macOS

Documenting useful configuration options for macOS. Some of these customizations will involve the defaults command. See macos-defaults.com for more information.

System Configuration

Dotfiles

Keep shell, editor, and terminal configuration aligned across systems by installing the shared dotfiles archive.

git archive --remote="git@codeberg.org:domi-p/core-config.git" HEAD | tar -xf - -C ~

FileVault

Enable FileVault in System Settings. After enabling FileVault, you will receive a recovery key. Store this recovery key in a safe location as you will need it if you ever forget your password. Use the following command to verify that you have recorded your recovery key correctly

sudo fdesetup validaterecovery

Homebrew

Install Homebrew using the following command.

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

Shell

Install bash and bash-completion packages.

brew install bash bash-completion@2

Add bash to the /etc/shells file.

echo "$HOMEBREW_PREFIX/bin/bash" | sudo tee -a /etc/shells

Change the shell.

chsh -s "$HOMEBREW_PREFIX/bin/bash"

SSH

macOS allows you to create SSH keys in the Secure Enclave with biometric protection. This provides enhanced security as the private key never leaves the Secure Enclave hardware.

Create a biometric-protected SSH key in the Secure Enclave:

sc_auth create-ctk-identity -l ssh -k p-256-ne -t bio

This creates an ECDSA P-256 key that requires biometric authentication whenever it’s used.

List your Secure Enclave SSH keys to verify creation:

sc_auth list-ctk-identities

Copy your public key to the clipboard to add to services like GitHub:

ssh-add -L | tr -d '\n' | pbcopy

Paste the key into your GitHub account under Settings > SSH and GPG keys.

For more advanced usage and configuration options, see this detailed guide.

Sudo

By default, macOS requires you to enter your password when you use sudo. However, you can configure PAM (Pluggable Authentication Module) to allow Touch ID authentication for sudo commands, making it more convenient while maintaining security.

The /etc/pam.d/sudo_local file is specifically designed for local customizations to sudo authentication, so your changes won’t be overwritten by system updates.

Create the /etc/pam.d/sudo_local file.

sed 's/^#auth/auth/' /etc/pam.d/sudo_local.template | sudo tee /etc/pam.d/sudo_local

Change the permissions of the file.

sudo chmod 444 /etc/pam.d/sudo_local

User Interface

Dock

Configure Dock

Automatically hide the dock to save some vertical space.

defaults write com.apple.dock "autohide" -bool "true"

Reduce the time it takes for the dock to show up.

defaults write com.apple.dock "autohide-delay" -float "0"

Hide the recent applications and documents in the dock.

defaults write com.apple.dock "show-recents" -bool "false"

Restart Dock

Run the following command for the changes to become effective.

killall Dock

Finder

Configure Finder

Enable the path bar for Finder.

defaults write com.apple.finder "ShowPathbar" -bool "true"

Show folders first in Finder.

defaults write com.apple.finder "_FXSortFoldersFirst" -bool "true"

Restart Finder

Run the following command for the changes to become effective.

killall Finder