Newbie Powerbook user with Firewall / Spyware questions

3%

That's the nice thing about having a 3% share in the market (give or take a few.)

There aren't a whole lot of viruses running around for Macs.

I've been using Macs for the past fifteen years and have never had a problem with viruses.

For me, I tend to go commando. For my PCs, I use protection!

I suppose it's all about how safe you want to play it...

No viruses for Mac OS X (yet).
No spyware for Mac OS X (yet).

The built-in firewall (ipfw) is very good.
The built-in GUI control for it (System Preferences -> Sharing prefpane -> Firewall tab) is VERY BAD.
Invest in Brickhouse or Sunshield to control/config ipfw if you don't know anything about UNIX and command line (if you do, learn to use ipfw via the command line).

flo via PM said:

Can you please explain?

Thanks a lot for your response, but what do you mean by GUI control?

I need to know UNIX (I used to know a little, it has been a while) to properly set the firewall? What is the ipfw?

Thanks a lot! Flo

Click to expand...

GUI = graphics user interface. Point and click with a mouse. Much easier for most people to navigate. Apple's point and click interface for the built in firewall (ipfw) is completely worthless and should not be relied upon.

ipfw is an IP FireWall built into the OS. It's quite configurable. It's pretty strong. Look over the man page on ipfw for more info: man ipfw

If you are comfortable with the command line, and with UNIX, and the learning curve that inevitably comes with it, you can learn to control ipfw. This is my preferred method. However, if reading that man page above sets your head spinning, look into some 3rd party utilities that allow you to control/configure ipfw from a better interface. Utilities like SunShield or BrickHouse.

You could use something like Little Snitch if you want to control outbound traffic of programs 🙂

As a matter of curiosity, what can ipfw do via the command line that you can't do via the Apple-provided GUI? A blanket statement that "it's Bad" isn't much use if you don't say exactly WHY it's Bad.

I'd kind of been under the impression that Apple ships the built-in firewall with only those ports that are really needed open, and all the GUI lets you do is open additional ports for specific purposes (like iTunes sharing) or close some of the major ones. Are more ports open than should be, as shipped? Or is it just that you personally like more explicit configurability?

rueyeet said:

As a matter of curiosity, what can ipfw do via the command line that you can't do via the Apple-provided GUI? A blanket statement that "it's Bad" isn't much use if you don't say exactly WHY it's Bad.

Click to expand...

Well, there's a lot to cover, so unless someone asks, I'll always just say "it's bad". But since you asked, here's the problems:

I do want finer grained control in my firewall. It's just not there with the Apple GUI control. But that's a small point of contention.

A larger point of contention is, there is NO WAY to turn on logging in the Apple control! What good is a firewall if you have no idea what is happening with it? Are you just going to press the "on" button and hope that it's doing a good job? How do you know if you're being targeted? How can you know who is touching which port? Logging is a very important part of a firewall and it's just no an option.

And finally, the biggest problem of all..

The Apple GUI control offers NO way to block specific IPs or ranges of IPs. It's all or nothing. This renders the firewall completely useless. It's about as effective as not running a firewall at all. Any service that is running and listening for external connections will show up through a port scan when the Mac is firewalled using the Apple-config, the same as it would if there was no firewall "running" (technically, ipfw is ALWAYS running, it's default rule set is "allow all from any to any", but this is equivalent to it being "off"). You cannot specify, hey, I'll let my buddy Foo from so-and-so connect to my FTP server, but everyone else can keep the hell out.

So, without being able to block IPs, nor have logging to know whom is touching my box (no pun), Apple has rendered ipfw impotent. It's benefits are miniscule.


Using ipfw from the command line (or BrickHouse/SunShield if you need/want GUI) allows for MUCH greater control.

I deny most external ICMP requests, and log when they connect:

I have a blacklist of hosts that are naughty, and log when they try to connect:

Unless I'm on vacation, I only allow ssh connections from a "trusted" source range of IPs, and I log all connections:

I only allow DNS from "trusted" sources, limiting my exposure to DNS spoofing:

Etc, etc, etc,...

No need to bore you anymore, I think you get the idea.