Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.sys.mac.system > #73086 > unrolled thread

more hardening

Back to article view | Back to comp.sys.mac.system

Contents

  more hardening Electric Comet <electric-comet@mail.invalid> - 2015-04-11 09:06 -0700
    Re: more hardening me@home.spamsucks.ca (Király) - 2015-04-11 16:58 +0000
      Re: more hardening Your Name <YourName@YourISP.com> - 2015-04-12 10:42 +1200
      Re: more hardening Electric Comet <electric-comet@mail.invalid> - 2015-04-12 16:36 -0700
        Re: more hardening David Ritz <dritz@mindspring.com> - 2015-04-12 22:19 -0500
          Re: more hardening Electric Comet <electric-comet@mail.invalid> - 2015-04-13 10:27 -0700
            Re: more hardening David Ritz <dritz@mindspring.com> - 2015-04-13 14:49 -0500
              Re: more hardening nospam <nospam@nospam.invalid> - 2015-04-13 16:40 -0400
    Re: more hardening nospam <nospam@nospam.invalid> - 2015-04-11 14:18 -0400
    Re: more hardening Michael Vilain <vilain@NOspamcop.net> - 2015-04-11 16:21 -0700
      Re: more hardening Your Name <YourName@YourISP.com> - 2015-04-12 14:08 +1200
        Re: more hardening sctvguy1 <sctvguy1@invalid.net> - 2015-04-12 03:41 +0000
      Re: more hardening Huge <Huge@nowhere.much.invalid> - 2015-04-12 10:02 +0000
        Re: more hardening Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-04-12 16:01 +0000
      Re: more hardening gtr <xxx@yyy.zzz> - 2015-04-12 08:17 -0700
      Re: more hardening Electric Comet <electric-comet@mail.invalid> - 2015-04-12 16:46 -0700
        Re: more hardening Your Name <YourName@YourISP.com> - 2015-04-13 13:09 +1200
        Re: more hardening Michael Vilain <vilain@NOspamcop.net> - 2015-04-13 09:48 -0700
    Re: more hardening Alan Browne <alan.browne@freelunchvideotron.ca> - 2015-04-12 09:34 -0400

#73086 — more hardening

for an imac there are processes running that are not needed, like wifi

I think I can unload modules or something like that but wanted to
find out if there's an app or some script someone might share that
could disable things based on a list of what's running and what's
not neeeded

this a snow leopard subscriber















 

[toc] | [next] | [standalone]

#73087

Electric Comet <electric-comet@mail.invalid> wrote:
> for an imac there are processes running that are not needed, like wifi
> 
> I think I can unload modules or something like that but wanted to
> find out if there's an app or some script someone might share that
> could disable things based on a list of what's running and what's
> not neeeded
> 
> this a snow leopard subscriber

Why are you wanting to do this? To save electricity? To make your Mac 
run faster? As an academic exercise? Messing around with this kind of 
stuff "just because" is almost always a mistake.

You can turn wi-fi off in the Network system pref pane.

-- 
K.

Lang may your lum reek.

[toc] | [prev] | [next] | [standalone]

#73110

In article <mgbjs2$32l$1@dont-email.me>, Király <me@home.spamsucks.ca>
wrote:
> Electric Comet <electric-comet@mail.invalid> wrote:
> > for an imac there are processes running that are not needed, like wifi
> > 
> > I think I can unload modules or something like that but wanted to
> > find out if there's an app or some script someone might share that
> > could disable things based on a list of what's running and what's
> > not neeeded
> > 
> > this a snow leopard subscriber
> 
> Why are you wanting to do this? To save electricity? To make your Mac 
> run faster? As an academic exercise? Messing around with this kind of 
> stuff "just because" is almost always a mistake.

Because he's a tin-foil-hat-wearer who doesn't want people (somehow
magically) accessing his Mac.




> You can turn wi-fi off in the Network system pref pane.

Yep, but he's a Linux-nerd, so doing something the easy way is beyond
him. He'd rather muck about in Terminal and take five times longer to
achieve the same result.

[toc] | [prev] | [next] | [standalone]

#73182

On Sat, 11 Apr 2015 16:58:42 +0000 (UTC)
me@home.spamsucks.ca (Király) wrote:

> You can turn wi-fi off in the Network system pref pane.

Did that but still see some stuff
think it was airport or something like that still running

also notice that there are processes running for users that are not
even logged in
gnupg or gpg or something like that
















 

[toc] | [prev] | [next] | [standalone]

#73189

[Multipart message — attachments visible in raw view] — view raw

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Sunday, 12 April 2015 16:36 -0700, 
 in article <mgevks$ks1$1@dont-email.me>, 
 Electric Comet <electric-comet@mail.invalid> wrote:

> On Sat, 11 Apr 2015 16:58:42 +0000 (UTC)
> me@home.spamsucks.ca (Király) wrote:

>> You can turn wi-fi off in the Network system pref pane.

> Did that but still see some stuff think it was airport or something 
> like that still running

> also notice that there are processes running for users that are not 
> even logged in gnupg or gpg or something like that

GnuPG is not stock Mac software.

The versions I run are built from Mac package managers.  GnuPG can 
also be manually built from source.  There's even a GUI installer, 
with additional management tools, called MacGPG.

So, when you got your pre-owned Mac, had the previous owner installed 
it, perhaps?  Might you benefit from a clean install of the OS?  You 
could do this, before upgrading to OS X 10.10.3, you know.  Just be 
sure you have a current, full backup.

Currently, user 501 is running 163 process, four of which are 
associated with gpg and four associated with PGP.  User 0 is running 
an additional 129, under Yosemite 10.10.3.  Thingsseems pretty peppy, 
with a total of ~420 processes running on this late 2009 MacMini, with 
its 2.53 GHz Intel Core 2 Duo processor, 8 GB 1067 MHz DDR3 and a 480 
GB SSD boot drive.

If you really want to know what's running, use 
/Applications/Utilities/Activity\ Monitor.app.  As an alternative, you 
can use /bin/ps, just as one would running Linux, or any POSIX-compliant or 
_mostly_ POSIX-compliant OS.

> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
>  
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 

Fascinating.

- -- 
David Ritz <dritz@mindspring.com>
 "An empty head is not really empty; it is stuffed with rubbish. Hence
  the difficulty of forcing anything into an empty head."
                                               - Eric Hoffer (1902-83)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iEYEARECAAYFAlUrNdwACgkQUrwpmRoS3uuOpgCg4z56tPSYy0/R/MBnlJnJ15j5
M+MAn2tH7jF0VYf1TSSck6S7Dj8dDP4i
=5yGd
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#73204

On Sun, 12 Apr 2015 22:19:56 -0500
David Ritz <dritz@mindspring.com> wrote:

> Currently, user 501 is running 163 process, four of which are 
> associated with gpg and four associated with PGP.  User 0 is running 

it's stock far as i know so must be PGP that I noticed
it surprised me to see procs running for users not logged in

this system may get upgrade to latest yoesmite after all
so then a new set of problems to look into











 

[toc] | [prev] | [next] | [standalone]

#73208

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Monday, 13 April 2015 10:27 -0700, 
 in article <mgguc3$mr1$1@dont-email.me>, 
 Electric Comet <electric-comet@mail.invalid> wrote:

> On Sun, 12 Apr 2015 22:19:56 -0500
> David Ritz <dritz@mindspring.com> wrote:

>> Currently, user 501 is running 163 process, four of which are 
>> associated with gpg and four associated with PGP.  User 0 is 
>> running

> it's stock far as i know so must be PGP that I noticed it surprised 
> me to see procs running for users not logged in

Sorry, but it's not going to be PGP, either.  Regardless the version, 
PGP requires installation.  The same is true for OpenPGP.  

> this system may get upgrade to latest yoesmite after all so then a 
> new set of problems to look into

You know, with all the bitching and moaning -- some quite loud and 
obnoxious from the most technically inept -- upgrading to OS X 
10.10.3, on two boxes, from 10.10.2, went more smoothly than any other 
similar upgrade I can recall.

The whining about Photos seems to be just that, while iPhoto was aimed 
at the smartphone-camera crowd, Apeture was aimed not at the advanced 
enthusist or professional, it was designed for the point & shoot user, 
who wanted some additional editing options.  Photos actually fills 
both these markets rather nicely.

Gimp is a free, open source image editor.  GraphicConverter (paid) is 
a long term favorite for basic adjustments and things like automated 
file conversions and processing.  The Adobe offerings go well beyond 
these and are specifically designed for image and graphic 
professionals.

So far as hardening is concerned, there is a smaller percentage of 
compromised Macs, than either Windows or Linux boxes connected to the 
Internet, judging by the malicious botnet activity I see.

- -- 
David Ritz <dritz@mindspring.com>
 Be kind to animals; kiss a shark.

-----BEGIN PGP SIGNATURE-----
Version: 10.2.0.1672

wj8DBQFVLB1VUrwpmRoS3usRApXUAJ4u1OmKPKzCGNJz1pUulK0YVgzzdQCfbXJf
dLn1w0ow31US8E61EHJto/E=
=HAi2
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#73209

In article <alpine.OSX.2.20.1504131359090.20380@mako.ath.cx>, David
Ritz <dritz@mindspring.com> wrote:

> The whining about Photos seems to be just that, while iPhoto was aimed 
> at the smartphone-camera crowd, Apeture was aimed not at the advanced 
> enthusist or professional, it was designed for the point & shoot user, 
> who wanted some additional editing options.  Photos actually fills 
> both these markets rather nicely.

aperture absolutely was aimed at the advanced enthusiast or
professional.

iphoto was aimed at the p&s crowd and predates smartphone cameras.

[toc] | [prev] | [next] | [standalone]

#73093

In article <mgbgsn$hua$3@dont-email.me>, Electric Comet
<electric-comet@mail.invalid> wrote:

> for an imac there are processes running that are not needed, like wifi

not when you turn it off, it isn't.

[toc] | [prev] | [next] | [standalone]

#73117

In article <mgbgsn$hua$3@dont-email.me>,
 Electric Comet <electric-comet@mail.invalid> wrote:

> for an imac there are processes running that are not needed, like wifi
> 
> I think I can unload modules or something like that but wanted to
> find out if there's an app or some script someone might share that
> could disable things based on a list of what's running and what's
> not neeeded
> 
> this a snow leopard subscriber
> 

I suspect this is a Linux or former Mainframe user who's now using a Mac 
and a rather old version of MacOS at that.  I still run SL because I 
still use MW and won't go to Unison.

My advise to this person is "Anything you disable in /System you do so 
at your own risk".  Apple puts stuff in there for a reason (i.e. "it's 
our system and we do what we want with it").  Disable it and a feature 
or function of MacOS may stop working and not in a graceful way.

If this person wants to do a security audit on Mac OS, they're in for a 
long haul if they're outside Apple.  A presentation to the SJ school 
district about security and using computers in the classroom had Apple 
essentially laughed out of the room.  iPad and Mac OS are so closed that 
when asked how secure against specific threats (the tech person had a 
laundry list that the district had recently had to deal with), the Apple 
marketing droid realized they were never going to get the sale and 
didn't bother following up with the guy.

If the SL subscriber wants security, try Linux.

-- 
DeeDee, don't press that button!  DeeDee!  NO!  Dee...
[I filter all Goggle Groups posts, so any reply may be automatically ignored]

[toc] | [prev] | [next] | [standalone]

#73142

In article <vilain-B7A0EF.16212211042015@news.individual.net>, Michael
Vilain <vilain@NOspamcop.net> wrote:
> 
<snip>
>  
> A presentation to the SJ school district about security and using 
> computers in the classroom had Apple essentially laughed out of the
> room.  iPad and Mac OS are so closed that when asked how secure against 
> specific threats (the tech person had a laundry list that the district
> had recently had to deal with), the Apple marketing droid realized they
> were never going to get the sale and didn't bother following up with the
> guy.

Easy: It ain't Windoze!

The likelihood is that NONE of those supposed "threats" were applicable
to Apple equipment.  

The biggest "threat" to computers in the classroom is the kids -
stealing them, dropping them, losing them, shoving rubbish into the
slots, etc. That's easily fixed by banning kids from schools.  ;-)

[toc] | [prev] | [next] | [standalone]

#73156

On Sun, 12 Apr 2015 14:08:19 +1200, Your Name wrote:

> In article <vilain-B7A0EF.16212211042015@news.individual.net>, Michael
> Vilain <vilain@NOspamcop.net> wrote:
>> 
> <snip>
>>  
>> A presentation to the SJ school district about security and using
>> computers in the classroom had Apple essentially laughed out of the
>> room.  iPad and Mac OS are so closed that when asked how secure against
>> specific threats (the tech person had a laundry list that the district
>> had recently had to deal with), the Apple marketing droid realized they
>> were never going to get the sale and didn't bother following up with
>> the guy.
> 
> Easy: It ain't Windoze!
> 
> The likelihood is that NONE of those supposed "threats" were applicable
> to Apple equipment.
> 
> The biggest "threat" to computers in the classroom is the kids -
> stealing them, dropping them, losing them, shoving rubbish into the
> slots, etc. That's easily fixed by banning kids from schools.  ;-)

As a retired HS teacher, I know that kids can f**k up any piece of 
technology that the school owns, but God forbid they would do it to their 
own stuff!

[toc] | [prev] | [next] | [standalone]

#73162

On 2015-04-11, Michael Vilain <vilain@NOspamcop.net> wrote:

> My advise to this person is "Anything you disable in /System you do so 
> at your own risk".  Apple puts stuff in there for a reason (i.e. "it's 
> our system and we do what we want with it").  

Then they need disavowing of this attitude.

-- 
Today is Boomtime, the 29th day of Discord in the YOLD 3181
                  I don't have an attitude problem.
    If you have a problem with my attitude, that's your problem.

[toc] | [prev] | [next] | [standalone]

#73177

In message <couu5pFu33nU3@mid.individual.net> 
  Huge <Huge@nowhere.much.invalid> wrote:
> On 2015-04-11, Michael Vilain <vilain@NOspamcop.net> wrote:

>> My advise to this person is "Anything you disable in /System you do so 
>> at your own risk".  Apple puts stuff in there for a reason (i.e. "it's 
>> our system and we do what we want with it").  

> Then they need disavowing of this attitude.

Good luck with that.


-- 
People only think for themselves if you tell them to.

[toc] | [prev] | [next] | [standalone]

#73172

On 2015-04-11 23:21:22 +0000, Michael Vilain said:

> I still run SL because I still use MW and won't go to Unison.

Pardon for trying to clarify: You have remained with the Snow Leopard 
OS because of software you use to access usenet?

[toc] | [prev] | [next] | [standalone]

#73185

On Sat, 11 Apr 2015 16:21:22 -0700
Michael Vilain <vilain@NOspamcop.net> wrote:

> Mac and a rather old version of MacOS at that.  I still run SL
> because I still use MW and won't go to Unison.

the mac came with SL

> If the SL subscriber wants security, try Linux.

this is meaningless because there are vulnerabilities everywhere
reducing the complexity of any system should help to make it
less target rich

I guess aapple does what they want because the OS is a subscription
















 

[toc] | [prev] | [next] | [standalone]

#73186

In article <mgf068$ks1$2@dont-email.me>, Electric Comet
<electric-comet@mail.invalid> wrote:
> On Sat, 11 Apr 2015 16:21:22 -0700
> Michael Vilain <vilain@NOspamcop.net> wrote:
> 
> > Mac and a rather old version of MacOS at that.  I still run SL
> > because I still use MW and won't go to Unison.
> 
> the mac came with SL
> 
> > If the SL subscriber wants security, try Linux.
> 
> this is meaningless because there are vulnerabilities everywhere
> reducing the complexity of any system should help to make it
> less target rich
> 
> I guess aapple does what they want because the OS is a subscription

It's a Mac ... so there is no "target", no real way you'll ever get
malware, and extremely unlikely you're important enough to bother
trying to hack into. Stop pointlessly wasting your time and effort (as
well as newsgroup bandwidth) and simply use the computer.   :-\

[toc] | [prev] | [next] | [standalone]

#73199

In article <mgf068$ks1$2@dont-email.me>,
 Electric Comet <electric-comet@mail.invalid> wrote:

> On Sat, 11 Apr 2015 16:21:22 -0700
> Michael Vilain <vilain@NOspamcop.net> wrote:
> 
> > Mac and a rather old version of MacOS at that.  I still run SL
> > because I still use MW and won't go to Unison.
> 
> the mac came with SL
> 
> > If the SL subscriber wants security, try Linux.
> 
> this is meaningless because there are vulnerabilities everywhere
> reducing the complexity of any system should help to make it
> less target rich
> 
> I guess aapple does what they want because the OS is a subscription

Actually, because Apple has taken responsibility for hardening their 
systems, they pick and choose what they want to deal with.  If you're 
enough of a Mac guru to do your own parallel work and publish it to the 
net, great.

But they won't update their older systems.  A known root exploit was 
recently patched in 10.10.3.  It's probably there in SL and all up to 
earlier versions of Yosemite.  Apple did a security patch for 10.8 and 
10.9 but I don't know if it dealt with that exploit specifically.

My point is that because Linux has so many people working on it and it's 
been around for at least as long as Apple, when an exploit occurs --I 
thinking shellshock and recent GHOST glibc exploits--they were patched 
for major distros pretty quickly.

We're running an ancient, unsupported version of Fedora and there's not 
patch for these exploits.  But if I wanted to take the RPMs for other 
distros and backrev it, I could.  But the RedHat 5 boxes had patches 
within days for both exploits.

Apple does what they want when they want.  

It it could be worse.  The subscriber could be running Windows Vista.

-- 
DeeDee, don't press that button!  DeeDee!  NO!  Dee...
[I filter all Goggle Groups posts, so any reply may be automatically ignored]

[toc] | [prev] | [next] | [standalone]

#73166

On 2015-04-11 12:06, Electric Comet wrote:
>
> for an imac there are processes running that are not needed, like wifi

Just turn it off in preferences.

> I think I can unload modules or something like that but wanted to
> find out if there's an app or some script someone might share that
> could disable things based on a list of what's running and what's
> not neeeded

WiFi is probably so intertwined with other things that it's not 
practical to 'unload' it.

[toc] | [prev] | [standalone]

Back to top | Article view | comp.sys.mac.system

csiph-web