Audit Show All Filename Extensions

낮음레벨 1수동 검토macos

설명

A filename extension is a suffix added to a base filename that indicates the base filename's file format. This is intended for any user that logs into the GUI and has a home folder and not for service accounts. For the audit, we will continue to verify that every account with a home folder has filename extensions enabled. In macOS 15.0 Sequoia, the Show all filename extensions no longer worked consistently but does nominally default to showing all filename extensions. Due to this, the recommendation has been modified to audit this setting, but it is remaining in the benchmark as a good security practice to train users to verify that the file they are opening is the correct and expected filetype. Visible filename extensions allow the user to identify the file type and the application it is associated with which leads to quick identification of misrepresented malicious files.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Graphical Method: Perform the following steps to ensure that file extensions are shown: 1. Open Finder 2. Select Finder in the menu bar 3. Select Settings 4. Select Advanced 5. Verify that Show all filename extensions is set Terminal Method: Run the following command to verify that displaying of file extensions is enabled: % /usr/bin/sudo -u <username> /usr/bin/defaults read /Users/<username>/Library/Preferences/.GlobalPreferences.plist AppleShowAllExtensions 1 example: % /usr/bin/sudo -u firstuser /usr/bin/defaults read /Users/firstuser/Library/Preferences/.GlobalPreferences.plist AppleShowAllExtensions 1 % /usr/bin/sudo -u seconduser /usr/bin/defaults read /Users/secondname/Library/Preferences/.GlobalPreferences.plist AppleShowAllExtensions The domain/default pair of (/Users/secondname/Library/Preferences/.GlobalPreferences.plist, AppleShowAllExtensions) does not exist In this example, firstuser is in compliance and seconduser is not.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Graphical Method: Perform the following steps to ensure file extensions are shown: 1. Open Finder 2. Select Finder in the menu bar 3. Select Settings 4. Select Advanced 5. Set Show all filename extensions to enabled Terminal Method: Run the following command to enable displaying of file extensions: % /usr/bin/sudo -u <username> /usr/bin/defaults write /Users/<username>/Library/Preferences/.GlobalPreferences.plist AppleShowAllExtensions -bool true % /usr/bin/sudo killall Finder example: % /usr/bin/sudo -u seconduser /usr/bin/defaults write /Users/secondname/Library/Preferences/.GlobalPreferences.plist AppleShowAllExtensions -bool true % /usr/bin/sudo killall Finder

속성

운영 체제: macos-14
태그: loggingmacossonoma
참고 자료: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 6.1.1 Audit Show All Filename Extensions