OS X Auditor

OSXAuditor is pretty dope and we used it a bunch at Yelp. Over time, we created what we think is an inspired next version - <a href="https://github.com/Yelp/osxcollector" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;Yelp&#x2F;osxcollector</a>

This looks like an interesting project. But, there&#x27;s one bit of information, which is missing from the description and this discussion, that would help a lot with my understanding.<p>Is this a tool for a user who wants to learn more about their own machine, or a non-user who wants to know how a given machine has been used?<p>More information about the use cases of such a tool would be most helpful.

I&#x27;d say this isn&#x27;t quite ready for prime time. The errors I received were annoying and you&#x27;re not going to get an end user or most IT admins to parse the python just to find the errors.<p>I&#x27;ve only had 3 major errors but they were significant: 1) I&#x27;m on Yosemite so GetAuditedSystemVersion() looks for a PatchVersion variable that simply isn&#x27;t there. The header reads 10.10 not 10.10.patch as expected. 2) The Safari parsing snafu listed in my previous comment. Opening Safari isn&#x27;t enough, you have to use the browser quite a bit. The same could likely be said for all browser tests and it would be a good idea to outline precisely what this needs to be. Hint: A new system or install of Yosemite for instance will produce the errors I saw. 3) There&#x27;s a parsing bug in ParseMailAppAccount() and I just commented out the call completely.<p>Any number of these could just be Yosemite related but I don&#x27;t think so. All of the bugs I ran into are variations on index out of bounds due to some hardcoded assumption that mostly works, except in this instance apparently. I&#x27;m not the only one with these nagging bugs based on the issues list but mine do seem very specific to Yosemite or how I do(n&#x27;t) use my system.

Cool idea.<p>But using raw md5 hashes to verify against a blacklist is kind of useless. Especially now.<p>You should be using smarter file signatures:<p><a href="http://hooked-on-mnemonics.blogspot.com/2011/01/intro-to-creating-anti-virus-signatures.html" rel="nofollow">http:&#x2F;&#x2F;hooked-on-mnemonics.blogspot.com&#x2F;2011&#x2F;01&#x2F;intro-to-cre...</a>

Great idea. Love to run it, but... crash and burn:<p>~&#x2F;Library&#x2F;Safari&#x2F;LastSession.plist Traceback (most recent call last): File &quot;osxauditor.py&quot;, line 1702, in &lt;module&gt; Main() File &quot;osxauditor.py&quot;, line 1663, in Main ParseBrowsers() File &quot;osxauditor.py&quot;, line 808, in ParseBrowsers ParseSafari() File &quot;osxauditor.py&quot;, line 745, in ParseSafari ParseSafariProfile(User, UserSafariProfilePath) File &quot;osxauditor.py&quot;, line 717, in ParseSafariProfile LastSession = LastSessionPlist[&quot;SessionWindows&quot;][0][&quot;TabStates&quot;][0] File &quot;&#x2F;System&#x2F;Library&#x2F;Frameworks&#x2F;Python.framework&#x2F;Versions&#x2F;2.7&#x2F;Extras&#x2F;lib&#x2F;python&#x2F;PyObjC&#x2F;objc&#x2F;_convenience.py&quot;, line 451, in __getitem__objectAtIndex_ return container_unwrap(self.objectAtIndex_(idx), RuntimeError) IndexError: NSRangeException - -[__NSCFArray objectAtIndex:]: index (0) beyond bounds (0)

This looks nice but there are a ton of issues around pyobjc. I&#x27;ve never been able to successfully install it on 10.9.

Very interested to try this out on my own machines to see the results. I know somebody who does computer security at a University and the staff there has been frustrated with the lack of available forensics tools for OSX, so this may nicely fill an empty niche for some industry people as well.

Application path scanning follows symlinks recursively. One upwards link, and it never terminates.

I&#x27;m getting an error after running it:<p>[INFO] Users&#x27; LoginItems [INFO] <i></i><i></i>&#x27;s LoginItems [INFO] &#x2F;Users&#x2F;<i></i><i></i>&#x2F;Library&#x2F;Preferences&#x2F;com.apple.loginitems.plist [INFO] Cannot parse &#x2F;Users&#x2F;<i></i><i></i>&#x2F;Library&#x2F;Preferences&#x2F;com.apple.loginitems.plist (Binary or JSON plist may FAIL)<p>Traceback (most recent call last): File &quot;osxauditor.py&quot;, line 1702, in &lt;module&gt; Main() File &quot;osxauditor.py&quot;, line 1651, in Main ParseStartup() File &quot;osxauditor.py&quot;, line 550, in ParseStartup if &quot;SessionItems&quot; in LoginItemsPlist: TypeError: argument of type &#x27;bool&#x27; is not iterable