HELP...Computer will not boot after NSA Security Recomendations applied

C

clamasters

Registered
Well here is the problem. I'm in the Marine Corps and work as IA/IT. Locking down Windows isn't very hard but locking down OS X even further was a little more complicated. I did stumble upon the NSA security recommendations and I did some of the recommendations however I did not do all of them. Now I cannot log back into my computer. The bootup hangs on "logon window starting". This would be an easy fix if my cdrom worked however it is broken and will not read cds at all. What I am trying to figure out is if there is anything I can do from the single user mode. I'm not very unix savvy but I learn pretty quickly. Sending the computer into Apple is not really an option, I'm currently stationed in Iraq and do not trust the mail delivery system here.

Any input would be great. Thanks

Curtis
 
To boot into Single user mode is easy. Boot the computer up while holding down the Command button (the Apple Key by the space board)+s. A black screen will come online and slowly go a prompt. At the prompt type fsck -yf . The program will check the disk. when finished it will either tell you it is all OK or it has errors. If it has errosr repeat the fsck-yf command. After the disk says all is OK, type reboot. The Mac then will attempt to boot into Mac OS X.
 
i did everything between "SECURING THE ROOT ACCOUNT" on page 59 of the nsa reccomendation guide to page 63 however I somehow didnt see this part so i didnt do it.

Only if the ability to boot into single-user mode is operationally required should a
password be provided for the root account in /etc/master.passwd. To provide
this password:
1. Log in as an administrator.
2. Start the Terminal application, located in /Applications/Utilities.
3. At the prompt, issue the command:
cd /etc
4. To edit the master password file, issue the command:
sudo pico master.passwd
5. Within the editor, delete the asterisk following the word “root”.
6. Open a new terminal window and issue the following command, replacing
<xx> with two random characters and <password> with an appropriate
8-character password:
openssl passwd -salt <xx> <password>
A hash of the password will be displayed after executing the command.
7. Type or paste the password hash where the asterisk was deleted in step 10.
8. Exit, saving changes.

but i did do the openssl passwd -salt command and pasted that into the netinfo manager in place of the *.

I hope that helps explain what i did.

the guide can be found at www.nsa.gov/snac
 
So my first question is had you enabled the root account before you tried to secure it? By default on OS X the root account is disabled, that is you cannot log into it at all.

Did you try to boot into single user mode as described above? If so were you able to log on at your normal user or root?
 
i logged into single user mode and im pretty sure i was logged in as root however i did not have to type in a password. i used the fsck -yf command and it came up clean. what i think happened is i was doing the portion of the lock down that whipes out all os9 files, i might have typed something in wrong and deleted the wrong thing.

is there anyway to bypass the logon screen and have the os boot straight into a user instead of asking for a user and password so i can just bypass the logon screen altogether. if not oh well. fedex will only cost me like 100bucks to get her back home and to apple. but i would like to get some files off of there first. thanks.

Curtis
 
clamasters said:
is there anyway to bypass the logon screen and have the os boot straight into a user instead of asking for a user and password so i can just bypass the logon screen altogether.
Click to expand...

If you are you have an administrator account, go to System Preferences->Accounts->Login Options. then check the checkbox "Automatically log in as ...." and then select the user.
 
Thats the problem. I can't login at all. It hangs forever on the start screen while it says "Login Window Starting". I let the damn thing sit there for 36 hours hoping for it to do something but it doesnt. It just sits there.

Curtis
 
If you have access to another Mac where you are, and a FireWire cable, you can plug either end of the cable into each of the macs, boot up the other Mac, then boot yours while holding "T" (for Target Disk Mode).

It'll mount as a FireWire hard disk on the other Mac and at very least you can get to your files (in a GUI, instead of in SU mode).

If your CD drive doesn't work at all, it's possibly worthwhile getting it fixed by Apple anyway.
 
You must log in or register to reply here.
Back
Top