TMAegisБета
Више правила за macos

macOS

TMA-MACOS14-2.7.1

Ensure Screen Saver Hot Corners Are Secure For Current User

НискаНиво 1Аутоматскаmacos

Опис

Hot Corners can be configured to disable the screen saver by moving the mouse cursor to a corner of the screen. This can only be accomplished by the current user, so that is the only user that needs to be audited. Setting a hot corner to disable the screen saver poses a potential security risk since an unauthorized person could use this to bypass the login screen and gain access to the system.

Како се проверава

Метод провере: Команда љуске

shell
[ -x /usr/bin/defaults ] || exit 1
u=$(/usr/bin/stat -f%Su /dev/console 2>/dev/null)
[ -n "$u" ] && [ "$u" != root ] || u=$(/usr/bin/defaults read /Library/Preferences/com.apple.loginwindow lastUserName 2>/dev/null) || exit 1
bad=""
for c in bl tl tr br; do
  v=$(/usr/bin/defaults read "/Users/$u/Library/Preferences/com.apple.dock" "wvous-$c-corner" 2>/dev/null)
  [ "$v" = 6 ] && bad="$bad $c"
done
if [ -z "$bad" ]; then echo compliant; else echo "hot corner set to disable screen saver:$bad"; fi
Очекивани излаз
compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Graphical Method: Perform the following steps to ensure that a Hot Corner is not set to Disable Screen Saver: 1. Open System Settings 2. Select Desktop & Dock 3. Select Hot Corners 4. Set and hot corner that is set to Disable Screen Saver to a setting that matches your organizational requirements Terminal Method: Run the following command to ensure that hot corners cannot disable the screen saver: % /usr/bin/sudo -u <current user> /usr/bin/defaults delete /Users/<current user>/Library/Preferences/com.apple.dock wvous-bl-corner 2>/dev/null % /usr/bin/sudo -u <current user> /usr/bin/defaults delete /Users/<current user>/Library/Preferences/com.apple.dock wvous-tl-corner 2>/dev/null % /usr/bin/sudo -u <current user> /usr/bin/defaults delete /Users/<current user>/Library/Preferences/com.apple.dock wvous-tr-corner 2>/dev/null % /usr/bin/sudo -u <current user> /usr/bin/defaults delete /Users/<current user>/Library/Preferences/com.apple.dock wvous-br-corner 2>/dev/null Note: To find out the current user name, run the command /usr/bin/defaults read /Library/Preferences/com.apple.loginwindow lastUserName

Својства

Оперативни системи
macos-14
Ознаке
macossonoma
Референца
CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 2.7.1 Ensure Screen Saver Hot Corners Are Secure For Current User

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell
tmaegis scan --target macos