3

I want to run a Mac in the cloud as a webserver and for facilitative use. I've secured most of my used tools already, but I was wondering about the OS itself.

Imagine I'm running an up-to-date Yosemite. How could I check what information a third party could obtain from the device. If information could be found, how to hide it?

I noticed some SSH services on Linux servers bluntly giving their exact OS version until the release number. I would want to prevent stuff like that being broadcasted and just wanted to double-check if OS X would broadcast such and how to obfuscate it or hide it fully. I can understand I can't hide my server is running OS X, but I would at least not like the external party to know more details if they were broadcasted.

  • Little Snitch might help macupdate.com/app/mac/10426/little-snitch – amergin Dec 24 '14 at 0:25
  • Think about not using OS X. It is an awful server OS. – bot47 Dec 24 '14 at 9:30
  • 2
    @MaxRied Could you give a valid reason? I can imagine reasons why Linux would be preferable over OS X. My server runs Golang compiled binaries and no script-language of some sort (like PHP, Python, Perl etc.). The reason I chose OS X is so I can lend some of the awesome features OS X has to automate stuff. If you have a valid reason I might consider using primary Linux server and a separate OS X server to only specifically give those tasks to. Thanks :) – User2910293 Dec 24 '14 at 12:04
  • 2
    As someone who actually runs an OS X machine as a server, I consider OS X to be fine server OS. It's a hell of a lot easier to deal with one OS (the one I use every day) than to have a separate one with its slight differences. Plus, there are a bunch of niceties that OS X offers that most Un*xes do not. – TJ Luoma Dec 30 '14 at 22:24
  • 1) OS X comes with an incredibly outdated userland. 2) If we are talking about using OS X as a server, we are talking about OS X Server. While it might be OK for a home user, professional users will find themselves on the shell immediately and thus could have used some real server OS in the first place. 3) A server OS that has a non-removable GUI, tends to refuse to boot headlessly and only boots on certain hardware?! 4) Some parts like smbx are NOT documented AT ALL. 5) Try setup routing that goes beyond Internet Sharing. There is NO way with stock tools! – bot47 Jan 2 '15 at 6:07
1

First make sure that you're running a firewall that is prohibiting all inbound and outbound connections on the server. Then open only those ports you need for the production to run fine.

Most applications can be configured to not identify their exact version, but remember that this is not really giving you any more security, it is just a tad harder to exploit.

After you've "hardened" your machine like this you could fire up a second machine in the same subnet and launch a utility like Wireshark (Wireshark download page) to listen to the chatter of your cloud server. This way you get additional hints about processes that you might want to silence.

| improve this answer | |
0

I second recommendation for "Little Snitch". It's always running on my Mac.

At first, shocking to see much traffic from the OS itself. To hide what you don't want revealed, you can set up rules in "Little Snitch".

I also use "Avast" to control connections.

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .