Tutorial

Firewall Management for macOS

Implement enterprise-grade firewall management across your MacFleet deployment with automated security policies, advanced network protection, threat detection, and comprehensive compliance monitoring. This tutorial provides solutions for maintaining robust network security while ensuring regulatory compliance and operational efficiency.

Understanding macOS Firewall Management

macOS provides several firewall management tools and mechanisms:

• Application Firewall - Built-in firewall that blocks incoming connections
• socketfilterfw - Command-line tool for firewall configuration
• pfctl - Packet Filter control utility (advanced filtering)
• System Preferences - GUI firewall management interface
• Configuration Profiles - MDM-based firewall policy deployment

Basic Firewall Operations

Enable Firewall

#!/bin/bash

# Enable macOS firewall
sudo defaults write /Library/Preferences/com.apple.alf globalstate -int 1

Disable Firewall

#!/bin/bash

# Disable macOS firewall
sudo defaults write /Library/Preferences/com.apple.alf globalstate -int 0

Check Firewall Status

#!/bin/bash

# Check firewall status
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate

Enterprise Firewall Management System

Comprehensive Firewall Management Tool

#!/bin/bash

# MacFleet Enterprise Firewall Management Tool
# Advanced network security and compliance monitoring

# Configuration
CONFIG_FILE="/etc/macfleet/firewall_policy.conf"
LOG_FILE="/var/log/macfleet_firewall.log"
RULES_DIR="/Library/MacFleet/FirewallRules"
AUDIT_LOG="/var/log/macfleet_firewall_audit.log"

# Create directories
mkdir -p "$(dirname "$CONFIG_FILE")" "$(dirname "$LOG_FILE")" "$RULES_DIR" "$(dirname "$AUDIT_LOG")"

# Default firewall policy
cat > "$CONFIG_FILE" 2>/dev/null << 'EOF' || true
# MacFleet Enterprise Firewall Management Policy
# Version: 2.0

# Firewall Enforcement Settings
ENFORCE_FIREWALL_ENABLED=true
AUTO_ENABLE_ON_VIOLATION=true
BLOCK_ALL_INCOMING_DEFAULT=true
ALLOW_SIGNED_APPS=true
STEALTH_MODE_ENABLED=true

# Application Control
WHITELIST_SYSTEM_APPS=true
REQUIRE_APP_SIGNATURES=true
BLOCK_UNSIGNED_APPS=true
LOG_ALL_CONNECTIONS=true
AUTO_BLOCK_SUSPICIOUS_APPS=true

# Network Security Policies
BLOCK_PRIVATE_NETWORKS=false
ALLOW_APPLE_SERVICES=true
BLOCK_P2P_CONNECTIONS=true
MONITOR_OUTBOUND_CONNECTIONS=true
RATE_LIMIT_CONNECTIONS=true

# Advanced Security Features
INTRUSION_DETECTION=true
THREAT_INTELLIGENCE_ENABLED=true
GEO_BLOCKING_ENABLED=false
DLP_INSPECTION=true
MALWARE_DETECTION=true

# Compliance and Monitoring
COMPLIANCE_MONITORING=true
SECURITY_BASELINE_ENFORCEMENT=true
AUTOMATED_REPORTING=true
REAL_TIME_ALERTS=true
INCIDENT_RESPONSE=true

# Policy Templates
DEFAULT_SECURITY_PROFILE="corporate_high"
ALLOWED_PORTS="22,53,80,443,993,995"
BLOCKED_COUNTRIES=""
WHITELIST_DOMAINS="*.apple.com,*.icloud.com"

# Maintenance Settings
AUTO_UPDATE_RULES=true
BACKUP_CONFIGURATIONS=true
LOG_RETENTION_DAYS=90
PERFORMANCE_MONITORING=true
EOF

# Source configuration
source "$CONFIG_FILE" 2>/dev/null || true

# Logging function
log_action() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
}

# Audit logging function
audit_log() {
    local action="$1"
    local result="$2"
    local details="$3"
    echo "$(date '+%Y-%m-%d %H:%M:%S') - ACTION:$action RESULT:$result DETAILS:$details USER:$(whoami)" >> "$AUDIT_LOG"
}

# Get current firewall status
get_firewall_status() {
    echo "=== Current Firewall Status ==="
    
    # Check global firewall state
    local global_state
    global_state=$(/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate 2>/dev/null | grep -o "enabled\|disabled")
    
    echo "Global Firewall State: $global_state"
    
    # Check stealth mode
    local stealth_mode
    stealth_mode=$(/usr/libexec/ApplicationFirewall/socketfilterfw --getstealthmode 2>/dev/null | grep -o "enabled\|disabled")
    
    echo "Stealth Mode: $stealth_mode"
    
    # Check logging state
    local logging_state
    logging_state=$(/usr/libexec/ApplicationFirewall/socketfilterfw --getloggingmode 2>/dev/null | grep -o "enabled\|disabled")
    
    echo "Logging: $logging_state"
    
    # Check block all mode
    local block_all
    block_all=$(/usr/libexec/ApplicationFirewall/socketfilterfw --getblockall 2>/dev/null | grep -o "enabled\|disabled")
    
    echo "Block All Incoming: $block_all"
    
    # Check allowed applications
    echo -e "\nAllowed Applications:"
    /usr/libexec/ApplicationFirewall/socketfilterfw --listapps 2>/dev/null | grep "ALF" | head -10
    
    return 0
}

# Enable firewall with enterprise settings
enterprise_firewall_enable() {
    local security_profile="${1:-$DEFAULT_SECURITY_PROFILE}"
    
    echo "=== Enabling Enterprise Firewall ==="
    echo "Security Profile: $security_profile"
    
    # Enable global firewall
    log_action "Enabling global firewall"
    if sudo defaults write /Library/Preferences/com.apple.alf globalstate -int 1; then
        echo "✅ Global firewall enabled"
        audit_log "FIREWALL_ENABLE" "SUCCESS" "Global firewall activated"
    else
        echo "❌ Failed to enable global firewall"
        audit_log "FIREWALL_ENABLE" "FAILED" "Global firewall activation failed"
        return 1
    fi
    
    # Configure based on security profile
    case "$security_profile" in
        "corporate_high")
            configure_high_security_profile
            ;;
        "corporate_standard")
            configure_standard_security_profile
            ;;
        "developer")
            configure_developer_profile
            ;;
        "kiosk")
            configure_kiosk_profile
            ;;
        *)
            echo "Unknown security profile, using standard configuration"
            configure_standard_security_profile
            ;;
    esac
    
    # Enable stealth mode if required
    if [[ "$STEALTH_MODE_ENABLED" == "true" ]]; then
        enable_stealth_mode
    fi
    
    # Enable logging if required
    if [[ "$LOG_ALL_CONNECTIONS" == "true" ]]; then
        enable_firewall_logging
    fi
    
    # Apply application rules
    configure_application_rules
    
    echo "✅ Enterprise firewall configuration completed"
    log_action "Enterprise firewall enabled with profile: $security_profile"
    
    return 0
}

# Configure high security profile
configure_high_security_profile() {
    echo "=== Configuring High Security Profile ==="
    
    # Block all incoming connections by default
    sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setblockall on 2>/dev/null
    
    # Enable stealth mode
    sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on 2>/dev/null
    
    # Disable automatic allow for signed apps
    sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setallowsigned off 2>/dev/null
    
    # Block all unsigned applications
    sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setallowsignedapp off 2>/dev/null
    
    echo "High security profile configured"
    log_action "High security firewall profile applied"
}

# Configure standard security profile
configure_standard_security_profile() {
    echo "=== Configuring Standard Security Profile ==="
    
    # Allow essential incoming connections
    sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setblockall off 2>/dev/null
    
    # Enable stealth mode
    sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on 2>/dev/null
    
    # Allow signed applications
    if [[ "$ALLOW_SIGNED_APPS" == "true" ]]; then
        sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setallowsigned on 2>/dev/null
    fi
    
    echo "Standard security profile configured"
    log_action "Standard security firewall profile applied"
}

# Configure developer profile
configure_developer_profile() {
    echo "=== Configuring Developer Profile ==="
    
    # Allow more permissive settings for development
    sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setblockall off 2>/dev/null
    sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode off 2>/dev/null
    sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setallowsigned on 2>/dev/null
    sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setallowsignedapp on 2>/dev/null
    
    # Add common development tools
    local dev_apps=(
        "/Applications/Xcode.app"
        "/Applications/Visual Studio Code.app"
        "/Applications/Docker.app"
        "/usr/bin/ssh"
        "/usr/bin/python3"
    )
    
    for app in "${dev_apps[@]}"; do
        if [[ -e "$app" ]]; then
            sudo /usr/libexec/ApplicationFirewall/socketfilterfw --add "$app" 2>/dev/null
            sudo /usr/libexec/ApplicationFirewall/socketfilterfw --unblock "$app" 2>/dev/null
        fi
    done
    
    echo "Developer profile configured"
    log_action "Developer firewall profile applied"
}

# Configure kiosk profile
configure_kiosk_profile() {
    echo "=== Configuring Kiosk Profile ==="
    
    # Maximum security for kiosk devices
    sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setblockall on 2>/dev/null
    sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on 2>/dev/null
    sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setallowsigned off 2>/dev/null
    sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setallowsignedapp off 2>/dev/null
    
    # Only allow essential system applications
    local kiosk_apps=(
        "/System/Library/CoreServices/Finder.app"
        "/Applications/Safari.app"
    )
    
    for app in "${kiosk_apps[@]}"; do
        if [[ -e "$app" ]]; then
            sudo /usr/libexec/ApplicationFirewall/socketfilterfw --add "$app" 2>/dev/null
            sudo /usr/libexec/ApplicationFirewall/socketfilterfw --unblock "$app" 2>/dev/null
        fi
    done
    
    echo "Kiosk profile configured"
    log_action "Kiosk firewall profile applied"
}

# Enable stealth mode
enable_stealth_mode() {
    echo "=== Enabling Stealth Mode ==="
    
    if sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on 2>/dev/null; then
        echo "✅ Stealth mode enabled"
        log_action "Stealth mode enabled"
        audit_log "STEALTH_MODE" "ENABLED" "Device hidden from network scans"
    else
        echo "❌ Failed to enable stealth mode"
        log_action "FAILED: Stealth mode enable"
    fi
}

# Enable firewall logging
enable_firewall_logging() {
    echo "=== Enabling Firewall Logging ==="
    
    if sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setloggingmode on 2>/dev/null; then
        echo "✅ Firewall logging enabled"
        log_action "Firewall logging enabled"
        audit_log "LOGGING" "ENABLED" "All firewall events will be logged"
    else
        echo "❌ Failed to enable firewall logging"
        log_action "FAILED: Firewall logging enable"
    fi
}

# Configure application rules
configure_application_rules() {
    echo "=== Configuring Application Rules ==="
    
    # Essential system applications
    local essential_apps=(
        "/System/Library/CoreServices/Software Update.app"
        "/usr/sbin/sshd"
        "/usr/bin/ssh"
        "/Applications/App Store.app"
    )
    
    # Add and allow essential applications
    for app in "${essential_apps[@]}"; do
        if [[ -e "$app" ]]; then
            sudo /usr/libexec/ApplicationFirewall/socketfilterfw --add "$app" 2>/dev/null
            sudo /usr/libexec/ApplicationFirewall/socketfilterfw --unblock "$app" 2>/dev/null
            echo "✅ Allowed: $(basename "$app")"
        fi
    done
    
    # Block known problematic applications
    local blocked_apps=(
        "/Applications/BitTorrent.app"
        "/Applications/P2P Client.app"
    )
    
    for app in "${blocked_apps[@]}"; do
        if [[ -e "$app" ]]; then
            sudo /usr/libexec/ApplicationFirewall/socketfilterfw --add "$app" 2>/dev/null
            sudo /usr/libexec/ApplicationFirewall/socketfilterfw --block "$app" 2>/dev/null
            echo "🚫 Blocked: $(basename "$app")"
        fi
    done
    
    log_action "Application firewall rules configured"
}

# Disable firewall (with safety checks)
enterprise_firewall_disable() {
    local force="${1:-false}"
    local reason="$2"
    
    echo "=== Disabling Enterprise Firewall ==="
    
    if [[ "$force" != "true" ]]; then
        echo "⚠️  WARNING: Disabling firewall will reduce security"
        echo "Use 'force' parameter to override this warning"
        
        if [[ -z "$reason" ]]; then
            echo "❌ Reason required for firewall disable operation"
            return 1
        fi
    fi
    
    # Log the disable action
    log_action "SECURITY WARNING: Firewall being disabled - Reason: ${reason:-Manual override}"
    audit_log "FIREWALL_DISABLE" "INITIATED" "Reason: ${reason:-Manual override}"
    
    # Disable global firewall
    if sudo defaults write /Library/Preferences/com.apple.alf globalstate -int 0; then
        echo "✅ Global firewall disabled"
        audit_log "FIREWALL_DISABLE" "SUCCESS" "Global firewall deactivated"
        
        # Schedule re-enable if temporary
        if [[ "$reason" == *"temporary"* || "$reason" == *"maintenance"* ]]; then
            schedule_firewall_renable
        fi
        
        return 0
    else
        echo "❌ Failed to disable global firewall"
        audit_log "FIREWALL_DISABLE" "FAILED" "Global firewall deactivation failed"
        return 1
    fi
}

# Schedule firewall re-enable
schedule_firewall_renable() {
    local renable_minutes="${1:-60}"  # Default 1 hour
    
    echo "🕒 Firewall will be automatically re-enabled in $renable_minutes minutes"
    
    # Create background job to re-enable firewall
    (
        sleep $((renable_minutes * 60))
        log_action "Auto re-enabling firewall after maintenance window"
        enterprise_firewall_enable "corporate_standard"
    ) &
    
    local job_pid=$!
    echo "$job_pid" > "/tmp/macfleet_firewall_renable.pid"
    log_action "Firewall re-enable scheduled for $renable_minutes minutes (PID: $job_pid)"
}

# Check firewall compliance
check_firewall_compliance() {
    echo "=== Firewall Compliance Check ==="
    
    local compliance_issues=()
    local compliance_score=100
    
    # Check if firewall is enabled
    local firewall_state
    firewall_state=$(/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate 2>/dev/null | grep -o "enabled\|disabled")
    
    if [[ "$firewall_state" != "enabled" ]]; then
        compliance_issues+=("Firewall not enabled")
        compliance_score=$((compliance_score - 30))
    fi
    
    # Check stealth mode
    if [[ "$STEALTH_MODE_ENABLED" == "true" ]]; then
        local stealth_state
        stealth_state=$(/usr/libexec/ApplicationFirewall/socketfilterfw --getstealthmode 2>/dev/null | grep -o "enabled\|disabled")
        
        if [[ "$stealth_state" != "enabled" ]]; then
            compliance_issues+=("Stealth mode not enabled")
            compliance_score=$((compliance_score - 15))
        fi
    fi
    
    # Check logging
    if [[ "$LOG_ALL_CONNECTIONS" == "true" ]]; then
        local logging_state
        logging_state=$(/usr/libexec/ApplicationFirewall/socketfilterfw --getloggingmode 2>/dev/null | grep -o "enabled\|disabled")
        
        if [[ "$logging_state" != "enabled" ]]; then
            compliance_issues+=("Firewall logging not enabled")
            compliance_score=$((compliance_score - 10))
        fi
    fi
    
    # Check for unauthorized applications
    local unauthorized_apps
    unauthorized_apps=$(/usr/libexec/ApplicationFirewall/socketfilterfw --listapps 2>/dev/null | grep -i "torrent\|p2p\|limewire" | wc -l)
    
    if [[ $unauthorized_apps -gt 0 ]]; then
        compliance_issues+=("Unauthorized applications detected: $unauthorized_apps")
        compliance_score=$((compliance_score - 20))
    fi
    
    # Report compliance status
    echo "Compliance Score: $compliance_score/100"
    
    if [[ ${#compliance_issues[@]} -eq 0 ]]; then
        echo "✅ Firewall configuration is compliant"
        audit_log "COMPLIANCE_CHECK" "PASSED" "Score: $compliance_score/100"
        return 0
    else
        echo "❌ Compliance issues found:"
        printf '  - %s\n' "${compliance_issues[@]}"
        audit_log "COMPLIANCE_CHECK" "FAILED" "Issues: ${#compliance_issues[@]} Score: $compliance_score/100"
        
        # Auto-remediate if enabled
        if [[ "$AUTO_ENABLE_ON_VIOLATION" == "true" ]]; then
            echo "🔧 Auto-remediation enabled, fixing issues..."
            enterprise_firewall_enable "$DEFAULT_SECURITY_PROFILE"
        fi
        
        return 1
    fi
}

# Monitor firewall events
monitor_firewall_events() {
    echo "=== Starting Firewall Event Monitoring ==="
    
    local log_file="/var/log/appfirewall.log"
    
    if [[ ! -f "$log_file" ]]; then
        echo "⚠️  Firewall log file not found. Enabling logging..."
        enable_firewall_logging
        sleep 2
    fi
    
    echo "Monitoring firewall events... Press Ctrl+C to stop"
    
    # Monitor firewall log in real-time
    tail -f "$log_file" 2>/dev/null | while read -r line; do
        if echo "$line" | grep -q "Deny\|Block"; then
            local app_name
            app_name=$(echo "$line" | awk '{print $8}' | cut -d'(' -f1)
            local action
            action=$(echo "$line" | awk '{print $6}')
            
            echo "🚫 $(date '+%H:%M:%S') - BLOCKED: $app_name ($action)"
            
            # Log security event
            log_action "SECURITY EVENT: $action - Application: $app_name"
            audit_log "FIREWALL_BLOCK" "DETECTED" "App: $app_name Action: $action"
            
            # Check for potential threats
            if echo "$app_name" | grep -i -E "(torrent|p2p|hack|crack|keygen)"; then
                echo "🚨 SECURITY ALERT: Potentially malicious application blocked: $app_name"
                log_action "SECURITY ALERT: Malicious app blocked - $app_name"
            fi
        fi
    done
}

# Generate firewall security report
generate_firewall_report() {
    local report_file="$RULES_DIR/firewall_report_$(date +%Y%m%d_%H%M%S).json"
    
    echo "=== Generating Firewall Security Report ==="
    
    # Get current firewall status
    local firewall_enabled="false"
    local stealth_enabled="false"
    local logging_enabled="false"
    local block_all_enabled="false"
    
    if /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate 2>/dev/null | grep -q "enabled"; then
        firewall_enabled="true"
    fi
    
    if /usr/libexec/ApplicationFirewall/socketfilterfw --getstealthmode 2>/dev/null | grep -q "enabled"; then
        stealth_enabled="true"
    fi
    
    if /usr/libexec/ApplicationFirewall/socketfilterfw --getloggingmode 2>/dev/null | grep -q "enabled"; then
        logging_enabled="true"
    fi
    
    if /usr/libexec/ApplicationFirewall/socketfilterfw --getblockall 2>/dev/null | grep -q "enabled"; then
        block_all_enabled="true"
    fi
    
    # Count allowed/blocked applications
    local total_apps=0
    local allowed_apps=0
    local blocked_apps=0
    
    if command -v /usr/libexec/ApplicationFirewall/socketfilterfw >/dev/null; then
        total_apps=$(/usr/libexec/ApplicationFirewall/socketfilterfw --listapps 2>/dev/null | grep -c "ALF" || echo 0)
        allowed_apps=$(/usr/libexec/ApplicationFirewall/socketfilterfw --listapps 2>/dev/null | grep -c "ALLOW" || echo 0)
        blocked_apps=$(/usr/libexec/ApplicationFirewall/socketfilterfw --listapps 2>/dev/null | grep -c "BLOCK" || echo 0)
    fi
    
    # Analyze recent security events
    local security_events=0
    local blocked_connections=0
    
    if [[ -f "/var/log/appfirewall.log" ]]; then
        security_events=$(grep -c "$(date '+%Y-%m-%d')" "/var/log/appfirewall.log" 2>/dev/null || echo 0)
        blocked_connections=$(grep -c "Deny\|Block" "/var/log/appfirewall.log" 2>/dev/null || echo 0)
    fi
    
    # Create JSON report
    cat > "$report_file" << EOF
{
  "report_type": "firewall_security",
  "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
  "device_info": {
    "hostname": "$(hostname)",
    "os_version": "$(sw_vers -productVersion)",
    "serial_number": "$(system_profiler SPHardwareDataType | grep "Serial Number" | awk -F: '{print $2}' | xargs)"
  },
  "firewall_status": {
    "global_firewall_enabled": $firewall_enabled,
    "stealth_mode_enabled": $stealth_enabled,
    "logging_enabled": $logging_enabled,
    "block_all_incoming": $block_all_enabled
  },
  "application_rules": {
    "total_applications": $total_apps,
    "allowed_applications": $allowed_apps,
    "blocked_applications": $blocked_apps
  },
  "security_events": {
    "total_events_today": $security_events,
    "blocked_connections": $blocked_connections,
    "last_event": "$(tail -1 /var/log/appfirewall.log 2>/dev/null | awk '{print $1 " " $2 " " $3}' || echo 'N/A')"
  },
  "compliance_status": {
    "policy_compliant": $(check_firewall_compliance >/dev/null 2>&1 && echo true || echo false),
    "security_profile": "$DEFAULT_SECURITY_PROFILE",
    "auto_remediation": $AUTO_ENABLE_ON_VIOLATION
  },
  "recommendations": [
    $([ "$firewall_enabled" != "true" ] && echo '"Enable global firewall",' || echo "")
    $([ "$stealth_enabled" != "true" ] && echo '"Enable stealth mode",' || echo "")
    $([ "$logging_enabled" != "true" ] && echo '"Enable firewall logging",' || echo "")
    "Regular firewall rule review"
  ]
}
EOF
    
    echo "Firewall security report saved to: $report_file"
    log_action "Firewall security report generated: $report_file"
}

# Main function with argument handling
main() {
    log_action "=== MacFleet Firewall Management Tool Started ==="
    
    case "${1:-status}" in
        "enable")
            enterprise_firewall_enable "$2"
            ;;
        "disable")
            enterprise_firewall_disable "$2" "$3"
            ;;
        "status")
            get_firewall_status
            ;;
        "compliance")
            check_firewall_compliance
            ;;
        "monitor")
            monitor_firewall_events
            ;;
        "report")
            generate_firewall_report
            ;;
        "stealth")
            enable_stealth_mode
            ;;
        "logging")
            enable_firewall_logging
            ;;
        "profile")
            enterprise_firewall_enable "$2"
            ;;
        *)
            echo "MacFleet Enterprise Firewall Management Tool"
            echo "Usage: $0 [command] [options]"
            echo ""
            echo "Commands:"
            echo "  enable [profile]              - Enable firewall with security profile"
            echo "  disable [force] [reason]      - Disable firewall (requires reason)"
            echo "  status                        - Show current firewall status"
            echo "  compliance                    - Check firewall compliance"
            echo "  monitor                       - Monitor firewall events in real-time"
            echo "  report                        - Generate security report"
            echo "  stealth                       - Enable stealth mode"
            echo "  logging                       - Enable firewall logging"
            echo "  profile [name]                - Apply specific security profile"
            echo ""
            echo "Security Profiles:"
            echo "  corporate_high                - Maximum security for sensitive environments"
            echo "  corporate_standard            - Standard corporate security (default)"
            echo "  developer                     - Development-friendly settings"
            echo "  kiosk                         - Kiosk/public access security"
            ;;
    esac
    
    log_action "=== Firewall management operation completed ==="
}

# Execute main function
main "$@"

Advanced Firewall Management

Custom Firewall Rules Engine

#!/bin/bash

# Advanced firewall rules management
manage_custom_rules() {
    local action="$1"
    local rule_name="$2"
    local rule_definition="$3"
    
    echo "=== Custom Firewall Rules Management ==="
    
    local rules_file="$RULES_DIR/custom_rules.conf"
    
    case "$action" in
        "add")
            if [[ -z "$rule_name" || -z "$rule_definition" ]]; then
                echo "❌ Rule name and definition required"
                return 1
            fi
            
            # Add rule to configuration
            echo "$rule_name:$rule_definition" >> "$rules_file"
            echo "✅ Custom rule '$rule_name' added"
            log_action "Custom firewall rule added: $rule_name"
            
            # Apply rule immediately
            apply_custom_rule "$rule_definition"
            ;;
        "remove")
            if [[ -f "$rules_file" && -n "$rule_name" ]]; then
                grep -v "^$rule_name:" "$rules_file" > "$rules_file.tmp"
                mv "$rules_file.tmp" "$rules_file"
                echo "✅ Custom rule '$rule_name' removed"
                log_action "Custom firewall rule removed: $rule_name"
            else
                echo "❌ Rule '$rule_name' not found"
            fi
            ;;
        "list")
            if [[ -f "$rules_file" ]]; then
                echo "Custom firewall rules:"
                cat "$rules_file" | while IFS=':' read -r name definition; do
                    echo "  $name: $definition"
                done
            else
                echo "No custom rules configured"
            fi
            ;;
        "apply")
            apply_all_custom_rules
            ;;
        *)
            echo "Usage: manage_custom_rules [add|remove|list|apply] [rule_name] [definition]"
            ;;
    esac
}

# Apply custom firewall rule
apply_custom_rule() {
    local rule_definition="$1"
    
    # Parse rule definition and apply appropriate firewall command
    if echo "$rule_definition" | grep -q "block_app:"; then
        local app_path
        app_path=$(echo "$rule_definition" | cut -d':' -f2)
        sudo /usr/libexec/ApplicationFirewall/socketfilterfw --add "$app_path" 2>/dev/null
        sudo /usr/libexec/ApplicationFirewall/socketfilterfw --block "$app_path" 2>/dev/null
        echo "Applied block rule for: $app_path"
    elif echo "$rule_definition" | grep -q "allow_app:"; then
        local app_path
        app_path=$(echo "$rule_definition" | cut -d':' -f2)
        sudo /usr/libexec/ApplicationFirewall/socketfilterfw --add "$app_path" 2>/dev/null
        sudo /usr/libexec/ApplicationFirewall/socketfilterfw --unblock "$app_path" 2>/dev/null
        echo "Applied allow rule for: $app_path"
    fi
}

# Apply all custom rules
apply_all_custom_rules() {
    local rules_file="$RULES_DIR/custom_rules.conf"
    
    if [[ -f "$rules_file" ]]; then
        echo "Applying all custom firewall rules..."
        while IFS=':' read -r name definition; do
            if [[ -n "$name" && -n "$definition" ]]; then
                apply_custom_rule "$definition"
            fi
        done < "$rules_file"
        echo "✅ All custom rules applied"
    else
        echo "No custom rules to apply"
    fi
}

# Example custom rules
create_example_rules() {
    manage_custom_rules "add" "block_bittorrent" "block_app:/Applications/BitTorrent.app"
    manage_custom_rules "add" "allow_docker" "allow_app:/Applications/Docker.app"
    manage_custom_rules "add" "allow_ssh" "allow_app:/usr/bin/ssh"
}

create_example_rules

Network Threat Detection

#!/bin/bash

# Advanced threat detection for firewall
detect_network_threats() {
    echo "=== Network Threat Detection ==="
    
    local threat_indicators=()
    local risk_score=0
    
    # Check for suspicious network connections
    echo "Scanning for suspicious network activity..."
    
    # Check for unusual outbound connections
    local unusual_connections
    unusual_connections=$(netstat -an | grep ESTABLISHED | grep -E ":(6667|6697|1337|31337|4444)" | wc -l)
    
    if [[ $unusual_connections -gt 0 ]]; then
        threat_indicators+=("Suspicious outbound connections detected: $unusual_connections")
        risk_score=$((risk_score + 20))
    fi
    
    # Check for high-risk processes with network access
    local risky_processes=()
    while IFS= read -r line; do
        if echo "$line" | grep -i -E "(torrent|p2p|hack|crack|keygen|bot|trojan)"; then
            risky_processes+=("$line")
            risk_score=$((risk_score + 15))
        fi
    done < <(lsof -i -n | awk '{print $1}' | sort -u)
    
    if [[ ${#risky_processes[@]} -gt 0 ]]; then
        threat_indicators+=("High-risk processes with network access: ${#risky_processes[@]}")
    fi
    
    # Check for firewall bypass attempts
    local bypass_attempts
    bypass_attempts=$(grep -c "socketfilterfw" /var/log/system.log 2>/dev/null || echo 0)
    
    if [[ $bypass_attempts -gt 10 ]]; then
        threat_indicators+=("Potential firewall bypass attempts: $bypass_attempts")
        risk_score=$((risk_score + 25))
    fi
    
    # Report threat assessment
    echo "Threat Risk Score: $risk_score/100"
    
    if [[ ${#threat_indicators[@]} -eq 0 ]]; then
        echo "✅ No immediate threats detected"
        audit_log "THREAT_SCAN" "CLEAN" "Risk score: $risk_score"
        return 0
    else
        echo "⚠️  Potential threats detected:"
        printf '  - %s\n' "${threat_indicators[@]}"
        
        # Log security alert
        log_action "SECURITY ALERT: Network threats detected - Risk score: $risk_score"
        audit_log "THREAT_SCAN" "THREATS_FOUND" "Count: ${#threat_indicators[@]} Risk: $risk_score"
        
        # Auto-remediation for high-risk scenarios
        if [[ $risk_score -gt 50 ]]; then
            echo "🚨 High risk detected - Enabling maximum security profile"
            configure_high_security_profile
        fi
        
        return 1
    fi
}

# Automated threat response
automated_threat_response() {
    local threat_level="$1"
    local threat_type="$2"
    
    echo "=== Automated Threat Response ==="
    echo "Threat Level: $threat_level"
    echo "Threat Type: $threat_type"
    
    case "$threat_level" in
        "high")
            # Maximum security measures
            echo "Implementing high-security measures..."
            sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setblockall on 2>/dev/null
            enable_stealth_mode
            log_action "HIGH THREAT RESPONSE: Maximum security enabled"
            ;;
        "medium")
            # Enhanced monitoring
            echo "Enabling enhanced monitoring..."
            enable_firewall_logging
            log_action "MEDIUM THREAT RESPONSE: Enhanced monitoring enabled"
            ;;
        "low")
            # Standard monitoring
            echo "Maintaining standard security posture..."
            log_action "LOW THREAT RESPONSE: Standard monitoring maintained"
            ;;
        *)
            echo "Unknown threat level: $threat_level"
            ;;
    esac
    
    # Send alert if configured
    if [[ "$REAL_TIME_ALERTS" == "true" ]]; then
        send_security_alert "$threat_level" "$threat_type"
    fi
}

# Send security alert
send_security_alert() {
    local threat_level="$1"
    local threat_type="$2"
    
    local alert_message="SECURITY ALERT: $threat_level level $threat_type detected on $(hostname) at $(date)"
    
    # Log the alert
    log_action "SECURITY ALERT SENT: $alert_message"
    
    # In a real implementation, this would send alerts via:
    # - Email to security team
    # - SIEM integration
    # - Slack/Teams notification
    # - MDM console alert
    
    echo "🚨 Security alert sent: $alert_message"
}

# Example usage:
# detect_network_threats
# automated_threat_response "high" "malware_communication"

Monitoring and Compliance

Real-time Security Monitoring

#!/bin/bash

# Comprehensive firewall security monitoring
start_security_monitoring() {
    echo "=== Starting Real-time Security Monitoring ==="
    
    local monitor_pid_file="$RULES_DIR/security_monitor.pid"
    
    # Store monitor PID
    echo $$ > "$monitor_pid_file"
    
    echo "Security monitoring started (PID: $$)"
    
    # Cleanup function
    cleanup() {
        echo "Stopping security monitor..."
        rm -f "$monitor_pid_file"
        exit 0
    }
    
    trap cleanup SIGTERM SIGINT
    
    while true; do
        # Check firewall compliance every 5 minutes
        if ! check_firewall_compliance >/dev/null 2>&1; then
            echo "⚠️  Compliance violation detected at $(date)"
            
            if [[ "$AUTO_ENABLE_ON_VIOLATION" == "true" ]]; then
                echo "🔧 Auto-remediation triggered"
                enterprise_firewall_enable "$DEFAULT_SECURITY_PROFILE" >/dev/null 2>&1
            fi
        fi
        
        # Run threat detection every 10 minutes
        if [[ $(($(date +%s) % 600)) -eq 0 ]]; then
            detect_network_threats >/dev/null 2>&1
        fi
        
        # Check for firewall configuration changes
        local current_config_hash
        current_config_hash=$(md5 -q /Library/Preferences/com.apple.alf.plist 2>/dev/null || echo "")
        
        if [[ -f "$RULES_DIR/last_config_hash" ]]; then
            local last_hash
            last_hash=$(cat "$RULES_DIR/last_config_hash")
            
            if [[ "$current_config_hash" != "$last_hash" ]]; then
                echo "🔄 Firewall configuration changed at $(date)"
                log_action "Firewall configuration change detected"
                audit_log "CONFIG_CHANGE" "DETECTED" "Hash changed from $last_hash to $current_config_hash"
            fi
        fi
        
        echo "$current_config_hash" > "$RULES_DIR/last_config_hash"
        
        sleep 60  # Check every minute
    done
}

# Stop security monitoring
stop_security_monitoring() {
    local monitor_pid_file="$RULES_DIR/security_monitor.pid"
    
    if [[ -f "$monitor_pid_file" ]]; then
        local monitor_pid
        monitor_pid=$(cat "$monitor_pid_file")
        
        if kill -0 "$monitor_pid" 2>/dev/null; then
            kill "$monitor_pid"
            echo "Security monitor stopped (PID: $monitor_pid)"
            rm -f "$monitor_pid_file"
        else
            echo "Monitor process not found"
            rm -f "$monitor_pid_file"
        fi
    else
        echo "No monitor PID file found"
    fi
}

# Example usage:
# start_security_monitoring &
# stop_security_monitoring

Important Configuration Notes

macOS Firewall Architecture

• Application Firewall - Controls incoming connections per application
• Socket Filter Framework - Low-level packet filtering
• Network Extension Framework - Modern content filtering
• System Integrity Protection - Protects firewall configuration
• Privacy Controls - User consent for network access

Enterprise Integration Points

• MDM Configuration Profiles - Deploy firewall policies centrally
• SIEM Integration - Forward security logs to monitoring systems
• Compliance Frameworks - Support for SOC 2, ISO 27001, NIST
• Incident Response - Automated threat detection and response

Best Practices for Enterprise

1. Layered Security Approach

   • Combine application firewall with network segmentation
   • Implement endpoint detection and response (EDR)
   • Use network access control (NAC)
   • Deploy intrusion detection systems (IDS)

2. Policy Management

   • Define clear security baselines
   • Regularly review and update firewall rules
   • Implement change management processes
   • Test security policies regularly

3. Monitoring and Response

   • Enable comprehensive logging
   • Monitor for configuration changes
   • Implement automated threat detection
   • Establish incident response procedures

4. Compliance and Auditing

   • Generate regular compliance reports
   • Maintain audit trails
   • Document security exceptions
   • Conduct periodic security assessments

Troubleshooting Common Issues

• Permission errors - Ensure admin privileges for firewall modifications
• Application connectivity - Review firewall rules for blocked applications
• Performance impact - Monitor CPU usage with extensive logging enabled
• Configuration conflicts - Check for conflicting MDM profiles
• Log file growth - Implement log rotation and archival

Remember to test firewall configurations thoroughly in a controlled environment before deploying across your entire MacFleet to ensure business continuity while maintaining security.

Finder Customization Management on macOS

Customize and manage Finder preferences across your MacFleet devices using command-line tools. This tutorial covers desktop display options, file visibility settings, interface customization, and enterprise-wide Finder configuration management.

Understanding macOS Finder Customization

Finder is the default file manager for macOS, and its behavior can be extensively customized using the defaults command. Key areas of customization include:

• Desktop Display - Control what appears on desktop
• File Visibility - Show/hide files and extensions
• Interface Elements - Status bars, path displays, and warnings
• Sorting Behavior - How files and folders are organized

Desktop Display Management

Show Hard Disks on Desktop

#!/bin/bash

# Enable hard disk display on desktop
echo "🖥️ Enabling hard disk display on desktop..."

defaults write com.apple.finder ShowHardDrivesOnDesktop -bool true
killall Finder

if [ $? -eq 0 ]; then
    echo "✅ Hard disks will now appear on desktop"
else
    echo "❌ Failed to update hard disk display setting"
    exit 1
fi

Show External Hard Drives on Desktop

#!/bin/bash

# Enable external drive display on desktop
echo "💾 Enabling external drive display on desktop..."

defaults write com.apple.finder ShowExternalHardDrivesOnDesktop -bool true
killall Finder

if [ $? -eq 0 ]; then
    echo "✅ External drives will now appear on desktop"
else
    echo "❌ Failed to update external drive display setting"
    exit 1
fi

Show Removable Media on Desktop

#!/bin/bash

# Enable removable media display on desktop
echo "💿 Enabling removable media display on desktop..."

defaults write com.apple.finder ShowRemovableMediaOnDesktop -bool true
killall Finder

if [ $? -eq 0 ]; then
    echo "✅ Removable media (CDs, DVDs, iPods) will now appear on desktop"
else
    echo "❌ Failed to update removable media display setting"
    exit 1
fi

File Visibility Configuration

Show All Filename Extensions

#!/bin/bash

# Enable display of all file extensions
echo "📄 Enabling display of all file extensions..."

defaults write NSGlobalDomain AppleShowAllExtensions -bool true
killall Finder

if [ $? -eq 0 ]; then
    echo "✅ All file extensions will now be visible"
    echo "ℹ️  Files like 'document.txt' and 'app.app' will show their extensions"
else
    echo "❌ Failed to update file extension display setting"
    exit 1
fi

Show Hidden Files

#!/bin/bash

# Enable display of hidden files
echo "👁️ Enabling display of hidden files..."

defaults write com.apple.finder AppleShowAllFiles -bool true
killall Finder

if [ $? -eq 0 ]; then
    echo "✅ Hidden files will now be visible in Finder"
    echo "⚠️  Warning: Hidden files contain system data - modify with caution"
else
    echo "❌ Failed to update hidden file display setting"
    exit 1
fi

Interface Enhancement Settings

Enable Status Bar

#!/bin/bash

# Enable Finder status bar
echo "📊 Enabling Finder status bar..."

defaults write com.apple.finder ShowStatusBar -bool true
killall Finder

if [ $? -eq 0 ]; then
    echo "✅ Status bar enabled - shows item count and available space"
else
    echo "❌ Failed to enable status bar"
    exit 1
fi

Show Full Path in Title Bar

#!/bin/bash

# Enable full path display in title bar
echo "🛤️ Enabling full path display in title bar..."

defaults write com.apple.finder _FXShowPosixPathInTitle -bool true
killall Finder

if [ $? -eq 0 ]; then
    echo "✅ Full file paths will now appear in Finder title bar"
else
    echo "❌ Failed to enable path display in title bar"
    exit 1
fi

Keep Folders on Top When Sorting

#!/bin/bash

# Enable folders-first sorting
echo "📁 Enabling folders-first sorting..."

defaults write com.apple.finder _FXSortFoldersFirst -bool true
killall Finder

if [ $? -eq 0 ]; then
    echo "✅ Folders will now appear before files when sorting by name"
else
    echo "❌ Failed to update folder sorting preference"
    exit 1
fi

Security and Warning Settings

Enable Extension Change Warning

#!/bin/bash

# Enable warning before changing file extensions
echo "⚠️ Enabling file extension change warning..."

defaults write com.apple.finder FXEnableExtensionChangeWarning -bool true
killall Finder

if [ $? -eq 0 ]; then
    echo "✅ Warning dialog will appear before changing file extensions"
else
    echo "❌ Failed to enable extension change warning"
    exit 1
fi

Enable iCloud Drive Removal Warning

#!/bin/bash

# Enable warning before removing items from iCloud Drive
echo "☁️ Enabling iCloud Drive removal warning..."

defaults write com.apple.finder FXEnableRemoveFromICloudDriveWarning -bool true
killall Finder

if [ $? -eq 0 ]; then
    echo "✅ Warning dialog will appear before removing items from iCloud Drive"
else
    echo "❌ Failed to enable iCloud Drive removal warning"
    exit 1
fi

Expand Information Window Panes

#!/bin/bash

# Configure information window panes to be expanded by default
echo "🔍 Configuring information window panes..."

defaults write com.apple.finder FXInfoPanesExpanded -dict \
    General -bool true \
    OpenWith -bool true \
    Privileges -bool true

killall Finder

if [ $? -eq 0 ]; then
    echo "✅ General, Open With, and Privileges panes will be expanded by default"
else
    echo "❌ Failed to configure information window panes"
    exit 1
fi

Enterprise Finder Configuration Script

#!/bin/bash

# MacFleet Finder Customization Tool
# Standardize Finder preferences across fleet devices

# Configuration
LOG_FILE="/var/log/macfleet_finder.log"
BACKUP_DIR="/var/backups/macfleet/finder"
CONFIG_FILE="/etc/macfleet/finder_config.plist"

# Logging function
log_action() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
}

# Create backup directory
setup_directories() {
    if [[ ! -d "$BACKUP_DIR" ]]; then
        mkdir -p "$BACKUP_DIR"
        log_action "Created backup directory: $BACKUP_DIR"
    fi
    
    if [[ ! -d "$(dirname "$CONFIG_FILE")" ]]; then
        mkdir -p "$(dirname "$CONFIG_FILE")"
        log_action "Created configuration directory"
    fi
}

# Backup current Finder preferences
backup_current_settings() {
    local backup_file="$BACKUP_DIR/finder_backup_$(date +%Y%m%d_%H%M%S).plist"
    
    echo "📦 Creating backup of current Finder settings..."
    
    # Export current Finder preferences
    defaults export com.apple.finder "$backup_file" 2>/dev/null
    
    if [ $? -eq 0 ]; then
        echo "✅ Backup created: $backup_file"
        log_action "Backup created: $backup_file"
    else
        echo "⚠️  Warning: Could not create backup"
        log_action "Warning: Backup creation failed"
    fi
}

# Apply enterprise Finder configuration
apply_finder_configuration() {
    echo "🔧 Applying MacFleet Finder configuration..."
    log_action "Starting Finder configuration deployment"
    
    # Desktop display settings
    echo "Configuring desktop display options..."
    defaults write com.apple.finder ShowHardDrivesOnDesktop -bool true
    defaults write com.apple.finder ShowExternalHardDrivesOnDesktop -bool true
    defaults write com.apple.finder ShowRemovableMediaOnDesktop -bool true
    
    # File visibility settings
    echo "Configuring file visibility options..."
    defaults write NSGlobalDomain AppleShowAllExtensions -bool true
    defaults write com.apple.finder _FXSortFoldersFirst -bool true
    
    # Interface enhancements
    echo "Configuring interface elements..."
    defaults write com.apple.finder ShowStatusBar -bool true
    defaults write com.apple.finder _FXShowPosixPathInTitle -bool true
    
    # Security warnings
    echo "Configuring security warnings..."
    defaults write com.apple.finder FXEnableExtensionChangeWarning -bool true
    defaults write com.apple.finder FXEnableRemoveFromICloudDriveWarning -bool true
    
    # Information window configuration
    echo "Configuring information window panes..."
    defaults write com.apple.finder FXInfoPanesExpanded -dict \
        General -bool true \
        OpenWith -bool true \
        Privileges -bool true
    
    # Restart Finder to apply changes
    echo "Restarting Finder to apply changes..."
    killall Finder
    
    if [ $? -eq 0 ]; then
        echo "✅ Finder configuration applied successfully"
        log_action "Finder configuration deployment completed successfully"
    else
        echo "❌ Failed to restart Finder"
        log_action "Error: Failed to restart Finder"
        return 1
    fi
}

# Verify configuration deployment
verify_configuration() {
    echo "🔍 Verifying Finder configuration..."
    
    local verification_passed=true
    
    # Check desktop display settings
    if [[ "$(defaults read com.apple.finder ShowHardDrivesOnDesktop 2>/dev/null)" == "1" ]]; then
        echo "✅ Hard drives on desktop: Enabled"
    else
        echo "❌ Hard drives on desktop: Failed"
        verification_passed=false
    fi
    
    if [[ "$(defaults read com.apple.finder ShowExternalHardDrivesOnDesktop 2>/dev/null)" == "1" ]]; then
        echo "✅ External drives on desktop: Enabled"
    else
        echo "❌ External drives on desktop: Failed"
        verification_passed=false
    fi
    
    # Check file visibility
    if [[ "$(defaults read NSGlobalDomain AppleShowAllExtensions 2>/dev/null)" == "1" ]]; then
        echo "✅ Show all extensions: Enabled"
    else
        echo "❌ Show all extensions: Failed"
        verification_passed=false
    fi
    
    # Check interface elements
    if [[ "$(defaults read com.apple.finder ShowStatusBar 2>/dev/null)" == "1" ]]; then
        echo "✅ Status bar: Enabled"
    else
        echo "❌ Status bar: Failed"
        verification_passed=false
    fi
    
    if $verification_passed; then
        echo "✅ All Finder configurations verified successfully"
        log_action "Configuration verification passed"
        return 0
    else
        echo "❌ Some configurations failed verification"
        log_action "Configuration verification failed"
        return 1
    fi
}

# Generate configuration report
generate_report() {
    local report_file="/tmp/finder_config_report_$(date +%Y%m%d_%H%M%S).txt"
    
    {
        echo "MacFleet Finder Configuration Report"
        echo "Generated: $(date)"
        echo "Hostname: $(hostname)"
        echo "User: $(whoami)"
        echo "======================================"
        echo ""
        
        echo "Desktop Display Settings:"
        echo "Hard drives on desktop: $(defaults read com.apple.finder ShowHardDrivesOnDesktop 2>/dev/null || echo 'Not set')"
        echo "External drives on desktop: $(defaults read com.apple.finder ShowExternalHardDrivesOnDesktop 2>/dev/null || echo 'Not set')"
        echo "Removable media on desktop: $(defaults read com.apple.finder ShowRemovableMediaOnDesktop 2>/dev/null || echo 'Not set')"
        echo ""
        
        echo "File Visibility Settings:"
        echo "Show all extensions: $(defaults read NSGlobalDomain AppleShowAllExtensions 2>/dev/null || echo 'Not set')"
        echo "Show hidden files: $(defaults read com.apple.finder AppleShowAllFiles 2>/dev/null || echo 'Not set')"
        echo "Folders first: $(defaults read com.apple.finder _FXSortFoldersFirst 2>/dev/null || echo 'Not set')"
        echo ""
        
        echo "Interface Settings:"
        echo "Status bar: $(defaults read com.apple.finder ShowStatusBar 2>/dev/null || echo 'Not set')"
        echo "Path in title: $(defaults read com.apple.finder _FXShowPosixPathInTitle 2>/dev/null || echo 'Not set')"
        echo ""
        
        echo "Security Settings:"
        echo "Extension change warning: $(defaults read com.apple.finder FXEnableExtensionChangeWarning 2>/dev/null || echo 'Not set')"
        echo "iCloud removal warning: $(defaults read com.apple.finder FXEnableRemoveFromICloudDriveWarning 2>/dev/null || echo 'Not set')"
        
    } > "$report_file"
    
    echo "📊 Configuration report saved to: $report_file"
    log_action "Configuration report generated: $report_file"
}

# Restore from backup
restore_from_backup() {
    local backup_file="$1"
    
    if [[ ! -f "$backup_file" ]]; then
        echo "❌ Backup file not found: $backup_file"
        return 1
    fi
    
    echo "🔄 Restoring Finder settings from backup..."
    
    # Import backup
    defaults import com.apple.finder "$backup_file"
    
    if [ $? -eq 0 ]; then
        echo "✅ Settings restored from backup"
        killall Finder
        log_action "Settings restored from backup: $backup_file"
    else
        echo "❌ Failed to restore from backup"
        log_action "Error: Failed to restore from backup: $backup_file"
        return 1
    fi
}

# Reset to defaults
reset_to_defaults() {
    echo "🔄 Resetting Finder to default settings..."
    
    # Remove custom settings
    defaults delete com.apple.finder ShowHardDrivesOnDesktop 2>/dev/null
    defaults delete com.apple.finder ShowExternalHardDrivesOnDesktop 2>/dev/null
    defaults delete com.apple.finder ShowRemovableMediaOnDesktop 2>/dev/null
    defaults delete NSGlobalDomain AppleShowAllExtensions 2>/dev/null
    defaults delete com.apple.finder AppleShowAllFiles 2>/dev/null
    defaults delete com.apple.finder ShowStatusBar 2>/dev/null
    defaults delete com.apple.finder _FXShowPosixPathInTitle 2>/dev/null
    defaults delete com.apple.finder _FXSortFoldersFirst 2>/dev/null
    defaults delete com.apple.finder FXEnableExtensionChangeWarning 2>/dev/null
    defaults delete com.apple.finder FXEnableRemoveFromICloudDriveWarning 2>/dev/null
    defaults delete com.apple.finder FXInfoPanesExpanded 2>/dev/null
    
    killall Finder
    
    echo "✅ Finder reset to default settings"
    log_action "Finder reset to default settings"
}

# Main execution function
main() {
    local action="${1:-deploy}"
    
    log_action "=== MacFleet Finder Customization Started ==="
    
    setup_directories
    
    case "$action" in
        "deploy")
            backup_current_settings
            apply_finder_configuration
            verify_configuration
            generate_report
            ;;
        "verify")
            verify_configuration
            ;;
        "report")
            generate_report
            ;;
        "restore")
            if [[ -n "$2" ]]; then
                restore_from_backup "$2"
            else
                echo "❌ Please specify backup file path"
                echo "Usage: $0 restore /path/to/backup.plist"
                exit 1
            fi
            ;;
        "reset")
            backup_current_settings
            reset_to_defaults
            ;;
        *)
            echo "Usage: $0 [deploy|verify|report|restore|reset]"
            echo ""
            echo "Commands:"
            echo "  deploy  - Apply MacFleet Finder configuration (default)"
            echo "  verify  - Verify current configuration"
            echo "  report  - Generate configuration report"
            echo "  restore - Restore from backup file"
            echo "  reset   - Reset to default settings"
            exit 1
            ;;
    esac
    
    log_action "=== MacFleet Finder Customization Completed ==="
}

# Execute main function
main "$@"

Configuration Reference

Setting	Command	Description
Hard drives on desktop	ShowHardDrivesOnDesktop	Display internal drives on desktop
External drives on desktop	ShowExternalHardDrivesOnDesktop	Display external drives on desktop
Removable media on desktop	ShowRemovableMediaOnDesktop	Display CDs, DVDs, iPods on desktop
Show all extensions	AppleShowAllExtensions	Display file extensions for all files
Show hidden files	AppleShowAllFiles	Display normally hidden system files
Status bar	ShowStatusBar	Show item count and disk space
Path in title	_FXShowPosixPathInTitle	Display full path in window title
Folders first	_FXSortFoldersFirst	Sort folders before files
Extension warning	FXEnableExtensionChangeWarning	Warn before changing extensions
iCloud warning	FXEnableRemoveFromICloudDriveWarning	Warn before iCloud removal

Quick Reference Commands

Enable All Desktop Items

# Show all desktop items
defaults write com.apple.finder ShowHardDrivesOnDesktop -bool true
defaults write com.apple.finder ShowExternalHardDrivesOnDesktop -bool true
defaults write com.apple.finder ShowRemovableMediaOnDesktop -bool true
killall Finder

Enable Full Visibility

# Maximum file visibility
defaults write NSGlobalDomain AppleShowAllExtensions -bool true
defaults write com.apple.finder AppleShowAllFiles -bool true
defaults write com.apple.finder ShowStatusBar -bool true
killall Finder

Enable All Security Warnings

# Enable all security warnings
defaults write com.apple.finder FXEnableExtensionChangeWarning -bool true
defaults write com.apple.finder FXEnableRemoveFromICloudDriveWarning -bool true
killall Finder

Troubleshooting

Finder Not Restarting

# Force restart Finder
sudo pkill -f Finder
sleep 2
open /System/Library/CoreServices/Finder.app

Settings Not Applying

# Clear Finder cache and restart
sudo rm -rf ~/Library/Caches/com.apple.finder
killall Finder

Verify Settings Applied

# Check specific setting
defaults read com.apple.finder ShowStatusBar

# List all Finder settings
defaults read com.apple.finder

Security Considerations

• Hidden files contain system data - modify with caution
• File extensions help identify file types - consider security implications
• Desktop items may clutter interface in shared environments
• Test changes on individual devices before fleet deployment
• Create backups before applying configuration changes

Important Notes

• Changes require Finder restart to take effect
• Some settings apply system-wide (NSGlobalDomain)
• User-specific settings don't affect other accounts
• Administrative privileges may be required for system-wide deployment
• Backup current settings before making changes for easy restoration

Find My Mac Security Management and Compliance

Ensure enterprise security compliance by monitoring and managing Find My Mac status across your MacFleet devices. This tutorial covers security auditing, Apple ID verification, automated compliance reporting, and enterprise security policy enforcement.

Understanding Find My Mac Security

Find My Mac is Apple's built-in device location and security service that provides:

• Device Location Tracking - Real-time location services for lost or stolen devices
• Remote Lock and Wipe - Secure device data remotely
• Activation Lock - Prevents unauthorized device reactivation
• Security Integration - Works with Apple ID and iCloud services

Basic Find My Mac Status Check

Simple Status Verification

#!/bin/bash

# Basic Find My Mac status check
fmmToken=$(/usr/sbin/nvram -x -p | /usr/bin/grep fmm-mobileme-token-FMM)

if [ -z "$fmmToken" ]; then
    echo "Find My Mac is disabled"
else
    echo "Find My Mac is enabled"
fi

Enhanced Status Check with Details

#!/bin/bash

# Enhanced Find My Mac verification
check_find_my_mac_basic() {
    echo "=== Find My Mac Status Check ==="
    
    # Check for Find My Mac token
    local fmm_token
    fmm_token=$(/usr/sbin/nvram -x -p | /usr/bin/grep fmm-mobileme-token-FMM 2>/dev/null)
    
    if [ -z "$fmm_token" ]; then
        echo "❌ Find My Mac: DISABLED"
        return 1
    else
        echo "✅ Find My Mac: ENABLED"
        
        # Extract additional details if available
        echo "Token found in NVRAM"
        return 0
    fi
}

# Execute the check
check_find_my_mac_basic

Enterprise Security Management Script

#!/bin/bash

# MacFleet Find My Mac Security Management
# Comprehensive security auditing and compliance monitoring

# Configuration
LOG_FILE="/var/log/macfleet_security.log"
REPORT_DIR="/var/reports/security"
COMPLIANCE_DIR="/var/compliance"
TEMP_DIR="/tmp/macfleet_security"

# Security policies configuration
REQUIRE_FIND_MY_MAC=true
REQUIRE_APPLE_ID=true
REQUIRE_ACTIVATION_LOCK=true
MAX_OFFLINE_DAYS=30

# Logging function
log_action() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
}

# Create necessary directories
setup_directories() {
    for dir in "$REPORT_DIR" "$COMPLIANCE_DIR" "$TEMP_DIR"; do
        if [[ ! -d "$dir" ]]; then
            mkdir -p "$dir"
            log_action "Created directory: $dir"
        fi
    done
}

# Check Find My Mac status with detailed analysis
check_find_my_mac_status() {
    log_action "Checking Find My Mac status"
    
    local status_report="$TEMP_DIR/fmm_status.json"
    
    # Initialize status object
    cat > "$status_report" << EOF
{
    "timestamp": "$(date -Iseconds)",
    "hostname": "$(hostname)",
    "find_my_mac": {
        "enabled": false,
        "token_present": false,
        "activation_lock": false,
        "apple_id_signed_in": false
    },
    "compliance": {
        "status": "non_compliant",
        "issues": []
    }
}
EOF

    # Check for Find My Mac token in NVRAM
    local fmm_token
    fmm_token=$(/usr/sbin/nvram -x -p | /usr/bin/grep fmm-mobileme-token-FMM 2>/dev/null)
    
    if [[ -n "$fmm_token" ]]; then
        log_action "✅ Find My Mac token found in NVRAM"
        
        # Update JSON status
        /usr/bin/python3 -c "
import json
with open('$status_report', 'r') as f:
    data = json.load(f)
data['find_my_mac']['enabled'] = True
data['find_my_mac']['token_present'] = True
with open('$status_report', 'w') as f:
    json.dump(data, f, indent=2)
"
        echo "enabled"
    else
        log_action "❌ Find My Mac not enabled - no token found"
        
        # Add compliance issue
        /usr/bin/python3 -c "
import json
with open('$status_report', 'r') as f:
    data = json.load(f)
data['compliance']['issues'].append('Find My Mac not enabled')
with open('$status_report', 'w') as f:
    json.dump(data, f, indent=2)
"
        echo "disabled"
    fi
}

# Check Apple ID sign-in status
check_apple_id_status() {
    log_action "Checking Apple ID sign-in status"
    
    # Check if user is signed into iCloud
    local icloud_account
    icloud_account=$(defaults read MobileMeAccounts Accounts 2>/dev/null | grep -c AccountID || echo "0")
    
    if [[ "$icloud_account" -gt 0 ]]; then
        log_action "✅ Apple ID signed in to iCloud"
        
        # Get Apple ID details (masked for privacy)
        local apple_id_info
        apple_id_info=$(defaults read MobileMeAccounts Accounts 2>/dev/null | grep AccountID | head -1 | sed 's/.*= "\(.*\)";/\1/' | sed 's/\(.*@\)\(.*\)/\1***/g')
        log_action "Apple ID: $apple_id_info"
        
        return 0
    else
        log_action "❌ No Apple ID signed in"
        return 1
    fi
}

# Check system integrity and security settings
check_system_security() {
    log_action "Performing system security audit"
    
    local security_report="$TEMP_DIR/security_audit.json"
    
    cat > "$security_report" << EOF
{
    "timestamp": "$(date -Iseconds)",
    "hostname": "$(hostname)",
    "security_audit": {
        "sip_status": "unknown",
        "gatekeeper_status": "unknown",
        "filevault_status": "unknown",
        "firewall_status": "unknown",
        "secure_boot": "unknown"
    }
}
EOF

    # Check System Integrity Protection (SIP)
    local sip_status
    sip_status=$(csrutil status 2>/dev/null | grep -i enabled && echo "enabled" || echo "disabled")
    log_action "SIP Status: $sip_status"
    
    # Check Gatekeeper
    local gatekeeper_status
    gatekeeper_status=$(spctl --status 2>/dev/null | grep -i enabled && echo "enabled" || echo "disabled")
    log_action "Gatekeeper Status: $gatekeeper_status"
    
    # Check FileVault
    local filevault_status
    filevault_status=$(fdesetup status 2>/dev/null | grep -i "on" && echo "enabled" || echo "disabled")
    log_action "FileVault Status: $filevault_status"
    
    # Check Firewall
    local firewall_status
    firewall_status=$(/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate 2>/dev/null | grep -i enabled && echo "enabled" || echo "disabled")
    log_action "Firewall Status: $firewall_status"
    
    # Update security report
    /usr/bin/python3 -c "
import json
with open('$security_report', 'r') as f:
    data = json.load(f)
data['security_audit']['sip_status'] = '$sip_status'
data['security_audit']['gatekeeper_status'] = '$gatekeeper_status'
data['security_audit']['filevault_status'] = '$filevault_status'
data['security_audit']['firewall_status'] = '$firewall_status'
with open('$security_report', 'w') as f:
    json.dump(data, f, indent=2)
"

    echo "$security_report"
}

# Check activation lock status
check_activation_lock() {
    log_action "Checking Activation Lock status"
    
    # Check if device has activation lock enabled
    # This requires checking with Apple's servers or MDM enrollment
    local activation_lock_status="unknown"
    
    # For enterprise devices, check MDM enrollment
    if profiles -P 2>/dev/null | grep -q "com.apple.mdm"; then
        log_action "✅ Device is MDM enrolled"
        activation_lock_status="mdm_managed"
    else
        log_action "⚠️  Device not MDM enrolled"
        activation_lock_status="not_managed"
    fi
    
    # Check for DEP/ABM enrollment
    if profiles -e 2>/dev/null | grep -q "DEP"; then
        log_action "✅ Device is DEP/ABM enrolled"
        activation_lock_status="dep_enrolled"
    fi
    
    echo "$activation_lock_status"
}

# Generate comprehensive security report
generate_security_report() {
    local report_timestamp
    report_timestamp=$(date '+%Y%m%d_%H%M%S')
    local report_file="$REPORT_DIR/security_report_$report_timestamp.json"
    
    log_action "Generating comprehensive security report: $report_file"
    
    # Get system information
    local os_version
    local serial_number
    local hardware_uuid
    os_version=$(sw_vers -productVersion)
    serial_number=$(system_profiler SPHardwareDataType | grep "Serial Number" | awk '{print $4}')
    hardware_uuid=$(system_profiler SPHardwareDataType | grep "Hardware UUID" | awk '{print $3}')
    
    # Compile comprehensive report
    cat > "$report_file" << EOF
{
    "report_metadata": {
        "timestamp": "$(date -Iseconds)",
        "report_version": "1.0",
        "generator": "MacFleet Security Audit"
    },
    "device_info": {
        "hostname": "$(hostname)",
        "serial_number": "$serial_number",
        "hardware_uuid": "$hardware_uuid",
        "os_version": "$os_version",
        "model": "$(system_profiler SPHardwareDataType | grep "Model Name" | awk -F': ' '{print $2}')"
    },
    "security_status": {
        "find_my_mac": {
            "enabled": $(check_find_my_mac_status >/dev/null && echo "true" || echo "false"),
            "compliance": $([ "$REQUIRE_FIND_MY_MAC" = true ] && check_find_my_mac_status >/dev/null && echo "true" || echo "false")
        },
        "apple_id": {
            "signed_in": $(check_apple_id_status >/dev/null && echo "true" || echo "false"),
            "compliance": $([ "$REQUIRE_APPLE_ID" = true ] && check_apple_id_status >/dev/null && echo "true" || echo "false")
        },
        "activation_lock": {
            "status": "$(check_activation_lock)",
            "compliance": $([ "$REQUIRE_ACTIVATION_LOCK" = true ] && echo "true" || echo "false")
        }
    },
    "compliance_summary": {
        "overall_status": "$(calculate_compliance_status)",
        "required_actions": $(generate_required_actions),
        "risk_level": "$(calculate_risk_level)"
    }
}
EOF

    log_action "Security report generated: $report_file"
    echo "$report_file"
}

# Calculate overall compliance status
calculate_compliance_status() {
    local fmm_status
    local apple_id_status
    local issues=0
    
    fmm_status=$(check_find_my_mac_status)
    if [[ "$REQUIRE_FIND_MY_MAC" = true && "$fmm_status" != "enabled" ]]; then
        ((issues++))
    fi
    
    if ! check_apple_id_status >/dev/null 2>&1; then
        if [[ "$REQUIRE_APPLE_ID" = true ]]; then
            ((issues++))
        fi
    fi
    
    if [[ $issues -eq 0 ]]; then
        echo "compliant"
    elif [[ $issues -le 2 ]]; then
        echo "partially_compliant"
    else
        echo "non_compliant"
    fi
}

# Generate required actions for compliance
generate_required_actions() {
    local actions=()
    
    if [[ "$REQUIRE_FIND_MY_MAC" = true ]] && [[ "$(check_find_my_mac_status)" != "enabled" ]]; then
        actions+=("\"Enable Find My Mac in System Preferences\"")
    fi
    
    if [[ "$REQUIRE_APPLE_ID" = true ]] && ! check_apple_id_status >/dev/null 2>&1; then
        actions+=("\"Sign in with Apple ID in System Preferences\"")
    fi
    
    if [[ ${#actions[@]} -eq 0 ]]; then
        echo "[]"
    else
        printf "[%s]" "$(IFS=,; echo "${actions[*]}")"
    fi
}

# Calculate risk level based on security status
calculate_risk_level() {
    local risk_score=0
    
    # Find My Mac disabled adds risk
    if [[ "$(check_find_my_mac_status)" != "enabled" ]]; then
        ((risk_score += 3))
    fi
    
    # No Apple ID adds risk
    if ! check_apple_id_status >/dev/null 2>&1; then
        ((risk_score += 2))
    fi
    
    # System security issues add risk
    if [[ "$(csrutil status 2>/dev/null | grep -i disabled)" ]]; then
        ((risk_score += 2))
    fi
    
    if [[ $risk_score -le 1 ]]; then
        echo "low"
    elif [[ $risk_score -le 4 ]]; then
        echo "medium"
    else
        echo "high"
    fi
}

# Remediation actions for common issues
remediate_security_issues() {
    log_action "Starting automated remediation process"
    
    local remediation_report="$TEMP_DIR/remediation_$(date '+%Y%m%d_%H%M%S').json"
    
    cat > "$remediation_report" << EOF
{
    "timestamp": "$(date -Iseconds)",
    "hostname": "$(hostname)",
    "remediation_actions": []
}
EOF

    # Check if Find My Mac can be enabled programmatically
    if [[ "$(check_find_my_mac_status)" != "enabled" ]]; then
        log_action "⚠️  Find My Mac is disabled - manual intervention required"
        log_action "   User must enable Find My Mac in System Preferences > Apple ID > Find My"
        
        # Add to remediation report
        /usr/bin/python3 -c "
import json
with open('$remediation_report', 'r') as f:
    data = json.load(f)
data['remediation_actions'].append({
    'issue': 'Find My Mac disabled',
    'action': 'manual_intervention_required',
    'instructions': 'Enable Find My Mac in System Preferences > Apple ID > Find My'
})
with open('$remediation_report', 'w') as f:
    json.dump(data, f, indent=2)
"
    fi
    
    # Generate user notification if needed
    if [[ "$(calculate_compliance_status)" != "compliant" ]]; then
        create_user_notification
    fi
    
    echo "$remediation_report"
}

# Create user notification for security compliance
create_user_notification() {
    log_action "Creating user notification for security compliance"
    
    local notification_title="MacFleet Security Compliance"
    local notification_message="Your device requires security configuration updates. Please contact IT support."
    
    # Use AppleScript to show notification
    osascript -e "display notification \"$notification_message\" with title \"$notification_title\""
    
    # Create persistent reminder file
    cat > "/tmp/macfleet_security_reminder.txt" << EOF
MacFleet Security Compliance Required

Your device needs the following security features enabled:
- Find My Mac
- Apple ID sign-in
- Activation Lock

Please contact IT support for assistance.
Generated: $(date)
EOF
}

# Monitor Find My Mac status over time
monitor_security_status() {
    log_action "Starting continuous security monitoring"
    
    local monitoring_interval=3600  # 1 hour
    local monitoring_log="$LOG_FILE.monitoring"
    
    while true; do
        {
            echo "=== Security Status Check - $(date) ==="
            echo "Find My Mac: $(check_find_my_mac_status)"
            echo "Apple ID: $(check_apple_id_status >/dev/null && echo "signed_in" || echo "not_signed_in")"
            echo "Compliance: $(calculate_compliance_status)"
            echo "Risk Level: $(calculate_risk_level)"
            echo "----------------------------------------"
        } >> "$monitoring_log"
        
        sleep "$monitoring_interval"
    done
}

# Fleet-wide security assessment
fleet_security_assessment() {
    log_action "Performing fleet-wide security assessment"
    
    local fleet_report="$REPORT_DIR/fleet_security_$(date '+%Y%m%d_%H%M%S').json"
    
    # This would typically integrate with MDM or configuration management
    # For demonstration, we'll show the current device assessment
    
    cat > "$fleet_report" << EOF
{
    "assessment_timestamp": "$(date -Iseconds)",
    "fleet_summary": {
        "total_devices": 1,
        "compliant_devices": $([ "$(calculate_compliance_status)" = "compliant" ] && echo "1" || echo "0"),
        "non_compliant_devices": $([ "$(calculate_compliance_status)" != "compliant" ] && echo "1" || echo "0")
    },
    "devices": [
        $(generate_security_report | tail -n +2 | head -n -1)
    ],
    "recommendations": [
        "Implement automated Find My Mac enablement via MDM",
        "Enforce Apple ID sign-in through device enrollment",
        "Regular security compliance auditing",
        "User education on security features"
    ]
}
EOF

    log_action "Fleet security assessment completed: $fleet_report"
    echo "$fleet_report"
}

# Main execution function
main() {
    local action="${1:-check}"
    
    log_action "=== MacFleet Security Management Started ==="
    log_action "Action: $action"
    log_action "Hostname: $(hostname)"
    log_action "User: $(whoami)"
    
    # Setup
    setup_directories
    
    case "$action" in
        "check")
            echo "=== Find My Mac Security Check ==="
            echo "Find My Mac Status: $(check_find_my_mac_status)"
            echo "Apple ID Status: $(check_apple_id_status >/dev/null && echo "signed_in" || echo "not_signed_in")"
            echo "Activation Lock: $(check_activation_lock)"
            echo "Compliance Status: $(calculate_compliance_status)"
            echo "Risk Level: $(calculate_risk_level)"
            ;;
        "audit")
            echo "Performing comprehensive security audit..."
            security_report=$(generate_security_report)
            echo "Security audit completed: $security_report"
            ;;
        "remediate")
            echo "Starting remediation process..."
            remediation_report=$(remediate_security_issues)
            echo "Remediation completed: $remediation_report"
            ;;
        "monitor")
            echo "Starting continuous monitoring..."
            monitor_security_status
            ;;
        "fleet")
            echo "Performing fleet-wide assessment..."
            fleet_report=$(fleet_security_assessment)
            echo "Fleet assessment completed: $fleet_report"
            ;;
        *)
            echo "Usage: $0 {check|audit|remediate|monitor|fleet}"
            echo "  check     - Quick security status check"
            echo "  audit     - Comprehensive security audit"
            echo "  remediate - Automated remediation actions"
            echo "  monitor   - Continuous security monitoring"
            echo "  fleet     - Fleet-wide security assessment"
            exit 1
            ;;
    esac
    
    # Cleanup
    rm -rf "$TEMP_DIR"
    
    log_action "=== Security management completed ==="
}

# Execute main function
main "$@"

Apple ID and iCloud Integration

Check Apple ID Sign-in Status

#!/bin/bash

# Comprehensive Apple ID verification
check_apple_id_comprehensive() {
    echo "=== Apple ID Status Check ==="
    
    # Check iCloud accounts
    local icloud_accounts
    icloud_accounts=$(defaults read MobileMeAccounts Accounts 2>/dev/null | grep -c AccountID || echo "0")
    
    if [[ "$icloud_accounts" -gt 0 ]]; then
        echo "✅ Apple ID signed in ($icloud_accounts account(s))"
        
        # Get account details (privacy-safe)
        defaults read MobileMeAccounts Accounts 2>/dev/null | grep AccountID | while read -r line; do
            local account_id
            account_id=$(echo "$line" | sed 's/.*= "\(.*\)";/\1/' | sed 's/\(.*@\)\(.*\)/\1***/g')
            echo "   Account: $account_id"
        done
        
        # Check iCloud services
        echo "iCloud Services:"
        defaults read MobileMeAccounts Accounts 2>/dev/null | grep -E "(BookmarksSyncEnabled|ContactsSyncEnabled|MailSyncEnabled)" | while read -r service; do
            echo "   $service"
        done
        
        return 0
    else
        echo "❌ No Apple ID signed in"
        return 1
    fi
}

Verify iCloud Services Status

#!/bin/bash

# Check specific iCloud services
check_icloud_services() {
    echo "=== iCloud Services Status ==="
    
    # Check Find My Mac specifically
    local fmf_token
    fmf_token=$(defaults read MobileMeAccounts Accounts 2>/dev/null | grep -i findmyfriends || echo "")
    
    if [[ -n "$fmf_token" ]]; then
        echo "✅ Find My Friends/Family service active"
    else
        echo "⚠️  Find My Friends/Family service not configured"
    fi
    
    # Check other critical services
    local services=(
        "BookmarksSyncEnabled:Safari Bookmarks"
        "ContactsSyncEnabled:Contacts"
        "CalendarSyncEnabled:Calendar"
        "KeychainSyncEnabled:Keychain"
    )
    
    for service in "${services[@]}"; do
        local key="${service%%:*}"
        local name="${service##*:}"
        local status
        status=$(defaults read MobileMeAccounts Accounts 2>/dev/null | grep "$key" | head -1 | grep -o "[01]" || echo "0")
        
        if [[ "$status" = "1" ]]; then
            echo "✅ $name sync enabled"
        else
            echo "❌ $name sync disabled"
        fi
    done
}

Enterprise Security Policies

Define Security Requirements

#!/bin/bash

# Enterprise security policy configuration
apply_security_policies() {
    echo "=== Applying Enterprise Security Policies ==="
    
    local policy_file="/etc/macfleet/security_policies.json"
    
    # Create security policy configuration
    mkdir -p "$(dirname "$policy_file")"
    cat > "$policy_file" << 'EOF'
{
    "security_policies": {
        "find_my_mac": {
            "required": true,
            "enforcement": "advisory",
            "grace_period_days": 7
        },
        "apple_id": {
            "required": true,
            "corporate_domain_only": false,
            "enforcement": "mandatory"
        },
        "activation_lock": {
            "required": true,
            "mdm_managed": true
        },
        "system_security": {
            "sip_required": true,
            "gatekeeper_required": true,
            "filevault_required": true,
            "firewall_required": true
        }
    },
    "compliance_reporting": {
        "frequency": "daily",
        "recipients": ["security@company.com"],
        "escalation_threshold": "medium"
    }
}
EOF

    echo "Security policies configured: $policy_file"
}

Compliance Monitoring

#!/bin/bash

# Automated compliance monitoring
setup_compliance_monitoring() {
    local monitoring_script="/usr/local/bin/macfleet_compliance_monitor.sh"
    local launchd_plist="/Library/LaunchDaemons/com.macfleet.security.compliance.plist"
    
    # Create monitoring script
    cat > "$monitoring_script" << 'EOF'
#!/bin/bash
LOG_FILE="/var/log/macfleet_compliance.log"
exec > >(tee -a "$LOG_FILE") 2>&1

echo "$(date): Starting security compliance check"

# Run security audit
/usr/local/bin/macfleet_security_manager.sh audit

# Check for non-compliance
COMPLIANCE_STATUS=$(calculate_compliance_status)
if [[ "$COMPLIANCE_STATUS" != "compliant" ]]; then
    echo "$(date): Non-compliance detected - $COMPLIANCE_STATUS"
    
    # Send alert (implement according to your notification system)
    echo "Device $(hostname) is non-compliant" | mail -s "Security Compliance Alert" security@company.com
fi

echo "$(date): Compliance check completed"
EOF

    chmod +x "$monitoring_script"
    
    # Create LaunchDaemon for scheduled compliance checks
    cat > "$launchd_plist" << EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.macfleet.security.compliance</string>
    <key>ProgramArguments</key>
    <array>
        <string>$monitoring_script</string>
    </array>
    <key>StartCalendarInterval</key>
    <array>
        <dict>
            <key>Hour</key>
            <integer>9</integer>
            <key>Minute</key>
            <integer>0</integer>
        </dict>
        <dict>
            <key>Hour</key>
            <integer>17</integer>
            <key>Minute</key>
            <integer>0</integer>
        </dict>
    </array>
    <key>RunAtLoad</key>
    <false/>
</dict>
</plist>
EOF

    # Load the LaunchDaemon
    sudo launchctl load "$launchd_plist"
    
    echo "Compliance monitoring configured"
    echo "Script: $monitoring_script"
    echo "Schedule: Daily at 9:00 AM and 5:00 PM"
}

Security Status Indicators

Understanding NVRAM Tokens

The Find My Mac status is stored in NVRAM (Non-Volatile Random Access Memory) tokens:

Token	Description	Indicates
fmm-mobileme-token-FMM	Primary Find My Mac token	Service is active and configured
fmm-computer-name	Device name for Find My	Device identification in Find My network
fmm-mobileme-token-FMF	Find My Friends token	Location sharing services

Interpreting Security States

State	Find My Mac	Apple ID	Compliance	Action Required
Fully Compliant	✅ Enabled	✅ Signed In	✅ Compliant	None
Partially Compliant	✅ Enabled	❌ Not Signed In	⚠️ Partial	Sign in to Apple ID
Non-Compliant	❌ Disabled	❌ Not Signed In	❌ Non-Compliant	Enable Find My Mac and sign in
Unknown State	❓ Cannot Detect	❓ Cannot Detect	❓ Unknown	Manual verification required

Troubleshooting Common Issues

Find My Mac Not Enabling

#!/bin/bash

# Troubleshoot Find My Mac issues
troubleshoot_find_my_mac() {
    echo "=== Find My Mac Troubleshooting ==="
    
    # Check prerequisites
    echo "Checking prerequisites..."
    
    # 1. Check internet connectivity
    if ping -c 1 apple.com >/dev/null 2>&1; then
        echo "✅ Internet connectivity: OK"
    else
        echo "❌ Internet connectivity: FAILED"
        echo "   - Check network connection"
        echo "   - Verify DNS settings"
    fi
    
    # 2. Check Apple ID sign-in
    if check_apple_id_status >/dev/null 2>&1; then
        echo "✅ Apple ID sign-in: OK"
    else
        echo "❌ Apple ID sign-in: REQUIRED"
        echo "   - Sign in to Apple ID in System Preferences"
        echo "   - Enable iCloud services"
    fi
    
    # 3. Check iCloud services
    local icloud_enabled
    icloud_enabled=$(defaults read MobileMeAccounts Accounts 2>/dev/null | grep -c "Enabled.*1" || echo "0")
    
    if [[ "$icloud_enabled" -gt 0 ]]; then
        echo "✅ iCloud services: ENABLED"
    else
        echo "❌ iCloud services: DISABLED"
        echo "   - Enable iCloud in System Preferences"
        echo "   - Ensure Find My Mac is checked"
    fi
    
    # 4. Check system requirements
    local os_version
    os_version=$(sw_vers -productVersion)
    
    if [[ "$(echo "$os_version" | cut -d. -f1)" -ge 10 ]] && [[ "$(echo "$os_version" | cut -d. -f2)" -ge 11 ]]; then
        echo "✅ macOS version: SUPPORTED ($os_version)"
    else
        echo "❌ macOS version: UNSUPPORTED ($os_version)"
        echo "   - Find My Mac requires macOS 10.11 or later"
    fi
}

Manual Remediation Steps

#!/bin/bash

# Generate manual remediation guide
generate_remediation_guide() {
    local guide_file="/tmp/macfleet_remediation_guide.txt"
    
    cat > "$guide_file" << EOF
MacFleet Security Remediation Guide
==================================

Device: $(hostname)
Date: $(date)

Required Actions:
EOF

    if [[ "$(check_find_my_mac_status)" != "enabled" ]]; then
        cat >> "$guide_file" << EOF

1. Enable Find My Mac:
   - Open System Preferences
   - Click on Apple ID (or iCloud on older systems)
   - Sign in with your Apple ID if not already signed in
   - Click on "Find My" in the sidebar
   - Check "Find My Mac"
   - Check "Enable offline finding" (if available)
   - Click "Allow" when prompted for location access

EOF
    fi
    
    if ! check_apple_id_status >/dev/null 2>&1; then
        cat >> "$guide_file" << EOF

2. Sign in to Apple ID:
   - Open System Preferences
   - Click on Apple ID at the top
   - Enter your Apple ID and password
   - Complete two-factor authentication if prompted
   - Enable iCloud services as needed

EOF
    fi
    
    cat >> "$guide_file" << EOF

For assistance, contact IT Support:
- Email: support@company.com
- Phone: +1-555-0123
- Ticket System: https://support.company.com

EOF

    echo "Remediation guide created: $guide_file"
    open "$guide_file"
}

Best Practices

🔐 Security Guidelines

• Enable Find My Mac on all enterprise devices
• Require Apple ID sign-in for device accountability
• Monitor compliance status regularly
• Implement automated alerting for non-compliance

📋 Management Recommendations

• Use MDM enrollment for enterprise activation lock
• Regular security audits across device fleet
• User education on security feature importance
• Automated compliance monitoring and reporting

🔍 Monitoring Strategy

• Daily compliance checks during business hours
• Immediate alerts for security violations
• Trend analysis of compliance metrics
• Regular policy review and updates

Important Notes

• Find My Mac requires macOS 10.11 or later for full functionality
• Apple ID sign-in is mandatory for Find My Mac operation
• Network connectivity required for initial setup and ongoing operation
• Privacy considerations should be documented for enterprise use
• Test remediation procedures before enterprise deployment