Ensure Guest Access to Shared Folders Is Disabled

低等級 1人工審核macos

說明

Allowing guests to connect to shared folders enables users to access selected shared folders and their contents from different computers on a network. Not allowing guests to connect to shared folders mitigates the risk of an untrusted user doing basic reconnaissance and possibly using privilege escalation attacks to take control of the system.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

Graphical Method: Perform the following steps to ensure that guests cannot connect to shared folders: 1. Open System Settings 2. Select Users & Groups 3. Select the i next to the Guest User 4. Verify that Allow guests to connect to shared folders is disabled Terminal Method: Run the following commands to verify that shared folders are not accessible to guest users: % /usr/bin/sudo /usr/sbin/sysadminctl -smbGuestAccess status The output should include SMB guest access disabled.

修補方式

修補方法: 操作指南或基礎設施修補檔

Graphical Method: Perform the following steps to no longer allow guest user access to shared folders: 1. Open System Settings 2. Select Users & Groups 3. Select the i next to the Guest User 4. Set Allow guests to connect to shared folders to disabled Terminal Method: Run the following commands to ensure that shared folders are not accessible to guest users: % /usr/bin/sudo /usr/sbin/sysadminctl -smbGuestAccess off

屬性

作業系統: macos-14
標籤: access-controlmacossonoma
參考資料: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 2.12.2 Ensure Guest Access to Shared Folders Is Disabled