DevSec macOS Baseline

This Compliance Profile ensures that all hardening projects keep the same quality across macOS operating systems.

• https://github.com/dev-sec/ansible-collection-hardening

Standalone Usage

This Compliance Profile requires InSpec for execution:

inspec exec mac-baseline

You can also execute the profile directly from GitHub:

inspec exec https://github.com/dev-sec/mac-baseline

Policy Inputs

Inputs allow tailoring the compliance profile to your environment. Define inputs in inspec.yml or an input file passed via --input-file:

time_server: time.apple.com
password_min_length: 15
password_max_failed_attempts: 5
allow_major_version_deferral: true
universal_control_disabled: true
safari_history_age_days: 365
time_machine_max_backup_age_hours: 24

Execute with custom inputs:

inspec exec mac-baseline --input-file inputs.yml

Control Categories

Controls are organized into category-based spec files under controls/:

• update_spec.rb: Apple software update checks, auto-download, auto-install, security responses, deferral.
• apple_spec.rb: Apple Account, iCloud sync, Siri, and Apple Intelligence features.
• network_spec.rb: Application Firewall, stealth mode, AirDrop, AirPlay, network time (timed), Bonjour, HTTP, NFS.
• sharing_spec.rb: Sharing services (Screen Sharing, File Sharing, Printer Sharing, SSH, ARD, Remote Apple Events, Internet Sharing, Content Caching, Media Sharing, Bluetooth Sharing) and PII.
• system_spec.rb: Time Machine backups, Control Center icons, screen saver hot corners, sleep/energy saver, lock screen settings, on-device dictation.
• security_spec.rb: Location Services, privacy settings, Gatekeeper, FileVault, SIP, AMFI, SSV, file/directory permissions, sudo settings, PolicyBanner, XProtect.
• account_spec.rb: Password policies, lockout threshold, complexity, history, age, Guest account, auto-login, password hints.
• audit_spec.rb: Security auditing (auditd), audit flags, log retention (install.log, audit logs), log directory permissions.
• safari_spec.rb: Safari settings, Terminal secure entry, Mail activity protection, Finder file extensions, Passwords app.

License and Authors

• DevSec Hardening Framework Team
• Joseph Erdosy

Licensed under the Apache License, Version 2.0. See LICENSE.