Initial commit: Complete macOS dotfiles system
🖖 Features: - Master 'engage' script for one-command setup - 120+ CLI tools via Homebrew - 40+ Applications (casks + MAS apps) - Complete macOS system configuration - Security hardening and privacy settings - Obsidian knowledge vault setup - Comprehensive backup strategies - Automated symlink management Live long and prosper\! 🚀 🤖 Generated with Claude Code (https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
David F Glidden
Executable
+152
@@ -0,0 +1,152 @@
|
||||
#!/usr/bin/env bash
|
||||
# macOS Security Settings
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
echo "Configuring macOS security settings..."
|
||||
|
||||
# Ask for admin password upfront
|
||||
sudo -v
|
||||
|
||||
# =============================================================================
|
||||
# Screen Security
|
||||
# =============================================================================
|
||||
|
||||
# Require password immediately after sleep or screen saver begins
|
||||
defaults write com.apple.screensaver askForPassword -int 1
|
||||
defaults write com.apple.screensaver askForPasswordDelay -int 0
|
||||
|
||||
# Set screen saver to start after 10 minutes of inactivity
|
||||
defaults -currentHost write com.apple.screensaver idleTime -int 600
|
||||
|
||||
# =============================================================================
|
||||
# Firewall
|
||||
# =============================================================================
|
||||
|
||||
# Enable firewall
|
||||
sudo defaults write /Library/Preferences/com.apple.alf globalstate -int 1
|
||||
|
||||
# Enable firewall stealth mode (don't respond to ICMP ping requests or closed TCP/UDP ports)
|
||||
sudo defaults write /Library/Preferences/com.apple.alf stealthenabled -int 1
|
||||
|
||||
# Enable firewall logging
|
||||
sudo defaults write /Library/Preferences/com.apple.alf loggingenabled -int 1
|
||||
|
||||
# =============================================================================
|
||||
# Privacy & Tracking
|
||||
# =============================================================================
|
||||
|
||||
# Disable location services for system services
|
||||
sudo defaults write /var/db/locationd/Library/Preferences/ByHost/com.apple.locationd LocationServicesEnabled -bool false
|
||||
|
||||
# Disable analytics & improvements
|
||||
defaults write com.apple.SubmitDiagInfo AutoSubmit -bool false
|
||||
defaults write com.apple.applicationaccess.plist com.apple.applicationaccess.feedback -bool false
|
||||
|
||||
# Disable personalized ads
|
||||
defaults write com.apple.AdLib forceLimitAdTracking -bool true
|
||||
|
||||
# =============================================================================
|
||||
# Safari Security (if Safari is used)
|
||||
# =============================================================================
|
||||
|
||||
# Enable "Do Not Track"
|
||||
defaults write com.apple.Safari SendDoNotTrackHTTPHeader -bool true
|
||||
|
||||
# Block pop-up windows
|
||||
defaults write com.apple.Safari WebKitJavaScriptCanOpenWindowsAutomatically -bool false
|
||||
defaults write com.apple.Safari com.apple.Safari.ContentPageGroupIdentifier.WebKit2JavaScriptCanOpenWindowsAutomatically -bool false
|
||||
|
||||
# Disable auto-filling passwords (if you use 1Password)
|
||||
defaults write com.apple.Safari AutoFillPasswords -bool false
|
||||
|
||||
# Warn about fraudulent websites
|
||||
defaults write com.apple.Safari WarnAboutFraudulentWebsites -bool true
|
||||
|
||||
# Disable automatic opening of safe files
|
||||
defaults write com.apple.Safari AutoOpenSafeDownloads -bool false
|
||||
|
||||
# =============================================================================
|
||||
# System Security
|
||||
# =============================================================================
|
||||
|
||||
# Disable guest account
|
||||
sudo dscl . create /Users/Guest UserShell /usr/bin/false
|
||||
|
||||
# Disable remote apple events
|
||||
sudo systemsetup -setremoteappleevents off
|
||||
|
||||
# Disable remote login (SSH) - uncomment if you don't need it
|
||||
# sudo systemsetup -setremotelogin off
|
||||
|
||||
# Disable wake-on modem
|
||||
sudo systemsetup -setwakeonmodem off
|
||||
|
||||
# Disable wake-on network access
|
||||
sudo systemsetup -setwakeonnetworkaccess off
|
||||
|
||||
# Disable file sharing
|
||||
sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.AppleFileServer.plist 2>/dev/null || true
|
||||
|
||||
# =============================================================================
|
||||
# FileVault (Disk Encryption)
|
||||
# =============================================================================
|
||||
|
||||
# Check if FileVault is enabled
|
||||
if ! sudo fdesetup status | grep -q "FileVault is On"; then
|
||||
echo "WARNING: FileVault is not enabled!"
|
||||
echo "Consider enabling FileVault for full disk encryption:"
|
||||
echo "System Preferences > Security & Privacy > FileVault"
|
||||
fi
|
||||
|
||||
# =============================================================================
|
||||
# Gatekeeper
|
||||
# =============================================================================
|
||||
|
||||
# Enable Gatekeeper
|
||||
sudo spctl --master-enable
|
||||
|
||||
# =============================================================================
|
||||
# Secure Empty Trash
|
||||
# =============================================================================
|
||||
|
||||
# Enable secure empty trash (if available on your macOS version)
|
||||
defaults write com.apple.finder EmptyTrashSecurely -bool true 2>/dev/null || true
|
||||
|
||||
# =============================================================================
|
||||
# Network Security
|
||||
# =============================================================================
|
||||
|
||||
# Disable Bonjour multicast advertisements
|
||||
sudo defaults write /Library/Preferences/com.apple.mDNSResponder.plist NoMulticastAdvertisements -bool true
|
||||
|
||||
# =============================================================================
|
||||
# Application Security
|
||||
# =============================================================================
|
||||
|
||||
# Prevent automatic software updates
|
||||
sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticDownload -bool false
|
||||
# Note: You might want to keep this enabled and just review updates manually
|
||||
|
||||
# Show all file extensions to prevent malware masquerading
|
||||
defaults write NSGlobalDomain AppleShowAllExtensions -bool true
|
||||
|
||||
# =============================================================================
|
||||
# Privacy - Microphone and Camera
|
||||
# =============================================================================
|
||||
|
||||
echo ""
|
||||
echo "Security configuration complete!"
|
||||
echo ""
|
||||
echo "Manual steps required:"
|
||||
echo "1. System Preferences > Security & Privacy > FileVault - Enable if not already on"
|
||||
echo "2. System Preferences > Security & Privacy > Privacy - Review app permissions"
|
||||
echo "3. System Preferences > Screen Time - Configure if desired"
|
||||
echo "4. Consider enabling 2FA for Apple ID"
|
||||
echo "5. Review Location Services in System Preferences"
|
||||
echo ""
|
||||
echo "Third-party security tools to consider:"
|
||||
echo "- LuLu (firewall) - already in your Brewfile"
|
||||
echo "- OverSight (camera/mic monitor) - already in your Brewfile"
|
||||
echo "- Little Snitch (network monitor)"
|
||||
echo "- 1Password (password manager) - already in your Brewfile"
|
||||
Reference in New Issue
Block a user