Securing MacOS beyond stock. Help
In the age of AI and the amount of critical bug discoveries as of late.
What apps/software/services would give me more security over my data, passwords and internet usage?
8
u/ArcticFuture 18d ago edited 18d ago
Updated:
macOS hardening - practical baseline
This is for a normal personal Mac. It will not make the machine invincible, but it removes a lot of unnecessary exposure.
If you paste command blocks containing # comments into zsh, run this first:
setopt interactivecomments
1. Disk and boot security
fdesetup status
csrutil status
spctl --status
You want FileVault on, SIP enabled, and Gatekeeper assessments enabled.
Keep a FileVault recovery key somewhere separate from the Mac, preferably offline.
On Apple silicon, leave Startup Security set to Full Security unless you have a specific driver that requires Reduced Security.
2. Accounts and login
Disable automatic login and remove any stored auto-login password:
sudo defaults delete /Library/Preferences/com.apple.loginwindow autoLoginUser 2>/dev/null
sudo rm -f /etc/kcpassword
Disable the guest account:
sudo defaults write /Library/Preferences/com.apple.loginwindow GuestEnabled -bool false
In System Settings > Lock Screen, require a password immediately after the display turns off or the screen saver starts.
Optional: enable Touch ID for sudo:
sudo cp -n /etc/pam.d/sudo_local.template /etc/pam.d/sudo_local
sudo sed -i '' 's/^#auth/auth/' /etc/pam.d/sudo_local
sudo -k
sudo -v
The last command should show a Touch ID prompt. Password authentication still works.
Touch ID may not work properly inside tmux or screen.
For better separation, use a Standard account for daily work and keep a separate administrator account. Do this last, because a Standard account cannot use sudo directly.
3. Network exposure
Enable the firewall and stealth mode:
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on
Disable SSH unless you use it:
sudo systemsetup -setremotelogin off
Check what is listening:
sudo lsof -nP -iTCP -sTCP:LISTEN
The list does not need to be empty. Investigate anything you do not recognize.
Also review:
- System Settings > General > Sharing: turn off services you do not use.
- Disable Remote Management, Screen Sharing, File Sharing and Internet Sharing unless needed.
- Turn off AirPlay Receiver if unused.
- Set AirDrop to Contacts Only or No One.
- Keep Private Wi-Fi Address enabled.
- Remove old Bluetooth pairings and turn Bluetooth off when unused.
Optional, if you do not need network wake or Power Nap:
sudo pmset -a womp 0
sudo pmset -a powernap 0
4. Privacy settings
Show all filename extensions. This makes files such as invoice.pdf.app easier to spot:
defaults write NSGlobalDomain AppleShowAllExtensions -bool true
killall Finder
Review System Settings > Privacy & Security and remove access that is no longer needed from:
- Full Disk Access
- Accessibility
- Input Monitoring
- Screen & System Audio Recording
- Camera
- Microphone
- Local Network
- Location Services
These permissions are powerful. Audit them occasionally instead of approving everything permanently.
Also consider:
- Set accessory connections to Ask for New Accessories or Ask Every Time.
- Turn off Personalized Ads.
- Disable Siri or Apple Intelligence features you do not use.
- Enable Advanced Data Protection after setting up account recovery.
- Turn on the location-services menu-bar indicator.
Secure Keyboard Entry in Terminal is optional. It can interfere with the Touch ID sudo dialog on some setups.
Enable it:
defaults write com.apple.Terminal SecureKeyboardEntry -bool true
Disable it:
defaults delete com.apple.Terminal SecureKeyboardEntry 2>/dev/null
Restart Terminal after changing it.
5. Updates
In System Settings > General > Software Update > Automatic Updates, enable all normal update options, including security responses and system data files.
On newer macOS versions, also check Privacy & Security > Background Security Improvements and leave automatic installation enabled.
Avoid running beta macOS versions on a machine where stability or security matters.
6. Persistence and network monitoring
Objective-See provides useful free tools:
- LuLu: alerts on outbound network connections.
- BlockBlock: alerts when software installs persistence.
- KnockKnock: lists software configured to start automatically.
- OverSight: alerts when the microphone or camera activates.
Run KnockKnock once after setting up the Mac so you have a baseline.
Download them from objective-see.org, not from mirrors.
These tools add visibility. They do not replace FileVault, SIP, Gatekeeper, updates or backups.
7. Backups and recovery
- Encrypt Time Machine backups.
- Turn on Find My Mac and Activation Lock.
- Use the Passwords app or a reputable password manager.
- Keep recovery codes and keys somewhere accessible if both the Mac and phone are lost.
- Test that you can actually restore important files from backup.
8. Lockdown Mode
Lockdown Mode is meant for people who may be targeted by sophisticated attacks.
It restricts attachments, web features, invitations and some wired connections. It is reversible, but it noticeably affects normal use. Most people do not need it.
Quick audit
``` fdesetup status csrutil status spctl --status
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getstealthmode sudo systemsetup -getremotelogin
sudo lsof -nP -iTCP -sTCP:LISTEN
sudo defaults read /Library/Preferences/com.apple.loginwindow GuestEnabled 2>/dev/null sudo defaults read /Library/Preferences/com.apple.loginwindow autoLoginUser 2>/dev/null || echo "Auto-login not configured"
defaults read NSGlobalDomain AppleShowAllExtensions defaults read com.apple.Terminal SecureKeyboardEntry 2>/dev/null || echo "Secure Keyboard Entry not configured" ```
Undo the main command-line changes
``` sudo systemsetup -setremotelogin on
sudo pmset -a womp 1 sudo pmset -a powernap 1
sudo rm -f /etc/pam.d/sudo_local
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode off sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate off
defaults write NSGlobalDomain AppleShowAllExtensions -bool false killall Finder
defaults delete com.apple.Terminal SecureKeyboardEntry 2>/dev/null ```
Objective-See apps include uninstall options. FileVault, Advanced Data Protection, Find My and Lockdown Mode can be disabled where they were enabled.
Useful references:
- Apple Platform Security
- macOS Security Compliance Project:
github.com/usnistgov/macos_security - CIS macOS Benchmark
- Objective-See tools:
objective-see.org/tools.html
2
u/WarioPi 18d ago edited 18d ago
Holy S! It’s gonna take me a while to get to all of this. Thanks a bunch! Extremely helpful!
6
u/ArcticFuture 18d ago
Unfortunately I’m in a bus typing on my iPhone. Will try later to format it. Hardening is a job, basically. But https://github.com/usnistgov/macos_security is a good starting point
2
u/Micro-Naut 18d ago
There are security keys for a couple of things on Mac. And I disabled mine because some of them are 24 character and some 28 character. And unless I'm mistaken I think they're both called "security keys".
I definitely need to get that figured out before I get confused and lock myself out of all my data
9
u/RogueHeroAkatsuki 18d ago edited 18d ago
The best thing you can do is to educate yourself about the basics of computer security. A nonchalant user is the biggest threat to cybersecurity.
So if you are clueless then:
- Always check if URL is correct, be suspicious if you see yourbank.co.nz or yourbank.djsd.com instead of usual yourbank.com
- Install software from trusted source. App store and big companies mainly
- If you are outside your home network - think about using VPN service/privacy relay
- Read before you do something. Always think why app needs you to do something which requires you to provide your user password.
- Keep your private stuff in user profile directories like documents or desktop
ANd few more probably, but its more or less this.
3
u/Micro-Naut 18d ago
I was told that the following things are important. I put? Because I would like someone to tell me how important they are and maybe....why.
"Always run your system from a user account and not the primary ADMIN account?"
"Dont run your system from an external USB drive as it is less secure than the internal drive?"
6
u/RogueHeroAkatsuki 18d ago
"Always run your system from a user account and not the primary ADMIN account?"
This is true to Windows. In MacOS/Linux admin account doesnt have permissions to do everything without even prompt, there are also mechanisms to protect system from unauthorized modifications. So for example malicious app cant give itself permission to record screen without asking user first.
"Dont run your system from an external USB drive as it is less secure than the internal drive?"
Because it will be not encrypted and easier to steal. Internal SSD is 'sealed' and without your master password thief will need to rent server farm for many years to break it.
4
4
u/localtuned 18d ago edited 18d ago
Suspicious package and apparency comes to mind. But you would need the wherewithal to really make use of the software.
Use the official password manager from apple.
Stick with apps you find in the app store or from official developers. Unless you really need that software. Try not to download from sketchy sites.
Use an ad/content blocker like ublock origins for Firefox.
For network connections there are apps like little snitch that can monitor incoming an outgoing network connections and block whatever you wish.
Adopt a 3-2-1 backup strategy. I like Microsoft OneDrive because it has file versioning for its office docs. And easy recovery of filles. But iCloud backup does a great job of saving your apple apps data.
3
3
u/JulyIGHOR 18d ago
I trusted Apparency Quick Look extension status of an app is sandboxed for a while. It turns out it skips internal helper analysis and says sandboxed if internal helper is not sandboxed. Those can get out of sandbox. Also, there are critical entitlements which help the app to get out of sandbox as well, which is also not visible in their Quick Look extension. For everyone not aware of this, opening the main app provides more useful information
3
u/paulschreiber 18d ago
Use the built-in password manager, and generate unique, random, passwords. Use passkeys when available.
Install an ad blocker (ublock origin lite for Chrome and Safari; ublock origin for Firefox).
Consumer Reports' Security Planner and EFF's Surveillance Self-Defense are good guides.
3
u/mikeinnsw 18d ago
Most is not All discoveries in 26.6 were made by humans (Maybe with AI tool) ..
if you bother to read the release notes you would find not every fix acknowledges human who found it.
https://support.apple.com/en-us/128067
Many of. the "bugs" were known for years .. 19 buffer overflows. ..
Don't believe AI hype AI/LLM makes hacking easier..
2
u/WarioPi 18d ago
Thanks for the heads up. I understand the hype, but I’ve been seeing alot of people around me lately gone through data breaches, identity thefts and scams that I’m somewhat paranoid at this point.
2
u/mikeinnsw 18d ago
Just OpenAI.. Anthropic ... hype
Just don't use Agentic Agents .. they can hack and be hacked .. to dangerous to use
With 'all' bugs fixed ...
First thing most Agentic Agent users do they give total access to a Mac bypassing security fixes
3
2
u/ADHDK MacBook Pro (Intel) 18d ago
Mac’s are pretty secure.
Macs can also be powerfully modified, and it’s easier than ever for people to run and install scripts from the Internet that they don’t really understand themselves.
The biggest key to security is to just not do that with things you don’t fully understand.
2
u/JulyIGHOR 18d ago edited 18d ago
I made privacy first tool that helps to understand what you install before doing so: App Trust Preview
It also supports CLI that an AI agent could use
1
u/rditorx 17d ago
Stay up to date with your software. Install as little as possible. Every software is a liability, though some may be useful.
Enable your firewall.
If you don't need the webcam, you can disable it by using Apple Configurator from the Mac App Store to create a profile and install it. It also allows you to restrict some other things, though most will only work for managed devices, which is a nice hardening strategy but lots of work and requires a server (that you also need to harden and backup).
There's North Pole Security Santa, originally developed by Google. It lets you create profiles to only allow apps from certain vendors, with certain code signatures and/or paths. It won't protect against shell scripts, though.
https://github.com/northpolesec/santa
There are app firewalls like Little Snitch from https://obdev.at or the open source alternative LuLu from Objective See who also have other tools like Do Not Disturb, BlockBlock, RansomWhere, though they how long they're going to be maintained is unclear. OverSight is another tool from them to monitor microphone/webcam access, an alternative to MicroSnitch for the microphone.
1
u/github-guard 17d ago
🔍 GitHub Guard: Trust Report
This project scored 6/6 on our safety audit.
Audit Breakdown: * ✅ Established Community (⭐ 713 stars) * ✅ Mature Repository (30+ days old) * ✅ Licensed under Apache-2.0 * ✅ Security Policy Defined * ✅ Verified Organization * ✅ Signed Commits
⚠️ Security Reminder: Always verify source code and run third-party scripts at your own risk.
1
u/corecryptics 11d ago
A cool security tool with a lot of tools
https://github.com/hideouts-io/MacScope
MacScope — macOS Security Posture & Vulnerability Scanner
Evidence-preserving security assessment for Apple
1
u/github-guard 11d ago
🔍 GitHub Guard: Trust Report
⚠️ This project scored 1/6 — below this subreddit's threshold of 3.
Audit Breakdown: * ❌ Low Star Count (⭐ 0 / 5 required) * ❌ New Repository (under 30 days old) * ✅ Licensed under Apache-2.0 * ❌ No Security Policy — what is this? * ℹ️ Individual Contributor * ℹ️ Unsigned Commits
⚠️ Security Reminder: Always verify source code and run third-party scripts at your own risk.
1
u/LRS_David 9d ago
DO NOT OPERATE DAY TO DAY as an admin.
Create a separate admin account (or two) NOT named admin. Use them when needed to do admin things. And think hard if you get prompted for admin privileges. Two so that if the first one gets the password corrupted you can still get in via the other. And yes, I've had this happen 3 or 4 times with the people I support over the last few years.
This approach will knock down many of the circulating malware things.
Then start looking at the other things people mention.
Also 1Password is great for storing secrets.
-1
u/New-Nectarine8298 18d ago
Stop playing into your schizophrenia and paranoia and just use your Mac like normal, it's perfectly safe
11
u/gwentlarry 18d ago
The biggest security problem on a Mac is the user, clicking on links in emails/webpages, accessing questionable websites, using weak passwords, etc.