Ensure a Login Window Banner Exists

보통레벨 2자동macos

설명

A Login window banner warning informs the user that the system is reserved for authorized use only. It enforces an acknowledgment by the user that they have been informed of the use policy in the banner if required. The system recognizes either the .txt and the .rtf formats. An access warning may reduce a casual attacker's tendency to target the system. Access warnings may also aid in the prosecution of an attacker by evincing the attacker's knowledge of the system's private status, acceptable use policy, and authorization requirements.

점검 방법

감사 방식: 셸 명령

shell

set -- /Library/Security/PolicyBanner.*
[ -e "$1" ] || exit 1
for f in "$@"; do
  p=$(/usr/bin/stat -f %A "$f") || exit 1
  case "$p" in ??4) ;; *) echo "$f mode $p"; exit 0;; esac
done
echo compliant

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Terminal Method: Run the following commands to create or edit the login window text and set the proper permissions: Edit (or create) a PolicyBanner.txt or PolicyBanner.rtf file, in the /Library/Security/ folder, to include the required login window banner text. Perform the following to set permissions on the policy banner file: % /usr/bin/sudo /bin/chmod o+r /Library/Security/PolicyBanner.txt % /usr/bin/sudo /bin/chmod o+r /Library/Security/PolicyBanner.rtf Note: If your organization uses an .rtfd file to set the policy banner, run % /usr/bin/sudo /bin/chmod o+rx /Library/Security/PolicyBanner.rtfd to update the permissions.

속성

운영 체제: macos-14
태그: loggingmacossonoma
참고 자료: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 5.8 Ensure a Login Window Banner Exists

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target macos --level 2