macOS
TMA-MACOS14-5.7
Ensure an Administrator Account Cannot Login to Another User's Active and Locked Session
Descripción
macOS has a privilege that can be granted to any user that will allow that user to unlock active users' sessions. Disabling the administrator's and/or user's ability to log into another user's active and locked session prevents unauthorized persons from viewing potentially sensitive and/or personal information.
Cómo se verifica
Método de auditoría: Comando de shell
out=$(/usr/bin/security authorizationdb read system.login.screensaver 2>&1) || exit 1
printf '%s\n' "$out" | /usr/bin/awk -F "[<>]" '$3=="authenticate-session-owner" { ++x } END { print x+0 }'- Salida esperada
1
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Terminal Method: Run the following command to disable a user logging into another user's active and/or locked session: % /usr/bin/sudo /usr/bin/security authorizationdb write system.login.screensaver authenticate-session-owner YES (0) Running this command will disable Touch ID to unlock the screen saver. To re-enable Touch ID for users, run the following command: % /usr/bin/sudo /usr/bin/defaults write /Library/Preferences/com.apple.loginwindow screenUnlockMode -int 1
Propiedades
- Sistemas operativos
- macos-14
- Etiquetas
- loggingmacossonoma
- Referencia
- CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 5.7 Ensure an Administrator Account Cannot Login to Another User's Active and Locked Session
Verificar este host
Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.
tmaegis scan --target macos