Ensure an Administrator Account Cannot Login to Another User's Active and Locked Session

TinggiLevel 1Otomatismacos

Deskripsi

macOS has a privilege that can be granted to any user that will allow that user to unlock active users' sessions. Note: For organizations that are using Platform Single-Sign-On (PSSO), this setting can cause issues with syncing with your PSSO. See the note in the audit to verify if you are using PSSO. Audit: Organisations using Platform SSO (app-sso platform -s shows a configuration) should not apply this change.

Cara pemeriksaan

Metode audit: Perintah shell

shell

out=$(/usr/bin/security authorizationdb read system.login.screensaver 2>&1) || exit 1
printf '%s\n' "$out" | /usr/bin/awk -F "[<>]" '$3=="authenticate-session-owner" { ++x } END { print x+0 }'

Output yang diharapkan: 1

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Terminal: sudo /usr/bin/security authorizationdb write system.login.screensaver authenticate-session-owner ; sudo /usr/bin/defaults write /Library/Preferences/com.apple.loginwindow screenUnlockMode -int 1.

Properti

Sistem operasi: macos-26
Tag: macossystem-access
Referensi: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 5.7 Ensure an Administrator Account Cannot Login to Another User's Active and Locked Session

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target macos