180 likes | 358 Views
Macintosh Configuration Management. Will Jorgensen. Overview. In the beginning…. Imaging is our Foundation. CIS Benchmark http://www.cisecurity.org/bench_osx.html Apple Security Configuration Guide http://images.apple.com/server/macosx/docs/Leopard_Security_Config_2nd_Ed.pdf.
E N D
Macintosh Configuration Management Will Jorgensen
Imaging is our Foundation • CIS Benchmark • http://www.cisecurity.org/bench_osx.html • Apple Security Configuration Guide • http://images.apple.com/server/macosx/docs/Leopard_Security_Config_2nd_Ed.pdf Apple Software Restore Mac OS X Baseline Configuration Network Registration & MHP Setup
User takes over Configure FileVault Install non-core applications Setup a backup strategy
FileVault • Laptops and offsite computers • Single encryption key • /Library/Keychains/FileVaultMaster.keychain • Tightly controlled decryption key
Installing Applications • PNNL Installer • Users still administrators • Minimum required software • Symantec AntiVirus • PNNL Configuration Tool
Backup Policy “Make backup copies of software, application, and data files. The frequency of the backup is based on the matter’s value, the frequency and volume of changes, and ease of restoration from loss or corruption. For example, data files that continually change should be backed up more frequently than static files or less dynamic data. For sensitive systems, backup requirements are established in computer security plans. For information on workstation backup services, see Data Backup Options on InfoSource.”
Workstation Backup and Restore • File Share & Tri-Backup • Flexible • Browse in Finder • Time Machine • Efficient • Flexible
Configuration Management Apple Remote Desktop Workgroup Manager Active Directory MCM or the PNNL Configuration Tool
Golden Triangle • Active Directory 2003 • User Accounts • Kerberos • Mac OS X Server • Preference Management • Web Services
Apple Remote Desktop ARD 3 Help Desk Tool Back door
Macintosh Configuration Management (MCM) • Server Side • Web server • Client Side • Shell scripts and applications • Checks in every 60 minutes
Challenges Intermittent network connections Sometimes things just don’t work Audit and Enforcement Resource constraints
Enhancements Manage Firewall Settings Staff log in with user accounts Full disk encryption InstaDMG Connected Backup
Summary Questions/Comments Will@pnl.gov