Securing System Startup
When a computer starts up, it first starts either Open Firmware or Extensible Firmware
Interface (EFI). EFI is similar to Open Firmware, but it runs on Intel-based Macintosh
computers. Open Firmware or EFI determines which partition or disk to load Mac OS X
from. They also allow (or prevent) the user to enter single-user mode.
Single-user mode automatically logs in the user as “root.”This is dangerous because
root user access is the most powerful level of access, and actions performed as root are
anonymous.
If you create an Open Firmware or EFI password, you disable single-user mode.
The password also stops users from loading unapproved partitions or disks, and from
enabling target disk mode at startup.
After creating an Open Firmware or EFI password, you must enter this password when
you start the computer from an alternate disk (for situations such as hard drive failure
or file system repair).
Chapter 3 Protecting Hardware and Securing Global System Settings
To secure startup, perform one of the following tasks:
- Use the Open Firmware Password application to set the Open Firmware password
- Set the Open Firmware password within Open Firmware
- Verify and set the security mode from the command line
WARNING: Open Firmware settings are critical. Take great care when modifying these
settings and when creating a secure Open Firmware password.
Open Firmware password protection can be bypassed if the user changes the
physical memory configuration of the machine and then resets the PRAM three times
(by holding down Command, Option, P, and R keys during system startup). An Open
Firmware password will provide some protection, however, it can be reset if a user has
physical access to the machine and can change the physical memory configuration of
the machine.
You can require a password to start single-user mode, which would further secure your
computer.
For more information about Open Firmware password protection, see AppleCare
Knowledge Base article #106482,“Setting up Open Firmware Password protection in
Mac OS X 10.1 or later” (www.apple.com/support/), and AppleCare Knowledge Base
article #107666,“Open Firmware: Password Not Recognized when it Contains the Letter
‘U’” (www.apple.com/support/).
Using the Open Firmware Password Application
The Mac OS X installation disc includes Open Firmware Password application,
an application that allows you to enable an Open Firmware or EFI password.
To use the Open Firmware Password application:
1 Log in with an administrator account and open Open Firmware Password application
(located on the Mac OS X installation disc in /Applications/Utilities/).
2 Click Change.
3 Select “Require password to change Open Firmware settings.”
To disable the Open Firmware or EFI password, deselect “Require password to change
Open Firmware settings.”You won’t have to enter a password and verify it. Disabling
the Open Firmware password is only recommended for when you install Mac OS X.
4 Enter a new Open Firmware or EFI password in the Password and Verify fields. Click OK.
This password can be up to eight characters.
Do not use the capital letter “U” in an Open Firmware password.
Chapter 3 Protecting Hardware and Securing Global System Settings
5 Close the Open Firmware Password application.
You can test your settings by attempting to start up in single-user mode. Restart the
computer while holding down the Command and S keys. If the login window loads,
changes made by the Open Firmware Password application completed successfully.
