Audit Touch ID

CaoCấp 1Tự độngmacos

Mô tả

Apple has integrated Touch ID with macOS and allows fingerprint use for many common operations. All use of Touch ID requires the presence of a password and the use of that password after every reboot, or when more than 48 hours has elapsed since the device was last unlocked. Touch ID is not a password replacement. The use of Touch ID can, however, make the use of passwords more secure for authorized users with physical access to a Mac. Normal day-to-day work operations can eliminate the use of console password entry unless a reboot is required other than on Monday morning. The infrequency of password screen unlock can enable a more complicated pass phrase that is seldom used. When Touch ID is used it remediates the risk of shoulder surfing (including video surveillance) to capture console credentials. There have been many reported shoulder surfing password captures on iOS devices. Rep...

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

s=$(/usr/sbin/sysadminctl -screenLock status 2>&1) || exit 1
p=$(/usr/bin/osascript -l JavaScript <<'EOS'
function run() {
  let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver').objectForKey('askForPassword'))
  let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver').objectForKey('askForPasswordDelay'))
  if ( pref1 == 1 && pref2 <= 5 ) {
    return("true")
  } else {
    return("false")
  }
}
EOS
)
if printf '%s' "$s" | /usr/bin/grep -qE 'screenLock delay is (immediate|5 seconds)' || [ "$p" = true ]; then echo compliant; else echo "$s"; fi

Đầu ra mong đợi: compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Graphical Method: Perform the following steps to set Touch ID to your organization's requirements: 1. Open System Settings 2. Select Touch ID & Password 3. Set the Touch ID settings to your organization's requirements Terminal Method: For each user, run the following commands to set Touch ID to your organization's requirements: Use this command for Touch ID to unlock the system. Use 0 to disable unlock or 1 to enable unlock: % /usr/bin/sudo -u <username> /usr/bin/bioutil -w -u <0,1> Use this command for Touch ID to use Apple Pay. Use 0 to disable Apple Pay or 1 to enable Apple Pay: % /usr/bin/sudo -u <username> /usr/bin/bioutil -w -a <0,1> Use this command to set the timeout at the system level: % /usr/bin/sudo usr/bin/bioutil -w -s -o <value≤172800> example: % /usr/bin/sudo -u <username> /usr/bin/bioutil -w -u 1 % /usr/bin/sudo -u <username> /usr/bin/bioutil -w -a 1 % /usr/bin/sudo usr/bin/bioutil -w -s -o 86400 Note: The -s notates a system configuration and does not need to be ran for each user.

Thuộc tính

Hệ điều hành: macos-14
Thẻ: loggingmacossonoma
Tham chiếu: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 2.11.2 Audit Touch ID

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target macos