Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am setting up a new Mac Mini server which will serve as a web server (with Apache and MySQL) as well as some other pieces of functionality. I have seen little on securing OS X for such a scenario (I am running Lion - and this is not Lion Sever).

I assume it is recommended to use ipfw as opposed to the application firewall. I also assume that it makes sense to lock down SSH (put it on a non-standard port and use certificate authentication). However, should I also lock down screen sharing (and force an SSH tunnel for this)? Any tips on this are welcome.

share|improve this question

migrated from Aug 24 '11 at 17:30

This question came from our site for system and network administrators.

Don't use LDAP for user authentication until it actually checks more than whether any text is entered in the user field. – bmike Aug 24 '11 at 17:48
up vote 3 down vote accepted

Although written for 10.5, this guide by Daniel Cuthbert (PDF) is fairly comprehensive and largely still applies to Lion.

Closing off screen sharing and tunneling it (if you need it at all) through SSH is probably a good idea.

Standard rules apply:

  • Only open absolutely necessary ports to the outside world
  • Keep your software up to date
  • Disable any unused services & Apache modules
  • Disable any listeners you don't need, rebind those you do need to localhost only if they're not needed outside (lsof -i is your friend)
  • Check that your firewall is really working as expected (nmap from an outside host)

Mac specific things:

  • Make sure the console is password protected, locks if you're using screensharing and doesn't auto-login on startup
  • You may want to enable verbose boot messages by default, it'll make debugging easier in case things go bad: sudo nvram boot-args="-v"
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.