Ensure Firewall Is Enabled

AltaNível 1Automatizadamacos

Descrição

A firewall is a piece of software that blocks unwanted incoming connections to a system. The socketfilter Firewall is what is used when the Firewall is turned on in the Security & Privacy Preference Pane. Logging is required to appropriately monitor what access is allowed and denied. The logs can be viewed in the macOS Unified Logs. Prior to macOS 15.0 Sequoia, there were additional steps to turn on firewall logging after enabling the firewall. As of macOS 15, logging is turned on automatically without user interaction. The logging recommendation has been removed in the macOS 15 benchmark and will not be included going forward. If your organization is looking for more detailed information about network security, you will need a third-party solution. A firewall minimizes the threat of unauthorized users gaining access to your system while connected to a network or the Internet.

Como é verificado

Método de auditoria: Comando shell

shell

[ -x /usr/bin/osascript ] || exit 1
p=$(/usr/bin/osascript -l JavaScript <<'EOS'
$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall').objectForKey('EnableFirewall').js
EOS
)
s=$(/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate 2>/dev/null)
if [ "$p" = true ] || printf '%s' "$s" | /usr/bin/grep -qE 'State = [12]'; then echo compliant; else echo "EnableFirewall=${p:-unset}; $s"; fi

Saída esperada: compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Graphical Method: Perform the following steps to turn the firewall on: 1. Open System Settings 2. Select Network 3. Select Firewall 4. Set Firewall to enabled Terminal Method: Run the following command to enable the firewall: % /usr/bin/sudo /usr/libexec/ApplicationFirewall/socketfilterfw -- setglobalstate on Profile Method: Create or edit a configuration profile with the following information: 1. The PayloadType string is com.apple.security.firewall 2. The key to include is EnableFirewall 3. The key must be set to <true/>

Propriedades

Sistemas operacionais: macos-14
Tags: macosnetworksonoma
Referência: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 2.2.1 Ensure Firewall Is Enabled

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

shell

tmaegis scan --target macos