MediumOS hardeningBLWK-MAC-004

The macOS firewall is off

What this means

The application firewall is off, so any service on this Mac that listens on the network can be reached from whatever network you're on.

How to fix it

Turn it on in System Settings → Network → Firewall (or sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on). Stealth mode is worth enabling too.

Check it yourself

Run a scan and look for BLWK-MAC-004 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads macos_security and reports this check when:

firewall_on_known == true and firewall_on == false

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1133

Related checks

• Cron entry runs a downloader piped to a shell · BLWK-ACCT-001
• Password maximum age is excessively long · BLWK-ACCT-002
• Password minimum age is zero · BLWK-ACCT-003
• Password hashing rounds are not explicitly configured · BLWK-ACCT-004
• Default UMASK is not explicitly configured · BLWK-ACCT-005
• A sensitive system file is world-writable · BLWK-FS-001