Ensure Firewall Is Enabled

高级别 1自动化macos

说明

A firewall is a piece of software that blocks unwanted incoming connections to a system. The socketfilter Firewall is what is used when the Firewall is turned on in the Security & Privacy Preference Pane. Logging is required to appropriately monitor what access is allowed and denied. The logs can be viewed in the macOS Unified Logs. Prior to macOS 15.0 Sequoia, there were additional steps to turn on firewall logging after enabling the firewall. As of macOS 15, logging is turned on automatically without user interaction. The logging recommendation has been removed in the macOS 15 benchmark and will not be included going forward. If your organization is looking for more detailed information about network security, you will need a third-party solution. A firewall minimizes the threat of unauthorized users gaining access to your system while connected to a network or the Internet.

检查方式

审计方法: Shell 命令

shell

[ -x /usr/bin/osascript ] || exit 1
p=$(/usr/bin/osascript -l JavaScript <<'EOS'
$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall').objectForKey('EnableFirewall').js
EOS
)
s=$(/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate 2>/dev/null)
if [ "$p" = true ] || printf '%s' "$s" | /usr/bin/grep -qE 'State = [12]'; then echo compliant; else echo "EnableFirewall=${p:-unset}; $s"; fi

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

Graphical Method: Perform the following steps to turn the firewall on: 1. Open System Settings 2. Select Network 3. Select Firewall 4. Set Firewall to enabled Terminal Method: Run the following command to enable the firewall: % /usr/bin/sudo /usr/libexec/ApplicationFirewall/socketfilterfw -- setglobalstate on Profile Method: Create or edit a configuration profile with the following information: 1. The PayloadType string is com.apple.security.firewall 2. The key to include is EnableFirewall 3. The key must be set to <true/>

属性

操作系统: macos-14
标签: macosnetworksonoma
参考: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 2.2.1 Ensure Firewall Is Enabled

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target macos