Home

Awesome

Project deprecated

This project is no longer being maintained. Please consider using https://github.com/kristovatlas/osx-config-check

osxlockdown

osxlockdown was built to audit, and remediate, security configuration settings on OS X 10.11 (El Capitan).

This checks, and if requested will flip, various configuration settings. Many are simply stripping out features to reduce the attack surface. You may not like this. This is a compilation of numerous resources listed in the Resources section which could be converted to bash scripts. This is different than those resources in that instead of requiring the user to read a 100+ page doc, click through numerous GUIs, and try to decide if some esoteric output is good or bad, this tool combines all the steps into a single command. This tool is focused on enterprise deployments of OSX with regard to what it does, but made to be usable for stand-alone home users as well.

Warning: Many of the rules disable functionality in the name of security. This may make you sad.

Warning: System commands and dark arts are involved, so ensure you have your system backed up first. No problems have been reported so far though.

Getting osxlockdown

You can build osxlockdown with Go, by cloning this repo and running go build osxlockdown

You can download releases at https://github.com/SummitRoute/osxlockdown/releases

Usage

Run sudo ./osxlockdown to check security settings. Run sudo ./osxlockdown --remediate to fix them.

The commands.yaml file may be edited to disable certain rules by setting enabled to false.

Available command-line options:

Sample output

$ sudo ./osxlockdown
[PASSED] Verify all application software is current
[PASSED] Enable Auto Update
[PASSED] Disable Bluetooth
[PASSED] Disable infrared receiver
[PASSED] Disable AirDrop
[PASSED] Set time and date automatically
[PASSED] Set an inactivity interval of 10 minutes or less for the screen saver
[PASSED] Enable secure screen saver corners
[PASSED] Require a password to wake the computer from sleep or screen saver
[PASSED] Ensure screen locks immediately when requested
[PASSED] Disable Remote Apple Events
[PASSED] Disable Remote Login
[PASSED] Disable Internet Sharing
[PASSED] Disable Screen Sharing
[PASSED] Disable Printer Sharing
[PASSED] Disable Wake on Network Access
[PASSED] Disable File Sharing
[PASSED] Disable Remote Management
[PASSED] Enable FileVault
[PASSED] Destroy File Vault Key when going to standby
[PASSED] Enable hibernation mode (no memory power on sleep)
[PASSED] Enable Gatekeeper
[PASSED] Enable Firewall
[PASSED] Enable Firewall Stealth Mode
[PASSED] Disable signed apps from being auto-permitted to listen through firewall
[PASSED] Disable iCloud drive
[PASSED] Require an administrator password to access system-wide preferences
[PASSED] Disable IPv6
[PASSED] Disable Previews
[PASSED] Secure Safari by crippling it
-------------------------------------------------------------------------------
osxlockdown 0.9
Date: 2016-01-02T13:01:11-08:00
SerialNumber: C02XXXXXXXXX
HardwareUUID: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
Final Score 100%: Pass rate: 30/30

Resources

This project pulled from numerous resources including:

Limitations

FAQ

FAQ for specific features