Authors: Adam Gray cism
|
|  Yüklə 279 Kb.
|
Securing the System Administrator AccountNot to be confused with an administrator account, the system administrator account is the account with UID 0 and a shortname of root. From here on, this document will be referring to this account as root, or the root account. By default, root is disabled in OS X client but enabled on OS X Server. This is a good thing on OS X Client, as this account has full privileges to do anything on the system. As already discussed in this section, OS X has a more restricted and complex method for administration. Root reduces that complexity and granularity to simply provide administrative access. Note: User and group management is different in Mac OS X than in a standard Unix environment. In Mac OS X 10.5 and above Apple migrated to storing account information in property list files, similar to an /etc/passwd file but with each account having their own file. This includes service accounts, signified by having names that start with an underscore (_) and user accounts. User accounts are located at /var/db/dslocal/nodes/Default/Users. Groups are located at /var/db/dslocal/nodes/Default/Groups. You can delete unused accounts by removing them from the directory structure or by using the Accounts System Preference Pane. You can also redirect a users home folder, restrict shell access, change short names, change UIDs and change default groups (eg – for umask) using these files (although you should do so with caution), Service accounts, by default, do not have passwords associated with them. You can assign a password to a service account using the –passwd extension to the dscl command. In Mac OS X the shadow directory is located in /var/db/shadow/hash. In this directory you will find the encrypted password hashes for any accounts with a password associated with them. The accounts are listed with the GeneratedUID as the naming convention. To find the GeneratedUID for any account you can use dscl to read the account property list. A disabled user may not mean the same thing as in other operating systems. In the Mac OS X context, disabled means that another account has to be privileged (essentially root) to use the account. Disabled accounts are still defined and root uses disabled accounts all the time to run background processes. Most application-oriented accounts like apache, sshd, and mysql are disabled with no password defined and no way to switch a non-root user to them. While direct root access is limited on OS X, the kernel starts launchd as root during boot up. If you’re a UNIX aficionado, you can relate launchd to init (although Mac OS X uses init as well, it should not be used so as not to have software updates overwrite your additions to init). Most UNIX distributions use init, and earlier versions of OS X did as well. Root also owns files with the Set User ID (SUID) bit turned on (SUID is explained further in the File Permissions section). Accounts with permission to execute SUID files execute them with the authority of the owning user. This explains how sudo and Mac OS X’s GUI authorization prompt work. Apple provides a way to administer OS X without becoming root, and allows you to do things as root using sudo. When root is disabled, an attacker is unable to gain root privileges by brute forcing root’s password, because the password doesn’t exist and no mechanism to log in as root exists. If root is enabled then it is possible to attempt to guess the root password, or change it by booting a computer to a CD and resetting the password. It is recommended to leave root disabled. But if you need to enable it (and you likely will to do some of the tasks in this checklist) it can be done by:
Note: If root is enabled, and you want to disable it, follow the same steps above, only the option under Security will be Disable root User. The root account should be disabled when it is not required. Note: Whereas root itself may be disabled you can still use sudo bash to gain a privileged session while in Terminal. Software InstallationInstalling software can be dangerous provided you do not obtain your software from a trusted source. Therefore, Mac OS X 10.5 provides digital signing for all software installed. Additionally, when software that is obtained from the Internet is run for the first time you will now be prompted with a dialog box that states what site the software was obtained from and you must specifically allow the software to then be able to be run.
Much of the behavior of Mac OS X is controlled by options in the System Preferences. Only the System Preferences that impact security are described in this section. To increase the system preferences security:
At the array of icons each represents a different category of System Preferences. Each of the subsections below corresponds to one of those categories. Click once on an icon to bring up its preference pane. To get back to the menu:
AppearanceTo prevent unauthorized access to recently-accessed applications, documents, and servers:
A locking screen saver can be used to reduce the risk of an intruder accessing the console of an unattended computer (see the next section). To avoid accidentally disabling the screensaver, make sure no hot corners are set to do so. To enable quickly putting the computer to sleep so it’s locked:
|