This document is provided without warranty — use it at your own risk. It may be downloaded for free for personal use. Do NOT re-post it or its content anywhere. Thanks

Download:

OS X Hardening.pdf

Listed below are the contents of several of the key folders for OS X preferences.

/Library/Preferences  (important stuff in bold).

drwxrwxr-x   23 root      admin   782 Apr  3 17:27 .
drwxrwxr-t   43 root      admin  1462 Mar 31 15:25 ..
-rw-rw-r–    1 administ  admin  6148 Mar 31 15:25 .DS_Store
-rw-r–r–    1 root      admin   850 Mar 31 12:11 .GlobalPreferences.plist
drwxrwxr-x    8 root      admin   272 Mar 31 03:53 DirectoryService
drwxrwxr-x    3 root      admin   102 Feb  2 00:05 Soundtrack
drwxr-xr-x    8 root      admin   272 Apr  5 16:14 SystemConfiguration
-rw-r–r–    1 root      admin   443 Mar 31 12:11 com.apple.BezelServices.plist
-rw-rw-r–    1 root      admin   418 Dec 25 03:00 com.apple.ByteRangeLocking.plist
-rw-r–r–    1 root      admin   691 Mar 31 03:52 com.apple.HIToolbox.plist
-rw-r–r–    1 administ  admin   118 Apr  3 17:18 com.apple.SoftwareUpdate.plist
-rw-r–r–    1 root      admin  3507 Apr  5 16:13 com.apple.audio.DeviceSettings.plist
-rw-rw-r–    1 root      admin  1340 Dec 25 13:36 com.apple.dockfixup.plist
-rw-r–r–    1 root      admin    80 Mar 15 05:23 com.apple.driver.AppleIRController.plist
-rw-r–r–    1 root      admin   310 Feb  2 00:07 com.apple.iDVD.plist
-rw-r–r–    1 root      admin   400 Feb  2 00:10 com.apple.iLifeMediaBrowser.plist
-rw-r–r–    1 root      admin   312 Feb  2 00:08 com.apple.iMovie.plist
-rw-r–r–    1 root      admin   163 Apr  3 17:27 com.apple.loginwindow.plist
-rw-r–r–    1 root      admin    71 Mar 31 12:11 com.apple.networkConfig.plist
-rw-rw-r–    1 root      admin   946 Mar 31 15:53 com.apple.sharing.firewall.plist
-rw-rw-r–    1 root      admin   469 Dec 25 08:42 com.apple.xgrid.agent.plist
-rw-rw-r–    1 root      admin   344 Dec 25 08:42 com.apple.xgrid.controller.plist
-rw-r—–    1 root      admin   117 Apr  3 15:21 edu.umich.radmindassistant.plist

Opening the files and doing a bit of googling, here’s a little bit about what each of these does.

.DS_Store – like all .DS_Store files, this one contains information about how that particular folder was last viewed, e.g. in column or list view.

.GlobalPreferences.plist — contains your Time Zone preferences, including the city you selected when you first set up the computer and whether or not you set time via a time server.  E.g. in Kansas City, I selected St. Louis, because it’s in the same time zone.  This file also lists the languages available to OS X (this probably is determined at the time of install — did you check "Install Additional Languages?").  It also has a bit in there about a default ColorSync Device (your default monitor, probably), and settings relating to that device (e.g. on an iMac, there are several keys in there about the built in monitor).

com.apple.BezelServices.plist — controls settings for those cool hovering images for when you eject a disk, change the volume etc. as well as their associated sounds (if any).  I think it’s other job is to sit around and get corrupted since so many solutions to bungled computers involved trashing this particular file.

com.apple.ByteRangeLocking.plist — deals with the DB hash table  in /var/db/BRLM.db but I don’t know which services make use of this framework.

com.apple.HIToolbox.plist – contains your keyboard layout and your preferred time format.

com.apple.SoftwareUpdate.plist — contains the date the computer last attempted to update, the result code, and the date of the last successful update.

com.apple.audio.DeviceSettings.plist –  Changing the output volume or checking sound effects options did not change this file.  I think this determines which driver is being used for the audio input/output, e.g. built-in via CoreAudio or via a 3rd party interface like a MOTU 896.

com.apple.dockfixup.plist — shows which icons I pulled from the dock, shows after which application new icons will be added, and contains a "move" key which references the Apple System Profiler, the System Profiler, the Print Center, and the Printer Setup Utility — I think these are all utilities which close themselves after the last window closes.  I tried adding a program to that list, but I didn’t notice any difference in its behavior, even after relaunching the Dock.

com.apple.driver.AppleIRController.plist  –  since I’m working on a new iMac that has a remote control for Front Row, my guess is that this file deals with that.  It contains a boolean "DeviceEnabled" key and a UIDFilter, defaulted to none.  I wonder if playing around with that would allow me to change which remote affected which computer.  Currently, the same remote will work on any number of computers.

com.apple.iDVD.plist  — merely contains a path for iDVD themes.

com.apple.iLifeMediaBrowser.plist — contains a path for content searches and demo songs for Garage Band.

com.apple.iMovie.plist  — contains a path for iMovie themes.

com.apple.loginwindow.plist — Has a key for retries until hint (referring to the password hint), the name of the last user who logged in, and the ID # of the user who is automatically logged in (if automatic login is enabled).

com.apple.networkConfig.plist — contains a 1/0 value specifying whether or not the network has been set up.  Presumably this works in tandem with Apple’s connection wizard.

com.apple.sharing.firewall.plist — the list of what appears in the Sharing Control Panel comes from this file.  Any modifications you made to the firewall show up in this preference file.  All open ports are listed specifically by UDP and TCP.

com.apple.xgrid.agent.plist  — Xgrid is a simple system for setting up and using a cluster of OS X machines.  The agent file contains information about controller authentication and whether or not computations should occur only if the machine is idle.  If you’re not doing cluster computing, you probably won’t use this much.  I suspect that Logic and Final Cut’s distributive computing functionality rely on Xgrid.

com.apple.xgrid.controller.plist — see above.

edu.umich.radmindassistant.plist — keys for check sum (1/0), radmindhost (containing the IP address of your server), and a few other things.  (You won’t have this unless you’ve installed Radmind).

/Library/Preferences/SystemConfiguration

-rw-r–r–    1 root  wheel   1732 Apr  6 10:17 NetworkInterfaces.plist — BSD Name.

-rw-r–r–    1 root  admin    338 Apr 26  2005 com.apple.Boot.plist — Key for Boot Graphics (Yes/No), Kernel (mach_kernel), Kernel Flags.

-rw-r–r–    1 root  admin    912 Apr  5 18:18 com.apple.PowerManagement.plist — Settings for AC (and battery) settings from the Energy Saver control panel: Automatic restart on Power Loss (1/0), Disk Sleep Timer (# minutes), Display Sleep Timer (# min.).

-rw-r–r–    1 root  admin   1255 Apr  6 10:18 com.apple.airport.preferences.plist — Always remember new networks (1/0), lists default 802.1X Configurations.

-rw-r–r–    1 root  admin    920 Apr  5 17:30 com.apple.nat.plist — Network stuff.  Has info for Airport (if available) and the Built-In Ethernet and specifies which is the preferred device (e.g. wireless instead of built-in ethernet).  This lists the computer name from the Sharing Control Panel.

-rw-r–r–    1 root  admin  12658 Mar 31 13:04 preferences.plist — This little file is a gold mine from the Networking Control Panel.  It states whether AppleTalk is off/on, it lists all Search Domains, DNS Servers, the machine’s MAC address, the DHCP Client ID, whether or not IPv6 is active, PPP info, it lists all proxies, Bluetooth configuration info, Firewire network stuff, Binding Methods, Local Host Name, Computer Name.

/Library/Preferences/DirectoryService

These must be special, because only root can touch them.

-rw——-    1 root  admin  404 Mar 31 03:53 ContactsNodeConfig.plist — DHCP LDAP, Search Node PlugIn Version, Search Policy

-rw——-    1 root  admin  333 Mar 31 03:53 ContactsNodeConfigBackup.plist — a backup of file above.

-rw——-    1 root  admin  274 Mar 15 05:22 DSLDAPv3PlugInConfig.plist — LDAP PlugIn Version

-rw——-    1 root  admin  385 Mar 15 05:22 DirectoryService.plist — Active Directory (Inactive/Active), AppleTalk (Inactive/Active), BSD (Inactive/Active).

-rw——-    1 root  admin  404 Mar 31 03:53 SearchNodeConfig.plist — looks almost identical to the ContactsNodeConfig.plist

-rw——-    1 root  admin  333 Mar 31 03:53 SearchNodeConfigBackup.plist — a back up of above file.

The Radmind Updating Script is actually several files that work together to let you
perform a Radmind update via the Terminal (e.g. referenced in the crontab). A floating
banner window is displayed alerting any users to the fact that the machine is being updated.
The script uses an AppleScript script to quit all open applications nicely so this
script will play as nicely as possible with users. A log-generating script is also included
so you can review the script’s success or errors in the console.

DOWNLOADS

Download Radmind Manual (.pdf) . . . . . . . . . . . . Last updated:
August 2, 2007

Radmind Updating Script (.zip) . . . . contains associated files for clean Radmind update via the Terminal.

Writing this documentation and the scripts took a lot of time. If you find them helpful, I’d appreciate
a donation. Thanks.

There has been some extensive Radmind Q & A on the macosxlabs.org website.
They also have some Radmind Scripts.