Phoenix Network Forums

safety wrote:Once personal web sharing is enabled, I have to chmod my home directory to 755 before apache can access the sites folder. I use filevault to encrypt my home directory and it sets the permissions to 700 automatically.

You can ease your life a lot by using kernel-side encryption, if there is such a thing in OS X. I'm using transparent encryption for almost my whole hard disk. It's also more secure, because it's per-filesystem instead of per-file/directory. With your solution, an attacker can still see your data structure and thus try to guess. Also you suffer from potential bugs in the software. Kernel-side ciphers ensure "pure" encryption, which means that there is no meta-data, like those, which many user-space programs create. Every single byte of meta-data gives the attacker info, which he shouldn't know.

safety wrote:mm_freak, do you use any type of NIDS, such as Firestorm or Snort?

No, I don't. I don't like automations to mess with my iptables.

Thanks for the tips! They are always welcomed.

I have done some searching on the net for os x, but I haven't found any kernel-side encryption info yet. Filevault stores the home directory as what it calls a sparseimage. Is this what you mean by "data structure"?

No, I mean that an attacker is still able to retrieve your directory structure (including directory and file names), file sizes and other informations. Another security thread is temporary storage. Your /tmp and especially your swap space may be filled with infos you never wanted to share with others. That's why I insist on encrypting as much as possible. It has a little performance impact though, but in my opinion it's worthful.

No problem, I'm glad if it helps. =)

A nice hardware firewall that you can make out of an old box is mon0wall. I used this unix firewall distro for a couple years and it has yet to serve me wrong. http://m0n0.ch/wall/