For one thing: I always require certificate logins on SSH. On Mac I used to simply change /etc/ssh/sshd_config to this effect, but since Catalina macOS reverts this with every update. Clearly they don't want me poking around in there :(
IMO if you offer SSH you should offer certificate-only access as well, either with a glitzy on/off button or with a config file change, whatever. But nope...
With Apple you get a lot of security for 'free', however you give up a lot of customisation in return, even in terms of security features.
You can override it with a commandline flag but that would mean changing the launchdaemon which is protected by SIP as far as I know. But I will have a look for that to doublecheck.
Or maybe I'll attempt to contribute the important parts to an established project, like ezjail [0][1], which seems to be quite competent at handling jails, but is specialized on running services.
Refs:
[0]: http://erdgeist.org/arts/software/ezjail/
[1]: https://www-legacy.freebsd.org/doc/en_US.ISO8859-1/books/han...
I had Firefox, Thunderbird, Pidgin and a few others running in complete isolation from the base system, and from each other. I even had a separate Firefox jail that was only allowed to get out via a Tor socks proxy to avoid leaks (more of an experiment than a necessity, to be fair).
Communication between jails was done via commonly mounted nullfs. I have also setup QoS via PF for each of them.
They were all running on the host’s Xorg, which was probably also the weakness of this setup.
It was a pretty sweet setup, but required quite a bit of effort to maintain, even tho I automated most of the stuff.
Now I use macOS, and I would like more control over what apps do what. I’m not particularly impressed with the direction of the UI (it also doesn’t bother me terribly), but I welcome the finer grained security control.
References:
[0]: https://en.wikipedia.org/wiki/FreeBSD_jail
[1]: https://www.freebsd.org/cgi/man.cgi?query=jail&sektion=8&for...