macOS
TMA-MACOS14-5.7
Ensure an Administrator Account Cannot Login to Another User's Active and Locked Session
Beschreibung
macOS has a privilege that can be granted to any user that will allow that user to unlock active users' sessions. Disabling the administrator's and/or user's ability to log into another user's active and locked session prevents unauthorized persons from viewing potentially sensitive and/or personal information.
So wird geprüft
Prüfmethode: Shell-Befehl
out=$(/usr/bin/security authorizationdb read system.login.screensaver 2>&1) || exit 1
printf '%s\n' "$out" | /usr/bin/awk -F "[<>]" '$3=="authenticate-session-owner" { ++x } END { print x+0 }'- Erwartete Ausgabe
1
So wird behoben
Behebungsmethode: Anleitung oder Infrastruktur-Patch
Terminal Method: Run the following command to disable a user logging into another user's active and/or locked session: % /usr/bin/sudo /usr/bin/security authorizationdb write system.login.screensaver authenticate-session-owner YES (0) Running this command will disable Touch ID to unlock the screen saver. To re-enable Touch ID for users, run the following command: % /usr/bin/sudo /usr/bin/defaults write /Library/Preferences/com.apple.loginwindow screenUnlockMode -int 1
Eigenschaften
- Betriebssysteme
- macos-14
- Tags
- loggingmacossonoma
- Referenz
- CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 5.7 Ensure an Administrator Account Cannot Login to Another User's Active and Locked Session
Diesen Host prüfen
Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.
tmaegis scan --target macos