macOS Security Tooling

Harden your Mac.
In minutes, not hours.

mac-security is an open-source toolkit for auditing and hardening macOS workstations. One command gives you a full security report. Another locks down your SSH, firewall, and sharing services to a defensible baseline.

⚠️ Test before you deploy. These scripts modify SSH configuration, firewall rules, and system security settings. Always validate in a non-production or development environment before applying to production machines. Review each script and understand what it does before running it with elevated privileges.
Install via Homebrew
brew tap davidwhittington/mac-security
brew install davidwhittington/mac-security/mac-security
Or clone the repo for the full audit + documentation workflow.
macOS Ventura / Sonoma / Sequoia / Tahoe · Apple Silicon and Intel

What it audits

Run mac-security-audit and get a structured Markdown report covering every major security control on your machine.

🔐

FileVault

Confirms disk encryption is on. Flags unencrypted machines as critical.

🛡️

SIP & Gatekeeper

System Integrity Protection and app signing enforcement status.

🔥

Application Firewall

Firewall state, stealth mode, and block-all setting.

🔑

SSH Configuration

Reads sshd_config.d drop-ins. Reports password auth, root login, key auth.

📡

Sharing Services

Remote Login, ARD, Screen Sharing, File Sharing, Internet Sharing.

🌐

Open Ports

All TCP listeners. Spot unexpected services before attackers do.

👤

User Accounts

Local users and admin group membership.

🔄

macOS Updates

Auto-check, auto-download, and security data install policy.

Commands

Three tools ship with the Homebrew formula.

mac-security-audit Full security posture audit — outputs a structured Markdown report to stdout
mac-security-audit --brief Audit without package lists — faster, good for scheduled runs
mac-security-audit --save Write the report to private/workstations/ for audit history tracking
mac-security-capture Snapshot Homebrew packages, shell config, and git config from the current machine
mac-security-deploy Restore a saved machine profile to a new or rebuilt Mac

Quick start

From zero to a hardened baseline in under five minutes.

# 1. Install the tools
brew tap davidwhittington/mac-security
brew install davidwhittington/mac-security/mac-security

# 2. Run your first audit
mac-security-audit --brief

# 3. Review the Findings Summary at the bottom of the report
#    Each finding includes a severity and a recommended fix.

# 4. Harden SSH (see the SSH guide for the full walkthrough)
printf '%s\n' \
  'PasswordAuthentication no' \
  'PermitRootLogin no' \
  'PubkeyAuthentication yes' \
  'MaxAuthTries 3' \
  | sudo tee /etc/ssh/sshd_config.d/099-hardening.conf

# 5. Re-run the audit to confirm findings are resolved
mac-security-audit --brief

Guides

Step-by-step documentation for every part of the hardening process.

SSH Public Key Authentication

Key generation, authorized_keys setup, sshd hardening, multi-machine deployment.

Firewall: Application Firewall vs pf

When block-all breaks SSH, and how pf gives you both.

SSH Fleet Key Management

Per-client key strategy, ~/.ssh/config host blocks, key rotation across a lab.

Automated Drift Detection

launchd-scheduled audits that diff against the last report and alert on change.

Removing Insecure Services

Disable ARD, Screen Sharing, File Sharing, Internet Sharing, AirDrop step by step.

Private data, public tools

Audit reports, machine profiles, and network diagrams contain sensitive data that shouldn't live in a public repo. mac-security uses a git submodule pattern to keep the tooling public and the data private: 

# Public repo — scripts, guides, config templates
mac-security/
  scripts/audit/security-audit.sh
  docs/guides/
  config/launchagents/
  config/launchdaemons/

# Private submodule — per-machine data (separate private repo)
mac-security/private/
  workstations/macbook-pro-2026-03-08.md
  machines/macbook-pro/Brewfile

Clone the repo, initialize the private submodule pointing at your own private repo, and your audit history stays yours.