TMA-SAFARI-4.1

Ensure 'AutoFill user names and passwords' is 'Disabled'

MoyenneNiveau 2Automatiséesafari

Description

Safari can utilize a user-level keychain for credential storage, and then access that information when revisiting websites on the same domain. By disabling this feature the user will be prompted to manually enter their credentials when they visit a website. Rationale: If this setting is enabled, users can have Safari store and retrieve passwords through the user-level Keychain and provide them automatically the next time they log in to a site. An intruder who has unrestricted access to your computer for even a minute can gain access to secure site areas. Audit reads AutoFillPasswords from the com.apple.Safari preference domain of the account running the scan (the PDF checks the same token in com.apple.Safari.plist; manual check: Follow the below steps and verify that AutoFill user names and passwords is Disabled: 1. Click Safari. 2. Click Preferences. 3. Click Passwords. 4. Verify AutoFill user names and passwords is unchecke). Safari is sandboxed, so the reading process needs Full Disk Access on macOS 10.14+. A missing key exits non-zero and is reported as FAIL even where the built-in default is compliant. Values forced by a configuration profile live in /Library/Managed Preferences and are not read here.

Méthode de vérification

Méthode d'audit: Commande shell

shell

out=$(defaults read com.apple.Safari AutoFillPasswords 2>/dev/null) || exit 1; printf '%s\n' "$out"

Sortie attendue: 0

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Follow the below steps to set AutoFill user names and passwords to Disabled: 1. Click Safari. 2. Click Preferences. 3. Click Passwords. 4. Uncheck the AutoFill user names and passwords checkbox. Or deploy a configuration profile for com.apple.Safari setting AutoFillPasswords = false, or as the logged-in user run: defaults write com.apple.Safari AutoFillPasswords -bool false and restart Safari.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: safaribrowsercis-l2
Référence: CIS macOS Safari Benchmark v2.0.0 - 4.1 Ensure 'AutoFill user names and passwords' is 'Disabled'

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target safari --level 2