Audit Passwords System Preference Setting

높음레벨 1자동macos

설명

Apple has provided a new interface in macOS Monterey for managing passwords that mirrors the interfaced capability already available in iOS. Password management in macOS was previously available in both Safari Preferences and in Keychain Access. Apple is attempting to simplify password management for macOS and make the user experience more similar to iOS. Organizations are justifiably concerned about the risk of password managers, particularly as a possible backdoor to improved credential management regimes and greater use of Multi-Factor-Authentication (MFA). Apple has information posted on this system preference with additional information. Change Passwords preferences on Mac A warning icon is shown next to a website for any of the following reasons: - Easily guessed - Appeared in a data leak - Reused on another website Organizations should remove what passwords can be saved on user...

점검 방법

감사 방식: 셸 명령

shell

/usr/bin/osascript -l JavaScript <<'EOS'
function run() {
  let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX').objectForKey('DisableGuestAccount'))
  let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX').objectForKey('EnableGuestAccount'))
  let pref3 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow').objectForKey('GuestEnabled'))
  if ( ( pref1 == 1 && pref2 == 0 ) || ( pref3 == 0 ) ) {
    return("true")
  } else {
    return("false")
  }
}
EOS

예상 출력: true

조치 방법

조치 방식: 가이드 또는 인프라 패치

Graphical Method: Perform the following steps to set Password system settings to your organization's requirements: 1. Open System Settings 2. Select Passwords 3. Enter the user's password 4. Select the Security Recommendations 5. Remove stored passwords that should not be saved.

속성

운영 체제: macos-14
태그: authloggingmacossonoma
참고 자료: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 2.13.1 Audit Passwords System Preference Setting

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target macos