Mac server security & malware

Firewall, intrusion prevention, open-ports monitoring and a full Malware Audit; for Macs and the fleet.

Layered security: the macOS Application Firewall and pf, fail2ban/CrowdSec, an open-ports watch with alerts, SSH hardening, and a Malware Audit pane (Gatekeeper/SIP/FileVault/XProtect, persistence, ClamAV, YARA, VirusTotal) with deeper tooling (Volatility 3, capa, CAPE/Cuckoo) and an EDR Fleet board.

Require a physical key before anything runs

With a Fleet licence, App Lock can require a physical FIDO2 security key. Enrol a Yubico YubiKey, Google Titan or FEITIAN ePass beside the password-lock setting and FrontierStack stays locked; including its external control surfaces; until you touch an enrolled key. If a password is also configured, both are required. You can register up to three keys so a sealed backup is ready. Compatible USB-C, Lightning and NFC models work through Apple's security-key sheet in the iPhone and iPad app too.

Networking, perimeter & integrations

Tight integrations with Cloudflare (zones, DNS, cache, tunnels) and OPNsense (driven by its REST API); plus pfSense, OpenWrt, MikroTik RouterOS, UniFi and more. Open a port with UPnP or NAT-PMP, follow a changing IP with DDNS, build a private network with WireGuard, Tailscale, Headscale, NetBird, Nebula or ZeroTier; including a self-hosted ZeroTier controller with its own flow-rule editor, and a tailnet-wide Tailscale view that warns before node keys expire; control PoE switch ports (RFC 3621) to power-cycle an access point or camera, and automate password-free service logins with auth.md. See the security reference for the full protocol list.