Ensure Firewall Is Enabled

高等級 1自動化macos

說明

A firewall is a piece of software that blocks unwanted incoming connections to a system. The socketfilter Firewall is what is used when the Firewall is turned on in the Security & Privacy Preference Pane. Logging is required to appropriately monitor what access is allowed and denied. The logs can be viewed in the macOS Unified Logs. Prior to macOS 15.0 Sequoia, there were additional steps to turn on firewall logging after enabling the firewall. As of macOS 15, logging is turned on automatically without user interaction. The logging recommendation has been removed in the macOS 15 benchmark and will not be included going forward. If your organization is looking for more detailed information about network security, you will need a third-party solution. A firewall minimizes the threat of unauthorized users gaining access to your system while connected to a network or the Internet.

檢查方式

稽核方法: Shell 指令

shell

[ -x /usr/bin/osascript ] || exit 1
p=$(/usr/bin/osascript -l JavaScript <<'EOS'
$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall').objectForKey('EnableFirewall').js
EOS
)
s=$(/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate 2>/dev/null)
if [ "$p" = true ] || printf '%s' "$s" | /usr/bin/grep -qE 'State = [12]'; then echo compliant; else echo "EnableFirewall=${p:-unset}; $s"; fi

預期輸出: compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

Graphical Method: Perform the following steps to turn the firewall on: 1. Open System Settings 2. Select Network 3. Select Firewall 4. Set Firewall to enabled Terminal Method: Run the following command to enable the firewall: % /usr/bin/sudo /usr/libexec/ApplicationFirewall/socketfilterfw -- setglobalstate on Profile Method: Create or edit a configuration profile with the following information: 1. The PayloadType string is com.apple.security.firewall 2. The key to include is EnableFirewall 3. The key must be set to <true/>

屬性

作業系統: macos-14
標籤: macosnetworksonoma
參考資料: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 2.2.1 Ensure Firewall Is Enabled

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target macos