macOS
TMA-MACOS14-5.7
Ensure an Administrator Account Cannot Login to Another User's Active and Locked Session
Deskripsi
macOS has a privilege that can be granted to any user that will allow that user to unlock active users' sessions. Disabling the administrator's and/or user's ability to log into another user's active and locked session prevents unauthorized persons from viewing potentially sensitive and/or personal information.
Cara pemeriksaan
Metode audit: Perintah shell
out=$(/usr/bin/security authorizationdb read system.login.screensaver 2>&1) || exit 1
printf '%s\n' "$out" | /usr/bin/awk -F "[<>]" '$3=="authenticate-session-owner" { ++x } END { print x+0 }'- Output yang diharapkan
1
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
Terminal Method: Run the following command to disable a user logging into another user's active and/or locked session: % /usr/bin/sudo /usr/bin/security authorizationdb write system.login.screensaver authenticate-session-owner YES (0) Running this command will disable Touch ID to unlock the screen saver. To re-enable Touch ID for users, run the following command: % /usr/bin/sudo /usr/bin/defaults write /Library/Preferences/com.apple.loginwindow screenUnlockMode -int 1
Properti
- Sistem operasi
- macos-14
- Tag
- loggingmacossonoma
- Referensi
- CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 5.7 Ensure an Administrator Account Cannot Login to Another User's Active and Locked Session
Periksa host ini
Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.
tmaegis scan --target macos