Ensure an Administrator Account Cannot Login to Another User's Active and Locked Session

AltaNivel 1Automatizadamacos

Descripción

macOS has a privilege that can be granted to any user that will allow that user to unlock active users' sessions. Note: For organizations that are using Platform Single-Sign-On (PSSO), this setting can cause issues with syncing with your PSSO. See the note in the audit to verify if you are using PSSO. Audit: Organisations using Platform SSO (app-sso platform -s shows a configuration) should not apply this change.

Cómo se verifica

Método de auditoría: Comando de shell

shell

out=$(/usr/bin/security authorizationdb read system.login.screensaver 2>&1) || exit 1
printf '%s\n' "$out" | /usr/bin/awk -F "[<>]" '$3=="authenticate-session-owner" { ++x } END { print x+0 }'

Salida esperada: 1

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Terminal: sudo /usr/bin/security authorizationdb write system.login.screensaver authenticate-session-owner ; sudo /usr/bin/defaults write /Library/Preferences/com.apple.loginwindow screenUnlockMode -int 1.

Propiedades

Sistemas operativos: macos-15
Etiquetas: macossystem-access
Referencia: CIS Apple macOS 15.0 Sequoia Benchmark v2.1.0 - 5.7 Ensure an Administrator Account Cannot Login to Another User's Active and Locked Session

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target macos