Repolode
Submit
drduh

drduh/macOS-Security-and-Privacy-Guide

A community guide of hands-on techniques for hardening security and privacy on Apple silicon Macs, from FileVault and the firewall to DNS, VPNs and messaging.

View on GitHubWebsite
Stars
22,566
Forks
1,469
Open issues
5
Last commit
4 days ago

What is it?

This is a long-form guide to improving the security and privacy of macOS, targeting Apple silicon Macs. It is written for experienced users who want practices common in organizations, and it is also approachable for newcomers interested in privacy. It begins with threat modeling, then walks through installation, accounts, FileVault, Lockdown Mode, and firewall options.

The guide goes deeper into network and application topics. It covers the built-in application firewall, the pf packet filter with sample rules, encrypted DNS via dnscrypt-proxy and dnsmasq, hosts-file blocking, Privoxy filtering, certificate authority review, and browser, Tor, VPN, PGP and messenger setup. Sections on malware defenses such as the App Sandbox, Gatekeeper and SIP, along with backup, SSH and logging, round out the coverage.

The guide is provided as-is, and each section includes commands and configuration snippets that readers can apply after understanding the trade-offs.

Key features

  • 01Threat-model framework for deciding which protections are worth the trade-offs
  • 02Guidance on FileVault, Lockdown Mode, and firmware security settings
  • 03Application firewall and pf packet filter configuration with sample rules
  • 04Encrypted DNS setup using dnscrypt-proxy and dnsmasq, plus hosts-file blocking
  • 05Privacy and security notes for browsers, VPNs, PGP, and messaging apps

Use cases

  • Hardening a personal or work MacBook after setting it up
  • Learning which macOS security controls exist and what each one protects against
  • Configuring encrypted DNS and network-level blocking on a Mac
  • Reviewing a Mac's security posture against a checklist

Quick start

  1. 1

    Read the guide in your browser from the README

Things to know

  • Written for Apple silicon Macs; it does not target other hardware.
  • The guide is provided as is, without warranties, and you are solely responsible for consequences of following it.

In collections

Open-source Mac appsPrivacy & local-first toolsSecurity scanners, audits & threat intel tools

Topics

#macos#security#privacy#hardening#disk-encryption#firewall#dns#guide#apple#checklist

FAQ

What is macOS-Security-and-Privacy-Guide?
A community guide of hands-on techniques for hardening security and privacy on Apple silicon Macs, from FileVault and the firewall to DNS, VPNs and messaging. This is a long-form guide to improving the security and privacy of macOS, targeting Apple silicon Macs. It is written for experienced users who want practices common in organizations, and it is also approachable for newcomers interested in privacy. It begins with threat modeling, then walks through installation, accounts, FileVault, Lockdown Mode, and firewall options.
Is macOS-Security-and-Privacy-Guide free to use? What license does it have?
macOS-Security-and-Privacy-Guide is open source under the MIT license. Check the license terms before using it in commercial products.
Is macOS-Security-and-Privacy-Guide still maintained?
Actively maintained. The last commit to macOS-Security-and-Privacy-Guide was on Oct 21, 2026.
What can I use macOS-Security-and-Privacy-Guide for?
Hardening a personal or work MacBook after setting it up Learning which macOS security controls exist and what each one protects against Configuring encrypted DNS and network-level blocking on a Mac Reviewing a Mac's security posture against a checklist
How do I install macOS-Security-and-Privacy-Guide?
Read the guide in your browser from the README
Where can I get macOS-Security-and-Privacy-Guide?
The source code and installation instructions are on GitHub: https://github.com/drduh/macOS-Security-and-Privacy-Guide

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects