Chapter

Chapter 1 Scope of Guidance

Scope of Guidance

Apples Mac OS X operating system is very versatile, and can be used not only as a client workstation, but also to manage entire networks of machines and users. Apple offers two versions of the operating system: Mac OS X and Mac OS X Server. The two products offer many of the same administration and configuration features. The server version provides additional tools designed to assist the administrator in managing networks of computers and users, to include other environments such as Windows and other UNIX-based systems. The default configuration for Mac OS X Server is not as locked-down from a security standpoint as Mac OS X. This is by design, since a server being used to administer an entire network will typically need more services available. The goal of this guidance is to provide instruction on securing a locally-administered Mac OS X system, including the management of user accounts on that system. The guidance concentrates on providing the information needed to configure and use a single Mac OS X system in a secure manner. This does not preclude addressing some networking issues; this guidance will address those networking issues that would most commonly be needed by a locally-administered Mac OS X system that will occasionally or regularly connect to either the Internet or a local area network. This configuration guidance may not be valid if the machine is managed by other systems, Mac OS X or otherwise. Although the guidance may be valid by itself, implementing some of the recommendations might result in interoperability problems between the system and any server managing it.
Guidance in this document is geared towards a locally-administered Mac OS X system. Guidance contained here may not be applicable to Mac OS X Server or to a Mac OS X network.
Additionally, the guidance in this document is geared towards allowing the user to change his password. As there is currently no way in a Mac OS X standalone system of enforcing strong passwords or of forcing the user to periodically change his password, this could result in passwords on a system never being changed, and being easily guessable. This is especially true for locally-administered laptops, which will likely have little administrative oversight. If the risk from a users password never being changed is greater than the difficulties and risks introduced by not allowing a user to change his password, each user should be restricted from changing his password. Restricting a user's ability to change his password causes the system to require an administrator's password used to change a user password. For this solution, the administrator should regularly schedule password changes with each

user. This method is labor-intensive for the system administrator, so the most appropriate method of password control for the operational site should be chosen. The guidance is also written such that a system secured using this guide should be easily transitioned into being a managed client in a Client-Server environment. If the system being secured will eventually reside in a Client-Server environment, the ability for a user to change his password should not be disabled. Finally, it is EXTREMELY important on portable systems that very strong user passwords be used. FileVault uses the users login password as a key for the FileVault encryption. FileVault encryption is used to encrypt the users entire home directory to give some protection against files being viewed by unauthorized users. All encryption methods mentioned in this guide are the default encryption routines that come standard on Mac OS X. Following this guide does not provide an exception to the encryption policies implemented by the site where the system will reside.
Chapter 2 Intro to Mac OS X Security
Introduction to Mac OS X Security
Mac OS X v10.3.x (a.k.a. Panther) is the latest version of the Mac OS X operating system as of the printing of this guidance. This system combines the GUI-based, user-friendly features of the Macintosh operating system with the underlying foundation of a BSD Unix system. This chapter provides a brief look at the security features built into the Mac OS X system. Multi-user, UNIX-based system As stated above, the Mac OS X operating system was built with BSD Unix as a major part of its foundation. The core of the operating system is called Darwin, and is made up of two parts: the Mach kernel, and the BSD subsystem. The Mach kernel and the BSD subsystem provide security features that were unavailable on Mac OS 9 and earlier versions. The Mach kernel handles all interaction with the system hardware, providing control and security over the applications running on the system. In addition, the kernel also provides a modern virtual memory system that provides each process with its own memory address space. Applications can no longer interfere with the system memory space or the memory space of other processes without special permissions, also controlled by the system, or Darwin. The BSD subsystem provides a multi-user environment, where each user has a unique login ID and can be made a member of various groups. The system can then use a users ID and group memberships to determine what the user is allowed to do on the system. In this way, the system restricts a users ability to run privileged processes and it controls access to system files. Users are protected from each other this way as well. Like most UNIX-based systems, Mac OS X has a super-user, or root account, which is able to do basically anything on the system. Unlike most UNIX-based systems, however, Mac OS X disables the root account by default. For any action that must be performed by root, the administrator must either enter his administrator credential (e.g. password, smart card) when prompted, or must enable the root account and enter the root account id and password. This not only prevents users from inadvertently performing system-level actions, but also provides an extra layer of authentication needed to perform system level actions. Another benefit to having the root account disabled is the effect on logging. Since a user cannot log in as root directly if the root account is disabled, he must act as root

manage the multitude of credentials and certificates that a user must maintain. Multiple keychains can be set up for a single user, each protected by a different credential such as a passphrase. All items stored in a keychain are encrypted, and can only be viewed as plaintext after authentication. Each keychain can have a different usage configuration, such as requiring the user to re-authenticate every time a credential in the keychain is used, or automatically unlocking a keychain when upon login so that all its credentials can be accessed automatically by applications. Each item in a keychain retains a unique Access Control List (ACL) that specifies applications authorized to access it. Certificates can be managed using a keychain and this can be used in conjunction with e-mail applications to enable a user to digitally sign messages. If configured correctly, keychains can be a useful tool for managing user credentials. Security Support for Applications The Keychain Access application provides a user-friendly interface that allows storage of secure keys, passwords, and certificates for use with Mail and Safari, as well as other applications. Importing a certificate, for example, is a point and click operation. This allows users to easily configure their computer for encrypted network transmissions, enhancing the security of e-mail and web applications. Smart Cards Mac OS X provides the ability to use Department of Defense Common Access Cards, or Federal Smart Cards, for user authentication. This guide does not contain instructions for using Smart Cards for authentication. Guidance of this nature is planned for future versions. Apple provides the Apple Federal Smart Card Package Installation and Setup Guide (http://docs.info.apple.com/article.html?artnum=25526) which provides guidance on setting up and using this capability in Mac OS X v10.2.3 v10.2.8. Apple is currently developing a comprehensive guide for Smart Card usage in Mac OS X v10.3.x. Users interested in taking advantage of the Smart Card capability in Mac OS X should refer to the Apple guidance as listed above. Detailed help for this capability is available from the Help menu while running the Common Access Card Viewer application.
Chapter 3 Initial Installation

Initial Installation

Although secure configuration of an existing Mac OS X installation is possible, securely configuring a fresh installation is much simpler. Although this may not always be practical, it is the recommended way to configure Mac OS X. This section details the steps involved in such an installation. If it is not possible to re-install the system, much of this chapter will not be applicable. The guidance in this chapter can still be used, however, to determine any differences between the previous installation and the recommended one. Wherever differences exist, the previous installation should be modified to match the recommended one; this may entail deleting installed packages, deleting registration information, changing an administrative account name, installing updates, and fixing disk permissions. This guide does not provide instructions on making these types of modifications to a previously installed system. Also, administrators should be aware that applying these recommendations to an existing system might cause the system to operate incorrectly. System Installation and Configuration

4. At the next prompt, enter: Chapter 4 Configuring System Settings setenv security-mode command 5. To restart the computer and enable the settings, enter the command: reset-all 6. The system should reboot into the Mac OS X Login Window. In command mode, the system will boot from the boot device specified in the systems boot device variable and disallow users from providing any boot arguments. To test that the system has been put into command mode as recommended: 1. Close all applications and choose Restart from the Apple menu. 2. A confirmation window will pop up. Continue restarting the machine by selecting the Restart button. 3. Hold down the key combination command-S while the machine boots. 4. If command mode has been set correctly, the machine will continue booting into the Mac OS X Login Window. Normally, holding down the command-S key combination during a reboot would cause the machine to reboot into single-user mode. 5. If the system did reboot into single-user mode, restart the system by issuing the command reboot. Then repeat the previous steps for putting the system into command mode. Open Firmware protection can be violated if the user has physical access to the machine. Open Firmware password protection can be bypassed if the user changes the physical memory configuration of the machine and then resets the PRAM 3 times (holding down command-option-P-R during boot).
An Open Firmware password will provide some protection, however, it can be reset if a user has physical access to the machine and can change the physical memory configuration of the machine.
The following Apple Knowledge Base articles discuss the Open Firmware password:
Title: Setting up Open Firmware Password protection in Mac OS X 10.1 or later; Article ID: 106482; URL: http://docs.info.apple.com/article.html?artnum=106482
Title: Open Firmware: Password Not Recognized when it Contains the Letter U; Article ID: 107666; URL: http://docs.info.apple.com/article.html?artnum=107666
Even if a single-user mode boot is successfully initiated by changing the Open Firmware settings, the system can still prevent automatic root login. To require entry of a root password during a single-user mode boot, the console and ttys must be marked as insecure in /etc/ttys. In fact, the system will require entry of a special root password, stored in /etc/master.passwd. If this remains unset as recommended, then it will be impossible for a user to enter the root password and complete the single-user boot, even if the Open Firmware password protection was bypassed. To perform this configuration: 1. Log in as an administrator. 2. Start the Terminal application, located in /Applications/Utilities. 3. At the prompt, issue the command: cd /etc 4. To create a backup copy of /etc/ttys, issue the command: sudo cp ttys ttys.old 5. To edit the ttys file as root, issue the command: sudo pico ttys 6. Replace occurrences of the word secure with the word insecure in the configuration lines of the file. Any line that does not begin with a # is a configuration line. 7. Exit, saving changes. Only if the ability to boot into single-user mode is operationally required should a password be provided for the root account in /etc/master.passwd. To provide this password: 1. Log in as an administrator. 2. Start the Terminal application, located in /Applications/Utilities. 3. At the prompt, issue the command: cd /etc 4. To edit the master password file, issue the command: sudo pico master.passwd 5. Within the editor, delete the asterisk following the word root.

Disabling Hardware Components Hardware components such as wireless features and microphones should be physically disabled if possible. Only an Apple Certified Technician should physically disable these components, which may not be practical in all circumstances. The following instructions provide an alternative means of disabling these components by removing the associated kernel extensions. Removing the kernel extensions does 56
not permanently disable the components; however, administrative access is needed to re-load them and restore the capabilities. Chapter 4Configuring System Settings Although disabling hardware in this manner is not as secure as disabling hardware physically, it is more secure than only disabling hardware through the System Preferences. This method of disabling hardware components may not be sufficient to meet site security policy. Consult operational policy to determine if this method is adequate. 1. Open the folder /System/Library/Extensions. 2. To remove AirPort support, drag the following files to the Trash: AppleAirPort.kext AppleAirPort2.kext AppleAirPortFW.kext 3. To remove support for Bluetooth, drag the following files to the Trash: IOBluetoothFamily.kext IOBluetoothHIDDriver.kext 4. To remove support for audio components such as the microphone, drag the following files to the Trash: AppleOnboardAudio.kext AppleUSBAudio.kext AudioDeviceTreeUpdater.kext IOAudioFamily.kext VirtualAudioDriver.kext 5. To remove support for the iSight camera, drag the following file to the Trash: Apple_iSight.kext 6. Open the folder /System/Library. 7. Drag the following files to the Trash: Extensions.kextcache Extensions.mkext 8. Choose Secure Empty Trash from the Finder menu to delete the file. 9. Reboot the system.
Disabling Mac OS 9 The previous major version of the Macintosh operating system, Mac OS 9, does not have many of the security features built into Mac OS X. There are two ways of
running Mac OS 9 applications: booting the system into Mac OS 9, and running an application in Classic Mode. This mode is an adaptation of Mac OS 9 that runs as an application on a system running Mac OS X. It is not recommended to boot into Mac OS 9 or to use Classic Mode. Mac OS 9 and any Mac OS 9 applications should be removed from the system. To do this, use the following instructions. Please note that great care must be taken in doing this; root access is required to do these steps, and incorrectly entering a folder name could result in removal of the Mac OS X operating system or all Mac OS X applications.
Following the instructions below will disable Classic Mode and no users will be able to run Mac OS 9 applications.

To remove Mac OS 9 and Mac OS 9 applications and files: 1. Log into the administrators account. 2. Start the Terminal application, found in /Applications/Utilities. 3. Type the following command to remove the Classic icon from the System Preferences panel: sudo rm rf '/System/Library/PreferencePanes/Classic.prefPane' 4. Type the following commands to remove Classic files and directories if they are present on the system. Note that each command should be typed on a single line; they are split across lines here only for readability:
sudo rm rf '/System/Library/Classic/' sudo rm rf '/System/Library/CoreServices/Classic Startup.app' sudo rm rf '/System/Library/UserTemplate/English.lproj/Desktop/ Desktop (Mac OS 9)' 5. Type the following commands to remove additional Mac OS 9 files and directories from the system if they exist: sudo rm rf '/System Folder' sudo rm rf '/Mac OS 9 Files/'
Make sure the single quotes (apostrophes) are placed correctly here. If this command is typed incorrectly, it could result in removal of the folder named System, which will disable the machine and necessitate a re-installation of the system.
6. Type the following command to remove Mac OS 9 applications if they exist on the system: sudo rm rf '/Applications (Mac OS 9)'
Make sure this command is typed exactly as shown. If the single quotes are not placed correctly, the Applications folder could be deleted.

7. Restart the system.

Configuring User Accounts
Once the first administrator account and the root account are securely configured, additional user accounts may be created. This chapter describes the process of creating and configuring new user accounts. Note that some of the instructions in this chapter are repeated from previous chapters. This is because the system should be completely secured before creating and securing individual user accounts. Some of the steps performed in securing the system must be repeated for each new user on the system. The steps are repeated in this chapter so the administrator will not have to skip through the guide to find the appropriate steps to perform. Guidelines for Creating Accounts Accounts should never be shared. Each user should have his own individual account, and each system administrator should have his own administrative account. Each administrator should also have a regular user account for normal activities, and should use his administrative account only for administrative activities. Reasons for these guidelines include: Individual accounts are necessary to maintain accountability. System logs can track activities of each user account, but if an account is shared among several users it may be impossible to determine which user performed a certain activity. If all administrators share a single administrative account, it may be impossible to determine which administrator performed a specific system change. If a shared account is compromised, it will likely take longer to notice that compromise, if it is ever noticed. Each user sharing an account may mistake malicious actions as those of another legitimate user of the account. Requiring administrators to have a personal account for individual use and an administrative account for administrative purposes reduces the risk of the administrator inadvertently making system configuration changes while performing normal non-administrative tasks. Chapter 6 Future Guidance

9. Repeat above steps, beginning with step 4, to create additional accounts. 10. Once all accounts have been created, click the lock in the lower left corner of the screen to relock the panel.
Granting Administrative Privileges An administrative user on the system can perform standard user-level tasks, as well as administrative-level activities such as: Adding a user account Changing the FileVault master password Enabling or disabling sharing Enabling, disabling, or changing firewall settings Changing other protected areas within System Preferences Installing system software
Administrative privileges should only be granted to users who are responsible for system administration, and should be limited to the smallest number of administrators necessary. To grant a user account administrative privileges: 1. Click on the Show All icon in System Preferences, or restart System Preferences if necessary. 2. Click on the Accounts icon to bring up the Accounts panel. 3. Unlock the screen for changes, if necessary. 4. Find the user account to be given administrative privileges in the list on the left side of the window, and click on that user account. 5. Click on the Security button towards the top of the window. 6. Click to put a check in the box next to Allow user to administer this computer. 7. Repeat steps for any other users that are to be given administrative privileges (Figure 23). 8. Click on the lock icon at the bottom of the screen to re-lock these preferences.
Figure 23: Grant Administrative Privileges
Limiting a User Account Two levels of limited user accounts are available: an account with configurable limits, and an account that is limited to a simple Finder. Managed User: Some Limits Within the Accounts System Preferences panel, the Limitations section allows the administrator to restrict a users access to programs and settings. Under Some Limits, the following can be configured for each user on the system: Access to applications on the system Access to the System Preferences panel Ability to change the user account password Ability to burn CDs and DVDs Ability to modify the dock
Account limitations can reduce access to advanced functionality for less knowledgeable users. If a user account is to be given limitations, the following configuration guidelines should be used:
1. Click on the Show All icon in System Preferences, or restart System Preferences if necessary. 2. Click on the Accounts icon in the System row to bring up the accounts management panel. Chapter 6 Future Guidance 3. Unlock the screen for changes, if necessary. 4. Find the user for which limitations are to be set in the list at the left side of the window. Click on that user account to highlight it and display its settings. 5. Click on the Limitations button in the window. Note that if the Limitations button is grayed out, this means that the Allow user to administer this computer checkbox in the Security settings panel for this account has been selected. This is normal, since it does not make sense to limit access to an administrative user. If the Limitations button is grayed out for this reason, click on the Security button, uncheck the Allow user to administer this computer checkbox, and click on the Limitations button again. 6. Click on the Some Limits button in the Limitations pane (Figure 24). Additional selections will then appear in that panel.

Figure 27: Disable Internal Microphone
28. Use a dummy plug to plug the Line In jack on the machine. 29. If there is no Line In jack, then the only setting available under the Choose a device for sound input box will be the internal microphone (if there is one), and there will be no way to remove that option. In either case, it is recommended that the internal microphone be physically disabled. As stated previously, this should only be done by an Apple Certified Technician to avoid voiding any warranty on the machine. Next, the Require a password to wake this computer from sleep or screen saver restriction should be enabled as follows: 30. Click on the Show All icon at the top of the system preferences panel. 31. Click on the Security icon to bring up the security preferences panel. 32. Place a check in the Require password to wake this computer from sleep or screen saver checkbox. Note that the above settings are not protected. Administrative privilege is not required to change them, and the user may change these settings himself. The configuration for these settings should be clearly indicated in the security policy for the system, and users should be educated about the need to ensure these settings are secure. Also, the system administrators may want to check users accounts periodically to ensure users are not changing these settings. 72
The next step is to enable FileVault for this user: 33. Make sure all applications (other than System Preferences) are closed, as the user will be logged out as part of the process of starting FileVault. 34. Bring up the security preferences panel in the System Preferences application if necessary. 35. Unlock the window for editing if necessary. 36. Click on the Turn On FileVault button (Figure 28). Chapter 6 Future Guidance
Figure 28: Enable File Vault
37. When prompted, enter the password given to the account when it was created and click OK. 38. Click on the Turn On FileVault button on the window that appears. At this point the user will be automatically logged out, the users file system will be encrypted, and FileVault will be enabled for the user. The above instructions for configuring a users System Preference settings should be repeated for every user on the system, and should be performed on every new account created.
Overriding the Default umask The default umask value can be overridden for a particular user, if needed. To do so, log into the user account to be changed. For example, to set the default umask to 027 (decimal equivalent 23) so that other group members can read files created by a user, issue the following command in a Terminal window: defaults write g NSUmask int 23 This command will affect the permissions on files and folders created by programs that respect the Mac OS X NSUmask settings, although there is no guarantee that a program will respect these settings. The user can also change his default umask setting at any time. The changes to the umask settings take effect at next login. Setting Up Keychains for a User Account Mac OS X provides an application called Keychain Access that allows a user to manage collections of passwords and certificates, each of which is called a keychain. Each keychain can hold a collection of credentials and protect them with a single password. Passwords, certificates, and any other private values (called secure notes) that a user or application places into a keychain are encrypted. These values are accessible only by unlocking the keychain using the keychain password. A user can create multiple keychains, each of which will appear in a keychain list in the Keychain Access application. Each keychain can store multiple values; each value is called an item. A user can create a new item in any keychain. When an application needs to store an item in a keychain, it will store it in the one designated as the users default. The default is initially the keychain named login, but the user may change that. When a user must keep track of a multitude of passwords, he is likely to either make the passwords identical for all the systems, or keep a written list of all passwords. Use of keychains can greatly reduce the number of passwords a user must remember. Since the user no longer has to remember passwords for a multitude of accounts, the passwords chosen can be very complex and could even be randomly generated. One disadvantage of using a keychain, however, is that if the user does not choose a strong password, or if the password is compromised, then all the accounts protected by that keychain may be compromised. Another disadvantage is that any application may make use of the Keychain API to query for passwords. Therefore, care must be taken in determining which applications are granted access to a keychain. Despite these disadvantages, keychains provide some additional protection for passwords, passphrases, certificates, and other credentials stored on the system. Also, in some cases, such as using a certificate to sign an e-mail message, the 74

Figure 30: Keychain Password Change
6. From the Edit menu, select Change Settings for keychain login. 7. Select Lock when sleeping (Figure 31).
Figure 31: Keychain Settings
8. Check the configuration of each of the items in the login keychain. Each item can be individually configured to permit access by only certain applications. The lower half of the Keychain Access window contains a tabbed view pane for configuring the attributes and settings for each item. Repeat the following steps for each item: a. Select an item within the currently selected keychain. b. Click on the Access Control tab in the bottom of the window to display the attributes of that item. c. The Allow all applications to access this item option should not be selected. If it is, it will allow any application to access the associated credential whenever the keychain is unlocked, without prompting the user.
Setting this option allows any application to access the item without user notification or authentication. This setting should never be selected.
d. The Confirm before allowing access option should be selected. Selecting this option causes the system to prompt the user for permission before releasing the passphrase to an application. 78
e. Place a check in the Ask for keychain password checkbox. With this option selected, the user will be required to provide the keychain password before the Keychain Access application will release the passphrase to another application. This is particularly important for high value items, such as personal key certificates which are only needed when signing or decrypting information, although such items should also be placed in their own keychains. f. The Always allow access by these applications list should be kept empty unless operationally required. Any application in this list can access the item without prompting the user or requiring re-entry of the keychain password. If there are any applications in this list, click on one of them, and click on the Remove button at the bottom of the window. Repeat this until all entries have been removed from the list. Creating Multiple Keychains When a user account is created, it will contain only an initial default keychain, login. A user may create additional keychains, each of which may have different settings. This allows the user to create and configure different keychains for different purposes. For example, a user may want to group all his credentials for mail accounts into one keychain. Since mail programs query the server frequently to check for new mail, it would not be practical to expect the user to re-authenticate every time such a check is being performed. The user could create a keychain and configure its settings such that he would be required to enter the keychain password at login and whenever the machine is awakened from sleep mode. He could then move all items containing credentials for mail applications into that keychain and set each item so that only the mail application associated with that particular credential can automatically access it. This would force all other applications to authenticate in order to access that credential. A setting such as the one given above might be appropriate for credentials used by mail applications, but might be unacceptable for others. If a user has an infrequently used web-based account, it would be more appropriately stored in a keychain configured to require re-authentication for every access by any application. The following guidance explains how to set up three keychains in a users account, each with a different level of accessibility. This configuration should be adequate for a typical user, and should demonstrate the use of multiple keychains by a single user. Once a user becomes familiar with configuring keychains, he may want to create a custom keychain configuration. Keychain Examples Keychain 1: Frequently accessed credentials (e.g. Mail)

Figure 34: Mail Keychain Items Access Control Settings
Keychain 2: Moderately accessed credentials (e.g. database access) This keychain is designed to protect credentials that are accessed frequently and automatically whenever a user is accessing a particular application that needs a credential from a keychain. An example of this might be a database that requires credentials for every query. In this situation, the desired behavior entails authentication of the keychain password at the beginning of a session, and reauthentication on a periodic basis (e.g. every 15 minutes) rather than for every query. 1. Start the Keychain Access application. 2. Select New keychain from the File menu. 3. Select a location for the new keychain. 4. Type a name for the new keychain in the Save As box and click on Create. For this example, the name of the new keychain is database_keychain. 5. Select a new password for the keychain and enter it in the window that appears on the screen. Use the password assistant (the i button) to check the strength of the password. 6. Select Change Settings for keychain database_keychain from the Edit menu.
7. Make sure the Lock when sleeping option is selected, and that the Lock after x minutes of inactivity option is selected and set to a appropriate value, such as 15 (Figure 35).
Figure 35:Database Keychain Settings
8. Move any items containing credentials for database applications, or any other items to be protected by this keychain, into the newly created keychain. This can either be done using the Cut and Paste features from the Edit menu, or by selecting the item to be moved and dragging it over the new keychain. Keychain Access will then prompt for the keychain password of the keychain originally containing the item. Enter the password and click the Allow Once button. The item should appear in the item list for the new keychain, and should no longer appear in the original keychain. 9. Configure all items now in this keychain. Select an item in the list, and click on Access Control. Make sure both Confirm Before Allowing Access and the Ask for keychain password are selected. Remove any entries in the access list other than the application that should be allowed to use the credential automatically. Repeat this step for all items in the list. Keychain 3: Infrequently accessed credentials (e.g. web accounts) This keychain is designed to protect credentials that are either accessed infrequently, or that require very strict control and re-authentication for every access. Initially, it might not seem to make sense to put credentials in a keychain if the user must enter a password every time the credential is used. But if the user uses a single keychain to store all such credentials (e.g. all web-based accounts) then he may use completely different, randomly generated passwords for every account protected with that keychain, and have a single, very strong password for that keychain that will access all accounts. This would be better than using simple passwords for each account, writing down the passwords for each account, or using a single password for several accounts across different systems with different levels of password protection. 1. Start the Keychain Access application. 2. Select New keychain from the File menu. 3. Select a location for the new keychain.

4. Type a name for the new keychain in the Save As box in the window, and click on Create. For this example, the name of the new keychain is accounts_keychain. Chapter 6 Future Guidance 5. Select a new password for the keychain and enter it in the window that appears on the screen. Use the password assistant (the i button) to check the strength of the password. 6. Select Change Settings for keychain accounts_keychain from the Edit menu. 7. Make sure the Lock when sleeping option is selected, and that the Lock after x minutes of inactivity option is selected and set to 0 (Figure 36). Note that if the value 0 is used here, the user will not be able to see the password for any items in the keychain without first changing the value to 1 or higher.
Figure 36:Accounts Keychain Settings
8. Move any items containing credentials for web-based accounts, or any other items to be protected by this keychain, into the newly created keychain. This can either be done using the Cut and Paste features from the Edit menu, or by selecting the item to be moved and dragging it over the new keychain. Keychain Access will then prompt for the keychain password of the keychain originally containing the item. Enter the password and click the Allow Once button. The item should appear in the item list for the new keychain, and should no longer appear in the original keychain. 9. Configure all items now in this keychain. Select an item in the list, and click on Access Control. Make sure both Confirm Before Allowing Access and the Ask for keychain password are selected. If there are any entries in the access list, select and remove them. Repeat this step for all items in the list. Setting the Default Keychain As stated earlier, any new items automatically saved to a keychain by an application are stored in the default keychain, which is initially set to be the login keychain. The user can designate any keychain as the default. The default keychain should be one that is completely protected. The login keychain as configured earlier in this 84
guide may be used as the default keychain. If the user chooses to set a different keychain as the default, he should ensure that it is secured in the same manner as given for the login keychain configuration. To change the default keychain: 1. Start the Keychain Access application. 2. If the drawer showing the users keychains is not open, click on the Show Keychains icon to open it. 3. Click to select the keychain that is to be designated as the new default. 4. Pull down the File menu and select Make keychain X Default, where X is the keychain that was selected in step 3. Additional Notes on Protecting Keychains For laptops it may be advisable to store all keychains on a portable drive, such as a USB flash memory key or a portable FireWire drive, if allowed by organizational policy. The portable USB key can then be removed from the laptop and stored separately when the keychains are not in use. Anyone attempting to access data on the machine will need the laptop, the USB device, and the password for the keychain stored on the USB device, providing an extra layer of protection if the laptop is stolen or misplaced. To use this capability, move all keychain files to the USB storage device and configure the Keychain Access application to use the keychains in the new location. Remember that the default storage location for keychains is in each users Library/keychains directory, but that the user may have stored keychains elsewhere as well. To move a keychain to a portable USB drive (or to any new location): 1. Start the Keychain Access application. 2. If the drawer showing the users keychains is not open, click on the Show Keychains icon to open it. 3. Click to select the keychain that is to be moved. 4. Pull down the Edit menu and select Change password for keychain X, where X is the keychain being moved. 5. Click on the Details arrow to display more detail about the keychain. 6. Note the Keychain Location and click Cancel. 7. Pull down the File menu and select Delete keychain X where X is the keychain being moved. 8. In the window that appears on the screen, select Delete References. Do not delete the files; only the references should be deleted here. 9. Open the folder containing the keychain as noted in step 6. 10. Copy this file to the new location, such as a USB keychain drive. Chapter 6 Future Guidance

11. Drag the original file to the Trash. 12. Choose Secure Empty Trash from the Finder menu to delete the file. 13. In the Keychain Access application, select Add keychain from the File menu and open the keychain file that was moved.The keychain will appear in the list of keychains in the Keychain Access application. The system will now access the keychain file in its new location. Using an Account Securely Because users can change several security-related settings, site policy must address how they should configure these settings. The following list summarizes those areas: The user can change the automatic screen saver timeout settings in the Desktop & Screen Saver panel of the System Preferences application. If site policy specifies a timeout period for the screen saver to be initiated, this policy should be made clear to users, and they should be instructed to set and leave this setting at the appropriate value. The user can turn off the Require password to wake this computer from sleep or screen saver option, found in the Security panel of the System Preferences application. If Bluetooth was not disabled physically or as described in Chapter 4s Disabling Hardware Components section, the user can turn Bluetooth back on using the Bluetooth panel in the System Preferences program. If the microphone was not disabled physically or as described in Chapter 4s Disabling Hardware Components section, the user can turn it back on using the Sound panel in the System Preferences program. Because there is currently no mechanism included in a standalone Mac OS X system for enforcing strong password selection or periodic password changing, site policy should specify password change intervals and rules for password selection. Users should receive instruction on using and managing keychains properly.

Future Guidance

Topics for consideration in future versions of this guide or in other guidance documentation include: Mac OS X v10.3.x Server Managing Mac OS X networks Cross-Platform (Mac OS XWindows, Mac OS XLinux, etc.) Security Issues Apple Remote Desktop A Pull-out Users Guide, which will include a users perspective on using keychain effectively for security, settings which users should not change, and other security-related instructions for users. More Detailed Configuration of the Built-in Firewall Managing Certificates in Mac OS X IPSec/VPNs under Mac OS X Using SmartCards with Mac OS X Secure File Deletion Tools for Checking the Security Configuration of a Mac OS X System Using groups under Mac OS X Using Global keychains

Figure 39: Password Entry for Encrypted Image
This dialog box offers a checkbox which, when checked, causes the password to be saved in the users keychain. This means that anytime the users 91 UNCLASSIFIED
keychain is unlocked, the data will be transparently unencrypted if an attempt to access it is made. This box is checked by default. If the data are particularly sensitive, uncheck the box to prevent storing the password in a keychain. Creating an Encrypted Image From Existing Data The instructions below follow those in the Disk Utility help section Creating a disk image of a device, folder, or volume. Creating a disk image from an existing data source is recommended for situations in which the datas confidentiality is at risk when it is moved from the computer, but encrypted storage on the computer is not needed. These situations include unavoidable plaintext file transfers across a network such as e-mail attachments or FTP, or copying to removable media such as a CD-R or floppy disk. 1. Open the Disk Utility program, located in Applications/Utilities. 2. To create a disk image from a folder, from the Images menu select New > Image from Folder. Next, select the folder from the navigation window. To create a disk image from a device or volume, select it in the list on the left side of the Disk Utility window, then choose from the Images menu New > Image from [disk or volume name] (Figure 40).
Figure 40: Creating a Disk Image
3. Type a name for the image, and choose a disk format (Figure 41).
Figure 41: Disk Utility Convert Image Panel
4. Select AES-128 (recommended) for Encryption and click Save. 5. As in the case of creating a new, blank encrypted image, a dialog box will appear requesting a password. See step 7 above for discussion.

References

1. Mac OS X Maximum Security; Ray, John, and Ray, Dr. William C.; Sams Publishing; 2003 2. Mac OS X Panther Unleashed; Ray, John, and Ray, Dr. William C.; Sams Publishing; 2004 3. Mac Help, Mac OS X Panther, Apple Computer, Inc., 2003 4. Inside Mac OS X, System Overview, Apple Computer, Inc., 2001-2002 5. Macintosh OS X Security Technical Implementation Guide (Draft); Version 1, Release 0; Defense Information Systems Agency (DISA); 30 June 2003 6. Apple Federal Smart Card Package Installation and Setup Guide; Apple Computer, Inc.; 2003 7. The Mac OS X File System; Mac OS X Reference Library. Apple Computer, Inc; March 26, 2004.

Appendix BReferences

Appendix B References
Appendix CAdditional Resources

Additional Resources

The following are additional resources that may be helpful to readers of this guide. 1. Mac OS X Panther in a Nutshell; Toporek, Stone, and McIntosh; OReilly & Associates; 2nd edition, December 2003

Welcome to Panther

Find out what you can do with Mac OS X and Mac OS X applications
Apple Computer, Inc. 2004 Apple Computer, Inc. All rights reserved. The Apple logo is a trademark of Apple Computer, Inc., registered in the U.S. and other countries. Use of the keyboard Apple logo (Option-Shift-K) for commercial purposes without the prior written consent of Apple may constitute trademark infringement and unfair competition in violation of federal and state laws. Apple, the Apple logo, iLife, iMovie, iTunes, Mac, and Mac OS are trademarks of Apple Computer, Inc., registered in the U.S. and other countries. Finder, GarageBand, iDVD, iPhoto, iPod, iSight, Panther, Safari, SnapBack, and SuperDrive are trademarks of Apple Computer, Inc.Mac is a service mark of Apple Computer, Inc. Because Apple frequently releases new versions and updates to its software, images shown in this book may be slightly different from what you see on your screen.
Mac OS X works the way you want to work. Its simple, yet powerful, so you can chat with friends, organize your desktop, arrange your photo album, and do ten other things at once, quickly and easily.
Switch users without quitting your applications.
Quickly access disks, servers, and your favorite folders in Finder windows.
Use iChat AV to video chat with friends and colleagues.

Centered on You

Mac OS X puts you at the center of your computer, making it easy to find your files wherever they are. The column on the left of every Finder window gives you easy access to your iDisk, network, home folder, and other favorite folders.
Search help to get answers to your questions. To find a file or folder quickly, type its name here.
Your hard disk, iDisk, servers, and removable media such as your iPod appear in the left column of every Finder window.
Keep your home folder and other favorite items in this part of the Finder window.
Use your home folder to store your documents, photos, music, and more.
For more information, search help for: Using the Finder Browsing your network Using your home folder Opening and saving documents Finding your files

Consistently Easy Access

Mac OS X Panther provides the same easy access to locations when you open and save files in applications and when you search for files in the Finder.
Finding files Finding your files in the Finder is fast and easy. Just type what youre looking for in the search field. As you type, youll see results immediately. Click the magnifying glass to choose where to search, then type the name of the file youre looking for.
Double-click a file to open it. Double-click a folder to open it in its own Finder window. Click here to repeat a search.
Opening and saving The Open and Save dialogs show the same view that you see in the Finder so you can access your iDisk, network, and other favorite folders. Click the List or Column View buttons to change the view. Choose recently used locations from the pop-up menu or use the back and forward buttons.
Applications may include additional options here.

Customize the Finder

The Finder provides many convenient features to help you work the way you want. You can customize the Finder window to quickly access the files and folders you use the most and the actions you perform most frequently.

Click this to eject a CD, DVD, iPod, server, or other removable media.
Add buttons to the toolbar for your favorite actions.
For quick access to project files and your favorite folders, drag them to the left column of the Finder window.
Select the items you access most often to show them in the Finder window.
For more information, search help for: Customizing the Finder Adding items to the Sidebar Using your home folder Selecting labels

Customize Your Files

Use the Action pop-up menu in the toolbar to assign labels and perform other actions on files. You can customize Finder windows and labels to suit your needs.
Actions The items in the Action pop-up menu change depending on the item you have selected. When you select a file, you can choose a label for it, compress it, or choose an application to open the file with.
To show preview icons or information about items or change the background color in Finder windows, choose Show View Options from the View menu.
Labels Labels let you quickly identify important documents. You can specify your own names for labels and search for files by label. You can also see labels in the Open and Save dialogs. Use the Labels pane in Finder preferences to customize the names of labels.

Easier for You

Mac OS X makes it easier than ever to get your work done, even when youre doing many things at once. When too many windows make it hard to see what you're doing, activate Expos to clear the clutter with the touch of a key.
To instantly access all the windows you have open at once, press F9. Expos Use these shortcuts to see the windows youre working with or your desktop. To change the default Expos shortcuts or use the screen corners, open System Preferences and click Expos.
When the pointer is over a window, you see the windows title.
To instantly access the windows in the current application, press F10.
To instantly access your desktop, press F11. To see your windows again, press F11 again.

For more information, search help for: Customizing Expos Copying items using Expos Switching applications Switching to a different user

Fast Switching

Mac OS X makes it easy for several people to share a computer. And Panther lets you quickly switch to another user without quitting the applications you have open.
Setting up To turn on Fast User Switching, open System Preferences and click Accounts, then click Login Options.
Select this option in the Login Options pane of Accounts preferences.
Switching users To switch user accounts, choose the users name from the menu in the top-right of the screen, then enter the users login password if required.
The checkmark indicates this user is logged in.
Switching After you enter the password the users desktop rotates into view.

Stay in Touch

Mac OS X provides many ways to stay in touch with friends, family, and colleagues. iChat AV* and iSight make videoconferencing a snap whether you're discussing business, chatting with friends, or staying in touch with your family.
Instant message a group of.Mac and AIM buddies.
This person is available for an audio chat. Use audio chat instead of calling on the phone.
This person is available for a video chat.
Click to add a new person to your Buddy List and your Address Book.
To see what your buddy is seeing, check the picture-in-picture.
Click here to view your video in full-screen mode.
For more information, search help for: Using iChat AV Setting up your.Mac account Organizing your email Addressing your messages
* To use iChat AV, you need a.Mac membership or AIM account.

Say It With Email

Use Mail to send and receive email messages to friends and colleagues. Youll find new ways to organize the messages you receive and address the messages you send.
Keep organized The Mail viewer lets you group all the messages on the same topic or thread. Click the first message in a thread to select the entire thread.

To see if you have replied to a message, look for the in the status column.
When you select a thread, youll see a summary of the messages in the thread. Click a message to open it.
Addressing To enter an address, begin typing the name of a person in your Address Book and Mail will automatically complete the address. To move an address from the To field to the CC field, just drag it. Click an address to edit it, add it to your Address Book, or choose an alternate address.
Many people have more than one email address. Mail can mark addresses so youre sure you are sending messages to the right address.
Use styled text and graphics in your messages.

Stay Mobile

Mac OS X helps you keep up with your important data on any computer connected to the Internet. Files on your iDisk* are always available even when youre not connected to the Internet and synchronized automatically when you are connected.
When youre connected, your iDisk synchronizes automatically so your files are always available.
Keep your documents on your iDisk and work on them anytime.
You can use iSync to synchronize your Address Book contacts, iCal calendars, and Safari bookmarks with the.Mac server.
For more information, search help for: Setting up your iDisk Synchronizing your data Keeping your computer safe Turning on FileVault
* To use iDisk, you need a.Mac membership.

Peace of Mind

Whether youre on the road or at home, security is important. Turn on FileVault to encrypt your home folder and keep your important data secure.
FileVault To turn on FileVault, use Security preferences. When you do, you must set a master password. Use Accounts preferences to turn on FileVault for other users on your computer.
If you forget your login password, the master password lets you access your data. If you forget both passwords, your data is lost forever.
For additional security, select other options to require a password to access your computer.
Protected When FileVault is turned on, you work with your files the same way in the Finder and other applications. When you open a file, it is automatically decrypted and ready to use.

The icon for your home folder changes to the FileVault icon to show that it is protected.

Addressing Made Simple

Address Book makes it easy to keep track of your contact information. You can use that information to send email, fax a document, or add a buddy in iChat AV. You can also print your contact list to keep your address book with you.
Search your contact information by typing here.
Use standard directory services such as LDAP.
Create groups to organize your contacts. To add contacts, drag them to the group.
Click these buttons to create a new group or add a new card to Address Book.
Send this person an email message or start a chat.
For more information, search help for: Using Address Book Printing your addresses Setting up printers Sending and receiving faxes

Printing and Faxing

Print your Address Book information as a list or as mailing labels. The new built-in fax support lets you send faxes using the fax numbers stored in your Address Book.
Printing To keep your personal phone book with you, print the information in your Address Book as a list, including pictures. You can also print mailing labels from your Address Book.
Choose to print a list or mailing labels using Avery labels. Select the items you want to include in the printout.
Faxing You can send faxes to people using their fax number stored in your Address Book. You can also receive faxes and view them in Preview.

Great Views

Preview is the fastest PDF viewer for your Mac. No matter how big the PDF file, you can quickly and easily find just the information you need. Whether you view documents and images on screen or print them from Preview, they always look their best.
Use the tools to copy text and images in PDF files or crop your image files. Type here to search for text in the PDF file.
Use Preview to view PDF files and many types of image files.
Click an item in the search results to open that page.
For more information, search help for: Using Preview Selecting fonts to use in documents Creating font collections Setting typographical options

Great Fonts

Mac OS X includes an outstanding collection of fonts for you to use. Font Book and the Font panel make it easy to install, preview, and manage all your fonts.

Font Book Use Font Book to install, preview, and organize fonts. To organize fonts, create a collection and drag fonts to it. If you dont want to see a font in the Font panel, select it and click Disable. Type a font name here to find it quickly. Drag the slider to see the font you are previewing at different sizes.
To install a font, you can double-click its icon in the Finder or click the Add (+) button under the Font column.
Font panel When you work on a document, use the Font panel to select fonts, styles, and typographical features of the font. You can access the same collections you created in Font Book. You can also create new collections or add fonts to the Favorites collection.
Select underlining, strikethrough, color, and drop shadow.
If you just need to choose fonts, you can resize the Font panel to show only pop-up menus. Click the Action button to select typographic properties for the font.

Getting Connected

Mac OS X makes it easy to connect to your network or the Internet. Once youre connected, applications like Safari, iChat AV, and iTunes make using the Internet more productive and fun.
Use the status icons to start connections.
Click Network in a Finder window to browse for and connect to Mac, Windows, and UNIX network servers.
See the status of your connection in Network preferences.
Many Mac OS X applications work with the Internet.
Click here for help setting up a connection.
For more information, search help for: Getting connected Sharing your files Searching the Internet Exploring the Internet

Sharing and Surfing

Sharing your files, folders, or Internet connection is easy and secure. Safari is the fastest and easiest-to-use web browser for the Mac.
Sharing Use Sharing preferences to turn on the network services that fit your needs, including sharing with Windows computers and the Internet. Separate your network from the outside world using Personal Firewall protection.
Click these buttons to share your Internet connection with other computers on your network and turn on Personal Firewall protection.
The address to access a service appears here.

Safari Safari displays webpages fast. Finding websites is a snap using the built-in Google search box. Click the Add Bookmark (+) button to bookmark a webpage. Tabbed browsing lets you open several webpages in the same window. Use SnapBack buttons to return to your starting webpage or your Google search results.

Works With Windows

Mac OS X fits seamlessly into Windows networks so you can share documents and printers. You can establish a secure connection to a Windows network over the Internet and access Microsoft Exchange servers.
You can also use the Connect To Server dialog to access servers in the Finder.
Browse for Windows servers and shared folders in the Finder.
Use your iDisk to share documents with Windows users.
Many applications, such as Microsoft Word, are available for both Mac and Windows computers so you can easily share files.
For more information, search help for: Connecting to Windows computers Sharing your files with Windows computers Connecting using VPN Opening and saving documents

Connects to Windows

Use Internet Connect to establish remote VPN connections to corporate Windows and Cisco networks. Use Mail and Address Book with Microsoft Exchange mail services.
VPN In Internet Connect, choose New VPN Connection from the File menu, then select L2TP over IPSec. This is the same standard used by Windows networks.
Choose Edit Configuration here to set up your VPN connection.
Enter the information provided by your system administrator Select this if you use an RSA SecurID card.
Exchange services Mail and Address Book work with Microsoft Exchange servers so you can access the same addresses available on an Exchange server.
Select this option in Address Book preferences.
In Mail preferences, create a new account and choose Exchange from the Account Type pop-up menu.

Make the Most of iLife

More and more, we use digital devices to capture the moments of our lives. iLife makes it easy to pick the highlights, put them together the way you want them, and share them with others.
Create your own movies using iMovie and your digital video camera.
Purchase music from the iTunes Music Store.* Create playlists to organize your music.
Turn your photos into a slideshow complete with music from iTunes.
Order prints or an album, share your photos using.Mac, or show them on your desktop.*
For more information, search help for: Using iTunes to purchase music Creating a slideshow with iPhoto Making movies with iMovie Producing your own DVDs

*The iTunes Music Store and some iPhoto services may not be available in your country. To use some iPhoto services, you need a.Mac membership.

Pictures and Movies

iPhoto and iMovie let you capture your digital photos and movies, then create interesting presentations and movies with them.
iPhoto Create albums to organize your pictures in iPhoto. To get your pictures ready to share with others, you can clean them up and crop them to a different size.
Drag to select an area to work on or crop, or choose the standard size from the Constrain pop-up menu.
Touch up your photo and zoom in to see the details.
iMovie Use iMovie to bring together your movies, pictures, and music. You can add effects, titles, and transitions to complete the experience.
Add pan and zoom motion to still photos using the Ken Burns Effect.
Use the iMedia browsers to add movie clips, photos, and music, or prepare to burn your own DVD. Drag scenes or transitions to the timeline, then drag to arrange them.

Make Your Own Music

GarageBand turns your Mac into a recording studio packed with hundreds of instruments to create, perform, and record your own music.
GarageBand Create songs using builtin instruments, Apple Loops, and recordings of real instruments. Add your original music to your slideshows or DVD menus, burn it to CDs, or use it for the score of an iMovie project.
GarageBand gives you complete control of your tracks so you can achieve just the right sound.
Use an Apple Loop to start creating your very first song.

Produce Your Own DVDs

Use iDVD* to produce DVDs to share the movies and slideshows you create with your friends and family.
iDVD Choose a movie or photo album to start your DVD. Then create custom DVD menus to browse your creation. When youre ready, burn a DVD.
Click here to burn your DVD.
Create custom DVD menus using your movies, music, and photos.
Create a slideshow using an iPhoto album and music from iTunes.
* To burn a DVD, your computer must have a SuperDrive. iDVD may not be installed on your computer.