{"id":524349,"date":"2025-09-10T15:20:22","date_gmt":"2025-09-10T15:20:22","guid":{"rendered":"https:\/\/www.ninjaone.com\/?post_type=script_hub&p=524349"},"modified":"2025-09-10T15:20:22","modified_gmt":"2025-09-10T15:20:22","slug":"configurer-le-pare-feu-macos-avec-un-script-shell","status":"publish","type":"script_hub","link":"https:\/\/www.ninjaone.com\/fr\/script-hub\/configurer-le-pare-feu-macos-avec-un-script-shell\/","title":{"rendered":"Comment configurer le pare-feu macOS avec un script Shell"},"content":{"rendered":"

Avec les pr\u00e9occupations croissantes concernant la s\u00e9curit\u00e9 des terminaux<\/a>, la gestion des param\u00e8tres du pare-feu macOS \u00e0 grande \u00e9chelle est une responsabilit\u00e9 essentielle pour les professionnels de l’informatique et les fournisseurs de services g\u00e9r\u00e9s (MSP)<\/a>. Qu’il s’agisse de renforcer les MacBooks de l’entreprise ou d’assurer une posture r\u00e9seau furtive pour les appareils sur le terrain, le fait de disposer d’un moyen coh\u00e9rent et automatis\u00e9 d’appliquer les configurations de pare-feu peut r\u00e9duire de mani\u00e8re significative les vuln\u00e9rabilit\u00e9s.<\/p>\n

Cet article pr\u00e9sente un script shell puissant qui permet aux administrateurs informatiques d’activer, de d\u00e9sactiver et de configurer le pare-feu macOS<\/strong>\u00a0de mani\u00e8re programmatique, afin de garantir la conformit\u00e9 et d’\u00e9liminer les erreurs manuelles.<\/p>\n

Contexte<\/h2>\n

macOS comprend un pare-feu int\u00e9gr\u00e9, contr\u00f4l\u00e9 par socketfilterfw<\/strong>, qui offre un contr\u00f4le pr\u00e9cis sur les connexions r\u00e9seau entrantes et une visibilit\u00e9 en mode furtif. Cependant, la modification manuelle de ces param\u00e8tres via l’interface utilisateur des param\u00e8tres du syst\u00e8me n’est pas extensible pour les MSP ou les d\u00e9partements informatiques des grandes entreprises qui g\u00e8rent des centaines ou des milliers de terminaux. De plus, les changements bas\u00e9s sur l’interface utilisateur peuvent \u00eatre ignor\u00e9s ou manqu\u00e9s, ce qui conduit \u00e0 des lignes de base de s\u00e9curit\u00e9 incoh\u00e9rentes.<\/p>\n

Ce script shell est con\u00e7u pour\u00a0configurer le pare-feu macOS de mani\u00e8re programmatique<\/strong>, prenant en charge Ventura (macOS 13) et les versions ult\u00e9rieures. En utilisant des param\u00e8tres tels que –firewallState<\/strong>, –blockAllIncomingConnections<\/strong> et –stealthMode<\/strong>, les professionnels de l’informatique peuvent appliquer les politiques de l’entreprise, se conformer aux cadres de s\u00e9curit\u00e9 et rationaliser le renforcement des terminaux lors de l’int\u00e9gration, de la rem\u00e9diation \u00e0 distance ou de la pr\u00e9paration des audits.<\/p>\n

Le script<\/h2>\n
#!\/usr\/bin\/env bash\r\n#\r\n# Description: This script configures the macOS firewall settings, including enabling\/disabling the firewall, blocking all incoming connections, and setting stealth mode to hide the computer from the network.\r\n# By using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n# Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n# Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n# Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n# Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n# Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n# Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n# EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n#\r\n# Example: --firewallState \"Enabled\" --stealthMode \"Enabled\" --blockAllIncomingConnections \"Yes\"\r\n#\r\n# Verifying the current firewall state.\r\n# The macOS firewall state is already set to 'enabled'.\r\n# Successfully set the firewall state to 'enabled'.\r\n#\r\n# Verifying the current status of the 'Block all incoming connections' setting.\r\n# Setting the block all incoming connections state to 'blocking'.\r\n# Successfully set the block all incoming setting to 'blocking'.\r\n#\r\n# Verifying the current stealth mode state.\r\n# The stealth mode state is already set to 'enabled'.\r\n# Successfully set the stealth mode state to 'enabled'.\r\n#\r\n# Preset Parameter: --firewallState \"Enabled\"\r\n#\t  Enable or disable the overall firewall global state.\r\n#\r\n# Preset Parameter: --stealthMode \"Enabled\"\r\n#\t  Stealth mode hides the computer from the network by not responding to ICMP (ping) packets. Leave blank to not modify the setting.\r\n#\r\n# Preset Parameter: --blockAllIncomingConnections \"Yes\"\r\n#\t  Should all incoming connections be blocked or allowed. Leave blank to not modify the setting.\r\n#\r\n# Preset Parameter: --killSystemSettingsAppIfNecessary\r\n#   Changes to the firewall may not be visible in System Settings until the app is restarted.\r\n#\r\n# Preset Parameter: --help\r\n#\t  Displays some help text.\r\n#\r\n# Minimum OS Architecture Supported: macOS 13 (Ventura)\r\n# Release Notes: Initial Release\r\n\r\n_arg_firewallState=\r\n_arg_blockAllIncomingConnections=\r\n_arg_stealthMode=\r\n_arg_killSystemSettingsIfNecessary=\"off\"\r\n_exitCode=0\r\n\r\nprint_help() {\r\n  printf '\\n%s\\n\\n' 'Usage: [--firewallState|-f <arg>] [--stealthMode|-s <arg>] [--blockAllIncomingConnections|-b <arg>] [--killSystemSettingsAppIfNecessary|-k] [--help|-h]'\r\n  printf '%s\\n' 'Preset Parameter: --firewallState \"Enabled\"'\r\n  printf '\\t%s\\n' \"Enable or disable the overall firewall global state.\"\r\n  printf '%s\\n' 'Preset Parameter: --stealthMode \"Enabled\"'\r\n  printf '\\t%s\\n' \"Stealth mode hides the computer from the network by not responding to ICMP (ping) packets. Leave blank to not modify the setting.\"\r\n  printf '%s\\n' 'Preset Parameter: --blockAllIncomingConnections \"Yes\"'\r\n  printf '\\t%s\\n' \"Should all incoming connections be blocked or allowed. Leave blank to not modify the setting.\"\r\n  printf '%s\\n' 'Preset Parameter: --killSystemSettingsAppIfNecessary'\r\n  printf '\\t%s\\n' \"Changes to the firewall may not be visible in System Settings until the app is restarted.\"\r\n  printf '%s\\n' 'Preset Parameter: --help'\r\n  printf '\\t%s\\n' \"Displays this help menu.\"\r\n}\r\n\r\ndie() {\r\n  local _ret=\"${2:-1}\"\r\n  echo \"$1\" >&2\r\n  test \"${_PRINT_HELP:-no}\" = yes && print_help >&2\r\n  exit \"${_ret}\"\r\n}\r\n\r\nparse_commandline() {\r\n  while test $# -gt 0; do\r\n    _key=\"$1\"\r\n    case \"$_key\" in\r\n    --firewallState | --firewallstate | -f)\r\n      test $# -lt 2 && die \"[Error] Missing value for the required argument '$_key'.\" 1\r\n      _arg_firewallState=$2\r\n      shift\r\n      ;;\r\n    --firewallState=*)\r\n      _arg_firewallState=\"${_key##--firewallState=}\"\r\n      ;;\r\n    --blockAllIncomingConnections | --blockAll | -b)\r\n      test $# -lt 2 && die \"[Error] Missing value for the optional argument '$_key'.\" 1\r\n      _arg_blockAllIncomingConnections=$2\r\n      shift\r\n      ;;\r\n    --blockAllIncomingConnections=*)\r\n      _arg_blockAllIncomingConnections=\"${_key##--blockAllIncomingConnections=}\"\r\n      ;;\r\n    --stealthMode | --stealthmode | -s)\r\n      test $# -lt 2 && die \"[Error] Missing value for the optional argument '$_key'.\" 1\r\n      _arg_stealthMode=$2\r\n      shift\r\n      ;;\r\n    --stealthMode=*)\r\n      _arg_stealthMode=\"${_key##--stealthMode=}\"\r\n      ;;\r\n    --killSystemSettingsIfNecessary | -k)\r\n      _arg_killSystemSettingsIfNecessary=\"on\"\r\n      ;;\r\n    --help | -h)\r\n      _PRINT_HELP=yes die\r\n      ;;\r\n    *)\r\n      _PRINT_HELP=yes die \"[Error] Received an unexpected argument '$1'\" 1\r\n      ;;\r\n    esac\r\n    shift\r\n  done\r\n}\r\n\r\necho \" \"\r\nparse_commandline \"$@\"\r\n\r\n# If script form variables are used, replace the command line parameters with their value.\r\nif [[ -n $firewallState ]]; then\r\n  _arg_firewallState=\"$firewallState\"\r\nfi\r\nif [[ -n $blockAllIncomingConnections ]]; then\r\n  _arg_blockAllIncomingConnections=\"$blockAllIncomingConnections\"\r\nfi\r\nif [[ -n $stealthModeState ]]; then\r\n  _arg_stealthMode=\"$stealthModeState\"\r\nfi\r\nif [[ -n $killSystemSettingsAppIfNecessary && \"$killSystemSettingsAppIfNecessary\" == \"true\" ]]; then\r\n  _arg_killSystemSettingsIfNecessary=\"on\"\r\nfi\r\n\r\n# Ensure the script is run with root permissions.\r\nif [[ $(id -u) -ne 0 ]]; then\r\n  _PRINT_HELP=no die \"[Error] This script must be run with root permissions. Try running it with sudo or as the system\/root user.\" 1\r\nfi\r\n\r\n# Trim whitespace from the firewall state argument.\r\nif [[ -n \"$_arg_firewallState\" ]]; then\r\n  _arg_firewallState=$(echo \"$_arg_firewallState\" | xargs)\r\nfi\r\n\r\n# Ensure a valid firewall state is provided.\r\nif [[ -z \"$_arg_firewallState\" ]]; then\r\n  _PRINT_HELP=yes die \"[Error] Please provide a valid firewall state to set such as 'Enabled' or 'Disabled'.\" 1\r\nfi\r\n\r\n# Convert firewall state to lowercase.\r\nif [[ -n \"$_arg_firewallState\" ]]; then\r\n  _arg_firewallState=$(echo \"$_arg_firewallState\" | tr '[:upper:]' '[:lower:]')\r\nfi\r\n\r\n# Validate the firewall state.\r\nif [[ \"$_arg_firewallState\" != \"enabled\" && \"$_arg_firewallState\" != \"disabled\" ]]; then\r\n  _PRINT_HELP=yes die \"[Error] The firewall state '$_arg_firewallState' is invalid. Please provide a valid firewall state such as 'Enabled' or 'Disabled'.\" 1\r\nfi\r\n\r\n# Process block all incoming connections argument if provided.\r\nif [[ -n \"$_arg_blockAllIncomingConnections\" ]]; then\r\n  _arg_blockAllIncomingConnections=$(echo \"$_arg_blockAllIncomingConnections\" | xargs)\r\n\r\n  # Ensure a valid block all incoming connections state is provided.\r\n  if [[ -z \"$_arg_blockAllIncomingConnections\" ]]; then\r\n    _PRINT_HELP=yes die \"[Error] Please specify whether to block all incoming connections (Yes) or allow all incoming connections (No). You can also leave this setting blank to not modify the current setting.\" 1\r\n  fi\r\n\r\n  # Convert block all incoming connections state to lowercase.\r\n  if [[ -n \"$_arg_blockAllIncomingConnections\" ]]; then\r\n    _arg_blockAllIncomingConnections=$(echo \"$_arg_blockAllIncomingConnections\" | tr '[:upper:]' '[:lower:]')\r\n  fi\r\n\r\n  # Validate the block all incoming connections state.\r\n  if [[ \"$_arg_blockAllIncomingConnections\" != \"yes\" && \"$_arg_blockAllIncomingConnections\" != \"no\" ]]; then\r\n    _PRINT_HELP=yes die \"[Error] The block all incoming connections setting of '$_arg_blockAllIncomingConnections' is invalid. Please specify 'Yes' to block all incoming connections or 'No' to allow all incoming connections.\" 1\r\n  fi\r\n\r\n  # Ensure block all incoming connections is not set to yes when firewall is disabled.\r\n  if [[ \"$_arg_firewallState\" == \"disabled\" && \"$_arg_blockAllIncomingConnections\" == \"yes\" ]]; then\r\n    _PRINT_HELP=yes die \"[Error] The block all incoming connections setting of '$_arg_blockAllIncomingConnections' is invalid. Unable to block all incoming connections while the firewall is disabled.\" 1\r\n  fi\r\nfi\r\n\r\n# Process stealth mode argument if provided.\r\nif [[ -n \"$_arg_stealthMode\" ]]; then\r\n  _arg_stealthMode=$(echo \"$_arg_stealthMode\" | xargs)\r\n\r\n  # Ensure a valid stealth mode state is provided.\r\n  if [[ -z \"$_arg_stealthMode\" ]]; then\r\n    _PRINT_HELP=yes die \"[Error] Please specify a valid stealth mode state such as 'Enabled' or 'Disabled'.\" 1\r\n  fi\r\n\r\n  # Convert stealth mode state to lowercase.\r\n  if [[ -n \"$_arg_stealthMode\" ]]; then\r\n    _arg_stealthMode=$(echo \"$_arg_stealthMode\" | tr '[:upper:]' '[:lower:]')\r\n  fi\r\n\r\n  # Validate the stealth mode state.\r\n  if [[ \"$_arg_stealthMode\" != \"enabled\" && \"$_arg_stealthMode\" != \"disabled\" ]]; then\r\n    _PRINT_HELP=yes die \"[Error] The stealth mode state of '$_arg_stealthMode' is invalid. Please specify a valid stealth mode state such as 'Enabled' or 'Disabled'.\" 1\r\n  fi\r\n\r\n  # Ensure stealth mode is not enabled when firewall is disabled.\r\n  if [[ \"$_arg_firewallState\" == \"disabled\" && \"$_arg_stealthMode\" == \"enabled\" ]]; then\r\n    _PRINT_HELP=yes die \"[Error] The stealth mode state of '$_arg_stealthMode' is invalid. Unable to disable the firewall and enable stealth mode.\" 1\r\n  fi\r\n\r\n  currentIncomingConnectionsSetting=$(\/usr\/libexec\/ApplicationFirewall\/socketfilterfw --getblockall | grep -i \"disable\")\r\n  if [[ -z \"$currentIncomingConnectionsSetting\" && \"$_arg_stealthMode\" == \"disabled\" && (-z \"$_arg_blockAllIncomingConnections\" || \"$_arg_blockAllIncomingConnections\" == \"yes\") ]]; then\r\n    _PRINT_HELP=yes die \"[Error] The stealth mode state of '$_arg_stealthMode' is invalid. Unable to disable stealth mode when block all incoming connections is enabled.\" 1\r\n  fi\r\nfi\r\n\r\n# Verify the current firewall state.\r\necho \"Verifying the current firewall state.\"\r\ncurrentFirewallState=$(\/usr\/libexec\/ApplicationFirewall\/socketfilterfw --getglobalstate | grep -e 'State = [0-9]*' -o | sed 's\/[^0-9]\/\/g')\r\n\r\n# Determine the desired firewall state.\r\ncase \"$_arg_firewallState\" in\r\ndisabled)\r\n  firewallGlobalState=\"off\"\r\n  if [[ \"$currentFirewallState\" == \"0\" ]]; then\r\n    updateFirewallGlobalState=\"false\"\r\n  fi\r\n  ;;\r\nenabled)\r\n  firewallGlobalState=\"on\"\r\n  if [[ \"$currentFirewallState\" == \"1\" || \"$currentFirewallState\" == \"2\" ]]; then\r\n    updateFirewallGlobalState=\"false\"\r\n  fi\r\n  ;;\r\nesac\r\n\r\n# Update the firewall state if necessary.\r\nif [[ \"$updateFirewallGlobalState\" == \"false\" ]]; then\r\n  echo \"The macOS firewall state is already set to '${_arg_firewallState}'.\"\r\nelse\r\n  echo \"Setting the firewall state to '${_arg_firewallState}'.\"\r\n\r\n  if ! \/usr\/libexec\/ApplicationFirewall\/socketfilterfw --setglobalstate \"$firewallGlobalState\"; then\r\n    _PRINT_HELP=no die \"[Error] Failed to set the firewall state of '$_arg_firewallState' by setting the global state to '$firewallGlobalState'.\" 1\r\n  fi\r\nfi\r\n\r\n# Verify the firewall state was updated successfully.\r\ncurrentFirewallState=$(\/usr\/libexec\/ApplicationFirewall\/socketfilterfw --getglobalstate | grep -e 'State = [0-9]*' -o | sed 's\/[^0-9]\/\/g')\r\ncase \"$_arg_firewallState\" in\r\ndisabled)\r\n  if [[ \"$currentFirewallState\" != \"0\" ]]; then\r\n    _PRINT_HELP=no die \"[Error] Failed to set the firewall state of '$_arg_firewallState' by setting the global state to '$firewallGlobalState'. The current state is '$currentFirewallState'.\" 1\r\n  fi\r\n  ;;\r\nenabled)\r\n  if [[ \"$currentFirewallState\" != \"1\" && \"$currentFirewallState\" != \"2\" ]]; then\r\n    _PRINT_HELP=no die \"[Error] Failed to set the firewall state of '$_arg_firewallState' by setting the global state to '$firewallGlobalState'. The current state is '$currentFirewallState'.\" 1\r\n  fi\r\n  ;;\r\nesac\r\n\r\necho \"Successfully set the firewall state to '${_arg_firewallState}'.\"\r\necho \"\"\r\n\r\n# Process block all incoming connections if provided.\r\nif [[ -n \"$_arg_blockAllIncomingConnections\" ]]; then\r\n\r\n  # Verify the current block all incoming connections setting.\r\n  echo \"Verifying the current status of the 'Block all incoming connections' setting.\"\r\n  currentIncomingConnectionsSetting=$(\/usr\/libexec\/ApplicationFirewall\/socketfilterfw --getblockall | grep -i \"disable\")\r\n\r\n  case \"$_arg_blockAllIncomingConnections\" in\r\n  yes)\r\n    blockAllIncoming=\"on\"\r\n    desiredIncomingStatus=\"blocking\"\r\n\r\n    if [[ -z \"$currentIncomingConnectionsSetting\" ]]; then\r\n      updateBlockAllIncomingConnections=\"false\"\r\n    else\r\n      updateBlockAllIncomingConnections=\"true\"\r\n    fi\r\n\r\n    ;;\r\n  no)\r\n    echo \"[Warning] Setting the block all incoming setting to a state of 'disabled'.\"\r\n    blockAllIncoming=\"off\"\r\n    desiredIncomingStatus=\"disabled\"\r\n\r\n    if [[ -n \"$currentIncomingConnectionsSetting\" ]]; then\r\n      updateBlockAllIncomingConnections=\"false\"\r\n    else\r\n      updateBlockAllIncomingConnections=\"true\"\r\n    fi\r\n    ;;\r\n  esac\r\n\r\n  if [[ \"$updateBlockAllIncomingConnections\" == \"false\" ]]; then\r\n    echo \"The block all incoming state is already set to '${desiredIncomingStatus}'.\"\r\n  else\r\n    echo \"Setting the block all incoming connections state to '${desiredIncomingStatus}'.\"\r\n\r\n    if ! \/usr\/libexec\/ApplicationFirewall\/socketfilterfw --setblockall \"$blockAllIncoming\"; then\r\n      _PRINT_HELP=no die \"[Error] Failed to set the block all incoming state to '$desiredIncomingStatus'.\" 1\r\n    fi\r\n  fi\r\n\r\n  # Verify the block all incoming connections setting was updated successfully.\r\n  currentIncomingConnectionsSetting=$(\/usr\/libexec\/ApplicationFirewall\/socketfilterfw --getblockall | grep -i \"disable\")\r\n  case \"$_arg_blockAllIncomingConnections\" in\r\n  yes)\r\n    if [[ -n \"$currentIncomingConnectionsSetting\" ]]; then\r\n      _PRINT_HELP=no die \"[Error] Failed to set the block all incoming state to '$desiredIncomingStatus'.\" 1\r\n    fi\r\n    ;;\r\n  no)\r\n    if [[ -z \"$currentIncomingConnectionsSetting\" ]]; then\r\n      _PRINT_HELP=no die \"[Error] Failed to set the block all incoming state to '$desiredIncomingStatus'.\" 1\r\n    fi\r\n    ;;\r\n  esac\r\n\r\n  echo \"Successfully set the block all incoming setting to '${desiredIncomingStatus}'.\"\r\n  echo \"\"\r\nfi\r\n\r\n# Process stealth mode if provided.\r\nif [[ -n \"$_arg_stealthMode\" ]]; then\r\n  # Verify the current stealth mode state.\r\n  echo \"Verifying the current stealth mode state.\"\r\n  currentStealthModeState=$(\/usr\/libexec\/ApplicationFirewall\/socketfilterfw --getstealthmode | grep -E \"off|disable\")\r\n\r\n  case \"$_arg_stealthMode\" in\r\n  disabled)\r\n    desiredStealthModeState=\"off\"\r\n\r\n    if [[ -n \"$currentStealthModeState\" ]]; then\r\n      updateStealthModeState=\"false\"\r\n    else\r\n      updateStealthModeState=\"true\"\r\n    fi\r\n    ;;\r\n  enabled)\r\n    desiredStealthModeState=\"on\"\r\n\r\n    if [[ -z \"$currentStealthModeState\" ]]; then\r\n      updateStealthModeState=\"false\"\r\n    else\r\n      updateStealthModeState=\"true\"\r\n    fi\r\n    ;;\r\n  esac\r\n\r\n  if [[ \"$updateStealthModeState\" == \"false\" ]]; then\r\n    echo \"The stealth mode state is already set to '${_arg_stealthMode}'.\"\r\n  else\r\n    echo \"Setting the stealth mode state to '${_arg_stealthMode}'.\"\r\n\r\n    if ! \/usr\/libexec\/ApplicationFirewall\/socketfilterfw --setstealthmode \"$desiredStealthModeState\"; then\r\n      _PRINT_HELP=no die \"[Error] Failed to set the stealth mode state of '$_arg_stealthMode' by setting the state to '$desiredStealthModeState'.\" 1\r\n    fi\r\n  fi\r\n\r\n  # Verify the stealth mode state was updated successfully.\r\n  currentStealthModeState=$(\/usr\/libexec\/ApplicationFirewall\/socketfilterfw --getstealthmode | grep -E \"off|disable\")\r\n\r\n  case \"$_arg_stealthMode\" in\r\n  disabled)\r\n    if [[ -z \"$currentStealthModeState\" ]]; then\r\n      _PRINT_HELP=no die \"[Error] Failed to set the stealth mode state of '$_arg_stealthMode' by setting the state to '$desiredStealthModeState'.\" 1\r\n    fi\r\n    ;;\r\n  enabled)\r\n    if [[ -n \"$currentStealthModeState\" ]]; then\r\n      _PRINT_HELP=no die \"[Error] Failed to set the stealth mode state of '$_arg_stealthMode' by setting the state to '$desiredStealthModeState'.\" 1\r\n    fi\r\n    ;;\r\n  esac\r\n\r\n  echo \"Successfully set the stealth mode state to '${_arg_stealthMode}'.\"\r\n  echo \"\"\r\nfi\r\n\r\n# Check if the 'System Settings' application is running.\r\nsystemSettingsProcess=$(pgrep -x \"System Settings\")\r\n\r\n# If the 'System Settings' application is running and the kill flag is not set, warn the user.\r\nif [[ \"$_arg_killSystemSettingsIfNecessary\" != \"on\" && -n \"$systemSettingsProcess\" ]]; then\r\n  echo \"[Warning] The 'System Settings' application is currently running with process ID (PID) '$systemSettingsProcess'.\"\r\n  echo \"[Warning] You may need to restart this application for the firewall changes to become visible.\"\r\nfi\r\n\r\n# If the kill flag is set and the 'System Settings' application is running, kill the application.\r\nif [[ \"$_arg_killSystemSettingsIfNecessary\" == \"on\" && -n \"$systemSettingsProcess\" ]]; then\r\n  for pid in $systemSettingsProcess; do\r\n    echo \"[Warning] Killing the 'System Settings' application with process ID (PID) '$pid'.\"\r\n\r\n    # Attempt to kill the process and handle any errors.\r\n    if ! kill -9 \"$pid\"; then\r\n      echo \"[Error] Failed to kill the application with process ID (PID) '$pid'.\" >&2\r\n      _exitCode=1\r\n    else\r\n      echo \"Killed process with PID $pid.\"\r\n    fi\r\n  done\r\nfi\r\n\r\n# If the 'System Settings' application is not running, inform the user that the changes are complete.\r\nif [[ -z \"$systemSettingsProcess\" ]]; then\r\n  echo \"The 'System Settings' application is not currently running. The changes are now complete.\"\r\nfi\r\n\r\nexit \"$_exitCode\"<\/pre>\n
 <\/p>\n\n
Description d\u00e9taill\u00e9e<\/h2>\n
Ce script est structur\u00e9 de mani\u00e8re \u00e0 g\u00e9rer quatre op\u00e9rations principales :<\/p>\n
    \n
  1. Analyser les arguments de la ligne de commande<\/strong>\u00a0pour d\u00e9terminer les param\u00e8tres \u00e0 appliquer.<\/li>\n
  2. Valider les entr\u00e9es utilisateur<\/strong>\u00a0pour l’\u00e9tat du pare-feu, le mode furtif et les param\u00e8tres de blocage.<\/li>\n
  3. Appliquer les changements en utilisant l’outil CLI\u00a0<\/strong>socketfilterfw<\/strong>\u00a0de macOS<\/strong>.<\/li>\n
  4. Il est possible de d\u00e9sactiver l’interface graphique \u00ab\u00a0Param\u00e8tres du syst\u00e8me\u00a0\u00bb<\/strong>\u00a0afin de refl\u00e9ter les modifications apport\u00e9es au pare-feu en temps r\u00e9el.<\/li>\n<\/ol>\n
    Param\u00e8tres cl\u00e9s<\/h3>\n\n\n\n\n\n\n\n\n
    Param\u00e8tres<\/strong><\/td>\nAction<\/strong><\/td>\n<\/tr>\n
    –firewallState<\/strong><\/td>\nActive ou d\u00e9sactive le pare-feu global (Activ\u00e9 \/ D\u00e9sactiv\u00e9)<\/td>\n<\/tr>\n
    –blockAllIncomingConnections<\/strong><\/td>\nBloque tout le trafic entrant (Oui \/ Non)<\/td>\n<\/tr>\n
    –stealthMode<\/strong><\/td>\nActive le mode furtif (ignore les requ\u00eates ping et ICMP)<\/td>\n<\/tr>\n
    –killSystemSettingsAppIfNecessary<\/strong><\/td>\nRed\u00e9marrage forc\u00e9 des param\u00e8tres du syst\u00e8me pour que l’interface utilisateur refl\u00e8te le nouvel \u00e9tat<\/td>\n<\/tr>\n
    –help<\/strong><\/td>\nAffiche les instructions d’utilisation<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
    Cette approche modulaire en fait un outil id\u00e9al pour l’int\u00e9gration avec des plateformes d’automatisation comme NinjaOne.<\/p>\n
    Cas d’utilisation potentiels<\/h2>\n
    Cas de figure\u00a0: Mise en conformit\u00e9 \u00e0 distance<\/h3>\n
    Un MSP du secteur de la sant\u00e9 g\u00e8re plus de 150 ordinateurs portables macOS utilis\u00e9s par des cliniciens travaillant hors site. Pour se conformer \u00e0 la loi HIPAA<\/a>, chaque dispositif doit bloquer toutes les connexions entrantes et fonctionner en mode furtif. Le MSP d\u00e9ploie ce script via le moteur d’automatisation de NinjaOne avec les param\u00e8tres :<\/p>\n\n\n\n
    bash<\/p>\n
    CopyEdit<\/p>\n
    .\/configure_firewall.sh –firewallState \u00ab\u00a0Enabled\u00a0\u00bb –stealthMode \u00ab\u00a0Enabled\u00a0\u00bb –blockAllIncomingConnections \u00ab\u00a0Yes\u00a0\u00bb –killSystemSettingsAppIfNecessary<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
    Cela permet de s’assurer que tous les dispositifs sont renforc\u00e9s pour r\u00e9pondre aux normes r\u00e9glementaires, sans intervention manuelle de la part de l’utilisateur.<\/p>\n
    Comparaisons<\/strong><\/h3>\n\n\n\n\n\n\n\n
    Approche<\/strong><\/td>\nAvantages<\/strong><\/td>\nInconv\u00e9nients<\/strong><\/td>\n<\/tr>\n
    Ce script shell<\/strong><\/td>\nAutomatisation compl\u00e8te, validation r\u00e9p\u00e9table, bas\u00e9e sur l’interface de programmation<\/td>\nN\u00e9cessite un acc\u00e8s root<\/td>\n<\/tr>\n
    Configuration manuelle de l’interface utilisateur<\/strong><\/td>\nAucune connaissance en mati\u00e8re de script n’est n\u00e9cessaire<\/td>\nNon \u00e9volutive, sujette aux erreurs<\/td>\n<\/tr>\n
    Profils MDM (Jamf, Kandji)<\/strong><\/td>\nCentralis\u00e9, conforme<\/td>\nN\u00e9cessite une plateforme MDM sous licence<\/td>\n<\/tr>\n
    Apple Configurator<\/strong><\/td>\nId\u00e9al pour le provisionnement initial<\/td>\nImpossible \u00e0 mettre en \u0153uvre apr\u00e8s le d\u00e9ploiement<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
    Bien que les MDM offrent un contr\u00f4le au niveau de l’entreprise, de nombreuses entreprises pr\u00e9f\u00e8rent des outils l\u00e9gers, bas\u00e9s sur des scripts, pour leur flexibilit\u00e9 et leurs frais g\u00e9n\u00e9raux minimes, en particulier lorsqu’ils sont int\u00e9gr\u00e9s dans des outils tels que NinjaOne<\/a>.<\/p>\n
    Questions fr\u00e9quentes<\/h2>\n
    Question 1\u00a0: Ce script prend-il en charge les anciennes versions de macOS comme Catalina ou Big Sur ?<\/h3>\n
    Non. Il est con\u00e7u pour macOS 13 Ventura et les versions ult\u00e9rieures. Le comportement des versions ant\u00e9rieures n’est pas garanti.<\/p>\n
    Question 2\u00a0: Puis-je activer le mode furtif lorsque le pare-feu est d\u00e9sactiv\u00e9 ?<\/h3>\n
    Non. Le script emp\u00eache l’activation du mode furtif lorsque le pare-feu est d\u00e9sactiv\u00e9 afin d’\u00e9viter les erreurs de configuration.<\/p>\n
    Question 3\u00a0: Les param\u00e8tres du syst\u00e8me refl\u00e8tent-ils imm\u00e9diatement ces changements ?<\/h3>\n
    Pas toujours. C’est pourquoi le script inclut l’option –killSystemSettingsAppIfNecessary<\/strong> pour forcer une actualisation.<\/p>\n
    Question 4\u00a0: Puis-je omettre des param\u00e8tres pour laisser certains r\u00e9glages inchang\u00e9s ?<\/h3>\n
    Oui. Le script autorise des param\u00e8tres facultatifs pour –stealthMode<\/strong> et –blockAllIncomingConnections<\/strong>.<\/p>\n
    Implications<\/h2>\n
    L’ex\u00e9cution de ce script a des cons\u00e9quences imm\u00e9diates sur la\u00a0visibilit\u00e9 du r\u00e9seau macOS et le contr\u00f4le d’acc\u00e8s<\/strong>:<\/p>\n