> ## Documentation Index
> Fetch the complete documentation index at: https://journal.daudaldi.my.id/llms.txt
> Use this file to discover all available pages before exploring further.

# macOS

# macOS Hardening

For a long time, macOS had a reputation of being "more secure" than Windows. Some of that is earned, macOS has solid built-in security features. But a lot of it is survivorship bias from when Macs were a smaller target. That's no longer the case: corporate Mac fleets are large, macOS malware is growing, and threat actors increasingly target Apple platforms.

The good news is that macOS has excellent native security controls - they just need to be enabled and configured properly.

## Start With the Benchmarks

Before diving in, know that both of these exist and are free:

* **CIS Apple macOS Benchmark** - Covers macOS Sonoma, Ventura, and older releases. Very thorough. Download at [cisecurity.org](https://www.cisecurity.org/benchmark/apple_os).
* **macOS Security Compliance Project (mSCP)** - Apple-supported project that generates compliance scripts for NIST 800-53, CIS, and DISA STIG profiles. Available at [github.com/usnistgov/macos\_security](https://github.com/usnistgov/macos_security).

For a quick audit of your current state, the **mSCP** tools can generate a compliance report and a hardening script in one go.

## System-Level Security Settings

Most of the critical macOS security settings live in **System Settings** (System Preferences on older macOS), but you can also configure them via `defaults` commands or MDM profiles - which is the right approach for a fleet.

### FileVault (Full-Disk Encryption)

This should be on. Period. If a Mac is lost or stolen with FileVault off, the data is accessible.

```bash theme={null}
# Check FileVault status
fdesetup status

# Enable FileVault (prompts for a user to set as recovery user)
sudo fdesetup enable

# Or enable silently via MDM/script (outputs personal recovery key)
sudo fdesetup enable -user username -outputplist /path/to/recovery.plist
```

In **System Settings > Privacy & Security > FileVault** you can also enable it via GUI.

### Firewall

macOS has an application-level firewall that controls which apps can receive incoming connections.

```bash theme={null}
# Enable the firewall
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on

# Enable stealth mode (don't respond to probe requests)
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on

# Block all incoming connections (most restrictive - good for personal/laptop)
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setblockall on

# Check current state
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getstealthmode
```

Via GUI: **System Settings > Network > Firewall**

### Gatekeeper

Gatekeeper ensures only signed and notarized software runs. It should always be on:

```bash theme={null}
# Check Gatekeeper status
spctl --status

# Enable Gatekeeper
sudo spctl --master-enable

# Check if an app is notarized
spctl --assess --type exec /Applications/SomeApp.app
```

In **System Settings > Privacy & Security**, the setting is under "Allow applications downloaded from."

## Screen Lock and Authentication

```bash theme={null}
# Require password immediately after screen saver starts (via defaults)
defaults write com.apple.screensaver askForPassword -int 1
defaults write com.apple.screensaver askForPasswordDelay -int 0

# Set screen saver to activate after 5 minutes of inactivity
defaults -currentHost write com.apple.screensaver idleTime -int 300
```

Via GUI: **System Settings > Lock Screen** - set both "Start Screen Saver after" and "Require password after screen saver begins or display is turned off" to appropriate values.

### Disable Automatic Login

Automatic login bypasses the login screen entirely:

```bash theme={null}
# Check if automatic login is configured
sudo defaults read /Library/Preferences/com.apple.loginwindow autoLoginUser 2>/dev/null

# Disable automatic login
sudo defaults delete /Library/Preferences/com.apple.loginwindow autoLoginUser
```

### Show All Users at Login (Don't Show Last Username)

```bash theme={null}
# Hide last username at login screen
sudo defaults write /Library/Preferences/com.apple.loginwindow SHOWFULLNAME -bool true
```

## User Account Hardening

### Audit Admin Accounts

```bash theme={null}
# List all admin accounts (should be minimal)
dscl . -read /Groups/admin GroupMembership

# List all local user accounts
dscl . list /Users | grep -v "^_"
```

Admin accounts should be limited. Regular users should not have admin rights for day-to-day use. If you need to install software, use a separate admin account or `sudo`.

### Firmware Password (Intel Macs)

On Intel Macs, a firmware password prevents booting from external media and resetting the system without credentials. On Apple Silicon, this is handled differently via Activation Lock.

```bash theme={null}
# Check firmware password status (Intel)
sudo firmwarepasswd -check

# Set a firmware password
sudo firmwarepasswd -setpasswd
```

## Privacy and Permissions

macOS's privacy model requires explicit permission grants for apps to access sensitive resources. Review and tighten these:

**System Settings > Privacy & Security:**

* **Location Services** - Review which apps have access. Most apps don't need this.
* **Contacts / Calendars / Reminders** - Remove apps that don't need access.
* **Full Disk Access** - Be very selective. Only give this to tools that genuinely require it.
* **Screen Recording** - Audit carefully - anything with this can see everything on your screen.
* **Accessibility** - Apps with Accessibility access can control your Mac. Audit regularly.
* **Microphone / Camera** - Review which apps have access.

```bash theme={null}
# List all TCC (Transparency, Consent, and Control) database entries
# Note: requires SIP disabled or appropriate access, usually view via System Settings
sudo sqlite3 "/Library/Application Support/com.apple.TCC/TCC.db" "select client, service, auth_value from access;"
```

## Disable Unnecessary Services and Sharing

**System Settings > General > Sharing** - Turn off everything you don't actively use:

```bash theme={null}
# Disable file sharing
sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.smbd.plist 2>/dev/null
sudo defaults write /Library/Preferences/SystemConfiguration/com.apple.smb.server.plist EnabledServices -array

# Disable Remote Login (SSH)
sudo systemsetup -setremotelogin off

# Check what's currently shared
sudo sharing -l

# Disable printer sharing
sudo cupsctl --no-share-printers
```

Services to review and typically disable:

* **File Sharing** - unless actively used
* **Printer Sharing** - unless you have a shared printer
* **Remote Login (SSH)** - unless you need remote terminal access
* **Remote Management (VNC/ARD)** - unless actively managed remotely
* **Bluetooth Sharing** - almost never needed
* **Internet Sharing** - disable unless you're using your Mac as a hotspot

## System Integrity Protection (SIP)

SIP is a macOS security feature that prevents even root from modifying protected system files. **Never disable this without a very good reason.** Some development tools or kernel extensions may ask you to - evaluate carefully whether it's necessary.

```bash theme={null}
# Check SIP status
csrutil status

# Should show: "System Integrity Protection status: enabled."
```

## Application Security

### Safari Hardening (if used as primary browser)

```bash theme={null}
# Enable fraudulent website warning
defaults write com.apple.Safari WarnAboutFraudulentWebsites -bool true

# Disable auto-opening safe files after download
defaults write com.apple.Safari AutoOpenSafeDownloads -bool false

# Enable Do Not Track header
defaults write com.apple.Safari SendDoNotTrackHTTPHeader -bool true
```

## Audit Logging

macOS has a built-in audit system (OpenBSM) but logging defaults are minimal. For more comprehensive logging:

```bash theme={null}
# Check current audit settings
sudo cat /etc/security/audit_control

# Enable detailed audit logging - add these to audit_control
# flags:lo,ad,fd,fm,-all
# minfree:5
# naflags:lo,ad

# View current audit logs
sudo praudit /var/audit/current

# List audit log files
ls /var/audit/
```

### Unified Log (macOS 10.12+)

The modern macOS log system:

```bash theme={null}
# Stream logs in real-time
log stream --predicate 'eventMessage contains "authentication"'

# Query historical logs
log show --last 1h --predicate 'process == "sshd"'

# Log failed sudo attempts
log show --predicate 'process == "sudo" && eventMessage contains "NOT"' --last 24h
```

## MDM and Enterprise Management

If you're managing a fleet of Macs, **MDM (Mobile Device Management)** is how you enforce configuration at scale. Options:

| Tool                       | What it is                                                                 |
| -------------------------- | -------------------------------------------------------------------------- |
| **Jamf Pro**               | The most widely used Mac MDM in enterprise - very feature-rich             |
| **Mosyle**                 | Popular alternative, strong security focus                                 |
| **Microsoft Intune**       | Good choice for Microsoft-centric shops                                    |
| **Kandji**                 | Modern MDM with good auto-remediation features                             |
| **Apple Business Manager** | Apple's own device enrollment and management platform (used alongside MDM) |

MDM lets you push configuration profiles, enforce FileVault, restrict app installs, and deploy software at scale.

## Useful Tools

| Tool                    | What it's for                                                                                              |
| ----------------------- | ---------------------------------------------------------------------------------------------------------- |
| **Objective-See tools** | Free macOS security tools by Patrick Wardle - BlockBlock, KnockKnock, LuLu, Oversight. Highly recommended. |
| **LuLu**                | Free open-source macOS firewall with outbound connection control                                           |
| **BlockBlock**          | Monitors for persistence mechanisms and alerts you                                                         |
| **KnockKnock**          | Scans for persistent software installed on your Mac                                                        |
| **Oversight**           | Alerts when camera or microphone is activated                                                              |
| **Santa**               | Open-source binary authorization tool from Google - blocks unauthorized executables                        |
| **osquery**             | SQL-based endpoint visibility - great for auditing and monitoring                                          |
| **mSCP**                | macOS Security Compliance Project - generate hardening scripts                                             |
| **Lynis**               | Works on macOS too - quick audit tool                                                                      |

The **Objective-See** suite (all free, all open-source, all made specifically for Mac security) is especially worth installing on any Mac you care about.

## Apple Silicon vs Intel - Differences Worth Knowing

Apple Silicon Macs (M1/M2/M3/M4) have some security improvements worth knowing about:

* **Secure Enclave** - Hardware-based key storage, significantly more robust than Intel counterparts
* **Activation Lock** - Ties the Mac to an Apple ID, preventing use if stolen (replaces firmware password)
* **Full Security mode** - Default boot policy only allows Apple-signed OS
* **Kernel extensions** - System extensions replaced kernel extensions on Apple Silicon; harder for attackers to load malicious kernel code

For enterprise, Apple Silicon Macs enrolled in Apple Business Manager with a MDM can be remotely wiped and locked even by Apple.

## Quick Win Checklist

If you're hardening a Mac and want to start with the highest-impact items:

* [ ] Enable FileVault
* [ ] Enable the application firewall with stealth mode
* [ ] Set screen lock to require password immediately
* [ ] Disable automatic login
* [ ] Turn off all unused sharing services
* [ ] Review Privacy & Security permissions for all apps
* [ ] Enable automatic security updates
* [ ] Install LuLu and Objective-See's BlockBlock and KnockKnock
* [ ] Audit admin accounts - regular users shouldn't need admin rights

## Reference

* [CIS macOS Benchmark](https://www.cisecurity.org/benchmark/apple_os)
* [macOS Security Compliance Project](https://github.com/usnistgov/macos_security)
* [Objective-See Tools](https://objective-see.org/tools.html) - Patrick Wardle's free Mac security tools
* [Apple Platform Security Guide](https://support.apple.com/guide/security/welcome/web) - Apple's own documentation on macOS security architecture
* [DISA STIG for macOS](https://public.cyber.mil/stigs/) - Government-grade hardening requirements

***

*macOS gives you a lot of security features for free - but "for free" doesn't mean automatically configured. The delta between a default Mac and a hardened Mac is entirely made up of settings that Apple built but left off.*