dotfiles/macos/security.sh

#!/usr/bin/env bash
# macOS Security Settings

set -euo pipefail

echo "Configuring macOS security settings..."

# Ask for admin password upfront
sudo -v

# =============================================================================
# Screen Security
# =============================================================================

# Require password immediately after sleep or screen saver begins
defaults write com.apple.screensaver askForPassword -int 1
defaults write com.apple.screensaver askForPasswordDelay -int 0

# Set screen saver to start after 10 minutes of inactivity
defaults -currentHost write com.apple.screensaver idleTime -int 600

# =============================================================================
# Firewall
# =============================================================================

# Enable firewall
sudo defaults write /Library/Preferences/com.apple.alf globalstate -int 1

# Enable firewall stealth mode (don't respond to ICMP ping requests or closed TCP/UDP ports)
sudo defaults write /Library/Preferences/com.apple.alf stealthenabled -int 1

# Enable firewall logging
sudo defaults write /Library/Preferences/com.apple.alf loggingenabled -int 1

# =============================================================================
# Privacy & Tracking
# =============================================================================

# Disable location services for system services
sudo defaults write /var/db/locationd/Library/Preferences/ByHost/com.apple.locationd LocationServicesEnabled -bool false

# Disable analytics & improvements
defaults write com.apple.SubmitDiagInfo AutoSubmit -bool false
defaults write com.apple.applicationaccess.plist com.apple.applicationaccess.feedback -bool false

# Disable personalized ads
defaults write com.apple.AdLib forceLimitAdTracking -bool true

# =============================================================================
# Safari Security (if Safari is used)
# =============================================================================

# Enable "Do Not Track"
defaults write com.apple.Safari SendDoNotTrackHTTPHeader -bool true

# Block pop-up windows
defaults write com.apple.Safari WebKitJavaScriptCanOpenWindowsAutomatically -bool false
defaults write com.apple.Safari com.apple.Safari.ContentPageGroupIdentifier.WebKit2JavaScriptCanOpenWindowsAutomatically -bool false

# Disable auto-filling passwords (if you use 1Password)
defaults write com.apple.Safari AutoFillPasswords -bool false

# Warn about fraudulent websites
defaults write com.apple.Safari WarnAboutFraudulentWebsites -bool true

# Disable automatic opening of safe files
defaults write com.apple.Safari AutoOpenSafeDownloads -bool false

# =============================================================================
# System Security
# =============================================================================

# Disable guest account
sudo dscl . create /Users/Guest UserShell /usr/bin/false

# Disable remote apple events
sudo systemsetup -setremoteappleevents off

# Disable remote login (SSH) - uncomment if you don't need it
# sudo systemsetup -setremotelogin off

# Disable wake-on modem
sudo systemsetup -setwakeonmodem off

# Disable wake-on network access
sudo systemsetup -setwakeonnetworkaccess off

# Disable file sharing
sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.AppleFileServer.plist 2>/dev/null || true

# =============================================================================
# FileVault (Disk Encryption)
# =============================================================================

# Check if FileVault is enabled
if ! sudo fdesetup status | grep -q "FileVault is On"; then
    echo "WARNING: FileVault is not enabled!"
    echo "Consider enabling FileVault for full disk encryption:"
    echo "System Preferences > Security & Privacy > FileVault"
fi

# =============================================================================
# Gatekeeper
# =============================================================================

# Enable Gatekeeper
sudo spctl --master-enable

# =============================================================================
# Secure Empty Trash
# =============================================================================

# Enable secure empty trash (if available on your macOS version)
defaults write com.apple.finder EmptyTrashSecurely -bool true 2>/dev/null || true

# =============================================================================
# Network Security
# =============================================================================

# Disable Bonjour multicast advertisements
sudo defaults write /Library/Preferences/com.apple.mDNSResponder.plist NoMulticastAdvertisements -bool true

# =============================================================================
# Application Security
# =============================================================================

# Prevent automatic software updates
sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticDownload -bool false
# Note: You might want to keep this enabled and just review updates manually

# Show all file extensions to prevent malware masquerading
defaults write NSGlobalDomain AppleShowAllExtensions -bool true

# =============================================================================
# Privacy - Microphone and Camera
# =============================================================================

echo ""
echo "Security configuration complete!"
echo ""
echo "Manual steps required:"
echo "1. System Preferences > Security & Privacy > FileVault - Enable if not already on"
echo "2. System Preferences > Security & Privacy > Privacy - Review app permissions"
echo "3. System Preferences > Screen Time - Configure if desired"
echo "4. Consider enabling 2FA for Apple ID"
echo "5. Review Location Services in System Preferences"
echo ""
echo "Third-party security tools to consider:"
echo "- LuLu (firewall) - already in your Brewfile"
echo "- OverSight (camera/mic monitor) - already in your Brewfile"
echo "- Little Snitch (network monitor)"
echo "- 1Password (password manager) - already in your Brewfile"