Mac OS X Security: Using Keychain

Keychain
Mac OS X supports what are known as keychains, a secure store for certificates, passwords, or any small bits of information to be kept private (known as secure “notes”). The primary purpose of a keychain is to facilitate the management of passwords for various applications and accounts such as mail and ftp servers, web sites, or encrypted disk images. The basic idea is that a single password, the keychain password, is used to unlock access to all passwords stored in that keychain. Whenever you use an application that is keychainaware, that application can store and retrieve any needed password(s). Users can have multiple distinct keychains, but every user starts out with a single keychain, considered that user’s default keychain. The name and password for this default keychain is the same as the user’s login name and password. This allows for that keychain to be automatically unlocked upon login.

The keychain service found on Mac OS X is significant for two major reasons. First, it uses strong cryptography. Over time, many applications have provided the capability to store passwords but have failed to do so in a way that can be trusted or considered safe from compromise. Second, the storage and retrieval of all passwords is handled by a single service, not individual applications. After you have decided to trust this service, any time you are asked to store a password you don’t have to worry about the means by which it is protected. What you do need to be careful of, though, is what applications you allow to make use of your keychain(s). When you unlock a keychain and allow an application to access a password, you open the door for that application to slip up and compromise the security of that password (more on this later). Although the keychain provides strong secure storage for passwords, any application can make use of the keychain API. Thus, be mindful of the applications for which you grant access to your keychain(s).

In this section we will discuss keychain management and configuration with Keychain Access.app and discuss some general security considerations regarding the use of keychains on Mac OS X.

Using the Keychain Access Application
Figure 5.1 shows the Keychain Access application (/Applications/ Utilities/Keychain Access.app) used to configure keychains. Keychain files are stored in each user’s ~/Library/Keychains directory—one file for each keychain. Initially, there is a single keychain known as the default keychain. New keychain files can be created by selecting File, New, New Keychain. To show all the keychains, select View, Show Keychains or use the Keychains icon on the far right of the toolbar. The toolbar of the Keychain Access application allows for the creation of new keychain items, including passwords and notes. The lock button on the toolbar can be used to lock or unlock the currently selected keychain.

The initial settings for the default keychain leave some room for improvement.

First, we recommend turning on the keychain menu bar icon. This icon allows you to quickly see if any of your keychains are unlocked. The locked icon means all keychains are locked, whereas the unlocked icon means at least one keychain is unlocked. The pull-down menu for this icon also allows for the locking and unlocking of each keychain, including an option to lock all keychains. Another nifty feature of this icon’s menu is the capability to lock your screen if you have a password-protected screensaver setup. But be careful, this will only lock your screen if you have your screensaver configured to prompt for a password, otherwise it simply starts the screen-saver. To enable the keychain icon in the menu bar, choose the Show Status in Menu Bar option from the View menu of the Keychain Access application.

Second, we recommend some adjustments to the settings for the default keychain. With your default keychain selected, from the Edit menu, choose the Settings option. This brings up the Settings dialog similar to that shown in Figure 5.2.

At the very least, be sure the Lock When Sleeping option is checked. Although it can be cumbersome to re-authenticate on waking up the machine, it means anyone else who has access to it in that state will also have to supply a password. Next, specify a reasonable idle timeout value for the keychain. After a certain number of minutes without use, the keychain will automatically become locked. This is a good idea in case you find yourself away from your machine for an extended period of time. Finally, if you do not want your default keychain to be unlocked automatically after logging in, change the password for that keychain. When logging in, you can then easily unlock the keychain through the menu bar icon or wait for an application to request a password stored in that keychain.

Creating a Secure Note
Besides passwords, the keychain also can be used to secure small amounts of important data, such as a PIN number or a password list. To create a secure note, choose the Note icon from the toolbar. Enter a name for the item and the text for the note as shown in Figure 5.3. Notes like this are useful, but we recommend creating a new keychain for items like this, as opposed to storing them in your default keychain. Keep that keychain locked and unlock it only when you need access to the items.

Managing Access to Keychain Items
Keychains can contain passwords and passphrases for web sites, mail servers, encrypted disk images, and many different third-party applications. Each item in your keychain can be configured differently to allow access only to certain applications. For example, there is probably no good reason for applications other than your email program to have access to your mail server password. This can all be configured through Keychain Access.app.

The bottom half of the Keychain Access window contains a tabbed view pane for configuring attributes and settings related to access control for each keychain item. The Attributes pane (see Figure 5.4) consists of metadata about the item, including the name, description, username, and URL associated with the keychain item. The Show passphrase check box allows you to view the passphrase for that item. Showing the password for an item requires you to enter the keychain password unless access is always allowed as described in the next section.

The Access Control tab (see Figure 5.5) is where all the access control settings for the selected keychain items are configured.

The Always Allow Access to This Item option still requires the keychain to be unlocked, but allows applications to access the passphrase without prompting the user. There are very few cases, if any, where this option is a good idea. One such example is for messaging or chat clients that have little risk attached to them.

The Confirm before Allowing Access option always prompts the user for permission before releasing a passphrase (unless that application is in the always-allowed list described here later). If the Ask for Keychain password box is checked, not only is the user informed upon each access request, but the user is also required to enter the keychain password before the passphrase is released. Underneath the access options is a list of applications that are always authorized to retrieve the passphrase from the keychain. That is, any application found in this list has access to the passphrase without having to inform the user or ask for approval (provided the keychain is unlocked). When applications add passwords to the keychain they sometimes add themselves to this list. If you have a passphrase you want to keep tight tabs on, it is a good idea to keep this list empty so that you are aware of every request for that passphrase.

The Keychain Access Dialog
Many applications can store passwords in the keychain; sometimes this is the only interaction users ever have with their keychain. Depending on how the access control for a passphrase is configured, you may see a dialog similar to the one shown in Figure 5.6. A passphrase that requires confirmation with each access is presented with three options: Deny, Allow Once, or Always Allow.

To Deny access means that the user must then specify the passphrase for the application and the keychain is ignored.

To Allow Once grants the requesting application access to the password. Subsequent requests display this same dialog.

To Always Allow changes the configuration for this keychain item by adding the requesting application to the always-allow list.

This dialog also may request the keychain’s password if the Ask for Keychain password option is set. It is a good idea to show the details on this dialog to verify the application path of the application that is requesting access to the passphrase; by default these details are hidden.

Is the Keychain Safe?
Generally, yes. The main password used to unlock a keychain is not stored on disk, and is never available to any other application, ever. However, if there is any part of the keychain that warrants concern it is the handing off of passwords to other applications. After an application takes possession of a passphrase the keychain no longer has any control over the security of that passphrase. An application can compromise the security provided by the keychain by storing the passphrase unencrypted on disk, sending it across a network in the clear, or allowing it to be paged to disk by the virtual memory manager. Obviously, there is a need for trust on behalf of the applications that make use of any keychain(s).

As a user, don’t assume that because an application makes use of a keychain that any involved passwords are automatically safe. Also, periodically audit the access lists of each item in your keychain file to be sure that only the necessary applications are allowed access.

Potter, Novell, and Wotring. MAC OS SECURITY, ©2003 New Riders Publishing, Reproduced by permission of Pearson Education,Inc., Publishing a New Riders Publishing. ALL RIGHTS RESERVED. Go Here to buy this book at a 30% discount

Navigating and Organizing in List View

Using the Command key to find the path of your folder

Unix Passwords & Security

More...