Ensure Guest Access to Shared Folders Is Disabled

НизкийУровень 1Ручная проверкаmacos

Описание

Allowing guests to connect to shared folders enables users to access selected shared folders and their contents from different computers on a network. Not allowing guests to connect to shared folders mitigates the risk of an untrusted user doing basic reconnaissance and possibly using privilege escalation attacks to take control of the system.

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

Graphical Method: Perform the following steps to ensure that guests cannot connect to shared folders: 1. Open System Settings 2. Select Users & Groups 3. Select the i next to the Guest User 4. Verify that Allow guests to connect to shared folders is disabled Terminal Method: Run the following commands to verify that shared folders are not accessible to guest users: % /usr/bin/sudo /usr/sbin/sysadminctl -smbGuestAccess status The output should include SMB guest access disabled.

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Graphical Method: Perform the following steps to no longer allow guest user access to shared folders: 1. Open System Settings 2. Select Users & Groups 3. Select the i next to the Guest User 4. Set Allow guests to connect to shared folders to disabled Terminal Method: Run the following commands to ensure that shared folders are not accessible to guest users: % /usr/bin/sudo /usr/sbin/sysadminctl -smbGuestAccess off

Свойства

Операционные системы: macos-14
Теги: access-controlmacossonoma
Источник: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 2.12.2 Ensure Guest Access to Shared Folders Is Disabled