There is a new Apple Macintosh tool that can be used to create customized security “baselines of technical security controls, which are mapped to various compliance frameworks such as: NIST 800-53, DISA STIG, FINRA, and HIPAA requirements. ”
This tool is located on Github.com, it is called the macOS Security Compliance Project. The project of federal operational IT Security staff from the National Institute of Standards and Technology (NIST), National Aeronautics and Space Administration (NASA), Defense Information Systems Agency (DISA), and Los Alamos National Laboratory (LANL) have developed and provided this much needed resource for Apple Macintosh Operating System Security and Compliance.
Thanks for this extraordinary effort!
In light of macOS Server removing the Account Lockout Policy Enforcement feature from the GUI, one can still apply this enforcement by way of terminal command on the Open Directory Server itself. For Example:
Set LDAP Account Policy Enforcement:
pwpolicy -a <<diradmin>> -p <<password>> -u <<username to unlock> -setpolicy "maxFailedLoginAttempts=1"
** This sets 5 password failed attempts along with 60days password reset
sudo pwpolicy -a diradmin -u edtester -setpolicy "maxMinutesUntilChangePassword=86400 maxFailedLoginAttempts=5"
pwpolicy -a <<diradmin>> -p <<password>> -u <<username to unlock> -setpolicy "isDisabled=0"
Link to technical article: https://superuser.com/questions/577273/osx-server-ldap-pwpolicy-how-to-disable-a-account
Splunk forum member: lguinn2 shows us to:
Put the following in the configuration file web.conf (perhaps in etc/system/local or etc/apps/search/local)
Your message here
Found information here: https://answers.splunk.com/answers/320607/is-there-way-to-add-a-warning-message-in-splunk-we.html
Run AdobeExpiryCheck tool
Run AdobeExpiryCheck on a local Windows machine
Launch command prompt and run the AdobeExpiryCheck tool.
The tool displays the product licensing identifier, the encrypted serial number, and the expiration date.
Link to Adobe Creative Cloud Software: Adobe Creative Cloud 12-month Plan Subscription
Timothy Sutton timsutton – Bromont, Québec – Tim has written a script that packages adobe serialization tools
This is a command-line tool that makes it easier to deploy Adobe Creative Cloud device license files (output by the Creative Cloud Packager application) on OS X, by building them into a standard OS X package installer.
Timothy Sutton timsutton – Bromont, Québec
Rich Mahlerwein writes on a Splunk comment:
Carefully craft a search that returns those rows and ONLY those rows. There’s isn’t enough information here to know precisely what it is that search will look like.
You could start by doing something like a
* | stats count by sourcetype to find out what sourcetype the ones you want to get rid of are, since I think this is your determining factor (remove all of that older sourcetype).
Once you’ve determined the sourcetype (or anything unique) of the data you want to remove, craft yourself a search that displays just those events. Perhaps
Make double sure this works right. It should include ALL the rows you want to have removed, but include NO rows that you want to keep. This is the search we’ll use to actually do the delete with.
Then follow the steps in the documentation on removing data from indexes using YOUR search to prevent those results from showing up again. To recap “how to delete data” from the docs, it’s basically
1) Add “delete” capabilities to a role (preferably use a special user)
2) Log in as that role
3) Use that search we made above, double-check that it returns the right data and only that data.
4) Then run
that search | delete
5) Watch the output, it’ll tell you how many events got deleted.
Then log OUT as that special user (and I’d suggest disabling it, but you can do what you want), log back in as your usual user and check that you only have the right data in there now.
This is all thanks to:
Save the file here:
set root permission:
sudo chown root /Library/LaunchDaemons/examplelaunchd.plist
sudo launchctl load -w /Library/LaunchDaemons/examplelaunchd.plist
You can stop the service using the unload subcommand.
sudo launchctl unload /Library/LaunchDaemons/examplelaunchd.plist
sudo launchctl list
pmset -g assertions
If you are looking for the nuclear option like I was:
sudo systemsetup -setcomputersleep Never
Schedules a repeating wake or power on event every tuesday at 12:00 noon, and a repeating sleep event every night at 8:00 PM.
pmset repeat wakeorpoweron T 06:00:00
Find Every Application (.app) Anywhere on the Mac via Command Line
sudo find / -iname *.app > ~/Desktop/EveryMacDotApp.txt
Once again, thanks to OSXDaily for this technical tidbit: http://osxdaily.com/2015/05/25/list-all-applications-mac-os-x/