TMAegisBeta
Thêm quy tắc cho macos

macOS

TMA-MACOS14-2.7.1

Ensure Screen Saver Hot Corners Are Secure For Current User

ThấpCấp 1Tự độngmacos

Mô tả

Hot Corners can be configured to disable the screen saver by moving the mouse cursor to a corner of the screen. This can only be accomplished by the current user, so that is the only user that needs to be audited. Setting a hot corner to disable the screen saver poses a potential security risk since an unauthorized person could use this to bypass the login screen and gain access to the system.

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell
[ -x /usr/bin/defaults ] || exit 1
u=$(/usr/bin/stat -f%Su /dev/console 2>/dev/null)
[ -n "$u" ] && [ "$u" != root ] || u=$(/usr/bin/defaults read /Library/Preferences/com.apple.loginwindow lastUserName 2>/dev/null) || exit 1
bad=""
for c in bl tl tr br; do
  v=$(/usr/bin/defaults read "/Users/$u/Library/Preferences/com.apple.dock" "wvous-$c-corner" 2>/dev/null)
  [ "$v" = 6 ] && bad="$bad $c"
done
if [ -z "$bad" ]; then echo compliant; else echo "hot corner set to disable screen saver:$bad"; fi
Đầu ra mong đợi
compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Graphical Method: Perform the following steps to ensure that a Hot Corner is not set to Disable Screen Saver: 1. Open System Settings 2. Select Desktop & Dock 3. Select Hot Corners 4. Set and hot corner that is set to Disable Screen Saver to a setting that matches your organizational requirements Terminal Method: Run the following command to ensure that hot corners cannot disable the screen saver: % /usr/bin/sudo -u <current user> /usr/bin/defaults delete /Users/<current user>/Library/Preferences/com.apple.dock wvous-bl-corner 2>/dev/null % /usr/bin/sudo -u <current user> /usr/bin/defaults delete /Users/<current user>/Library/Preferences/com.apple.dock wvous-tl-corner 2>/dev/null % /usr/bin/sudo -u <current user> /usr/bin/defaults delete /Users/<current user>/Library/Preferences/com.apple.dock wvous-tr-corner 2>/dev/null % /usr/bin/sudo -u <current user> /usr/bin/defaults delete /Users/<current user>/Library/Preferences/com.apple.dock wvous-br-corner 2>/dev/null Note: To find out the current user name, run the command /usr/bin/defaults read /Library/Preferences/com.apple.loginwindow lastUserName

Thuộc tính

Hệ điều hành
macos-14
Thẻ
macossonoma
Tham chiếu
CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 2.7.1 Ensure Screen Saver Hot Corners Are Secure For Current User

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell
tmaegis scan --target macos