Ensure Require Password After Screen Saver Begins or Display Is Turned Off Is Enabled for 5 Seconds or Immediately

高等級 1自動化macos

說明

Sleep and screen saver modes are low power modes that reduce electrical consumption while the system is not in use. Audit: Passes when sysadminctl reports immediate/5 seconds for the console user or a profile sets askForPassword with askForPasswordDelay <= 5.

檢查方式

稽核方法: Shell 指令

shell

s=$(/usr/sbin/sysadminctl -screenLock status 2>&1) || exit 1
p=$(/usr/bin/osascript -l JavaScript <<'EOS'
function run() {
  let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver').objectForKey('askForPassword'))
  let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver').objectForKey('askForPasswordDelay'))
  if ( pref1 == 1 && pref2 <= 5 ) {
    return("true")
  } else {
    return("false")
  }
}
EOS
)
if printf '%s' "$s" | /usr/bin/grep -qE 'screenLock delay is (immediate|5 seconds)' || [ "$p" = true ]; then echo compliant; else echo "$s"; fi

預期輸出: compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

Profile (preferred): com.apple.screensaver askForPassword = <true/>; com.apple.screensaver askForPasswordDelay = <integer><0,5></integer>. Terminal: sudo /usr/sbin/sysadminctl -screenLock immediate -password <administrator password> or ; sudo /usr/sbin/sysadminctl -screenLock 5 seconds -password <administrator password>. GUI: System Settings > Lock Screen > Set Require password after screensaver begins or display is turned off to either After 0 seconds or After 5 seconds.

屬性

作業系統: macos-15
標籤: macossystem-settings
參考資料: CIS Apple macOS 15.0 Sequoia Benchmark v2.1.0 - 2.11.2 Ensure Require Password After Screen Saver Begins or Display Is Turned Off Is Enabled for 5 Seconds or Immediately

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target macos