Audit Passwords System Preference Setting

HighLevel 1Automatedmacos

Description

Apple has provided a new interface in macOS Monterey for managing passwords that mirrors the interfaced capability already available in iOS. Password management in macOS was previously available in both Safari Preferences and in Keychain Access. Apple is attempting to simplify password management for macOS and make the user experience more similar to iOS. Organizations are justifiably concerned about the risk of password managers, particularly as a possible backdoor to improved credential management regimes and greater use of Multi-Factor-Authentication (MFA). Apple has information posted on this system preference with additional information. Change Passwords preferences on Mac A warning icon is shown next to a website for any of the following reasons: - Easily guessed - Appeared in a data leak - Reused on another website Organizations should remove what passwords can be saved on user...

How it is checked

Audit method: Shell command

shell

/usr/bin/osascript -l JavaScript <<'EOS'
function run() {
  let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX').objectForKey('DisableGuestAccount'))
  let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX').objectForKey('EnableGuestAccount'))
  let pref3 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow').objectForKey('GuestEnabled'))
  if ( ( pref1 == 1 && pref2 == 0 ) || ( pref3 == 0 ) ) {
    return("true")
  } else {
    return("false")
  }
}
EOS

Expected output: true

How it is fixed

Fix method: Guidance or infrastructure patch

Graphical Method: Perform the following steps to set Password system settings to your organization's requirements: 1. Open System Settings 2. Select Passwords 3. Enter the user's password 4. Select the Security Recommendations 5. Remove stored passwords that should not be saved.

Properties

Operating systems: macos-14
Tags: authloggingmacossonoma
Reference: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 2.13.1 Audit Passwords System Preference Setting

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target macos