all systems. Banners should be provided to users logging onto the system locally, and also to any users logging into services remotely. To provide a logon warning banner to local (GUI) users: 1. Edit the file /Library/Preferences/com.apple.loginwindow.plist as an administrator. To do this, start the Terminal application, found in /Applications/Utilities, and enter the following command (the entire command is entered on a single line): sudo pico /Library/Preferences/com.apple.loginwindow.plist 2. Immeditately after the <dict> tag, add new lines with a <key> and <string> entry, as show below in bold. The new <key> tag must contain LoginwindowText, but the new <string> can contain whatever warning banner has been indicated by site policy. <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList1.0.dtd"> <plist version="1.0"> <dict> <key>LoginwindowText</key> 52
<string>THIS IS A DEPARTMENT OF DEFENSE COMPUTER SYSTEM. USE OF THE SYSTEM IMPLIES CONSENT TO MONITORING. ANY UNAUTHORIZED USE OF THE SYSTEM WILL BE PROSECUTED. </string> <key>MasterPasswordHint</key> <string></string>. 3. Exit, saving changes. The warning banner should appear for the next person logging into the GUI. To provide a logon warning banner to users logging into remote services on the system: 1. Edit the file /etc/motd as an administrator with the following command in a Terminal window: sudo pico /etc/motd 2. Enter the warning banner that has been approved. 3. Exit, saving changes. The warning banner should appear for the next person logging into a remote service. Auditing and Log File Configuration Apple includes a graphical program, Console, to view and maintain log files. Console is found in the /Applications/Utilities folder. Upon starting, the console window shows the console.log file (Figure 20). Clicking on the Logs icon at the top left of the window displays a sidebar that shows other log files on the system in a tree view. The tree may include directories for services that are installed but not running on a typical Mac OS X system (e.g. http, ftp).

Figure 20: Console Log

In Mac OS X, log files are handled by either the BSD subsystem or a specific application. The BSD subsystem handles most of the important system logging, while applications such as the Apache web server handle their own logging. Like other BSD systems, Mac OS X uses a background process called syslogd to handle logging. A primary decision to make when configuring syslogd is whether to use remote logging. In local logging, log messages are stored on the hard disk. In remote logging, log messages are transferred over the network to a dedicated log server which stores them. Using remote logging is recommended in addition to local logging when possible. Configuring syslogd The configuration file for the system logging process, syslogd, is /etc/syslog.conf. A manual for configuration of this file is available by issuing the command man syslog.conf in a Terminal window. Each line within /etc/syslog.conf consists of text containing three types of data: a facility, a priority, and an action. Facilities are categories of log messages. The standard facilities include mail, news, user, and kern (kernel). Priorities deal with the urgency of the message. In order from least to most critical, they are: debug, info, notice, warning, err, crit, alert, and emerg. The priority of the log message is set by the application sending it, not syslogd. Finally, the action specifies what to do with a log message of a specific facility and priority. Messages can be sent to files, named pipes, devices, or to a remote host. The following example line specifies that for any log messages in the category mail, with a priority of emerg or higher, the message will be written to the /var/log/mail.log file: 54
mail.emerg /var/log/mail.log
The facility and priority are separated by only a period, and these are separated from the action by one or more tabs. Wildcards (*) may also be used in the configuration file. The following example line logs all messages of any facility or priority to the file /var/log/all.log:

*.* /var/log/all.log

Local Logging The default configuration in /etc/syslog.conf is already appropriate for the typical Mac OS X system when a remote log server is not available. The system is set to rotate log files using a cron job at the time intervals specified in the file /etc/crontab. Rotation entails compressing the current log file, incrementing the integer in the filename of compressed log files, and creating a new log file for new messages (Table 2).
Table 2: Log Files in /var/log
Files before rotation: System.log mail.log
Files after first rotation: system.log mail.log mail.log.1.gz system.log.1.gz
Files after second rotation: system.log mail.log mail.log.1.gz system.log.1.gz mail.log.2.gz system.log.2.gz
The log files are rotated by a cron job, and the rotation will only occur if the system is on when the job is scheduled. By default, the log rotation tasks are scheduled for very early in the morning (e.g. 4:30 A.M. on Saturday) in order to be as unobtrusive as possible. If the system will not be powered on at this time, adjust the settings in /etc/crontab. Details on editing the /etc/crontab file can be found by issuing the command man 5 crontab in a terminal window. For example, the following line shows the default for running the weekly log rotation script, which is configured for 4:15 AM on the last day of the week, Saturday (Sunday is 0). An asterisk denotes any, so a line of all asterisks would execute every minute.

not permanently disable the components; however, administrative access is needed to re-load them and restore the capabilities. Chapter 4Configuring System Settings Although disabling hardware in this manner is not as secure as disabling hardware physically, it is more secure than only disabling hardware through the System Preferences. This method of disabling hardware components may not be sufficient to meet site security policy. Consult operational policy to determine if this method is adequate. 1. Open the folder /System/Library/Extensions. 2. To remove AirPort support, drag the following files to the Trash: AppleAirPort.kext AppleAirPort2.kext AppleAirPortFW.kext 3. To remove support for Bluetooth, drag the following files to the Trash: IOBluetoothFamily.kext IOBluetoothHIDDriver.kext 4. To remove support for audio components such as the microphone, drag the following files to the Trash: AppleOnboardAudio.kext AppleUSBAudio.kext AudioDeviceTreeUpdater.kext IOAudioFamily.kext VirtualAudioDriver.kext 5. To remove support for the iSight camera, drag the following file to the Trash: Apple_iSight.kext 6. Open the folder /System/Library. 7. Drag the following files to the Trash: Extensions.kextcache Extensions.mkext 8. Choose Secure Empty Trash from the Finder menu to delete the file. 9. Reboot the system.
Disabling Mac OS 9 The previous major version of the Macintosh operating system, Mac OS 9, does not have many of the security features built into Mac OS X. There are two ways of
running Mac OS 9 applications: booting the system into Mac OS 9, and running an application in Classic Mode. This mode is an adaptation of Mac OS 9 that runs as an application on a system running Mac OS X. It is not recommended to boot into Mac OS 9 or to use Classic Mode. Mac OS 9 and any Mac OS 9 applications should be removed from the system. To do this, use the following instructions. Please note that great care must be taken in doing this; root access is required to do these steps, and incorrectly entering a folder name could result in removal of the Mac OS X operating system or all Mac OS X applications.
Following the instructions below will disable Classic Mode and no users will be able to run Mac OS 9 applications.
To remove Mac OS 9 and Mac OS 9 applications and files: 1. Log into the administrators account. 2. Start the Terminal application, found in /Applications/Utilities. 3. Type the following command to remove the Classic icon from the System Preferences panel: sudo rm rf '/System/Library/PreferencePanes/Classic.prefPane' 4. Type the following commands to remove Classic files and directories if they are present on the system. Note that each command should be typed on a single line; they are split across lines here only for readability:

Figure 27: Disable Internal Microphone
28. Use a dummy plug to plug the Line In jack on the machine. 29. If there is no Line In jack, then the only setting available under the Choose a device for sound input box will be the internal microphone (if there is one), and there will be no way to remove that option. In either case, it is recommended that the internal microphone be physically disabled. As stated previously, this should only be done by an Apple Certified Technician to avoid voiding any warranty on the machine. Next, the Require a password to wake this computer from sleep or screen saver restriction should be enabled as follows: 30. Click on the Show All icon at the top of the system preferences panel. 31. Click on the Security icon to bring up the security preferences panel. 32. Place a check in the Require password to wake this computer from sleep or screen saver checkbox. Note that the above settings are not protected. Administrative privilege is not required to change them, and the user may change these settings himself. The configuration for these settings should be clearly indicated in the security policy for the system, and users should be educated about the need to ensure these settings are secure. Also, the system administrators may want to check users accounts periodically to ensure users are not changing these settings. 72
The next step is to enable FileVault for this user: 33. Make sure all applications (other than System Preferences) are closed, as the user will be logged out as part of the process of starting FileVault. 34. Bring up the security preferences panel in the System Preferences application if necessary. 35. Unlock the window for editing if necessary. 36. Click on the Turn On FileVault button (Figure 28). Chapter 6 Future Guidance
Figure 28: Enable File Vault
37. When prompted, enter the password given to the account when it was created and click OK. 38. Click on the Turn On FileVault button on the window that appears. At this point the user will be automatically logged out, the users file system will be encrypted, and FileVault will be enabled for the user. The above instructions for configuring a users System Preference settings should be repeated for every user on the system, and should be performed on every new account created.
Overriding the Default umask The default umask value can be overridden for a particular user, if needed. To do so, log into the user account to be changed. For example, to set the default umask to 027 (decimal equivalent 23) so that other group members can read files created by a user, issue the following command in a Terminal window: defaults write g NSUmask int 23 This command will affect the permissions on files and folders created by programs that respect the Mac OS X NSUmask settings, although there is no guarantee that a program will respect these settings. The user can also change his default umask setting at any time. The changes to the umask settings take effect at next login. Setting Up Keychains for a User Account Mac OS X provides an application called Keychain Access that allows a user to manage collections of passwords and certificates, each of which is called a keychain. Each keychain can hold a collection of credentials and protect them with a single password. Passwords, certificates, and any other private values (called secure notes) that a user or application places into a keychain are encrypted. These values are accessible only by unlocking the keychain using the keychain password. A user can create multiple keychains, each of which will appear in a keychain list in the Keychain Access application. Each keychain can store multiple values; each value is called an item. A user can create a new item in any keychain. When an application needs to store an item in a keychain, it will store it in the one designated as the users default. The default is initially the keychain named login, but the user may change that. When a user must keep track of a multitude of passwords, he is likely to either make the passwords identical for all the systems, or keep a written list of all passwords. Use of keychains can greatly reduce the number of passwords a user must remember. Since the user no longer has to remember passwords for a multitude of accounts, the passwords chosen can be very complex and could even be randomly generated. One disadvantage of using a keychain, however, is that if the user does not choose a strong password, or if the password is compromised, then all the accounts protected by that keychain may be compromised. Another disadvantage is that any application may make use of the Keychain API to query for passwords. Therefore, care must be taken in determining which applications are granted access to a keychain. Despite these disadvantages, keychains provide some additional protection for passwords, passphrases, certificates, and other credentials stored on the system. Also, in some cases, such as using a certificate to sign an e-mail message, the 74

Figure 30: Keychain Password Change
6. From the Edit menu, select Change Settings for keychain login. 7. Select Lock when sleeping (Figure 31).
Figure 31: Keychain Settings
8. Check the configuration of each of the items in the login keychain. Each item can be individually configured to permit access by only certain applications. The lower half of the Keychain Access window contains a tabbed view pane for configuring the attributes and settings for each item. Repeat the following steps for each item: a. Select an item within the currently selected keychain. b. Click on the Access Control tab in the bottom of the window to display the attributes of that item. c. The Allow all applications to access this item option should not be selected. If it is, it will allow any application to access the associated credential whenever the keychain is unlocked, without prompting the user.
Setting this option allows any application to access the item without user notification or authentication. This setting should never be selected.
d. The Confirm before allowing access option should be selected. Selecting this option causes the system to prompt the user for permission before releasing the passphrase to an application. 78
e. Place a check in the Ask for keychain password checkbox. With this option selected, the user will be required to provide the keychain password before the Keychain Access application will release the passphrase to another application. This is particularly important for high value items, such as personal key certificates which are only needed when signing or decrypting information, although such items should also be placed in their own keychains. f. The Always allow access by these applications list should be kept empty unless operationally required. Any application in this list can access the item without prompting the user or requiring re-entry of the keychain password. If there are any applications in this list, click on one of them, and click on the Remove button at the bottom of the window. Repeat this until all entries have been removed from the list. Creating Multiple Keychains When a user account is created, it will contain only an initial default keychain, login. A user may create additional keychains, each of which may have different settings. This allows the user to create and configure different keychains for different purposes. For example, a user may want to group all his credentials for mail accounts into one keychain. Since mail programs query the server frequently to check for new mail, it would not be practical to expect the user to re-authenticate every time such a check is being performed. The user could create a keychain and configure its settings such that he would be required to enter the keychain password at login and whenever the machine is awakened from sleep mode. He could then move all items containing credentials for mail applications into that keychain and set each item so that only the mail application associated with that particular credential can automatically access it. This would force all other applications to authenticate in order to access that credential. A setting such as the one given above might be appropriate for credentials used by mail applications, but might be unacceptable for others. If a user has an infrequently used web-based account, it would be more appropriately stored in a keychain configured to require re-authentication for every access by any application. The following guidance explains how to set up three keychains in a users account, each with a different level of accessibility. This configuration should be adequate for a typical user, and should demonstrate the use of multiple keychains by a single user. Once a user becomes familiar with configuring keychains, he may want to create a custom keychain configuration. Keychain Examples Keychain 1: Frequently accessed credentials (e.g. Mail)

Figure 34: Mail Keychain Items Access Control Settings
Keychain 2: Moderately accessed credentials (e.g. database access) This keychain is designed to protect credentials that are accessed frequently and automatically whenever a user is accessing a particular application that needs a credential from a keychain. An example of this might be a database that requires credentials for every query. In this situation, the desired behavior entails authentication of the keychain password at the beginning of a session, and reauthentication on a periodic basis (e.g. every 15 minutes) rather than for every query. 1. Start the Keychain Access application. 2. Select New keychain from the File menu. 3. Select a location for the new keychain. 4. Type a name for the new keychain in the Save As box and click on Create. For this example, the name of the new keychain is database_keychain. 5. Select a new password for the keychain and enter it in the window that appears on the screen. Use the password assistant (the i button) to check the strength of the password. 6. Select Change Settings for keychain database_keychain from the Edit menu.
7. Make sure the Lock when sleeping option is selected, and that the Lock after x minutes of inactivity option is selected and set to a appropriate value, such as 15 (Figure 35).
Figure 35:Database Keychain Settings
8. Move any items containing credentials for database applications, or any other items to be protected by this keychain, into the newly created keychain. This can either be done using the Cut and Paste features from the Edit menu, or by selecting the item to be moved and dragging it over the new keychain. Keychain Access will then prompt for the keychain password of the keychain originally containing the item. Enter the password and click the Allow Once button. The item should appear in the item list for the new keychain, and should no longer appear in the original keychain. 9. Configure all items now in this keychain. Select an item in the list, and click on Access Control. Make sure both Confirm Before Allowing Access and the Ask for keychain password are selected. Remove any entries in the access list other than the application that should be allowed to use the credential automatically. Repeat this step for all items in the list. Keychain 3: Infrequently accessed credentials (e.g. web accounts) This keychain is designed to protect credentials that are either accessed infrequently, or that require very strict control and re-authentication for every access. Initially, it might not seem to make sense to put credentials in a keychain if the user must enter a password every time the credential is used. But if the user uses a single keychain to store all such credentials (e.g. all web-based accounts) then he may use completely different, randomly generated passwords for every account protected with that keychain, and have a single, very strong password for that keychain that will access all accounts. This would be better than using simple passwords for each account, writing down the passwords for each account, or using a single password for several accounts across different systems with different levels of password protection. 1. Start the Keychain Access application. 2. Select New keychain from the File menu. 3. Select a location for the new keychain.

11. Drag the original file to the Trash. 12. Choose Secure Empty Trash from the Finder menu to delete the file. 13. In the Keychain Access application, select Add keychain from the File menu and open the keychain file that was moved.The keychain will appear in the list of keychains in the Keychain Access application. The system will now access the keychain file in its new location. Using an Account Securely Because users can change several security-related settings, site policy must address how they should configure these settings. The following list summarizes those areas: The user can change the automatic screen saver timeout settings in the Desktop & Screen Saver panel of the System Preferences application. If site policy specifies a timeout period for the screen saver to be initiated, this policy should be made clear to users, and they should be instructed to set and leave this setting at the appropriate value. The user can turn off the Require password to wake this computer from sleep or screen saver option, found in the Security panel of the System Preferences application. If Bluetooth was not disabled physically or as described in Chapter 4s Disabling Hardware Components section, the user can turn Bluetooth back on using the Bluetooth panel in the System Preferences program. If the microphone was not disabled physically or as described in Chapter 4s Disabling Hardware Components section, the user can turn it back on using the Sound panel in the System Preferences program. Because there is currently no mechanism included in a standalone Mac OS X system for enforcing strong password selection or periodic password changing, site policy should specify password change intervals and rules for password selection. Users should receive instruction on using and managing keychains properly.

Future Guidance

Topics for consideration in future versions of this guide or in other guidance documentation include: Mac OS X v10.3.x Server Managing Mac OS X networks Cross-Platform (Mac OS XWindows, Mac OS XLinux, etc.) Security Issues Apple Remote Desktop A Pull-out Users Guide, which will include a users perspective on using keychain effectively for security, settings which users should not change, and other security-related instructions for users. More Detailed Configuration of the Built-in Firewall Managing Certificates in Mac OS X IPSec/VPNs under Mac OS X Using SmartCards with Mac OS X Secure File Deletion Tools for Checking the Security Configuration of a Mac OS X System Using groups under Mac OS X Using Global keychains

Appendix

Appendix A Encrypting Files and Folders
Encrypting Files and Folders
As described earlier, Mac OS Xs FileVault feature can be used to encrypt a users entire home directory. However, some situations call for the encryption of individual files and folders, not simply the entire home directory. The Disk Utility program shipped with Mac OS X provides the ability to encrypt disk images containing arbitrary files and folders. Like FileVault, it uses the Advanced Encryption Standard (AES) with a 128-bit key. Using Disk Utility Using Disk Utility is recommended for situations in which either the file system permissions or FileVault may not be sufficient to guarantee the confidentiality of a file or folder. Situations in which filesystem permissions no longer protect a file include: Transmission of a file over a network using a plaintext protocol such as SMTP or FTP Transfer of a file to removable media whose physical security cannot be guaranteed Compromise of a computers administrator account

The Disk Utility program is located in the folder /Applications/Utilities. Two methods exist for creating encrypted disk images: a new blank image can be created, or an image can be created directly from an existing folder or volume. Disk Utilitys help facility (in the Help menu, choose Disk Utility Help) provides details on how to create and use these encrypted disk images. Creating a New, Blank Disk Image With Encryption Users can add files to blank disk images over a period of time, unlike images created directly from existing data. The instructions below follow those in the Disk Utility help section Creating a blank disk image, which describes how to create a new image whose contents can be encrypted. For situations where the threat includes unauthorized administrator access to the machine, creating an encrypted, blank disk image before receiving or creating sensitive data is preferred over directly creating an image from previously existing sensitive data. For example, many application programs create backups, working copies, or caches of files in the same folder as the original. If a file has only been created and accessed from the encrypted image, then these copies will also be protected.
1. Open Disk Utility, located in /Applications/Utilities, and make sure nothing is selected in the Disk Utility window (Figure 37). Appendix A Encrypting Files and Folders
Figure 37: Disk Utility Panel
2. In the Images menu, choose New > Blank Image or click the New Image button. 3. Type a name for the disk image and choose where to save it (Figure 38).
Figure 38: Disk Utility Save Panel
4. Choose the size of the disk image from the Size pop-up menu. Disk images cannot be directly expanded, so make the size as large as may be needed. 5. Choose an encryption method. The recommended method is AES-128. 6. Choose a format, and then click Create. Although there is some overhead, the sparse format allows the image to maintain a size proportional to its contents (up to its maximum size), which can save disk space. 7. A dialog box (Figure 39) will appear asking for a password to use in encrypting the image. It is important to use a good password here, and to ensure that the password is not forgotten. If the data is very important, it may be a good idea to write down the password, seal it in an envelope, and store it in a secure location. If the password is lost or forgotten, the data cannot be recovered.
Figure 39: Password Entry for Encrypted Image
This dialog box offers a checkbox which, when checked, causes the password to be saved in the users keychain. This means that anytime the users 91 UNCLASSIFIED

Welcome to Panther

Find out what you can do with Mac OS X and Mac OS X applications
Apple Computer, Inc. 2004 Apple Computer, Inc. All rights reserved. The Apple logo is a trademark of Apple Computer, Inc., registered in the U.S. and other countries. Use of the keyboard Apple logo (Option-Shift-K) for commercial purposes without the prior written consent of Apple may constitute trademark infringement and unfair competition in violation of federal and state laws. Apple, the Apple logo, iLife, iMovie, iTunes, Mac, and Mac OS are trademarks of Apple Computer, Inc., registered in the U.S. and other countries. Finder, GarageBand, iDVD, iPhoto, iPod, iSight, Panther, Safari, SnapBack, and SuperDrive are trademarks of Apple Computer, Inc.Mac is a service mark of Apple Computer, Inc. Because Apple frequently releases new versions and updates to its software, images shown in this book may be slightly different from what you see on your screen.
Mac OS X works the way you want to work. Its simple, yet powerful, so you can chat with friends, organize your desktop, arrange your photo album, and do ten other things at once, quickly and easily.
Switch users without quitting your applications.
Quickly access disks, servers, and your favorite folders in Finder windows.
Use iChat AV to video chat with friends and colleagues.

Centered on You

Mac OS X puts you at the center of your computer, making it easy to find your files wherever they are. The column on the left of every Finder window gives you easy access to your iDisk, network, home folder, and other favorite folders.
Search help to get answers to your questions. To find a file or folder quickly, type its name here.
Your hard disk, iDisk, servers, and removable media such as your iPod appear in the left column of every Finder window.
Keep your home folder and other favorite items in this part of the Finder window.
Use your home folder to store your documents, photos, music, and more.
For more information, search help for: Using the Finder Browsing your network Using your home folder Opening and saving documents Finding your files

Consistently Easy Access

Mac OS X Panther provides the same easy access to locations when you open and save files in applications and when you search for files in the Finder.
Finding files Finding your files in the Finder is fast and easy. Just type what youre looking for in the search field. As you type, youll see results immediately. Click the magnifying glass to choose where to search, then type the name of the file youre looking for.
Double-click a file to open it. Double-click a folder to open it in its own Finder window. Click here to repeat a search.
Opening and saving The Open and Save dialogs show the same view that you see in the Finder so you can access your iDisk, network, and other favorite folders. Click the List or Column View buttons to change the view. Choose recently used locations from the pop-up menu or use the back and forward buttons.
Applications may include additional options here.

Customize the Finder

The Finder provides many convenient features to help you work the way you want. You can customize the Finder window to quickly access the files and folders you use the most and the actions you perform most frequently.

Click this to eject a CD, DVD, iPod, server, or other removable media.
Add buttons to the toolbar for your favorite actions.
For quick access to project files and your favorite folders, drag them to the left column of the Finder window.
Select the items you access most often to show them in the Finder window.
For more information, search help for: Customizing the Finder Adding items to the Sidebar Using your home folder Selecting labels

Customize Your Files

Use the Action pop-up menu in the toolbar to assign labels and perform other actions on files. You can customize Finder windows and labels to suit your needs.
Actions The items in the Action pop-up menu change depending on the item you have selected. When you select a file, you can choose a label for it, compress it, or choose an application to open the file with.
To show preview icons or information about items or change the background color in Finder windows, choose Show View Options from the View menu.
Labels Labels let you quickly identify important documents. You can specify your own names for labels and search for files by label. You can also see labels in the Open and Save dialogs. Use the Labels pane in Finder preferences to customize the names of labels.

Easier for You

Mac OS X makes it easier than ever to get your work done, even when youre doing many things at once. When too many windows make it hard to see what you're doing, activate Expos to clear the clutter with the touch of a key.
To instantly access all the windows you have open at once, press F9. Expos Use these shortcuts to see the windows youre working with or your desktop. To change the default Expos shortcuts or use the screen corners, open System Preferences and click Expos.
When the pointer is over a window, you see the windows title.
To instantly access the windows in the current application, press F10.
To instantly access your desktop, press F11. To see your windows again, press F11 again.
For more information, search help for: Customizing Expos Copying items using Expos Switching applications Switching to a different user

Fast Switching

Mac OS X makes it easy for several people to share a computer. And Panther lets you quickly switch to another user without quitting the applications you have open.

Setting up To turn on Fast User Switching, open System Preferences and click Accounts, then click Login Options.
Select this option in the Login Options pane of Accounts preferences.
Switching users To switch user accounts, choose the users name from the menu in the top-right of the screen, then enter the users login password if required.
The checkmark indicates this user is logged in.
Switching After you enter the password the users desktop rotates into view.

Stay in Touch

Mac OS X provides many ways to stay in touch with friends, family, and colleagues. iChat AV* and iSight make videoconferencing a snap whether you're discussing business, chatting with friends, or staying in touch with your family.
Instant message a group of.Mac and AIM buddies.
This person is available for an audio chat. Use audio chat instead of calling on the phone.
This person is available for a video chat.
Click to add a new person to your Buddy List and your Address Book.
To see what your buddy is seeing, check the picture-in-picture.
Click here to view your video in full-screen mode.
For more information, search help for: Using iChat AV Setting up your.Mac account Organizing your email Addressing your messages
* To use iChat AV, you need a.Mac membership or AIM account.

Say It With Email

Use Mail to send and receive email messages to friends and colleagues. Youll find new ways to organize the messages you receive and address the messages you send.
Keep organized The Mail viewer lets you group all the messages on the same topic or thread. Click the first message in a thread to select the entire thread.
To see if you have replied to a message, look for the in the status column.
When you select a thread, youll see a summary of the messages in the thread. Click a message to open it.
Addressing To enter an address, begin typing the name of a person in your Address Book and Mail will automatically complete the address. To move an address from the To field to the CC field, just drag it. Click an address to edit it, add it to your Address Book, or choose an alternate address.

Many people have more than one email address. Mail can mark addresses so youre sure you are sending messages to the right address.
Use styled text and graphics in your messages.

Stay Mobile

Mac OS X helps you keep up with your important data on any computer connected to the Internet. Files on your iDisk* are always available even when youre not connected to the Internet and synchronized automatically when you are connected.
When youre connected, your iDisk synchronizes automatically so your files are always available.
Keep your documents on your iDisk and work on them anytime.
You can use iSync to synchronize your Address Book contacts, iCal calendars, and Safari bookmarks with the.Mac server.
For more information, search help for: Setting up your iDisk Synchronizing your data Keeping your computer safe Turning on FileVault
* To use iDisk, you need a.Mac membership.

Peace of Mind

Whether youre on the road or at home, security is important. Turn on FileVault to encrypt your home folder and keep your important data secure.
FileVault To turn on FileVault, use Security preferences. When you do, you must set a master password. Use Accounts preferences to turn on FileVault for other users on your computer.
If you forget your login password, the master password lets you access your data. If you forget both passwords, your data is lost forever.
For additional security, select other options to require a password to access your computer.
Protected When FileVault is turned on, you work with your files the same way in the Finder and other applications. When you open a file, it is automatically decrypted and ready to use.
The icon for your home folder changes to the FileVault icon to show that it is protected.

Addressing Made Simple

Address Book makes it easy to keep track of your contact information. You can use that information to send email, fax a document, or add a buddy in iChat AV. You can also print your contact list to keep your address book with you.
Search your contact information by typing here.
Use standard directory services such as LDAP.
Create groups to organize your contacts. To add contacts, drag them to the group.
Click these buttons to create a new group or add a new card to Address Book.
Send this person an email message or start a chat.
For more information, search help for: Using Address Book Printing your addresses Setting up printers Sending and receiving faxes

Printing and Faxing

Print your Address Book information as a list or as mailing labels. The new built-in fax support lets you send faxes using the fax numbers stored in your Address Book.
Printing To keep your personal phone book with you, print the information in your Address Book as a list, including pictures. You can also print mailing labels from your Address Book.
Choose to print a list or mailing labels using Avery labels. Select the items you want to include in the printout.
Faxing You can send faxes to people using their fax number stored in your Address Book. You can also receive faxes and view them in Preview.

Great Views

Preview is the fastest PDF viewer for your Mac. No matter how big the PDF file, you can quickly and easily find just the information you need. Whether you view documents and images on screen or print them from Preview, they always look their best.
Use the tools to copy text and images in PDF files or crop your image files. Type here to search for text in the PDF file.
Use Preview to view PDF files and many types of image files.
Click an item in the search results to open that page.
For more information, search help for: Using Preview Selecting fonts to use in documents Creating font collections Setting typographical options

Great Fonts

Mac OS X includes an outstanding collection of fonts for you to use. Font Book and the Font panel make it easy to install, preview, and manage all your fonts.
Font Book Use Font Book to install, preview, and organize fonts. To organize fonts, create a collection and drag fonts to it. If you dont want to see a font in the Font panel, select it and click Disable. Type a font name here to find it quickly. Drag the slider to see the font you are previewing at different sizes.
To install a font, you can double-click its icon in the Finder or click the Add (+) button under the Font column.
Font panel When you work on a document, use the Font panel to select fonts, styles, and typographical features of the font. You can access the same collections you created in Font Book. You can also create new collections or add fonts to the Favorites collection.

Select underlining, strikethrough, color, and drop shadow.
If you just need to choose fonts, you can resize the Font panel to show only pop-up menus. Click the Action button to select typographic properties for the font.

Getting Connected

Mac OS X makes it easy to connect to your network or the Internet. Once youre connected, applications like Safari, iChat AV, and iTunes make using the Internet more productive and fun.
Use the status icons to start connections.
Click Network in a Finder window to browse for and connect to Mac, Windows, and UNIX network servers.
See the status of your connection in Network preferences.
Many Mac OS X applications work with the Internet.
Click here for help setting up a connection.
For more information, search help for: Getting connected Sharing your files Searching the Internet Exploring the Internet

Sharing and Surfing

Sharing your files, folders, or Internet connection is easy and secure. Safari is the fastest and easiest-to-use web browser for the Mac.
Sharing Use Sharing preferences to turn on the network services that fit your needs, including sharing with Windows computers and the Internet. Separate your network from the outside world using Personal Firewall protection.
Click these buttons to share your Internet connection with other computers on your network and turn on Personal Firewall protection.
The address to access a service appears here.
Safari Safari displays webpages fast. Finding websites is a snap using the built-in Google search box. Click the Add Bookmark (+) button to bookmark a webpage. Tabbed browsing lets you open several webpages in the same window. Use SnapBack buttons to return to your starting webpage or your Google search results.

Works With Windows

Mac OS X fits seamlessly into Windows networks so you can share documents and printers. You can establish a secure connection to a Windows network over the Internet and access Microsoft Exchange servers.
You can also use the Connect To Server dialog to access servers in the Finder.
Browse for Windows servers and shared folders in the Finder.
Use your iDisk to share documents with Windows users.
Many applications, such as Microsoft Word, are available for both Mac and Windows computers so you can easily share files.
For more information, search help for: Connecting to Windows computers Sharing your files with Windows computers Connecting using VPN Opening and saving documents

Connects to Windows

Use Internet Connect to establish remote VPN connections to corporate Windows and Cisco networks. Use Mail and Address Book with Microsoft Exchange mail services.
VPN In Internet Connect, choose New VPN Connection from the File menu, then select L2TP over IPSec. This is the same standard used by Windows networks.
Choose Edit Configuration here to set up your VPN connection.
Enter the information provided by your system administrator Select this if you use an RSA SecurID card.
Exchange services Mail and Address Book work with Microsoft Exchange servers so you can access the same addresses available on an Exchange server.
Select this option in Address Book preferences.
In Mail preferences, create a new account and choose Exchange from the Account Type pop-up menu.

Make the Most of iLife

More and more, we use digital devices to capture the moments of our lives. iLife makes it easy to pick the highlights, put them together the way you want them, and share them with others.
Create your own movies using iMovie and your digital video camera.
Purchase music from the iTunes Music Store.* Create playlists to organize your music.
Turn your photos into a slideshow complete with music from iTunes.
Order prints or an album, share your photos using.Mac, or show them on your desktop.*
For more information, search help for: Using iTunes to purchase music Creating a slideshow with iPhoto Making movies with iMovie Producing your own DVDs
*The iTunes Music Store and some iPhoto services may not be available in your country. To use some iPhoto services, you need a.Mac membership.

Pictures and Movies

iPhoto and iMovie let you capture your digital photos and movies, then create interesting presentations and movies with them.
iPhoto Create albums to organize your pictures in iPhoto. To get your pictures ready to share with others, you can clean them up and crop them to a different size.
Drag to select an area to work on or crop, or choose the standard size from the Constrain pop-up menu.
Touch up your photo and zoom in to see the details.
iMovie Use iMovie to bring together your movies, pictures, and music. You can add effects, titles, and transitions to complete the experience.

Add pan and zoom motion to still photos using the Ken Burns Effect.
Use the iMedia browsers to add movie clips, photos, and music, or prepare to burn your own DVD. Drag scenes or transitions to the timeline, then drag to arrange them.

Make Your Own Music

GarageBand turns your Mac into a recording studio packed with hundreds of instruments to create, perform, and record your own music.
GarageBand Create songs using builtin instruments, Apple Loops, and recordings of real instruments. Add your original music to your slideshows or DVD menus, burn it to CDs, or use it for the score of an iMovie project.
GarageBand gives you complete control of your tracks so you can achieve just the right sound.
Use an Apple Loop to start creating your very first song.

Produce Your Own DVDs

Use iDVD* to produce DVDs to share the movies and slideshows you create with your friends and family.
iDVD Choose a movie or photo album to start your DVD. Then create custom DVD menus to browse your creation. When youre ready, burn a DVD.
Click here to burn your DVD.
Create custom DVD menus using your movies, music, and photos.
Create a slideshow using an iPhoto album and music from iTunes.
* To burn a DVD, your computer must have a SuperDrive. iDVD may not be installed on your computer.