Ensure an Administrator Account Cannot Login to Another User's Active and Locked Session

HochStufe 1Automatisiertmacos

Beschreibung

macOS has a privilege that can be granted to any user that will allow that user to unlock active users' sessions. Note: For organizations that are using Platform Single-Sign-On (PSSO), this setting can cause issues with syncing with your PSSO. See the note in the audit to verify if you are using PSSO. Audit: Organisations using Platform SSO (app-sso platform -s shows a configuration) should not apply this change.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

out=$(/usr/bin/security authorizationdb read system.login.screensaver 2>&1) || exit 1
printf '%s\n' "$out" | /usr/bin/awk -F "[<>]" '$3=="authenticate-session-owner" { ++x } END { print x+0 }'

Erwartete Ausgabe: 1

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Terminal: sudo /usr/bin/security authorizationdb write system.login.screensaver authenticate-session-owner ; sudo /usr/bin/defaults write /Library/Preferences/com.apple.loginwindow screenUnlockMode -int 1.

Eigenschaften

Betriebssysteme: macos-15
Tags: macossystem-access
Referenz: CIS Apple macOS 15.0 Sequoia Benchmark v2.1.0 - 5.7 Ensure an Administrator Account Cannot Login to Another User's Active and Locked Session

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target macos