Audit Passwords System Preference Setting

高レベル 1自動macos

説明

Apple has provided a new interface in macOS Monterey for managing passwords that mirrors the interfaced capability already available in iOS. Password management in macOS was previously available in both Safari Preferences and in Keychain Access. Apple is attempting to simplify password management for macOS and make the user experience more similar to iOS. Organizations are justifiably concerned about the risk of password managers, particularly as a possible backdoor to improved credential management regimes and greater use of Multi-Factor-Authentication (MFA). Apple has information posted on this system preference with additional information. Change Passwords preferences on Mac A warning icon is shown next to a website for any of the following reasons: - Easily guessed - Appeared in a data leak - Reused on another website Organizations should remove what passwords can be saved on user...

チェック方法

監査方法: シェルコマンド

shell

/usr/bin/osascript -l JavaScript <<'EOS'
function run() {
  let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX').objectForKey('DisableGuestAccount'))
  let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX').objectForKey('EnableGuestAccount'))
  let pref3 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow').objectForKey('GuestEnabled'))
  if ( ( pref1 == 1 && pref2 == 0 ) || ( pref3 == 0 ) ) {
    return("true")
  } else {
    return("false")
  }
}
EOS

期待される出力: true

修正方法

修正方法: ガイダンスまたは IaC パッチ

Graphical Method: Perform the following steps to set Password system settings to your organization's requirements: 1. Open System Settings 2. Select Passwords 3. Enter the user's password 4. Select the Security Recommendations 5. Remove stored passwords that should not be saved.

プロパティ

オペレーティングシステム: macos-14
タグ: authloggingmacossonoma
参照: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 2.13.1 Audit Passwords System Preference Setting

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target macos