Guide to Checking and Managing macOS Firewall Status for IT Security

Key takeaways

• The ‘Check-FirewallStatusMac.sh’ script is a vital tool for automating firewall status checks on macOS, ensuring network security.
• It operates in two modes: with predefined checks or user-specified arguments (–inboundblocked and –stealthmode).
• Utilizes macOS’s socketfilterfw and defaults commands for fetching firewall configurations.
• Exit statuses (1 for security risks, 2 for invalid input) provide quick insights into the firewall state.
• Offers a more efficient, error-resistant alternative to manual firewall checks.
• Ideal for IT administrators and MSPs to ensure compliance with security policies across multiple macOS devices.
• Regular usage as part of IT maintenance routines enhances proactive security measures.
• Customization and integration into broader IT management systems like NinjaOne can streamline organizational security processes.

Introduction

Firewall management is a critical component in safeguarding any organization’s IT infrastructure. With the increasing reliance on digital systems, understanding and controlling network traffic becomes imperative to prevent unauthorized access and ensure data integrity. In this context, scripts like the ‘Check-FirewallStatusMac.sh’ play a pivotal role, offering a streamlined and efficient way to monitor firewall status on macOS systems.

Background

In the dynamic landscape of IT security, professionals and Managed Service Providers (MSPs) are constantly challenged to maintain optimal security postures. This script emerges as a vital tool for IT administrators, enabling them to automate the monitoring of firewall settings. It is designed to check if the firewall is enabled, if inbound connections are blocked, and if the system is in stealth mode, which are essential parameters for robust network security.

The script:

#!/usr/bin/env bash
# Description: Checks whether or not firewall is enabled and whether or not it's blocking inbound connections and optionally in stealth mode.
#  Will exit with status code 1 if any of those are not true. It exits with status code 2 for invalid input!
# Release Notes: Initial Release
# By using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https://www.ninjaone.com/terms-of-use.
# Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. 
# Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. 
# Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. 
# Warranty Disclaimer: The script is provided “as is” and “as available”, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. 
# Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. 
# Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. 
# EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).
#
# Usage: ./Check-FirewallStatusMac.sh [--inboundblocked] [--stealthmode]
# <> are required
# [] are optional
# Example: ./Check-FirewallStatusMac.sh --inboundblocked --stealthmode
#
# Notes:
#
#

function socketfilterfw() {
    /usr/libexec/ApplicationFirewall/socketfilterfw "$@"
}

function defaults() {
    /usr/bin/defaults "$@"
}

# When run directly without testing, the "__()" function does nothing.
test || __() { :; }

__ begin __
if [ $# -eq 0 ]; then
    if [[ "${inboundblocked}" == "true" ]]; then
        inboundCheck=$(socketfilterfw --getblockall | grep DISABLED)
        if [[ -n $inboundCheck ]]; then
            echo "Inbound traffic is not being blocked by default!"
            failed="True"
        fi
    fi
    if [[ "${stealthmode}" == "true" ]]; then
        stealthCheck=$(socketfilterfw --getstealthmode | grep disabled)
        if [[ -n $stealthCheck ]]; then
            echo "Stealthmode is NOT enabled!"
            failed="True"
        fi
    fi
else
    for i in "$@"; do
        if [[ $i != **"--inboundblocked"** && $i != **"--stealthmode"** && -n $i ]]; then
            echo "[Error] invalid input! Only supports --inboundblocked and --stealthmode" 1>&2
            echo "Exiting with status code 2" 1>&2
            exit 2
        fi

        if [[ $i == *"--inboundblocked"* ]]; then
            inboundCheck=$(socketfilterfw --getblockall | grep DISABLED)
            if [[ -n $inboundCheck ]]; then
                echo "Inbound traffic is not being blocked by default!"
                failed="True"
            fi
        fi

        if [[ $i == *"--stealthmode"* ]]; then
            stealthCheck=$(socketfilterfw --getstealthmode | grep disabled)
            if [[ -n $stealthCheck ]]; then
                echo "Stealthmode is NOT enabled!"
                failed="True"
            fi
        fi
    done
fi

firewallSocket=$(socketfilterfw --getglobalstate | grep disabled)
firewallALF=$(defaults read /Library/Preferences/com.apple.alf globalstate | grep 0)

if [[ -n $firewallSocket || -n $firewallALF ]]; then
    echo "The firewall is currently disabled."
    failed="True"
fi

if [[ $failed == "True" ]]; then
    echo "One or more checks have failed. Exiting with status code 1."
    exit 1
else
    echo "The firewall is enabled and all other checks have passed."
    exit 0
fi

__ end __

 

Detailed breakdown

The script begins with a function definition for socketfilterfw and defaults, which are macOS commands for managing the application firewall and system preferences, respectively. It operates in two modes: with and without arguments. When no arguments are provided, it checks if the inbound connections are blocked and if stealth mode is enabled based on predefined variables.

With arguments, it iterates through them, validating and executing checks for –inboundblocked and –stealthmode. It utilizes the socketfilterfw command to retrieve the current settings and uses grep to filter the output. The script then checks the global firewall state and the ALF (Application Layer Firewall) preference. Any failure in these checks results in an exit status of 1, indicating a potential security risk, while invalid inputs trigger an exit status of 2.

Potential use cases

Consider an IT administrator managing a network with several macOS devices. They can deploy this script across the network to periodically verify the firewall settings, ensuring all devices comply with the organization’s security policies. In case of a discrepancy, the script’s output can trigger further investigation or automated remediation actions.

Comparisons

While manual checking via System Preferences or terminal commands is possible, it is time-consuming and prone to human error. Other software solutions offer similar functionalities but often come with additional costs and complexity. This script provides a lightweight, customizable, and cost-effective alternative.

FAQs

• How do I run the script?
  • Run the script in the terminal with optional –inboundblocked and –stealthmode arguments.
• What does an exit status of 1 imply?
  • It indicates that either the firewall is disabled, inbound connections are not blocked, or stealth mode is not enabled.
• Is this script compatible with all macOS versions?
  • It is designed for macOS but should be tested on specific versions for compatibility.

Implications

The script’s results have significant implications for IT security. A disabled firewall or improperly configured settings can expose the network to vulnerabilities. Regular checks using this script can form part of a proactive security strategy, reducing the risk of cyber-attacks.

Recommendations

Best practices include regular script execution, perhaps as part of scheduled maintenance. Administrators should also review and adjust the script for specific organizational requirements and macOS versions. Integration with broader IT management systems can further streamline security processes.

Final thoughts

In a world where IT infrastructure complexity is ever-increasing, tools like NinjaOne provide comprehensive solutions for managing IT environments efficiently. Integrating scripts such as ‘Check-FirewallStatusMac.sh’ within NinjaOne’s platform could enhance its capabilities, offering streamlined firewall monitoring and ensuring a robust security posture for organizations leveraging macOS systems