MacOSXServer SecurityConfiguration. ForMacOSXServerVersion10.6 SnowLeopard

(1)

Mac

OS

X

Server

Security

Configuration

For

Mac

OS

X

Server

Version

10.6

(2)

K AppleInc. ©2010AppleInc.Allrightsreserved. Theownerorauthorizeduserofavalidcopyof MacOSXsoftwaremayreproducethispublicationfor thepurposeoflearningtousesuchsoftware.Nopartof thispublicationmaybereproducedortransmittedfor commercialpurposes,suchassellingcopiesofthis publicationorforprovidingpaid-forsupportservices. Everyefforthasbeenmadetoensurethatthe informationinthismanualisaccurate.Appleisnot responsibleforprintingorclericalerrors. Apple 1InfiniteLoop Cupertino,CA95014 408-996-1010 www.apple.com TheApplelogoisatrademarkofAppleInc.,registered intheU.S.andothercountries.Useofthe“keyboard” Applelogo(Option-Shift-K)forcommercialpurposes withoutthepriorwrittenconsentofApplemay constitutetrademarkinfringementandunfair competitioninviolationoffederalandstatelaws. Apple,theApplelogo,Airport,Bonjour,FileVault, FireWire,iCal,iChat,iMac,iSight,iTunes,Keychain,Mac, MacOS,QuickTime,Safari,SnowLeopard,Spotlight, Tiger,TimeMachine,Xgrid,Xsan,andXserveare trademarksofAppleInc.,registeredintheU.S.andother countries. AppleRemoteDesktop,Finder,andQuickTime BroadcasteraretrademarksofAppleInc. MobileMeisaservicemarkofAppleInc. TheBluetooth®wordmarkandlogosareregistered trademarksownedbyBluetoothSIG,Inc.andanyuseof suchmarksbyAppleisunderlicense. Intel,IntelCore,andXeonaretrademarksofIntelCorp. intheU.S.andothercountries. Java™andallJava-basedtrademarksandlogosare trademarksorregisteredtrademarksofSun Microsystems,Inc.intheU.S.andothercountries. UNIXisaregisteredtrademarkofTheOpenGroup. Thisproductincludessoftwaredevelopedbythe UniversityofCalifornia,Berkeley,FreeBSD,Inc.,The NetBSDFoundation,Inc.,andtheirrespective contributors. Othercompanyandproductnamesmentionedherein aretrademarksoftheirrespectivecompanies.Mention ofthird-partyproductsisforinformationalpurposes onlyandconstitutesneitheranendorsementnora recommendation.Appleassumesnoresponsibilitywith regardtotheperformanceoruseoftheseproducts. 019-1875/2010-06

(3)

3 2

255 RestrictingFilePermissions 256 ProtocolSecurityComparison 256 DisablingFileSharingServices 257 ChoosingaFileSharingProtocol 258 ConfiguringAFPFileSharingService 259 ConfiguringFTPFileSharingService 262 ConfiguringNFSFileSharingService 263 ConfiguringSMBFileSharingService 264 ConfiguringSharePoints

265 DisablingSharePoints

265 RestrictingAccesstoaSharePoint 267 AFPSharePoints

267 SMBSharePoints 268 FTPSharePoints 268 NFSSharePoints

Chapter18 271 SecuringWebService

272 DisablingWebService 272 ManagingWebModules 273 DisablingWebOptions

274 UsingRealmstoControlAccess 276 EnablingSecureSocketsLayer(SSL) 278 UsingaPassphrasewithSSLCertificates 278 ViewingWebServiceLogs

279 SecuringWebDAV 280 SecuringBlogServices 280 DisablingBlogServices

280 SecurelyConfiguringBlogServices 281 SecuringTomcat

282 SecuringMySQL

282 DisablingMySQLService 282 SettingUpMySQLService

283 ViewingMySQLServiceandAdminLogs

Chapter19 284 SecuringClientConfigurationManagementServices

284 ManagingApplicationsPreferences

285 ControllingUserAccesstoApplicationsandFolders 287 AllowingSpecificDashboardWidgets

288 DisablingFrontRow

289 AllowingLegacyUserstoOpenApplicationsandFolders 291 ManagingDockPreferences

292 ManagingEnergySaverPreferences 293 ManagingFinderPreferences

(12)

12 Contents

295 ManagingLoginPreferences 298 ManagingMediaAccessPreferences 299 ManagingMobilityPreferences 301 ManagingNetworkPreferences

302 ManagingParentalControlsPreferences 303 HidingProfanityinDictionary 303 PreventingAccesstoAdultWebsites 304 AllowingAccessOnlytoSpecificWebsites

306 SettingTimeLimitsandCurfewsonComputerUsage 307 ManagingPrintingPreferences

308 ManagingSoftwareUpdatePreferences 308 ManagingAccesstoSystemPreferences 309 ManagingUniversalAccessPreferences

310 EnforcingPolicy

Chapter20 311 SecuringNetBootService

311 SecuringNetBootService 311 DisablingNetBootService 312 LimitNetBootServiceClients 314 ViewingNetBootServiceLogs

Chapter21 315 SecuringSoftwareUpdateService

315 DisablingSoftwareUpdateService 316 LimitingAutomaticUpdateAvailability 317 ViewingSoftwareUpdateServiceLogs

Chapter22 318 SecuringNetworkAccounts

318 AboutOpenDirectoryandActiveDirectory 319 SecuringDirectoryAccounts

319 ConfiguringDirectoryUserAccounts 321 ConfiguringGroupAccounts 322 ConfiguringComputerGroups 323 ControllingNetworkViews

Chapter23 324 SecuringDirectoryServices

325 OpenDirectoryServerRoles

325 ConfiguringtheOpenDirectoryServicesRole

326 StartingKerberosAfterSettingUpanOpenDirectoryMaster 327 ConfiguringOpenDirectoryforSSL

329 ConfiguringOpenDirectoryPolicies 329 SettingtheGlobalPasswordPolicy

330 SettingaBindingPolicyforanOpenDirectoryMasterandReplicas 331 SettingaSecurityPolicyforanOpenDirectoryMasterandReplicas

(13)

Contents 13

Chapter24 333 SecuringRADIUS

333 DisablingRADIUS

334 SecurelyConfiguringRADIUSService 334 ConfiguringRADIUStoUseCertificates 335 EditingRADIUSAccess

335 ViewingRADIUSServiceLogs

Chapter25 337 SecuringPrintService

337 DisablingPrintService 338 SecuringPrintService

338 ConfiguringPrintServiceAccessControlLists(SACLs) 339 ConfiguringKerberos

340 ConfiguringPrintQueues

342 ViewingPrintServiceandQueueLogs

Chapter26 344 SecuringMultimediaServices

344 DisablingQTSS

345 SecurelyConfiguringQTSS 346 ConfiguringaStreamingServer

347 ServingStreamsThroughFirewallsUsingPort80

347 StreamingThroughFirewallsorNetworkswithAddressTranslation 348 ChangingthePasswordRequiredtoSendanMP3BroadcastStream 348 UsingAutomaticUnicast(Announce)withQTSSonaSeparateComputer 349 ControllingAccesstoStreamedMedia

353 ViewingQTSSLogs

Chapter27 354 SecuringGridandClusterComputingServices

354 UnderstandingXgridService 355 DisablingXgridService

355 AboutAuthenticationMethodsforXgrid 356 SingleSign-On

356 Password-BasedAuthentication 357 NoAuthentication

357 SecurelyConfiguringXgridService 357 DisablingtheXgridAgent 358 LimitingtheXgridAgent 359 ConfiguringanXgridController

Chapter28 361 ManagingWhoCanObtainAdministrativePrivileges(sudo)

361 ManagingthesudoersFile

Chapter29 363 ManagingAuthorizationThroughRights

363 UnderstandingthePolicyDatabase 363 TheRightsDictionary

(14)

14 Contents

365 Rules

366 ManagingAuthorizationRights 366 CreatinganAuthorizationRight 366 ModifyinganAuthorizationRight 366 ExampleAuthorizationRestrictions

Chapter30 368 MaintainingSystemIntegrity

368 UsingDigitalSignaturestoValidateApplicationsandProcesses 369 ValidatingApplicationBundleIntegrity

370 ValidatingRunningProcesses 370 AuditingSystemActivity 370 InstallingAuditingTools 371 EnablingAuditing 372 SettingAuditMechanisms 372 UsingAuditingTools 372 UsingtheauditTool 373 UsingtheauditreduceTool 374 UsingtheprauditTool 375 DeletingAuditRecords 375 AuditControlFiles

376 ManagingandAnalyzingAuditLogFiles 376 UsingActivityAnalysisTools

377 ValidatingSystemLogging 377 Configuringsyslogd 378 LocalSystemLogging 378 RemoteSystemLogging 379 ViewingLogsinServerAdmin

AppendixA 380 UnderstandingPasswordsandAuthentication

380 PasswordTypes

380 AuthenticationandAuthorization 381 OpenDirectoryPasswords 382 ShadowPasswords 382 CryptPasswords

382 OfflineAttacksonPasswords 383 PasswordGuidelines

383 CreatingComplexPasswords

383 UsinganAlgorithmtoCreateaComplexPassword 384 SafelyStoringYourPassword

385 PasswordMaintenance 385 AuthenticationServices

386 DeterminingWhichAuthenticationOptiontoUse 387 PasswordPolicies

(15)

Contents 15

387 SingleSign-OnAuthentication 388 KerberosAuthentication 389 SmartCardAuthentication

AppendixB 390 SecurityChecklist

390 InstallationActionItems

391 HardwareandCoreSnowLeopardServerActionItems 391 GlobalSettingsforSnowLeopardServerActionItems 392 AccountConfigurationActionItems

393 SystemSoftwareActionItems

393 MobileMePreferencesActionItems 393 AccountsPreferencesActionItems 393 AppearancePreferencesActionItems 394 BluetoothPreferencesActionItems 394 CDs&DVDsPreferencesActionsItems 394 Exposé&SpacesPreferencesActionItems 394 Date&TimePreferencesActionItems

395 Desktop&ScreenSaverPreferencesActionItems 395 DisplayPreferencesActionItems

395 DockPreferencesActionItems 395 EnergySaverPreferencesActionItems 396 KeyboardandMousePreferencesActionItems 396 NetworkPreferencesActionItems

396 Print&FaxPreferencesActionItems 396 QuickTimePreferencesActionItems 397 SecurityPreferencesActionItems 397 SharingPreferencesActionItems

397 SoftwareUpdatePreferencesActionItems 397 SoundPreferencesActionItems

398 SpeechPreferencesActionItems 398 SpotlightPreferencesActionItems 398 StartupDiskPreferencesActionItems 398 TimeMachinePreferencesActionItems 398 DataMaintenanceandEncryptionActionItems 399 AccountPoliciesActionItems

399 SharePointsActionItems

399 AccountConfigurationActionItems 400 ApplicationsPreferencesActionItems 400 DockPreferencesActionItems 401 EnergySaverPreferencesActionItems 401 FinderPreferencesActionItems 401 LoginPreferencesActionItems 402 MediaAccessPreferencesActionItems

(16)

16 Contents

403 MobilityPreferencesActionItems 403 NetworkPreferencesActionItems 403 PrintingPreferencesActionItems

404 SoftwareUpdatePreferencesActionItems 404 AccesstoSystemPreferencesActionItems 404 UniversalAccessPreferencesActionItems 405 CertificatesActionItems

405 GeneralProtocolsandServiceAccessActionItems 405 RemoteAccessServicesActionItems

407 NetworkandHostAccessServicesActionItems 407 IPv6ProtocolActionItems

407 DHCPServiceActionItems 407 DNSServiceActionItems 408 FirewallServiceActionItems 408 NATServiceActionItems 408 BonjourServiceActionItems 408 CollaborationServicesActionItems 409 MailServiceActionItems

410 FileServicesActionItems

410 AFPFileSharingServiceActionItems 410 FTPFileSharingServiceActionItems 411 NFSFileSharingServiceActionItems 411 SMBActionItems

412 WebServiceActionItems

412 ClientConfigurationManagementServicesActionItems 412 DirectoryServicesActionItems

413 PrintServiceActionItems 413 MultimediaServicesActionItems

413 GridandClusterComputingServicesActionItems 414 ValidatingSystemIntegrityActionItems

AppendixC 415 Scripts

(17)

PrefaceAboutThisGuide 17

About

This

Guide

Use

this

guide

as

an

overview

of

Mac

OS

X

v10.6

Snow

Leopard

Server

security

features

that

can

enhance

security

on

your

computer.

ThisguidegivesinstructionsforsecuringSnowLeopardServer,andforsecurely

managingserversandclientsinanetworkedenvironment.Italsoprovidesinformation

aboutthemanyrolesSnowLeopardServercanassumeinanetwork.

Audience

AdministratorsofservercomputersrunningSnowLeopardServeraretheintended

audienceforthisguide.

Ifyou’reusingthisguide,youshouldbeanexperiencedSnowLeopardServeruser,be

familiarwiththeWorkgroupManagerandServerAdminapplications,andhaveatleast

someexperienceusingtheTerminalapplication’scommand-lineinterface.

Youshouldalsohaveexperienceadministeringanetwork,befamiliarwithbasic

networkingconcepts,andbefamiliarwiththeSnowLeopardServeradministration

guides.

Someinstructionsinthisguidearecomplex,anddeviationfromthemcouldresultin

seriousadverseeffectsontheserveranditssecurity.Theseinstructionsshouldonlybe

usedbyexperiencedSnowLeopardServeradministrators,andshouldbefollowedby

thoroughtesting.

What’s

in

This

Guide

Thisguideexplainshowtosecureserversandsecurelymanageserverandclient

computersinanetworkedenvironment.Itdoesnotprovideinformationabout

securingclients.ForhelpwithsecuringcomputersrunningSnowLeopard,see

MacOSXSecurityConfiguration.

Thisguidecannotcoverallpossiblenetworkconfigurationsinwhich

SnowLeopardServermightbeused.Goodnetworksecurityanddesignmustbeused

forthisinformationtobeeffective,andanyoneusingthisguideneedstobefamiliar

(18)

18 PrefaceAboutThisGuide

Thisguideincludesthefollowingchapters,arrangedintheorderthatyou’relikelyto

needthemwhensecurelyconfiguringaserver.

Â _Chapter_1,_{“Introduction}_to_Snow_Leopard_Server_Security_{Architecture,”}_provides

anoverviewofthesecurityarchitectureandfeaturesofSnowLeopardServer.This

chapterdescribesthesecurityframework,accesspermissions,built-insecurity

services,anddirectoryservices.

Â _Chapter_2,_{“Installing}_Snow_Leopard_Server,”_describes_how_to_securely_install

SnowLeopardServerlocallyorremotely.Thischapteralsoincludesinformation

aboutupdatingsystemsoftware,repairingdiskpermissions,andsecurelyerasing

data.

Â _Chapter_3,_“Securing_System_Hardware,”_describes_how_to_physically_protect_your

hardwarefromattacks.

Â _Chapter_4,_“Securing_Global_System_Settings,”_describes_how_to_secure_settings_that

affectallusersofthecomputer.

Â _Chapter_5,_“Securing_Local_Server_Accounts,”_describes_the_types_of_user_accounts_and

howtosecurelyconfigureanaccount.Thisincludessecuringaccountsusingstrong

authentication.

Â Chapter6,“SecuringSystemPreferences,”helpsyouconfigurelocalserveraccounts

securely.Thisincludesthesecureconfigurationoflocalsystempreferences,setting

upstrongauthenticationandcredentialstorage,andsecuringdata.

Â _Chapter_7,_“Securing_System_Swap_and_Hibernation_Storage,”_describes_how_to_scrub

yoursystemswapandhibernationspaceofsensitiveinformation.

Â _Chapter_8,_“Securing_Data_and_Using_{Encryption,”}_describes_how_to_encrypt_data_and

howtouseSecureErasetoensureolddataiscompletelyremoved.

Â _Chapter_9,_“Managing_{Certificates,”}_describes_how_to_generate,_request,_and_deploy

certificates.

Â _Chapter_10,_“Setting_General_Protocols_and_Access_to_Services,”_helps_you_configure

generalnetworkmanagementprotocolsandrestrictaccesstootherservices.

Â _Chapter_11,_“Securing_Remote_Access_Services,”_tells_you_how_to_create_remote

connectionstoyourserverusingencryption.

Â _Chapter_12,_“Securing_Network_{Infrastructure}_Services,”_explains_how_to_connect

clientcomputersandconfigureafirewall.

Â _Chapter_13,_{“Configuring}_the_Firewall,”_describes_how_to_configure_the_IPFW2_firewall. Â Chapter14,“SecuringCollaborationServices,”describeshowtosecurelyconfigure

iChat,iCal,Wiki,andPodcastProducerservices.

Â Chapter15,“SecuringMailService,”explainshowtosetupmailservicetouse

encryptionandfilterforspamandviruses.

Â Chapter16,“SecuringAntivirusServices,”describeshowtoenableandmanage

(19)

PrefaceAboutThisGuide 19 Â _Chapter_17,_“Securing_File_Services_and_{Sharepoints,”}_explains_how_to_configure_file

servicestoenablesecuredatasharing.

Â _Chapter_18,_“Securing_Web_Service,”_describes_how_to_set_up_a_web_server_and_secure

websettingsandcomponents.

Â _Chapter_19,_“Securing_Client_{Configuration}_Management_Services,”_helps_you_set

policiesandenforcethemusingWorkgroupManager.

Â _Chapter_20,_“Securing_NetBoot_Service,”_tells_you_how_to_configure_NetBoot_securely

toprovideimagestoclients.

Â _Chapter_21,_“Securing_Software_Update_Service,”_describes_how_to_securely_configure

softwareupdateservices.

Â _Chapter_22,_“Securing_Network_Accounts,”_describes_security_settings_related_to

manageduserandgroupaccounts.

Â _Chapter_23,_“Securing_Directory_Services,”_explains_how_to_configure_Open_Directory

servicerolesandpasswordpolicies.

Â _Chapter_24,_“Securing_RADIUS,”_tells_how_to_securely_configure_RADIUS.

Â Chapter25,“SecuringPrintService,”explainshowtosetupprintqueuesandbanner

pages.

Â Chapter26,“SecuringMultimediaServices,”providessecurityinformationto

configureastreamingserver.

Â Chapter27,“SecuringGridandClusterComputingServices,”explainshowtosecurely

configureanXgridagentandcontroller.

Â Chapter28,“ManagingWhoCanObtainAdministrativePrivileges(sudo),”describes

howtorestrictaccesstothesudocommand.

Â Chapter29,“ManagingAuthorizationThroughRights,”explainsthepolicydatabase

andhowtocontrolauthorizationbymanagingrightsinthepolicydatabase.

Â Chapter30,“MaintainingSystemIntegrity,”describeshowtousesecurityauditsand

loggingtovalidatetheintegrityofyourserveranddata.

Â AppendixA,“UnderstandingPasswordsandAuthentication,”describesOpen

Directoryauthentication,shadowandcryptpasswords,Kerberos,LDAPbind,and

singlesign-on.

Â _Appendix_B,_“Security_{Checklist,”}_provides_a_checklist_that_guides_you_through

securingyourserver.

Â _Appendix_C,_{“Scripts,”}_provides_command-line_commands_and_scripts_for_securing

yourserver.

Note:BecauseApplefrequentlyreleasesnewversionsandupdatestoitssoftware,

(20)

Using

This

Guide

Thefollowinglistcontainssuggestionsforusingthisguide:

Â Readtheguideinitsentirety.Subsequentsectionsmightbuildoninformationand

recommendationsdiscussedinpriorsections.

Â Theinstructionsinthisguideshouldalwaysbetestedinanonoperational

environmentbeforedeployment.Thisnonoperationalenvironmentshouldsimulate,

asmuchaspossible,theenvironmentwherethecomputerwillbedeployed.

Â _This_information_is_intended_for_computers_running_Snow_Leopard_Server._Before

securelyconfiguringaserver,determinewhatfunctionthatparticularserverwill

performandapplysecurityconfigurationswhereapplicable.

Â UsethesecuritychecklistinAppendixBtotrackandrecordeachsecuritytaskand

notewhatsettingsyouchanged.Thisinformationcanbehelpfulwhendeveloping

asecuritystandardwithinyourorganization.

Important:Anydeviationfromthisguideshouldbeevaluatedtodeterminewhat

securityrisksitmightintroduce.Takemeasurestomonitorormitigatethoserisks.

Using

Onscreen

Help

YoucangettaskinstructionsonscreeninHelpViewerwhileyou’remanaging

SnowLeopardServer.Youcanviewhelponaserveroranadministratorcomputer. (AnadministratorcomputerisacomputerrunningSnowLeopardServerwiththe

serveradministrationtoolsinstalled)

TogethelpforanadvancedconfigurationofSnowLeopardServer: m OpenServerAdminorWorkgroupManagerandthen:

Â _Use_the_Help_menu_to_search_for_a_task_you_want_to_perform.

Â ChooseHelp>ServerAdminHelporHelp>WorkgroupManagerHelptobrowse

andsearchthehelptopics.

Theonscreenhelpcontainsinstructionstakenfromtheadvancedadministration

guidesdescribedin“SnowLeopardServerAdministrationGuides,”next. Toseethemostrecentserverhelptopics:

m _Make_sure_the_server_or_{administrator}_computer_is_connected_to_the_Internet_while you’regettinghelp.

HelpViewerautomaticallyretrievesandcachesthemostrecentserverhelptopics

fromtheInternet.WhennotconnectedtotheInternet,HelpViewerdisplayscached

(21)

Snow

Leopard

Server

Administration

Guides

GettingStartedcoversinstallationandsetupforstandardandworkgroupconfigurations

ofSnowLeopardServer.Foradvancedconfigurations,AdvancedServerAdministration

coversplanning,installation,setup,andgeneralserveradministration.

Asuiteofadditionalguidescoversadvancedplanning,setup,andmanagement

ofindividualservices.YoucangettheseguidesinPDFformatfromthe

SnowLeopardServerdocumentationwebsite:

www.apple.com/server/macosx/resources/documentation.html

Viewing

PDF

Guides

on

Screen

WhilereadingthePDFversionofaguideonscreen:

Â _Show_bookmarks_to_see_the_guide’s_outline,_and_click_a_bookmark_to_jump_to_the

correspondingsection.

Â _Search_for_a_word_or_phrase_to_see_a_list_of_places_where_it_appears_in_the_document.

Clickalistedplacetoseethepagewhereitoccurs.

Â _Click_a_{cross-reference}_to_jump_to_the_referenced_section._Click_a_web_link_to_visit_the

websiteinyourbrowser.

Printing

PDF

Guides

Ifyouwanttoprintaguide,youcantakethesestepstosavepaperandink:

Â Saveinkortonerbynotprintingthecoverpage.

Â _Save_color_ink_on_a_color_printer_by_looking_in_the_panes_of_the_Print_dialog_for_an

optiontoprintingraysorblackandwhite.

Â _Reduce_the_bulk_of_the_printed_document_and_save_paper_by_printing_more_than

onepagepersheetofpaper.InthePrintdialog,changeScaleto115%(155%for

GettingStarted).ThenchooseLayoutfromtheuntitledpop-upmenu.Ifyourprinter

supportstwo-sided(duplex)printing,selectoneoftheTwo-Sidedoptions.

Otherwise,choose2fromthePagesperSheetpop-upmenu,andoptionallychoose

SingleHairlinefromtheBordermenu.(Ifyou’reusingMacOSXv10.4Tigeror

earlier,theScalesettingisinthePageSetupdialogandtheLayoutsettingsarein

thePrintdialog.)

Youmaywanttoenlargetheprintedpagesevenifyoudon’tprintdoublesided,because

thePDFpagesizeissmallerthanstandardprinterpaper.InthePrintdialogorPageSetup

(22)

Getting

Documentation

Updates

Periodically,Applepostsrevisedhelppagesandneweditionsofguides.Somerevised

helppagesupdatethelatesteditionsoftheguides.

Â _To_view_new_onscreen_help_topics_for_a_server_application,_make_sure_your_server_or

administratorcomputerisconnectedtotheInternetandclick“Latesthelptopics”or

“Stayingcurrent”inthemainhelppagefortheapplication.

Â TodownloadthelatestguidesinPDFformat,gototheMacOSXServer

documentationwebsite:

www.apple.com/server/resources/

Â _An_RSS_feed_listing_the_latest_updates_to_Mac_OS_X_Server_{documentation}_and

onscreenhelpisavailable.ToviewthefeeduseanRSSreaderapplication,suchas

SafariorMail:

feed://helposx.apple.com/rss/snowleopard/serverdocupdates.xml

Getting

Additional

Information

Formoreinformation,consulttheseresources:

Â ReadMedocuments—getimportantupdatesandspecialinformation.Lookforthem

ontheserverdiscs.

Â MacOSXServerwebsite(www.apple.com/server/macosx)—enterthegatewayto

extensiveproductandtechnologyinformation.

Â SnowLeopardServerSupportwebsite(www.apple.com/support/macosxserver)— accesshundredsofarticlesfromApple’ssupportorganization.

Â AppleDiscussionswebsite(discussions.apple.com)—sharequestions,knowledge,and

advicewithotheradministrators.

Â AppleMailingListswebsite(www.lists.apple.com)—subscribetomailinglistssoyou

cancommunicatewithotheradministratorsusingemail.

Â AppleTrainingandCertificationwebsite(www.apple.com/training)—honeyourserver

administrationskillswithinstructor-ledorself-pacedtraining,anddifferentiate

yourselfwithcertification.

Â _Apple_Product_Security_Mailing_Lists_website

(lists.apple.com/mailman/listinfo/security-announce/)—Mailinglistsforcommunicatingbyemailwithotheradministrators

aboutsecuritynotificationsandannouncements.

Â OpenSourcewebsite(developer.apple.com/darwin/)—AccesstoDarwinopensource

code,developerinformation,andFAQs.

Â AppleProductSecuritywebsite(www.apple.com/support/security/)—Accessto

(23)

Foradditionalsecurity-specificinformation,consulttheseresources:

Â NSAsecurityconfigurationguides(www.nsa.gov/snac/)—TheNationalSecurity

Agency(NSA)providesinformationaboutsecurelyconfiguringproprietaryandopen

sourcesoftware.

Â _NIST_Security_{Configuration}_Checklists_Repository_{(checklists.nist.gov/repository/}

category.html)—ThisistheNationalInstituteofStandardsandTechnology(NIST)

repositoryforsecurityconfigurationchecklists.

Â DISASecurityTechnicalImplementationGuide(www.disa.mil/gs/dsn/policies.html)— ThisistheDefenseInformationSystemsAgency(DISA)guideforimplementing

securegovernmentnetworks.ADepartmentofDefense(DoD)PKICertificateis

requiredtoaccessthisinformation.

Â CISBenchmarkandScoringTool(www.cisecurity.org/bench_osx.html)—Thisisthe

CenterforInternetSecurity(CIS)benchmarkandscoringtoolusedtoestablishCIS

benchmarks.

Acknowledgments

ApplewouldliketothanktheNSA,NIST,andDISAfortheirassistanceincontributing

(24)

1

24

1

Introduction

to

Snow

Leopard

Server

Security

Architecture

Use

this

chapter

to

learn

about

the

features

in

Snow

Leopard

Server

that

can

enhance

security

on

your

computer

Whetheryou’reahomeuserwithabroadbandInternetconnection,aprofessionalwith

amobilecomputer,oranITmanagerwiththousandsofnetworkedsystems,youneed

tosafeguardtheconfidentialityofinformationandtheintegrityofyourcomputers. WithSnowLeopardServer,asecuritystrategyisimplementedthatiscentraltothe

designoftheoperatingsystem.Toenhancesecurityonyourcomputer,

SnowLeopardServerprovidesthefollowingfeatures.

Â _Modern_security_{architecture.}_Snow_Leopard_includes_{state-of-the-art,}

standards-basedtechnologiesthatenableAppleandthird-partydeveloperstobuildsecure

softwarefortheMac.Thesetechnologiessupportallaspectsofsystem,data,and

networkingsecurityrequiredbytoday’sapplications.

Â _Secure_default_settings._When_you_take_your_Mac_out_of_the_box,_it_is_securely

configuredtomeettheneedsofmostcommonenvironments,soyoudon’tneed

tobeasecurityexperttosetupyourcomputer.Thedefaultsettingsmakeitvery

difficultformalicioussoftwaretoinfectyourcomputer.Youcanfurtherconfigure

securityonthecomputertomeetorganizationaloruserrequirements.

Â Innovativesecurityapplications.SnowLeopardincludesfeaturesthattakethe

worryoutofusingacomputer.Forexample,FileVaultprotectsyourdocuments

byusingstrongencryption,anintegratedVPNclientgivesyousecureaccessto

networksovertheInternet,andapowerfulfirewallsecuresyourhomenetwork.

Â Opensourcefoundation.OpensourcemethodologymakesSnowLeopardarobust,

secureoperatingsystem,becauseitscorecomponentshavebeensubjectedtopeer

reviewfordecades.ProblemscanbequicklyidentifiedandfixedbyAppleandthe

(25)

Chapter1IntroductiontoSnowLeopardServerSecurityArchitecture 25 Â Rapidresponse.Becausethesecurityofyourcomputerisimportant,Apple

respondsrapidlytoprovidepatchesandupdates.Appleworkswithworldwide

partners,includingtheComputerEmergencyResponseTeam(CERT),tonotify

usersofpotentialthreats.Ifvulnerabilitiesarediscovered,thebuilt-inSoftware

Updatetoolnotifiesusersofsecurityupdates,whichareavailableforeasy

retrievalandinstallation.

Security

Architectural

Overview

SnowLeopardServersecurityservicesarebuiltontwoopensourcestandards:

Â BerkeleySoftwareDistribution(BSD):BSDisaformofUNIXthatprovides

fundamentalservices,includingtheSnowLeopardServerfilesystemandfile

accesspermissions.

Â CommonDataSecurityArchitecture(CDSA):CDSAprovidesanarrayofsecurity

services,includingmorespecificaccesspermissions,authenticationofuseridentities,

encryption,andsecuredatastorage.

UNIX

Infrastructure

TheSnowLeopardServerkernel—theheartoftheoperatingsystem—isbuiltfrom

BSDandMach.

Amongotherthings,BSDprovidesbasicfilesystemandnetworkingservicesand

implementsauserandgroupidentificationscheme.BSDenforcesaccessrestrictions

tofilesandsystemresourcesbasedonuserandgroupIDs.

Machprovidesmemorymanagement,threadcontrol,hardwareabstraction,and

interprocesscommunication.Machenforcesaccessbycontrollingwhichtaskscan

sendamessagetoaMachport.(AMachportrepresentsataskorsomeother

resource.)BSDsecuritypoliciesandMachaccesspermissionsconstituteanessential

partofsecurityinSnowLeopardServer,andarecriticaltoenforcinglocalsecurity.

Access

Permissions

Animportantaspectofcomputersecurityisthegrantingordenyingofaccess

permissions(sometimescalledaccessrights).Apermissionistheabilitytoperform

aspecificoperation,suchasgainingaccesstodataortoexecutecode.

Permissionsaregrantedattheleveloffolders,subfolders,files,orapplications.

Permissionsarealsograntedforspecificdatainfilesorapplicationfunctions. PermissionsinSnowLeopardServerarecontrolledatmanylevels,fromtheMach

andBSDcomponentsofthekernelthroughhigherlevelsoftheoperatingsystem,

(26)

26 Chapter1IntroductiontoSnowLeopardServerSecurityArchitecture AuthorizationVersusAuthentication

Authorizationistheprocessbywhichanentity,suchasauseroracomputer,obtains

therighttoperformarestrictedoperation.Authorizationcanalsorefertotheright

itself,asin“Annehastheauthorizationtorunthatprogram.”Authorizationusually

involvesauthenticatingtheentityandthendeterminingwhetherithasthecorrect

permissions.

Authenticationistheprocessbywhichanentity(suchastheuser)demonstratesthat

theyarewhotheysaytheyare.Forexample,theuser,enteringapasswordwhichonly

heorshecouldknow,allowsthesystemtoauthenticatethatuser.Authenticationis

normallydoneasastepintheauthorizationprocess.Someapplicationsandoperating

systemcomponentsperformtheirownauthentication.Authenticationmightuse

authorizationserviceswhennecessary.

Security

Framework

ThesecurityframeworkinSnowLeopardisanimplementationoftheCDSA

architecture.Itcontainsanexpandablesetofcryptographicalgorithmstoperform

codesigningandencryptionoperationswhilemaintainingthesecurityofthe

cryptographickeys.ItalsocontainslibrariesthatallowtheinterpretationofX.509

certificates.

TheCDSAcodeisusedbySnowLeopardfeaturessuchasKeychainandURLAccess

forprotectionoflogindata.

ApplebuiltthefoundationofSnowLeopardandmanyofitsintegratedserviceswith

opensourcesoftware—suchasFreeBSD,Apache,andKerberos,amongothers—that

hasbeenmadesecurethroughyearsofpublicscrutinybydevelopersandsecurity

expertsaroundtheworld.

Strongsecurityisabenefitofopensourcesoftwarebecauseanyonecaninspect

thesourcecode,identifytheoreticalvulnerabilities,andtakestepstostrengthen

thesoftware.

Appleactivelyparticipateswiththeopensourcecommunitybyroutinelyreleasing

updatesofSnowLeopardServerthataresubjecttoindependentdevelopers’ongoing

review—andbyincorporatingimprovements.Anopensourcesoftwaredevelopment

approachprovidesthetransparencynecessarytoincreaseSnowLeopardServer

(27)

Chapter1IntroductiontoSnowLeopardServerSecurityArchitecture 27

Layered

Security

Defense

SnowLeopardServersecurityisbuiltonalayereddefenseformaximumprotection.

Securityfeaturessuchasthefollowingprovidesolutionsforsecuringdataatalllevels,

fromtheoperatingsystemandapplicationstonetworksandtheInternet.

Â Secureworldwidecommunication:Firewallandmailfilteringhelpprevent

malicioussoftwarefromcompromisingyourcomputer.

Â Secureapplications:EncryptedDiskImagesandFileVaulthelppreventintruders

fromviewingdataonyourcomputer.

Â Securenetworkprotocols:SecureSocketsLayer(SSL)isaprotocolthat

helpspreventintrudersfromviewinginformationexchangeacrossanetwork,

andKerberossecurestheauthenticationprocess,andafirewallprevents

unauthorizedaccesstoacomputerornetwork.

Â SecurityServices:Authenticationusingkeychains,togetherwithPOSIXandACL

permissions,helpspreventintrudersfromusingyourapplicationsandaccessing

yourfiles.

Â Securebootandlockdown:TheFirmwarePasswordUtilityhelpspreventpeople

whocanaccessyourhardwarefromgainingroot-levelaccesspermissionstoyour

computerfiles.

Network

Security

SecureTransportisusedtoimplementSSLandTransportLayerSecurity(TLS)protocols.

TheseprotocolsprovidesecurecommunicationsoveraTCP/IPconnectionsuchas

theInternetbyusingencryptionandcertificateexchange.Afirewallcanthen

filtercommunicationoveraTCP/IPconnectionbypermittingordenyingaccessto

acomputeroranetwork.

Secure Worldwide Communication Internet

Secure Applications

Secure Network Protocols

Security Services

Secure Boot/”Lock Down”

Applications

Network

Operating System

(28)

28 Chapter1IntroductiontoSnowLeopardServerSecurityArchitecture

Credential

Management

Akeychainisusedtostorepasswords,keys,certificates,andotherdataplacedinthe

keychainbyauser.Duetothesensitivenatureofthisinformation,keychainsuse

cryptographytoencryptanddecryptsecrets,andtheysafelystoresecretsandrelated

datainfiles.

SnowLeopardServerKeychainservicesenableyoutocreatekeychainsandsecurely

storekeychainitems.Afterakeychainiscreated,youcanadd,delete,andeditkeychain

items,suchaspasswords,keys,certificates,andnotesforusers.

Ausercanunlockakeychainthroughauthentication(byusingapassword,digital

token,smartcard)andapplicationscanthenusethatkeychaintostoreandretrieve

data,suchaspasswords.

Public

Key

Infrastructure

(PKI)

ThePublicKeyInfrastructure(PKI)includescertificate,key,andtrustservicesinclude

functionsto:

Â _Create,_manage,_and_read_certificates Â Addcertificatestoakeychain

Â _Create_encryption_keys Â Managetrustpolicies

ThesefunctionsareusedwhentheservicescallCommonSecurityServiceManager

(29)

What’s

New

in

Snow

Leopard

Server

Security

SnowLeopardServeroffersthefollowingmajorsecurityenhancements:

Â Increasedsecurityformemoryandprotection:SnowLeopardServerrunning

onthe64-bitchipimprovessupportformemoryandexecutableprotection

againstarbitrarycodeexecution.Technologiessuchasexecutedisable,library

randomization,andsandboxinghelppreventattacksthattrytohijackormodify

thesoftwareonyourcomputer.

Â BetterTrojanhorseprotection:SnowLeopardServermaintainsprofilesforknown

malicioussoftware,andpreventsitsdownloadthroughmanyapplications.

Â IncreasedVPNcompatibility:Virtualprivatenetwork(VPN)supporthasbeen

enhancedtosupportCiscoIPSecVPNconnectionswithoutadditionalsoftware.

Â ImprovedCryptologytechnologies:SnowLeopardServerincludesEllipticalCurve

Cryptography(ECC)supportinmostofitsencryptiontechnologies.

Â SupportforExtendedValidationCertificates:ExtendedValidation(EV)Certificates

requirestheCertificateAuthoritytoinvestigatetheidentityofthecertificateholder

beforeissuingacertificate.

Â SupportforwildcardsindomainsforKeychainAccessidentitypreferences:This

allowsaclientcertificate-authenticatedconnectionstomultipleserversorpaths

definedwithinasingleIDPref.

Â Updatedsecuritycommand-linetools:Thesecurityandnetworksetup

command-linetoolshavebeenenhanced.

Â EnhancedSafari4.0security:Safarihasenhanceddetectionoffraudulentsites.It

alsorunsmanybrowserplug-insasseparateprocessesforenhancedsecurityand

stability.

Existing

Security

Features

in

Snow

Leopard

Server

SnowLeopardServercontinuestoincludethefollowingsecurityfeaturesand

technologiestoenhancetheprotectionofyourcomputerandyourpersonal

information.

Â Applicationsigning:Thisenablesyoutoverifytheintegrityandidentityof

applicationsonyourMac.

Â Mandatoryaccesscontrol:Theseenforcerestrictionsonaccesstosystemresources.

Â Quarantinedapplications:MacOSXv10.6tagsandmarksdownloadedfileswith

first-runwarningstohelppreventusersfrominadvertentlyrunningmalicious

downloadedapplications.

Â Runtimeprotection:Technologiessuchasexecutedisable,libraryrandomization,

andsandboxinghelppreventattacksthattrytohijackormodifythesoftwareon

(30)

Â Meaningfulsecurityalerts:Whenusersreceivesecurityalertsandquestionstoo

frequently,theymayfallintoreflexivemodewhenthesystemasksasecurity-related

question,clickingOKwithoutthought.MacOSXv10.6minimizesthenumberof

securityalertsthatyousee,sowhenyoudoseeone,itgetsyourattention.

Signed

Applications

Bysigningapplications,yourMaccanverifytheidentityandintegrityofanapplication.

ApplicationsshippedwithSnowLeopardServeraresignedbyApple.Inaddition,

third-partysoftwaredeveloperscansigntheirsoftwarefortheMac.Applicationsigning

doesn’tprovideintrinsicprotection,butitintegrateswithseveralotherfeaturesto

enhancesecurity.

Featuressuchasparentalcontrols,managedpreferences,Keychain,andthefirewalluse

applicationsigningtoverifythattheapplicationstheyareworkingwitharethecorrect,

unmodifiedversions.

WithKeychain,theuseofsigningdramaticallyreducesthenumberofKeychaindialogs

presentedtousersbecausethesystemcanvalidatetheintegrityofanapplicationthat

usestheKeychain.Withparentalcontrolsandmanagedpreferences,thesystemuses

signaturestoverifythatanapplicationrunsunmodified.

Theapplicationfirewallusessignaturestoidentifyandverifytheintegrityof

applicationsthataregrantednetworkaccess.Inthecaseofparentalcontrolsand

thefirewall,unsignedapplicationsaresignedbythesystemonanadhocbasis

toidentifythemandverifythattheyremainunmodified.

Mandatory

Access

Controls

SnowLeopardServerusesanaccesscontrolmechanismknownasmandatoryaccess

controls.AlthoughtheMandatoryAccessControltechnologyisnotvisibletousers,itis

includedinSnowLeopardServertoprotectyourcomputer.

Mandatoryaccesscontrolsarepoliciesthatcannotbeoverridden.Thesepoliciesset

securityrestrictionscreatedbythedeveloper.Thisapproachisdifferentfrom

discretionaryaccesscontrolsthatpermituserstooverridesecuritypoliciesaccording

totheirpreferences.

MandatoryaccesscontrolsinSnowLeopardServeraren’tvisibletousers,butthey

aretheunderlyingtechnologythathelpsenableseveralimportantnewfeatures,

includingsandboxing,parentalcontrols,managedpreferences,andasafetynet

(31)

TimeMachineillustratesthedifferencebetweenmandatoryaccesscontrolsandthe

userprivilegemodel—itallowsfileswithinTimeMachinebackupstobedeletedonly

byprogramsrelatedtoTimeMachine.Fromthecommandline,nouser—noteven

oneloggedinasroot—candeletefilesinaTimeMachinebackup.

TimeMachineusesthisstrictpolicybecauseitutilizesfilesystemfeaturesin

SnowLeopardServer.Thepolicypreventscorruptioninthebackupdirectoryby

preventingtoolsfromdeletingfilesfrombackupsthatmaynotrecognizethenewfile

systemfeatures.

Mandatoryaccesscontrolsareintegratedwiththeexecsystemservicetopreventthe

executionofunauthorizedapplications.Thisisthebasisforapplicationcontrolsin

parentalcontrolsinSnowLeopardandmanagedpreferencesinSnowLeopardServer. Mandatoryaccesscontrolsenablestrongparentalcontrols.Inthecaseofthenew

sandboxingfacility,mandatoryaccesscontrolsrestrictaccesstosystemresources

asdeterminedbyaspecialsandboxingprofilethatisprovidedforeachsandboxed

application.Thismeansthatevenprocessesrunningasrootcanhaveextremely

limitedaccesstosystemresources.

Sandboxing

Sandboxinghelpsensurethatapplicationsdoonlywhatthey’reintendedtodoby

placingcontrolsonapplicationsthatrestrictwhatfilestheycanaccess,whetherthe

applicationscantalktothenetwork,andwhethertheapplicationscanbeusedto

launchotherapplications.

InSnowLeopardServer,manyofthesystem’shelperapplicationsthatnormally

communicatewiththenetwork—suchasmDNSResponder(thesoftwareunderlying

Bonjour)andtheKerberosKDC—aresandboxedtoguardthemfromabuseby

attackerstryingtoaccessthesystem.

Inaddition,otherprogramsthatroutinelytakeuntrustedinput(forinstance,arbitrary

filesornetworkconnections),suchasXgridandtheQuickLookandSpotlight

backgrounddaemons,aresandboxed.

Sandboxingisbasedonthesystem’smandatoryaccesscontrolsmechanism,which

isimplementedatthekernellevel.Sandboxingprofilesaredevelopedforeach

applicationthatrunsinasandbox,describingpreciselywhichresourcesareaccessible

(32)

Managed

User

Accounts

Parentalcontrolsprovidecomputeradministratorswiththetoolstoenforcea

reasonablelevelofrestrictionsforusersofthecomputer.

AdministratoruserscanusefeatureslikeSimpleFindertolimitthelaunchingofaset

ofapplicationsorcreateawhitelistofwebsitesthatuserscanvisit.However,ifan

attackerhasphysicalaccesstothecomputerportssuchasUSBorFireWire,Parental

controlscanbebypassedbymountingadiskimagethatcontainmalicioussoftware.

Youcansecuretheseportsbydisablingthem.Forinformationaboutdisabling

hardware,seeChapter3,“SecuringSystemHardware.”

ThisisthekindofsimpleUIadministratorsofapublicusecomputerenvironmentcan

usetorestrictaccesstoapplicationsorsitestokeepusersfromperformingmalicious

activities.Itisnotafool-proofsecuritysystemforlocalusers.

InSnowLeopardServer,youuseWorkgroupManagertomanagepreferencesforusers

ofSnowLeopardsystems.

Enhanced

Quarantining

ApplicationsthatdownloadfilesfromtheInternetorreceivefilesfromexternalsources

(suchasmailattachments)canusetheQuarantinefeaturetoprovideafirstlineof

defenseagainstmalicioussoftwaresuchasTrojanhorses.Whenanapplicationreceives

anunknownfile,itaddsmetadata(quarantineattributes)tothefileusingfunctions

foundinLaunchServices.

FilesdownloadedusingSafari,Mail,andiChataretaggedwithmetadataindicating

thattheyaredownloadedfilesandreferringtotheURL,date,andtimeofthe

download.Thismetadataispropagatedfromarchivefilesthataredownloaded(such

asZIPorDMGfiles)sothatanyfileextractedfromanarchiveisalsotaggedwith

thesameinformation.Thismetadataisusedbythedownloadinspectortoprevent

dangerousfiletypesfrombeingopenedunexpectedly.

Thefirsttimeyoutrytorunanapplicationthathasbeendownloaded,Download

Inspectorinspectsthefile,promptsyouwithawarningaskingwhetheryouwant

toruntheapplication,anddisplaystheinformationonthedate,time,andlocation

ofthedownload.

Youcancontinuetoopentheapplicationorcanceltheattempt,whichisappropriate

ifyoudon’trecognizeortrusttheapplication.Afteranapplicationisopened,this

messagedoesnotappearagainforthatapplicationandthequarantineattributes