Server Hardening

Template for Part 2 of the setup script. All sudo commands.

FileVault (MUST DISABLE)

FileVault disk encryption blocks unattended boot — the machine sits at a pre-boot unlock screen waiting for a password before macOS even loads. This is incompatible with headless server operation.

# Check status
fdesetup status

# Disable non-interactively (for MCP/scripted use)
printf '<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0"><dict>
<key>Username</key><string>USERNAME</string>
<key>Password</key><string>PASSWORD</string>
</dict></plist>' | sudo fdesetup disable -inputplist

# Monitor decryption progress (runs in background, machine stays usable)
fdesetup status

Required for headless operation — ensures the GUI session starts on boot so user-level LaunchAgents (Tailscale, Signet, etc.) can run. Cannot work while FileVault is enabled.

# Set auto-login user
sudo defaults write /Library/Preferences/com.apple.loginwindow autoLoginUser "USERNAME"

# Create kcpassword (XOR-obfuscated password file)
python3 -c "
password = 'PASSWORD'
key = [0x7d, 0x89, 0x52, 0x23, 0xd2, 0xbc, 0xdd, 0xea, 0xa3, 0xb9, 0x1f]
encoded = bytearray()
for i, c in enumerate(password + chr(0)):
    encoded.append(ord(c) ^ key[i % len(key)])
while len(encoded) % 12 != 0:
    encoded.append(0)
with open('/etc/kcpassword', 'wb') as f:
    f.write(encoded)
"
sudo chmod 600 /etc/kcpassword

Power Management

sudo pmset -a displaysleep 0 disksleep 0 sleep 0 \
  powernap 0 autorestart 1 networkoversleep 1

Application Firewall

FW=/usr/libexec/ApplicationFirewall/socketfilterfw
sudo $FW --setglobalstate on
sudo $FW --setallowsigned on
sudo $FW --setstealthmode on

SMB Guest Access

WARNING: Never hardcode share names. macOS uses Unicode curly quotes (' U+2019) in default names like "Mac's Public Folder", which silently breaks sharing -r with straight quotes. Always parse dynamically:

# Remove ALL share points dynamically
sharing -l | grep "^name:" | sed 's/name:[[:space:]]*//' | \
  while read -r name; do
    sudo sharing -r "$name" 2>/dev/null && \
      echo "removed: $name" || echo "skip: $name"
  done

SMBPREF=/Library/Preferences/SystemConfiguration/com.apple.smb.server
sudo defaults write $SMBPREF AllowGuestAccess -bool false

Consumer Launch Agents

Disable via launchctl disable gui/$UID/<label>. This persists across reboots without modifying plists (SIP-safe).

Services to disable:

com.apple.Siri.agent
com.apple.siriactionsd
com.apple.siriknowledged
com.apple.siriinferenced
com.apple.sirittsd
com.apple.siri-distributed-evaluation
com.apple.cloudphotod
com.apple.CloudPhotosConfiguration
com.apple.photolibraryd
com.apple.gamed
com.apple.GameController.gamecontrolleragentd
com.apple.GamePolicyAgent
com.apple.newsd
com.apple.weatherd
com.apple.tipsd
com.apple.Maps.mapssyncd
com.apple.findmymacmessenger
com.apple.icloud.findmydeviced.findmydevice-user-agent
com.apple.homed
com.apple.homeenergyd
com.apple.itunescloudd

NOT disabled (keep these): Safari agents, Zoom, Google/Chrome.

Pattern:

UID_NUM=$(id -u)
for svc in <list>; do
  launchctl disable "gui/$UID_NUM/$svc" 2>/dev/null && \
    echo "  disabled: $svc" || echo "  skip: $svc"
done

Hostname

sudo scutil --set ComputerName "<name>"
sudo scutil --set HostName "<name>"
sudo scutil --set LocalHostName "<name>"

Spotlight

sudo mdutil -a -i off

Use ARD kickstart — launchctl load/bootstrap for screensharing.plist fails with I/O errors on modern macOS. The kickstart binary is the official way.

Important: must use -allowAccessFor -allUsers and set VNC legacy mode with an explicit password. Using -specifiedUsers can result in broken naprivs values that cause auth failures.

KICKSTART=/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart

# Clean start — deactivate first if re-running
sudo $KICKSTART -deactivate -stop

# Activate with VNC legacy password (for non-macOS clients)
sudo $KICKSTART \
  -activate -configure \
  -allowAccessFor -allUsers \
  -privs -all \
  -clientopts -setvnclegacy -vnclegacy yes \
  -setvncpw -vncpw <PASSWORD> \
  -restart -agent

Connect via vnc://<tailscale-ip> or any VNC client on port 5900. Over Tailscale, no extra firewall rules needed.

Visual Effects

Disable Liquid Glass, transparency, and animations to save GPU/CPU on a headless server:

defaults write com.apple.universalaccess reduceTransparency -bool true
defaults write com.apple.universalaccess reduceMotion -bool true
defaults write NSGlobalDomain NSAutomaticWindowAnimationsEnabled -bool false
defaults write com.apple.dock launchanim -bool false
defaults write com.apple.dock expose-animation-duration -float 0.1
defaults write NSGlobalDomain NSWindowResizeTime -float 0.001
killall Dock 2>/dev/null || true

Note: these are user-level defaults (no sudo needed).

Software Update

Keep auto-check, defer auto-install:

sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate \
  AutomaticInstall -bool false

5.2 KiB Raw Blame History