alichtman / stronghold Goto Github PK

1. Check if brew is installed.
   a. If not, install it.
   b. $ mkdir homebrew && curl -L https://github.com/Homebrew/brew/tarball/master | tar xz --strip 1 -C homebrew
2. Install security tools.

@shobrook

This should be a sequence of prompts for locking down remote login.

> Do you use SSH?
If yes, skip prompt
If no, offer to shutdown ssh daemon on start

etc

SSH

$ sudo systemsetup -f -setremotelogin off
$ sudo systemsetup -f -setremotelogin on

Apache Autostart

Learn about launchctl for disabling apache autostart: https://apple.stackexchange.com/a/119678

• Add badges
  • Github Version

http://jimkubicek.com/blog/2015/02/14/creating-a-homebrew-formula-for-a-python-project/

Should skip all firewall options if sudo password not entered correctly.

Although, maybe just leave this as-is because they'll be prompted for the pass again when the reset socketfilterfw command is run and they won't have the pass then either. No password, no changes. So no problem?

When/where does this break? Lowest valid version #s needed (potentially Sierra 10.12.0)

• Tested successfully on High Sierra 10.13.3

magmax/python-inquirer#42

BUG -> /bin/sh:/Users/alichtman/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2: Operation not permitted

if prompt_yes_no(bottom_line="-> Clear Downloads metadata?"):
	print_confirmation("Removing Downloads metadata...")
	sp.run(':>~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2', shell=True, stdout=sp.PIPE)

• https://packaging.python.org/tutorials/distributing-packages/#pure-python-wheels

Definitely requires .rst encoding.

Do I make two versions of the README and maintain both independently or can GitHub support .rst files?

CLOSED

#27
#28
#18
#6

OPEN

#3

herrbischoff/awesome-command-line-apps#52 (comment)

Add colors for section headers.

Using terminal and typing "python -V" shows 3.6.5. As well, it's been set in pyenv.

When running stronghold, after setting first security setting, "firewall", the app crashes, siting it's using python 2.7. I've tried sy-linking python 3 to python, using pyenv to set 3.6.5 as default.

Error below:
Traceback (most recent call last):
File "/usr/local/bin/stronghold", line 11, in
sys.exit(cli())
File "/Library/Python/2.7/site-packages/click/core.py", line 722, in call
return self.main(*args, **kwargs)
File "/Library/Python/2.7/site-packages/click/core.py", line 697, in main
rv = self.invoke(ctx)
File "/Library/Python/2.7/site-packages/click/core.py", line 895, in invoke
return ctx.invoke(self.callback, **ctx.params)
File "/Library/Python/2.7/site-packages/click/core.py", line 535, in invoke
return callback(*args, **kwargs)
File "/Library/Python/2.7/site-packages/stronghold.py", line 374, in cli
firewall_config()
File "/Library/Python/2.7/site-packages/stronghold.py", line 108, in firewall_config
if sp.run("sudo -E -v", shell=True, stdout=sp.PIPE).returncode != 0:
AttributeError: 'module' object has no attribute 'run'

https://github.com/wong2/pick

Pop up a suggestion at the end to enable it if I detect FileVault is not enabled

http://blog.jonparrott.com/github-flavored-markdown-on-pypi/

When running stronghold and responding "yes" to turn on the firewall, I get the error "Invalid sudo password. Firewall configuration aborted."

Here's a screenshot:

Not sure if this is because I am on MacOS Big Sur or if it is a separate issue altogether.

smashism/awesome-macadmin-tools#23 (comment)

ADD TO README

https://github.com/Homebrew/brew/blob/master/docs/Formula-Cookbook.md

• Brief Description/rationale for each option

As above... tried running with both 'stronghold' and 'sudo stronghold' and both have this problem. See what I'm getting below:

###########################
# FINAL CONFIGURATION STEPS
###########################

 -> Restart your Mac right now?
[?] This is necessary for some configuration changes to take effect.:  Yes
 >  Yes
    No

Configuration complete after restart!

Restarting in 5 seconds...
4...
3...
2...
1...
usage: sudo -h | -K | -k | -V
usage: sudo -v [-AknS] [-g group] [-h host] [-p prompt] [-u user]
usage: sudo -l [-AknS] [-g group] [-h host] [-p prompt] [-U user] [-u user] [command]
usage: sudo [-AbEHknPS] [-C num] [-g group] [-h host] [-p prompt] [-u user] [VAR=value] [-i|-s] [<command>]
usage: sudo -e [-AknS] [-C num] [-g group] [-h host] [-p prompt] [-u user] file ...
WARNING: Configuration not complete! A full restart is necessary.

https://github.com/0xmachos/mOSL is a good replacement until this is updated.

Basically, we should remove all settings that are no longer relevant, and add ones that are newly added.

I just installed it with pip, and it keeps bombing out:

Traceback (most recent call last):
  File "/usr/local/bin/stronghold", line 11, in <module>
    sys.exit(cli())
  File "/usr/local/lib/python2.7/site-packages/click/core.py", line 722, in __call__
    return self.main(*args, **kwargs)
  File "/usr/local/lib/python2.7/site-packages/click/core.py", line 697, in main
    rv = self.invoke(ctx)
  File "/usr/local/lib/python2.7/site-packages/click/core.py", line 895, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/usr/local/lib/python2.7/site-packages/click/core.py", line 535, in invoke
    return callback(*args, **kwargs)
  File "/usr/local/lib/python2.7/site-packages/stronghold.py", line 356, in cli
    firewall_config()
  File "/usr/local/lib/python2.7/site-packages/stronghold.py", line 106, in firewall_config
    if sp.run("sudo -E -v", shell=True, stdout=sp.PIPE).returncode != 0:
AttributeError: 'module' object has no attribute 'run'

-secure -> Turn everything on with no prompting

These commands are not functional on High Sierra. See drduh/macOS-Security-and-Privacy-Guide#290 for more details

Uhhhhh...

print_confirmation("Clearing SiriAnalytics data...")
if os.isfile("~/Library/Assistant/SiriAnalytics.db"):
    sp.run('sudo rm ~/Library/Assistant/SiriAnalytics.db ', shell=True, stdout=sp.PIPE)

It seems that the two keys used to set up the screen saver password, askForPassword and askForPasswordDelay are no longer used in the latest versions of macOS High Sierra.

Travis CI doesn't allow mixing of python and OSX, so we'll need to explore using a different service.

$ softwareupdate --schedule on

You can't change the permissions on a file you've just deleted so the command sequence I found/have been using makes absolutely no sense. Filing this as a bug...

This should be written in Swift: www.github.com/alichtman/stronghold-macOS

I'm running
High Sierra 10.13.6
Darwin 17.7.0
Python 2.7.15

The lockdown method is a mess... c'mon lol