Ensure Remote Management Is Disabled

高レベル 1自動macos

説明

Remote Management is the client portion of Apple Remote Desktop (ARD). Remote Management can be used by remote administrators to view the current screen, install software, report on, and generally manage client Macs. The screen sharing options in Remote Management are identical to those in the Screen Sharing section. In fact, only one of the two can be configured. If Remote Management is used, refer to the Screen Sharing section above on issues regarding screen sharing. Remote Management should only be enabled when a Directory is in place to manage the accounts with access. Computers will be available on port 5900 on a macOS System and could accept connections from untrusted hosts depending on the configuration, which is a major concern for mobile systems. As with other sharing options, an open port even for authorized management functions can be attacked, and both unauthorized access...

チェック方法

監査方法: シェルコマンド

shell

[ -x /usr/bin/sw_vers ] || exit 1
out=$(/bin/ps -axo comm= 2>/dev/null) || exit 1
printf '%s\n' "$out" | /usr/bin/grep -c ARDAgent || true

期待される出力: 0

修正方法

修正方法: ガイダンスまたは IaC パッチ

Graphical Method: Perform the following steps to disable Remote Management: 1. Open System Settings 2. Select General 3. Select Sharing 4. Set Remote Management to disabled Terminal Method: Run the following command to disable Remote Management: % /usr/bin/sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources /kickstart -deactivate -stop Starting... Removed preference to start ARD after reboot. Done.

プロパティ

オペレーティングシステム: macos-14
タグ: macossonoma
参照: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 2.3.3.5 Ensure Remote Management Is Disabled

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target macos