Ensure Wake for Network Access Is Disabled

낮음레벨 1자동macos

설명

This feature allows the computer to take action when the user is not present and the computer is in energy saving mode. These tools require FileVault to remain unlocked and fully rejoin known networks. This macOS feature is meant to allow the computer to resume activity as needed regardless of physical security controls.

점검 방법

감사 방식: 셸 명령

shell

out=$(/usr/bin/pmset -g custom 2>/dev/null) || exit 1
n=$(printf '%s\n' "$out" | /usr/bin/awk '$1 == "womp" && $2 != 0 {n++} END {print n+0}')
p=$(/usr/bin/profiles -P -o stdout 2>/dev/null | /usr/bin/grep -c '"Wake On LAN" = 1')
if [ "$n" -eq 0 ] && [ "${p:-0}" -eq 0 ]; then echo compliant; else echo "womp enabled ($n) / profile Wake On LAN=1 ($p)"; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Profile (preferred): com.apple.MCX com.apple.EnergySaver.desktop.ACPower = <dict>; com.apple.MCX com.apple.EnergySaver.portable.ACPower = <dict>; com.apple.MCX com.apple.EnergySaver.portable.BatteryPower = <dict>. Terminal: sudo /usr/bin/pmset -a womp 0. GUI: Desktop Instructions: System Settings > Energy Saver > Set Wake for network access to disabled. Laptop Instructions: System Settings > Battery > Options > Set Wake for network access to Never.

속성

운영 체제: macos-15
태그: macossystem-settings
참고 자료: CIS Apple macOS 15.0 Sequoia Benchmark v2.1.0 - 2.10.3 Ensure Wake for Network Access Is Disabled

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target macos