Audit Show All Filename Extensions

FaibleNiveau 1Revue manuellemacos

Description

A filename extension is a suffix added to a base filename that indicates the base filename's file format. This is intended for any user that logs into the GUI and has a home folder and not for service accounts. For the audit, we will continue to verify that every account with a home folder has filename extensions enabled. In macOS 15.0 Sequoia, the Show all filename extensions no longer worked consistently but does nominally default to showing all filename extensions. Due to this, the recommendation has been modified to audit this setting, but it is remaining in the benchmark as a good security practice to train users to verify that the file they are opening is the correct and expected filetype. Visible filename extensions allow the user to identify the file type and the application it is associated with which leads to quick identification of misrepresented malicious files.

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

Graphical Method: Perform the following steps to ensure that file extensions are shown: 1. Open Finder 2. Select Finder in the menu bar 3. Select Settings 4. Select Advanced 5. Verify that Show all filename extensions is set Terminal Method: Run the following command to verify that displaying of file extensions is enabled: % /usr/bin/sudo -u <username> /usr/bin/defaults read /Users/<username>/Library/Preferences/.GlobalPreferences.plist AppleShowAllExtensions 1 example: % /usr/bin/sudo -u firstuser /usr/bin/defaults read /Users/firstuser/Library/Preferences/.GlobalPreferences.plist AppleShowAllExtensions 1 % /usr/bin/sudo -u seconduser /usr/bin/defaults read /Users/secondname/Library/Preferences/.GlobalPreferences.plist AppleShowAllExtensions The domain/default pair of (/Users/secondname/Library/Preferences/.GlobalPreferences.plist, AppleShowAllExtensions) does not exist In this example, firstuser is in compliance and seconduser is not.

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Graphical Method: Perform the following steps to ensure file extensions are shown: 1. Open Finder 2. Select Finder in the menu bar 3. Select Settings 4. Select Advanced 5. Set Show all filename extensions to enabled Terminal Method: Run the following command to enable displaying of file extensions: % /usr/bin/sudo -u <username> /usr/bin/defaults write /Users/<username>/Library/Preferences/.GlobalPreferences.plist AppleShowAllExtensions -bool true % /usr/bin/sudo killall Finder example: % /usr/bin/sudo -u seconduser /usr/bin/defaults write /Users/secondname/Library/Preferences/.GlobalPreferences.plist AppleShowAllExtensions -bool true % /usr/bin/sudo killall Finder

Propriétés

Systèmes d'exploitation: macos-14
Étiquettes: loggingmacossonoma
Référence: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 6.1.1 Audit Show All Filename Extensions