macos-hardening

commands

sudo scutil --set ComputerName MacBook && \
sudo scutil --set LocalHostName MacBook && \
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on && \
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setloggingmode on && \
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on && \
sudo pkill -HUP socketfilterfw && \
curl https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts | sudo tee -a /etc/hosts && \
rm -rfv ~/Library/LanguageModeling/* ~/Library/Spelling/* ~/Library/Suggestions/* && \
chmod -R 000 ~/Library/LanguageModeling ~/Library/Spelling ~/Library/Suggestions && \
chflags -R uchg ~/Library/LanguageModeling ~/Library/Spelling ~/Library/Suggestions && \
rm -rfv ~/Library/Assistant/SiriAnalytics.db && \
chmod -R 000 ~/Library/Assistant/SiriAnalytics.db && \
chflags -R uchg ~/Library/Assistant/SiriAnalytics.db

what does it do?

  1. computer and local hostname become macbook
  2. block ads using custom host files /StevenBlack/hosts/master/hosts
  3. clear and disable siri, telemetry and modification
  4. lock down data collection

more commands (it breaks icloud syncing)

sudo mdutil -i off ~/Documents && sudo mdutil -i off ~/Desktop && sudo mdutil -i off ~/Downloads && sudo mdutil -i off ~/Library/Mail && sudo mdutil -i off ~/Library/Messages && sudo mdutil -i off ~/Library/Calendars && sudo mdutil -i off ~/Library/Contacts && \
sudo mdutil -E ~/Documents && sudo mdutil -E ~/Desktop && sudo mdutil -E ~/Downloads && sudo mdutil -E ~/Library/Mail && sudo mdutil -E ~/Library/Messages && sudo mdutil -E ~/Library/Calendars && sudo mdutil -E ~/Library/Contacts

sudo systemsetup -setremoteappleevents off && \
sudo systemsetup -setremotelogin off && \
sudo launchctl unload -w "/System/Library/LaunchDaemons/com.apple.smbd.plist" && \
sudo defaults write "/Library/Application Support/CrashReporter/DiagnosticMessagesHistory.plist" AutoSubmit -bool false && \
sudo defaults write "/Library/Application Support/CrashReporter/DiagnosticMessagesHistory.plist" AutoSubmitVersion -int 4
  1. disable crash report sending to remote server
  2. disable ssh
  3. lock down contacts, calendars