Your best defence is always to turn off unnecessary services. If you're not using remote desktop: turn it off. If you're not using the HTTP or FTP servers: turn them off. Fewer services running, fewer points of entry for possibly intruders to exploit.

Aside from locking it down, there are some free and open source products that are OS X friendly you can look at to do intrusion detection on your machine.

Snort

Though I haven't personally run it, I do have colleagues who know and trust it for intrusion detection. It's BSD-compatible so it makes a it a good fit for OS X. Another upside to going with Snort is it's available as a Homebrew package:

> brew info snort
snort 2.9.0.5
http://www.snort.org
Depends on: daq, libdnet, pcre
Not installed
https://github.com/mxcl/homebrew/commits/master/Library/Formula/snort.rb

==> Caveats
For snort to be functional, you need to update the permissions for /dev/bpf*
so that they can be read by non-root users.  This can be done manually using:
    sudo chmod 644 /dev/bpf*
or you could create a startup item to do this for you.

So you get a simplified path to installation and some trust in the fact that it ports well to OS X and runs there. With Homebrew installed you only need to do:

> brew install snort

And you're ready to get started with it.

Check out this Snort for OS X Lion Server setup guide that the Snort community provides to get started with rule writing for your OS X machine. That's a great document and, in addition to walking through installing Snort from source (which you don't need to do), it talks about all the things you should do your OS X Lion Server instance to help protect it. If you install via Homebrew, start at Section 5 (page 13) in the PDF since you don't need to worry about installing it from source code.

Tripwire

I've run Tripwire on linux machines to do rapid intrusion detection and alerting. It's effective but it's a bit of a beast to set up. It can perform actions when rules are matched against log files. Of course, a savvy hacker is going to know to disable Tripwire as soon as they break in so they don't end up with their session getting cut off.

The MacWorld hint talks about setting up Tripwire on OS X. It's not simple and the article ends with mentioning that it's not been tested.

There is no command line access for the Microsoft Remote Desktop Client. But the free and most excellent CoRD remote desktop client does handle rdp:// links which would let you call it from a launcher of your choice or even via open on the command line.

The CoRD documentation on github lays out how you can use URL encoded parameters to open full-configured RDP sessions.

rdp:// URL syntax

CoRD handles rdp:// URLs, which you can use from many places inside OS X. Unfortunately, there is no way to extend Finder's "Connect to Server" dialog, which supports launching VNC URLs, so we can't launch CoRD from there. If Apple changes this (or if anybody is aware of a way to extend it) we would love to hear about it.

Saved Servers

If you want to use rdp:// urls with existing saved servers, you can (as of 0.5.3)! Just use the label in place of a hostname:

open rdp://label

New Servers

From a shell (using Terminal):

open rdp://hostname

Additional parameters can be used to start a fully-configured session via the URL:

open rdp://[username[:password]@]hostname[:port][/domain][?parameters]

The following parameters can be set for the session via a query string (as of 0.5.2):

• screenDepth ### [8|16|24|32]
• screenWidth <width in pixels>
• screenHeight <height in pixels>
• consoleSession ### [true|false|yes|no]
• fullscreen ### [true|false|yes|no]
• windowDrags ### [true|false|yes|no]
• drawDesktop ### [true|false|yes|no]
• windowAnimation ### [true|false|yes|no]
• themes ### [true|false|yes|no]
• fontSmoothing ### [true|false|yes|no]
• forwardDisks ### [true|false|yes|no]
• forwardPrinters ### [true|false|yes|no]
• forwardAudio ### [0|1|2]
  • 0 - Forward Audio to the Local Machine (Currently not used since CoRD doesn't present audio)
  • 1 - Leave Audio at the Remote Machine
  • 2 - Disable Audio at both Machines

Example

open rdp://jsmith:securePassword@hostname.bigco.com/BigCoDomain?screendepth###24\&consoleSession###true\&themes###false\&screenWidth###1280\&screenHeight###800

Note:

When using ampersands (&) from the command line, they have to be escaped with a backslash (). Colons (:) can be used in place of ampersands for the same effect, without needing to be escaped.

Passwords with any special characters in them, @, :, &, etc need to be encoded according to the URL Encoding Format

Command Line Use

CoRD supports the following command line options: -host -port -u -d -p -a [8|16|24|32] set screen depth -width set screen resolution width -height set screen resolution height

Example

/Applications/CoRD.app/Contents/MacOS/CoRD -host example.com -port 3389 -u username

Caveats

Launching CoRD from the command line this way causes a fresh instance of CoRD to be opened. One symptom of this is multiple Dock icons. This overrides or decreases the effectiveness of many of CoRD strong points, including unified sessions, etc. For that reason, we recommend using the open command, and rdp:// URLs to launch sessions.