Comment configurer le pare-feu macOS avec un script Shell

Avec les préoccupations croissantes concernant la sécurité des terminaux, la gestion des paramètres du pare-feu macOS à grande échelle est une responsabilité essentielle pour les professionnels de l’informatique et les fournisseurs de services gérés (MSP). Qu’il s’agisse de renforcer les MacBooks de l’entreprise ou d’assurer une posture réseau furtive pour les appareils sur le terrain, le fait de disposer d’un moyen cohérent et automatisé d’appliquer les configurations de pare-feu peut réduire de manière significative les vulnérabilités.

Cet article présente un script shell puissant qui permet aux administrateurs informatiques d’activer, de désactiver et de configurer le pare-feu macOS de manière programmatique, afin de garantir la conformité et d’éliminer les erreurs manuelles.

Contexte

macOS comprend un pare-feu intégré, contrôlé par socketfilterfw, qui offre un contrôle précis sur les connexions réseau entrantes et une visibilité en mode furtif. Cependant, la modification manuelle de ces paramètres via l’interface utilisateur des paramètres du système n’est pas extensible pour les MSP ou les départements informatiques des grandes entreprises qui gèrent des centaines ou des milliers de terminaux. De plus, les changements basés sur l’interface utilisateur peuvent être ignorés ou manqués, ce qui conduit à des lignes de base de sécurité incohérentes.

Ce script shell est conçu pour configurer le pare-feu macOS de manière programmatique, prenant en charge Ventura (macOS 13) et les versions ultérieures. En utilisant des paramètres tels que –firewallState, –blockAllIncomingConnections et –stealthMode, les professionnels de l’informatique peuvent appliquer les politiques de l’entreprise, se conformer aux cadres de sécurité et rationaliser le renforcement des terminaux lors de l’intégration, de la remédiation à distance ou de la préparation des audits.

Le script

#!/usr/bin/env bash
#
# Description: This script configures the macOS firewall settings, including enabling/disabling the firewall, blocking all incoming connections, and setting stealth mode to hide the computer from the network.
# By using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https://www.ninjaone.com/terms-of-use.
# Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. 
# Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. 
# Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. 
# Warranty Disclaimer: The script is provided “as is” and “as available”, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. 
# Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. 
# Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. 
# EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).
#
# Example: --firewallState "Enabled" --stealthMode "Enabled" --blockAllIncomingConnections "Yes"
#
# Verifying the current firewall state.
# The macOS firewall state is already set to 'enabled'.
# Successfully set the firewall state to 'enabled'.
#
# Verifying the current status of the 'Block all incoming connections' setting.
# Setting the block all incoming connections state to 'blocking'.
# Successfully set the block all incoming setting to 'blocking'.
#
# Verifying the current stealth mode state.
# The stealth mode state is already set to 'enabled'.
# Successfully set the stealth mode state to 'enabled'.
#
# Preset Parameter: --firewallState "Enabled"
#	  Enable or disable the overall firewall global state.
#
# Preset Parameter: --stealthMode "Enabled"
#	  Stealth mode hides the computer from the network by not responding to ICMP (ping) packets. Leave blank to not modify the setting.
#
# Preset Parameter: --blockAllIncomingConnections "Yes"
#	  Should all incoming connections be blocked or allowed. Leave blank to not modify the setting.
#
# Preset Parameter: --killSystemSettingsAppIfNecessary
#   Changes to the firewall may not be visible in System Settings until the app is restarted.
#
# Preset Parameter: --help
#	  Displays some help text.
#
# Minimum OS Architecture Supported: macOS 13 (Ventura)
# Release Notes: Initial Release

_arg_firewallState=
_arg_blockAllIncomingConnections=
_arg_stealthMode=
_arg_killSystemSettingsIfNecessary="off"
_exitCode=0

print_help() {
  printf '\n%s\n\n' 'Usage: [--firewallState|-f <arg>] [--stealthMode|-s <arg>] [--blockAllIncomingConnections|-b <arg>] [--killSystemSettingsAppIfNecessary|-k] [--help|-h]'
  printf '%s\n' 'Preset Parameter: --firewallState "Enabled"'
  printf '\t%s\n' "Enable or disable the overall firewall global state."
  printf '%s\n' 'Preset Parameter: --stealthMode "Enabled"'
  printf '\t%s\n' "Stealth mode hides the computer from the network by not responding to ICMP (ping) packets. Leave blank to not modify the setting."
  printf '%s\n' 'Preset Parameter: --blockAllIncomingConnections "Yes"'
  printf '\t%s\n' "Should all incoming connections be blocked or allowed. Leave blank to not modify the setting."
  printf '%s\n' 'Preset Parameter: --killSystemSettingsAppIfNecessary'
  printf '\t%s\n' "Changes to the firewall may not be visible in System Settings until the app is restarted."
  printf '%s\n' 'Preset Parameter: --help'
  printf '\t%s\n' "Displays this help menu."
}

die() {
  local _ret="${2:-1}"
  echo "$1" >&2
  test "${_PRINT_HELP:-no}" = yes && print_help >&2
  exit "${_ret}"
}

parse_commandline() {
  while test $# -gt 0; do
    _key="$1"
    case "$_key" in
    --firewallState | --firewallstate | -f)
      test $# -lt 2 && die "[Error] Missing value for the required argument '$_key'." 1
      _arg_firewallState=$2
      shift
      ;;
    --firewallState=*)
      _arg_firewallState="${_key##--firewallState=}"
      ;;
    --blockAllIncomingConnections | --blockAll | -b)
      test $# -lt 2 && die "[Error] Missing value for the optional argument '$_key'." 1
      _arg_blockAllIncomingConnections=$2
      shift
      ;;
    --blockAllIncomingConnections=*)
      _arg_blockAllIncomingConnections="${_key##--blockAllIncomingConnections=}"
      ;;
    --stealthMode | --stealthmode | -s)
      test $# -lt 2 && die "[Error] Missing value for the optional argument '$_key'." 1
      _arg_stealthMode=$2
      shift
      ;;
    --stealthMode=*)
      _arg_stealthMode="${_key##--stealthMode=}"
      ;;
    --killSystemSettingsIfNecessary | -k)
      _arg_killSystemSettingsIfNecessary="on"
      ;;
    --help | -h)
      _PRINT_HELP=yes die
      ;;
    *)
      _PRINT_HELP=yes die "[Error] Received an unexpected argument '$1'" 1
      ;;
    esac
    shift
  done
}

echo " "
parse_commandline "$@"

# If script form variables are used, replace the command line parameters with their value.
if [[ -n $firewallState ]]; then
  _arg_firewallState="$firewallState"
fi
if [[ -n $blockAllIncomingConnections ]]; then
  _arg_blockAllIncomingConnections="$blockAllIncomingConnections"
fi
if [[ -n $stealthModeState ]]; then
  _arg_stealthMode="$stealthModeState"
fi
if [[ -n $killSystemSettingsAppIfNecessary && "$killSystemSettingsAppIfNecessary" == "true" ]]; then
  _arg_killSystemSettingsIfNecessary="on"
fi

# Ensure the script is run with root permissions.
if [[ $(id -u) -ne 0 ]]; then
  _PRINT_HELP=no die "[Error] This script must be run with root permissions. Try running it with sudo or as the system/root user." 1
fi

# Trim whitespace from the firewall state argument.
if [[ -n "$_arg_firewallState" ]]; then
  _arg_firewallState=$(echo "$_arg_firewallState" | xargs)
fi

# Ensure a valid firewall state is provided.
if [[ -z "$_arg_firewallState" ]]; then
  _PRINT_HELP=yes die "[Error] Please provide a valid firewall state to set such as 'Enabled' or 'Disabled'." 1
fi

# Convert firewall state to lowercase.
if [[ -n "$_arg_firewallState" ]]; then
  _arg_firewallState=$(echo "$_arg_firewallState" | tr '[:upper:]' '[:lower:]')
fi

# Validate the firewall state.
if [[ "$_arg_firewallState" != "enabled" && "$_arg_firewallState" != "disabled" ]]; then
  _PRINT_HELP=yes die "[Error] The firewall state '$_arg_firewallState' is invalid. Please provide a valid firewall state such as 'Enabled' or 'Disabled'." 1
fi

# Process block all incoming connections argument if provided.
if [[ -n "$_arg_blockAllIncomingConnections" ]]; then
  _arg_blockAllIncomingConnections=$(echo "$_arg_blockAllIncomingConnections" | xargs)

  # Ensure a valid block all incoming connections state is provided.
  if [[ -z "$_arg_blockAllIncomingConnections" ]]; then
    _PRINT_HELP=yes die "[Error] Please specify whether to block all incoming connections (Yes) or allow all incoming connections (No). You can also leave this setting blank to not modify the current setting." 1
  fi

  # Convert block all incoming connections state to lowercase.
  if [[ -n "$_arg_blockAllIncomingConnections" ]]; then
    _arg_blockAllIncomingConnections=$(echo "$_arg_blockAllIncomingConnections" | tr '[:upper:]' '[:lower:]')
  fi

  # Validate the block all incoming connections state.
  if [[ "$_arg_blockAllIncomingConnections" != "yes" && "$_arg_blockAllIncomingConnections" != "no" ]]; then
    _PRINT_HELP=yes die "[Error] The block all incoming connections setting of '$_arg_blockAllIncomingConnections' is invalid. Please specify 'Yes' to block all incoming connections or 'No' to allow all incoming connections." 1
  fi

  # Ensure block all incoming connections is not set to yes when firewall is disabled.
  if [[ "$_arg_firewallState" == "disabled" && "$_arg_blockAllIncomingConnections" == "yes" ]]; then
    _PRINT_HELP=yes die "[Error] The block all incoming connections setting of '$_arg_blockAllIncomingConnections' is invalid. Unable to block all incoming connections while the firewall is disabled." 1
  fi
fi

# Process stealth mode argument if provided.
if [[ -n "$_arg_stealthMode" ]]; then
  _arg_stealthMode=$(echo "$_arg_stealthMode" | xargs)

  # Ensure a valid stealth mode state is provided.
  if [[ -z "$_arg_stealthMode" ]]; then
    _PRINT_HELP=yes die "[Error] Please specify a valid stealth mode state such as 'Enabled' or 'Disabled'." 1
  fi

  # Convert stealth mode state to lowercase.
  if [[ -n "$_arg_stealthMode" ]]; then
    _arg_stealthMode=$(echo "$_arg_stealthMode" | tr '[:upper:]' '[:lower:]')
  fi

  # Validate the stealth mode state.
  if [[ "$_arg_stealthMode" != "enabled" && "$_arg_stealthMode" != "disabled" ]]; then
    _PRINT_HELP=yes die "[Error] The stealth mode state of '$_arg_stealthMode' is invalid. Please specify a valid stealth mode state such as 'Enabled' or 'Disabled'." 1
  fi

  # Ensure stealth mode is not enabled when firewall is disabled.
  if [[ "$_arg_firewallState" == "disabled" && "$_arg_stealthMode" == "enabled" ]]; then
    _PRINT_HELP=yes die "[Error] The stealth mode state of '$_arg_stealthMode' is invalid. Unable to disable the firewall and enable stealth mode." 1
  fi

  currentIncomingConnectionsSetting=$(/usr/libexec/ApplicationFirewall/socketfilterfw --getblockall | grep -i "disable")
  if [[ -z "$currentIncomingConnectionsSetting" && "$_arg_stealthMode" == "disabled" && (-z "$_arg_blockAllIncomingConnections" || "$_arg_blockAllIncomingConnections" == "yes") ]]; then
    _PRINT_HELP=yes die "[Error] The stealth mode state of '$_arg_stealthMode' is invalid. Unable to disable stealth mode when block all incoming connections is enabled." 1
  fi
fi

# Verify the current firewall state.
echo "Verifying the current firewall state."
currentFirewallState=$(/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate | grep -e 'State = [0-9]*' -o | sed 's/[^0-9]//g')

# Determine the desired firewall state.
case "$_arg_firewallState" in
disabled)
  firewallGlobalState="off"
  if [[ "$currentFirewallState" == "0" ]]; then
    updateFirewallGlobalState="false"
  fi
  ;;
enabled)
  firewallGlobalState="on"
  if [[ "$currentFirewallState" == "1" || "$currentFirewallState" == "2" ]]; then
    updateFirewallGlobalState="false"
  fi
  ;;
esac

# Update the firewall state if necessary.
if [[ "$updateFirewallGlobalState" == "false" ]]; then
  echo "The macOS firewall state is already set to '${_arg_firewallState}'."
else
  echo "Setting the firewall state to '${_arg_firewallState}'."

  if ! /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate "$firewallGlobalState"; then
    _PRINT_HELP=no die "[Error] Failed to set the firewall state of '$_arg_firewallState' by setting the global state to '$firewallGlobalState'." 1
  fi
fi

# Verify the firewall state was updated successfully.
currentFirewallState=$(/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate | grep -e 'State = [0-9]*' -o | sed 's/[^0-9]//g')
case "$_arg_firewallState" in
disabled)
  if [[ "$currentFirewallState" != "0" ]]; then
    _PRINT_HELP=no die "[Error] Failed to set the firewall state of '$_arg_firewallState' by setting the global state to '$firewallGlobalState'. The current state is '$currentFirewallState'." 1
  fi
  ;;
enabled)
  if [[ "$currentFirewallState" != "1" && "$currentFirewallState" != "2" ]]; then
    _PRINT_HELP=no die "[Error] Failed to set the firewall state of '$_arg_firewallState' by setting the global state to '$firewallGlobalState'. The current state is '$currentFirewallState'." 1
  fi
  ;;
esac

echo "Successfully set the firewall state to '${_arg_firewallState}'."
echo ""

# Process block all incoming connections if provided.
if [[ -n "$_arg_blockAllIncomingConnections" ]]; then

  # Verify the current block all incoming connections setting.
  echo "Verifying the current status of the 'Block all incoming connections' setting."
  currentIncomingConnectionsSetting=$(/usr/libexec/ApplicationFirewall/socketfilterfw --getblockall | grep -i "disable")

  case "$_arg_blockAllIncomingConnections" in
  yes)
    blockAllIncoming="on"
    desiredIncomingStatus="blocking"

    if [[ -z "$currentIncomingConnectionsSetting" ]]; then
      updateBlockAllIncomingConnections="false"
    else
      updateBlockAllIncomingConnections="true"
    fi

    ;;
  no)
    echo "[Warning] Setting the block all incoming setting to a state of 'disabled'."
    blockAllIncoming="off"
    desiredIncomingStatus="disabled"

    if [[ -n "$currentIncomingConnectionsSetting" ]]; then
      updateBlockAllIncomingConnections="false"
    else
      updateBlockAllIncomingConnections="true"
    fi
    ;;
  esac

  if [[ "$updateBlockAllIncomingConnections" == "false" ]]; then
    echo "The block all incoming state is already set to '${desiredIncomingStatus}'."
  else
    echo "Setting the block all incoming connections state to '${desiredIncomingStatus}'."

    if ! /usr/libexec/ApplicationFirewall/socketfilterfw --setblockall "$blockAllIncoming"; then
      _PRINT_HELP=no die "[Error] Failed to set the block all incoming state to '$desiredIncomingStatus'." 1
    fi
  fi

  # Verify the block all incoming connections setting was updated successfully.
  currentIncomingConnectionsSetting=$(/usr/libexec/ApplicationFirewall/socketfilterfw --getblockall | grep -i "disable")
  case "$_arg_blockAllIncomingConnections" in
  yes)
    if [[ -n "$currentIncomingConnectionsSetting" ]]; then
      _PRINT_HELP=no die "[Error] Failed to set the block all incoming state to '$desiredIncomingStatus'." 1
    fi
    ;;
  no)
    if [[ -z "$currentIncomingConnectionsSetting" ]]; then
      _PRINT_HELP=no die "[Error] Failed to set the block all incoming state to '$desiredIncomingStatus'." 1
    fi
    ;;
  esac

  echo "Successfully set the block all incoming setting to '${desiredIncomingStatus}'."
  echo ""
fi

# Process stealth mode if provided.
if [[ -n "$_arg_stealthMode" ]]; then
  # Verify the current stealth mode state.
  echo "Verifying the current stealth mode state."
  currentStealthModeState=$(/usr/libexec/ApplicationFirewall/socketfilterfw --getstealthmode | grep -E "off|disable")

  case "$_arg_stealthMode" in
  disabled)
    desiredStealthModeState="off"

    if [[ -n "$currentStealthModeState" ]]; then
      updateStealthModeState="false"
    else
      updateStealthModeState="true"
    fi
    ;;
  enabled)
    desiredStealthModeState="on"

    if [[ -z "$currentStealthModeState" ]]; then
      updateStealthModeState="false"
    else
      updateStealthModeState="true"
    fi
    ;;
  esac

  if [[ "$updateStealthModeState" == "false" ]]; then
    echo "The stealth mode state is already set to '${_arg_stealthMode}'."
  else
    echo "Setting the stealth mode state to '${_arg_stealthMode}'."

    if ! /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode "$desiredStealthModeState"; then
      _PRINT_HELP=no die "[Error] Failed to set the stealth mode state of '$_arg_stealthMode' by setting the state to '$desiredStealthModeState'." 1
    fi
  fi

  # Verify the stealth mode state was updated successfully.
  currentStealthModeState=$(/usr/libexec/ApplicationFirewall/socketfilterfw --getstealthmode | grep -E "off|disable")

  case "$_arg_stealthMode" in
  disabled)
    if [[ -z "$currentStealthModeState" ]]; then
      _PRINT_HELP=no die "[Error] Failed to set the stealth mode state of '$_arg_stealthMode' by setting the state to '$desiredStealthModeState'." 1
    fi
    ;;
  enabled)
    if [[ -n "$currentStealthModeState" ]]; then
      _PRINT_HELP=no die "[Error] Failed to set the stealth mode state of '$_arg_stealthMode' by setting the state to '$desiredStealthModeState'." 1
    fi
    ;;
  esac

  echo "Successfully set the stealth mode state to '${_arg_stealthMode}'."
  echo ""
fi

# Check if the 'System Settings' application is running.
systemSettingsProcess=$(pgrep -x "System Settings")

# If the 'System Settings' application is running and the kill flag is not set, warn the user.
if [[ "$_arg_killSystemSettingsIfNecessary" != "on" && -n "$systemSettingsProcess" ]]; then
  echo "[Warning] The 'System Settings' application is currently running with process ID (PID) '$systemSettingsProcess'."
  echo "[Warning] You may need to restart this application for the firewall changes to become visible."
fi

# If the kill flag is set and the 'System Settings' application is running, kill the application.
if [[ "$_arg_killSystemSettingsIfNecessary" == "on" && -n "$systemSettingsProcess" ]]; then
  for pid in $systemSettingsProcess; do
    echo "[Warning] Killing the 'System Settings' application with process ID (PID) '$pid'."

    # Attempt to kill the process and handle any errors.
    if ! kill -9 "$pid"; then
      echo "[Error] Failed to kill the application with process ID (PID) '$pid'." >&2
      _exitCode=1
    else
      echo "Killed process with PID $pid."
    fi
  done
fi

# If the 'System Settings' application is not running, inform the user that the changes are complete.
if [[ -z "$systemSettingsProcess" ]]; then
  echo "The 'System Settings' application is not currently running. The changes are now complete."
fi

exit "$_exitCode"

Description détaillée

Ce script est structuré de manière à gérer quatre opérations principales :

1. Analyser les arguments de la ligne de commande pour déterminer les paramètres à appliquer.
2. Valider les entrées utilisateur pour l’état du pare-feu, le mode furtif et les paramètres de blocage.
3. Appliquer les changements en utilisant l’outil CLI socketfilterfw de macOS.
4. Il est possible de désactiver l’interface graphique « Paramètres du système » afin de refléter les modifications apportées au pare-feu en temps réel.

Paramètres clés

Cette approche modulaire en fait un outil idéal pour l’intégration avec des plateformes d’automatisation comme NinjaOne.

Cas d’utilisation potentiels

Cas de figure : Mise en conformité à distance

Un MSP du secteur de la santé gère plus de 150 ordinateurs portables macOS utilisés par des cliniciens travaillant hors site. Pour se conformer à la loi HIPAA, chaque dispositif doit bloquer toutes les connexions entrantes et fonctionner en mode furtif. Le MSP déploie ce script via le moteur d’automatisation de NinjaOne avec les paramètres :

Cela permet de s’assurer que tous les dispositifs sont renforcés pour répondre aux normes réglementaires, sans intervention manuelle de la part de l’utilisateur.

Comparaisons

Bien que les MDM offrent un contrôle au niveau de l’entreprise, de nombreuses entreprises préfèrent des outils légers, basés sur des scripts, pour leur flexibilité et leurs frais généraux minimes, en particulier lorsqu’ils sont intégrés dans des outils tels que NinjaOne.

Questions fréquentes

Question 1 : Ce script prend-il en charge les anciennes versions de macOS comme Catalina ou Big Sur ?

Non. Il est conçu pour macOS 13 Ventura et les versions ultérieures. Le comportement des versions antérieures n’est pas garanti.

Question 2 : Puis-je activer le mode furtif lorsque le pare-feu est désactivé ?

Non. Le script empêche l’activation du mode furtif lorsque le pare-feu est désactivé afin d’éviter les erreurs de configuration.

Question 3 : Les paramètres du système reflètent-ils immédiatement ces changements ?

Pas toujours. C’est pourquoi le script inclut l’option –killSystemSettingsAppIfNecessary pour forcer une actualisation.

Question 4 : Puis-je omettre des paramètres pour laisser certains réglages inchangés ?

Oui. Le script autorise des paramètres facultatifs pour –stealthMode et –blockAllIncomingConnections.

Implications

L’exécution de ce script a des conséquences immédiates sur la visibilité du réseau macOS et le contrôle d’accès:

• Amélioration de la sécurité des terminaux: En activant le mode furtif et en bloquant le trafic entrant, la surface d’attaque est considérablement réduite.
• Réduction du risque de découverte: Les appareils deviennent invisibles aux balayages ping et aux analyses non sollicitées.
• Préparation à la mise en conformité: S’aligne sur des cadres tels que CIS Benchmarks, NIST et HIPAA.

Cependant, des paramètres agressifs peuvent perturber des flux de travail légitimes, tels que AirDrop, les outils d’accès à distance ou les environnements de développement. Une planification minutieuse est essentielle.

Recommandations

• Toujours tester dans un environnement d’essai avant de procéder à un déploiement massif.
• Associer à des scripts de journalisation/audit pour confirmer que les paramètres ont été appliqués.
• Utiliser la logique conditionnelle dans les outils de déploiement pour détecter la version de macOS avant l’exécution.
• Informer les utilisateurs finaux si les changements ont un impact sur le comportement de leur réseau (par exemple, en bloquant les partages de fichiers entrants).

Conclusion

La gestion des paramètres du pare-feu macOS à grande échelle n’est plus optionnelle, mais une nécessité dans un monde de travail à distance, de mandats de conformité et de menaces en constante évolution. Ce script shell fournit un moyen fiable et flexible de configurer le pare-feu dans macOS, que vous cherchiez à l’activer, le désactiver, ou affiner son fonctionnement.

Avec NinjaOne, les équipes informatiques peuvent déployer ce script de manière optimale sur l’ensemble de leur parc macOS. L’automatisation des politiques, la prise en charge des scripts et la surveillance en temps réel font de NinjaOne la plateforme idéale pour appliquer les contrôles de sécurité du réseau à grande échelle, sans la complexité des solutions MDM traditionnelles.