05 · Hardening area
Accounts & Privileges
Running every day as an administrator hands any malicious process a one-password path to root. Here we cover standard versus admin accounts, sudoers hardening, Touch ID for sudo, password and lock-screen policy, and just-in-time elevation.
sudoersStandard userpam_tid
- macOS Accounts, sudo and Least Privilege: Hardening Guide
Run macOS as a standard user, harden sudoers, enable Touch ID for sudo safely, disable guest and auto-login, and enforce password and screen lock policy.