New Patch Fixes 43 Flaws In OS X, Many Serious 2128

Daniel Johnson said the following on 16-05-2006 11:25 am: He said, "the answer is too long to post". I found a shorter answer, that is not so thorough, but I suspect by your ignoring of previous explanations this one won't do for you either.

Out of the box, root is disabled. It doesn't seem to mention that here, and if I go on to to other things this will become too long. it would be easy enough for you to find out this yourself, but from your atbreastude it doesn't look like you really want to know, just to put down what others here are saying.

anyway, here it is:

A Quick Primer in UNIX-BSD

Mac OS X is new, but it has a long family history. It is a descendent of the BSD UNIX family and the original AT&T UNIX, which have been around more than 30 years. This history provides Mac OS X with excellent power and stability, as well as a great deal more flexibility than earlier versions of Mac OS. This is especially true if youÕre willing to take a look under the hood and work with the BSD subsystem directly.

As you start working with the UNIX system, you should be familiar with a few key concepts. These include:

* The multi-user nature of UNIX systems. * The UNIX file system and buttociated permissions model. * The way UNIX provides network services.

UNIXÕs Multi-user Nature

There are multiple user accounts in every UNIX system. Most of these accounts are buttociated with actual, human users. For example, you created an account when you supplied a username and pbuttword upon installing Mac OS X. Every process and application is buttociated with a user. So when you start an application after logging in, that application will be buttociated with your username.

UNIX systems also have accounts that are not buttociated with any person logging into the system; rather, they are built into the system. Five accounts are installed by default in Mac OS X: daemon, nobody, root, unknown, and www. To understand the full significance of these accounts, youÕll need to understand UNIX permissions, which will be discussed shortly. For now, keep in mind that www is the account used by the built-in web server, unknown and nobody provide minimal permissions, and daemon runs system services that need some permissions.

The root account is very special Ñ it has no restrictions. Any application or process running with the privileges of the root user can read, write, or delete any file on the system; stop or start any application on the system; or do anything else it pleases. There is nothing the root user cannot do. Consequently, guarding access to the root account is very, very important.

In addition to users, UNIX has a concept of groups. A UNIX group is a collection of individual accounts. In the UNIX file permission scheme, which will be discussed shortly, you can grant permissions to a group. This provides a way of allowing a selected set of users to have identical access to files, directories, and applications, while denying access to other users. Individual user accounts belong to a default group and may be given membership in other groups. UNIX Filesystem and buttociated Permissions Model

If youÕve worked with file sharing in previous versions of the Mac OS, what youÕve read so far about users and groups should be familiar. Like the older versions of Mac OS, each object in UNIX systems (a file or folder) is owned by a user and is buttociated with a group. For each object, specific permissions can be granted to the owner, to the group, and to everyone else.

There are three basic permissions: read, write, and execute. The meanings of read and write are fairly straightforward; execute, however has different meanings depending on whether the object is a file or a directory. For a file, execute means the file is executable (that is, itÕs an application or a script), but if the object is a directory, execute means that the clbutt (owner, group, or everyone) has permission to search the directory.

You can view the permissions buttociated with any file by opening up the Terminal application and using the ls command.

G4-OSX 1% ls -Fla total 32 drwxr-xr-x 16 eric users 2048 Mar 11 18:06 ..drwxr-xr-x 2 eric users 512 Feb 19 15:15 OpenBSD-rw-r--r-- 1 eric users 2525 Mar 1 15:01 filelistings -rw-r--r-- 1 eric users 2408 Mar 1 15:00 filelistings.2 Apple drwxr-xr-x 3 eric users 512 Feb 4 11:22 foobardrwxr-xr-x 2 eric users 512 Jan 18 18:02 honeynetdrwxr-xr-x 3 eric users 512 Feb 2 13:56 ipfhowtodrwxr-xr-x 3 eric users 512 Feb 16 23:20 upgradesG4-OSX 2%=20

The collection of letters and hyphens furthest to left indicates exactly what each element is and the permissions for that element. The first column of each line indicates the elementÕs type: d for directory, - for a regular file, and l for a symbolic link, which is essentially the same as an alias in Mac OS 9.x. The next three columns (rwx) show the permissions for the owner, the next three for the group buttociated with the file, and the last three for everyone. A - in any position indicates a lack of that permission. For example, rw- indicates read and write permissions, but no execute permission, and r-x indicates read and execute permission, but no write access.

For the third listing above (Apple-), you can look at the permissions (drwxr-x Ñ -) and know that this is a directory (the first letter is d) that has read, write, and execute permissions for the owner (rwx), read and execute permissions for the group (r-x) and no permissions for everyone ( Ñ -).

The owner (eric) and the group (users) are both shown here, as well as the file size in bytes, the last modified date, and the filename. Also shown are the current directory (symbolized by a single dot) and the parent directory (symbolized by two dots). UNIX Networking

UNIX systems are designed to be used in network environments. Frequently, UNIX systems host network services, such as Web servers, file sharing, and database servers. Although thereÕs no need to run these services on your Mac OS X box, you do have the option. You can run, for example, the Apache Web server with PHP and Perl and the MySQL database server in your development environment.

UNIX systems natively speak the various protocols of what is commonly referred to as the TCP-IP suite. Each network service will be buttociated with the IP address buttigned to your machine. Additionally, each service will be buttociated with a TCP or UDP port. Ports are a feature of TCP and UDP that allow many processes on a single host access to TCP and UDP services simultaneously. Ports are numeric in the range of 1 to 65535, some of which are, by convention, buttigned to specific services. For example, the HTTP services is commonly buttigned to TCP port 80. There are a number of such buttigned ports, but there are a far greater number of unbuttigned ports Ñ that is, ports that are not commonly bound to a service or application.

The combination of an IP address and a port makes a socket, and a pair of sockets define a connection. Applications that provide network services listen for connections on a socket. For example, a secure web server commonly listens on the socket formed by the IP address of the server and TCP port 443.

The more sockets that are active on your machine, the greater the opportunity for an intruder to break into your box. More on this later. Additional Reading

This has been a very quick introduction to a few important UNIX topics. Further information and details about UNIX, BSD, and UNIX networking can be found at the following sites:

* An Introduction to FreeBSD and UNIX. * The Challenges of Integrating the Unix and Mac OS Environments Ñ a discussion of some of the differences between Clbuttic Mac OS and Mac OS X. * An Internet Encyclopedia Ñ includes all Internet standards and course work-type information about the Internet and Internet protocols. * The UNIX Security Model Ñ an introductory course on UNIX security. * BSD Devcenter Ñ This OÕReilly network site has good articles, including one on UNIX file permissions. * Practical UNIX Security Ñ a workshop on UNIX security (from 1997, but with a lot of good background information)

Mac OS X Security Out of the Box

Following the initial install, Mac OS X is fairly secure. A few simple tweaks make it even more secure. But before we get to those changes, there are a few things you should notice during the install process. Administrative Accounts

The first account created on a Mac OS X system is an administrative account. If possible, this account should not be the account you commonly use; it should be reserved for making changes to the system and installing system-wide applications. After installing Mac OS X, go into the Users item in System Preferences create a new account without administrative access. For your common tasks, log in as that user.

The root has been disabled, although it can be re-enabled if need be. This means that all administrative tasks, such as turning on and off various types of sharing and adding or deleting users, must be done by one of the administrator accounts.

The GUI tools for administrative tasks provide additional restrictions in that they do not allow direct software installs or other edits to the core portions of the OS. These restrictions prevent users from accidentally breaking their systems. Any time you launch an administrative tool, you will have to authenticate yourself by entering the username and pbuttword of an administrative account to make changes. Active Network Services

After the initial install, Mac OS X provides only a few network services, automounter, syslog, sunrpc, and NetInfo, each of which will be described in a moment. Having few network services available is a good way to start off Ñ the fewer services available over the network, the harder it is to break into your system. As an analogy, think of how scaling a smooth wall is much harder than climbing one with good finger- and foot-holds.

The automounter service is used for automatically mounting network volumes; syslog is both a process and a protocol for recording system logs. The sunrpc service maps Remote Procedure Call (RPC) application information into TCP-IP (a.k.a. Internet protocols). RPC is used for services like Network File System (NFS) Ñ the standard method of file sharing in UNIX. You can read more about sunrpc from this W3C description and the RFC.

The NetInfo service is thoroughly described in AppleÕs Knowledge Base. Other Network Services

A variety of other services are available for activation. File sharing (AFP) over both TCP-IP and AppleTalk are available, as is Web sharing. Starting up either of these services opens additional network services and thereby introduces some risk; however, that doesnÕt mean these services are insecure.

In-bound SSH and FTP services are also available in the Sharing System Preferences panel but are best left turned off unless you have a specific need for them to be active. SSH does provide for host-to-host and individual account authentication. It does this while encrypting all network traffic between the hosts. However, it is still an open service that may provide an attacker leverage into your system. Simple Changes to Enhance the Security of Mac OS X

Once Mac OS X is installed, three quick steps will enhance your machineÕs security:

* Create an additional, non-administrative account and use that for all of your day-to-day work. Using a non-administrative account will make it harder to damage your system because you wonÕt have the privileges to commit a serious mistake. * Use the Mac OS X screen saver (Screen Effects). Not only is it cool to look at, but it can also help protect your machine from others who come by when youÕre not around. Turn on the screen saver from within System Preferences (it has its own panel) via the Activation tab Ñ 10 or 15 minutes for a startup time is a good default. Be sure to make the screen saver ask for your pbuttword before releasing the machine. * Turn on Network Time Synchronization. This is a good idea, particularly if you have a constant connection to either a local NTP (Network Time Protocol) server or the Internet. Ask your local systems or network administrator if you have a local NTP server. Keeping your clock synchronized to official time is helpful in coordinating forensics of an attack and detecting alterations to the system.

On-the-box Firewalling

You can minimize the risk of a network service being used to attack your machine by using the firewall built into Mac OS X. Called ipfw, it can prevent potential attackers from reaching these services. As of Mac OS X 10.2, Apple has included a simple GUI for configuring ipfw. The GUI is good for adding simple rules to your machine; more complex rules will require you to use either the command line tools for manipulating the firewall, or a third-party GUI that has more features. Building a comprehensive firewall requires a detailed understanding of what the firewall rules do and a certain amount of skill. Understanding TCP-IP networking is also important. Note that building firewall rulesets can cause your network connection to stop working, so be sure to invoke ruleset additions and changes directly on your machine and not from a remote location. VPNs

Mac OS X 10.2 includes support for two types of Virtual Private Networks (VPNs), PPTP and IPsec. Using PPTP as a client is fairly easy, the ÒInternet ConnectÓ application has an easy GUI for accessing PPTP servers. IPsec support is also built into Mac OS X 10.2, but there isnÕt a built-in GUI for it. Again, either the command line tools or a third-party GUI tool can be helpful. Logging

Recording events through system logging and reviewing these logs is a key element of good security. Good logging provides information as to what happened, when it happened, and (usually) who did it. By default, Mac OS X logs a fair bit of information to several files in thevar-log directory. One of these is system.log, which records general information from various subsystems. Examples of the types of events recorded in the logs are:

* Firewall (ipfw) blocked packets. * Web server access and error messages. * Use of privilege escalation tools. * Informational messages, such as subsystem status messages.

Going Further

If youÕre willing to take a look under the hood, you can get direct access to the UNIX command line. As a non-administrative user, you navigate through a lot of the underpinnings of Mac OS X and not worry about altering the Mac OS X system. You can still cause yourself some problems; for example you can overwrite your own documents, and alter Clbuttic Mac OS files or volumes, as they default to world-writable directories and files.

Several command-line utilities allow your administrative account to do just about anything. The best of these is sudo, an application that allows specified users to do tasks with (potentially) no restrictions. Tasks are carried out as if they were called by the root user. By default, anyone in the group admin is allowed to do use sudo. The good part about sudo is that it logs all usage along with the user who executed the command, which makes for good accountability and good debugging (you can see what you did to cause problems). If you find a need to do any administrative tasks from the command line, use the sudo command.

Working at the UNIX command line level, you can install and access a a little programming work to get them to install. The additional resources links below are great places to look for these types of tools and packages. Additional Resources:

* AppleÕs Mac OS X Site Ñ The source for Mac OS X. * Apple Developer Connection Ñ AppleÕs developer site with security info. * Ultimate Guide to Mac OS Security Ñ A very long list of Mac OS related security links * OS X FAQ Ñ More Mac OS X information * MacSecurity.org Ñ More security news relating to Macs. * osx.hyperjeff.net - Mac OS X information, applications, and more. * Xappeal.org Ñ Covering Mac OS X since Mac OS X Server 1.0. * SecureMac.com Ñ Security news and information relating to Macs. * SecurityFocus.com Ñ An excellent source of security information and resources.