.macos_hardening

#!/usr/bin/env bash
#
# MacOs Hardening:
#
#  - Ensure FileVault is enabled
#  - Ensure firmware password is enabled
#  - Enforce Firewall settings
#  - Consolidate my /etc/hosts
#  - Manage my Network locations:
#    * Automatic: follow DHCP instructions
#    * Public Network: Local DNS resolver + Tor
#    * Office: Local DNS resolver
#    * Home: follow DHCP instructions
#
# https://github.com/drduh/macOS-Security-and-Privacy-Guide
#

set -o errexit
set -o pipefail
set -o nounset

CPU_BRAND="$(sysctl -n machdep.cpu.brand_string)"
CURRENT_NETWORK_LOCATION="$(networksetup -getcurrentlocation)"

export CPU_BRAND CURRENT_NETWORK_LOCATION

echo "--> Detected CPU Brand: ${CPU_BRAND}"

function _clean() {
  sudo networksetup -switchtolocation "$CURRENT_NETWORK_LOCATION"
  sudo networksetup -setairportpower en0 on
  sudo networksetup -deletelocation 'tmp' || true
}

while true; do
  sudo -n true
  sleep 60
  kill -0 $$ || exit
done 2>/dev/null &

# Check FileVault status
if ! fdesetup status | grep -q 'FileVault is On.'; then
  # shellcheck disable=SC1003
  echo 1>&2 '/!\ FileVault is not enabled /!\'
  exit 1
  # sudo fdesetup enable -user $USER > $HOME/FileVault_recovery_key.txt
fi

if [[ $CPU_BRAND != 'Apple M1' ]]; then
  # Check firmware password
  if ! sudo firmwarepasswd -check | grep -q 'Password Enabled: Yes'; then
    # shellcheck disable=SC1003
    echo 1>&2 '/!\ firmware password is not set /!\'
    echo 1>&2 'Hint: "sudo firmwarepasswd -setpasswd"'
    exit 1
  fi

  # Check firmware password mode
  if ! sudo firmwarepasswd -mode | grep -q 'Mode: full'; then
    # shellcheck disable=SC1003
    echo 1>&2 '/!\ firmware password is not required on all startups /!\'
    echo 1>&2 'Hint: "sudo firmwarepasswd -setmode full"'
    exit 1
  fi

  # check EFI Firmware Integrity
  /usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check
fi

# Check System Integrity Protection
if ! csrutil status | grep -q 'System Integrity Protection status: enabled.'; then
  # shellcheck disable=SC1003
  echo 1>&2 '/!\ System Integrity protection is disabled /!\'
  echo 1>&2 'Hint: "sudo csrutil enable"'
  exit 1
fi

# Enable Gatekeeper
sudo spctl --master-enable

# Require an administrator password to access system-wide preferences
sudo /usr/bin/security authorizationdb write system.preferences deny

# Enable the firewall
/usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on

# Enable logging
/usr/libexec/ApplicationFirewall/socketfilterfw --setloggingmode on

# Enable stealth mode
/usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on

# Prevent built-in software as well as code-signed, downloaded software from
# being whitelisted automatically
/usr/libexec/ApplicationFirewall/socketfilterfw --setallowsigned off
/usr/libexec/ApplicationFirewall/socketfilterfw --setallowsignedapp off

# Configure the firewall to block all incoming traffic
/usr/libexec/ApplicationFirewall/socketfilterfw --setblockall on

# Disabled allow signed downloaded applications automatically
/usr/libexec/ApplicationFirewall/socketfilterfw --setallowsignedapp off

sudo pkill -HUP socketfilterfw

# Set the screen to lock as soon as the screensaver starts
defaults write com.apple.screensaver askForPassword -int 1
defaults write com.apple.screensaver askForPasswordDelay -int 0

# Expose hidden files and Library folder in Finder
defaults write com.apple.finder AppleShowAllFiles -bool true
chflags nohidden ~/Library

# Show all filename extensions (so that "Evil.jpg.app" cannot masquerade easily).
defaults write NSGlobalDomain AppleShowAllExtensions -bool true

# Don't default to saving documents to iCloud
defaults write NSGlobalDomain NSDocumentSaveNewDocumentsToCloud -bool false

# Disable Bonjour multicast advertisements
sudo defaults write /Library/Preferences/com.apple.mDNSResponder.plist NoMulticastAdvertisements -bool YES

# Set AirDrop Discoverability to 'Contacts Only'
defaults write com.apple.sharingd DiscoverableMode -string 'Contacts Only'
sudo killall -HUP sharingd

# Set AppStore update check to every one (1) day
defaults write com.apple.SoftwareUpdate ScheduleFrequency -int 1

# Captive portal
sudo defaults write \
  /Library/Preferences/SystemConfiguration/com.apple.captive.control Active \
  -bool false

# disable automatic loading of remote content by Mail.app
defaults write -app mail DisableURLLoading -bool true

# Disable Remote Login
sudo systemsetup -f -setremotelogin off

# Disable Safari Auto Open 'safe' Files
defaults write -app safari AutoOpenSafeDownloads -bool false

# You may wish to enforce hibernation and evict FileVault keys from memory
# instead of traditional sleep to memory
sudo pmset -a destroyfvkeyonstandby 1
sudo pmset -a hibernatemode 25

# If you choose to evict FileVault keys in standby mode, you should also modify
# your standby and power nap settings. Otherwise, your machine may wake while
# in standby mode and then power off due to the absence of the FileVault key
sudo pmset -a powernap 0
sudo pmset -a standby 0
sudo pmset -a standbydelay 0
sudo pmset -a autopoweroff 0

# Consolidate my /etc/hosts too just in case I don't use my DNS, eg: automatic
# network profile
curl -s 'https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-gambling/hosts' |
  sudo tee '/etc/hosts'

# Shutdown Wi-Fi
sudo networksetup -setairportpower airport off

trap _clean INT TERM EXIT

# Create a tmp location, before generate 'Automatic' location
sudo networksetup -createlocation 'tmp' populate ||
  sudo networksetup -switchtolocation 'tmp'

# Automatic
sudo networksetup -deletelocation 'Automatic' || true
sudo networksetup -createlocation 'Automatic' populate
sudo networksetup -switchtolocation 'Automatic'

# Public Network
sudo networksetup -deletelocation 'Public Network' || true
sudo networksetup -createlocation 'Public Network' populate
sudo networksetup -switchtolocation 'Public Network'
sudo networksetup -setdnsservers Wi-Fi 127.0.0.1
sudo networksetup -setproxybypassdomains Wi-Fi 'localhost' '127.0.0.0/8' '172.16.0.0/12' '192.168.0.0/16' '169.254/16' '*.local' '*.home' '*.netflix.com' '*.youtube.com' '*.airbnb.fr'
sudo networksetup -setsocksfirewallproxy Wi-Fi 127.0.0.1 9050
sudo networksetup -setsocksfirewallproxystate Wi-Fi on
sudo networksetup -setsearchdomains Wi-Fi Empty

# Office
sudo networksetup -deletelocation 'Office' || true
sudo networksetup -createlocation 'Office' populate
sudo networksetup -switchtolocation 'Office'
sudo networksetup -setdnsservers Wi-Fi 127.0.0.1
sudo networksetup -setproxybypassdomains Wi-Fi 'localhost' '127.0.0.0/8' '172.16.0.0/12' '192.168.0.0/16' '169.254/16' '*.local' '*.home' '*.netflix.com' '*.youtube.com'
sudo networksetup -setsocksfirewallproxystate Wi-Fi off
sudo networksetup -setsearchdomains Wi-Fi Empty

# Home
sudo networksetup -deletelocation 'Home' || true
sudo networksetup -createlocation 'Home' populate
sudo networksetup -switchtolocation 'Home'
sudo networksetup -setdnsservers Wi-Fi Empty
sudo networksetup -setproxybypassdomains Wi-Fi 'localhost' '127.0.0.0/8' '172.16.0.0/12' '192.168.0.0/16' '169.254/16' '*.local' '*.home' '*.netflix.com' '*.youtube.com'
sudo networksetup -setsocksfirewallproxy Wi-Fi Empty
sudo networksetup -setsocksfirewallproxystate Wi-Fi off
sudo networksetup -setsearchdomains Wi-Fi Empty