macOS strictest published profile

STIG rules: CAT I 13 kept

Every CAT I rule of Apple macOS 26 (Tahoe) V1R4: the ones DISA rates most severe.

1. APPL-26-000054 CAT I The macOS system must limit SSHD to FIPS-compliant connections.
   Recommended: apply AC-17(2), IA-7, MA-4(6), SC-8(1), SC-13 mSCP os_sshd_fips_compliant
   How to apply

   mSCP rule

   os_sshd_fips_compliant

   Profile payload

   none; see the fix

   Declarative management

   {"declarationtype":"com.apple.configuration.services.configuration-files","service":"com.apple.sshd","config_file":"sshd_config","configuration_key":"file","configuration_value":"Ciphers [email protected]\nHostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,[email protected]\nHostKeyAlgorithms ecdsa-sha2-nistp256,[email protected]\nKexAlgorithms ecdh…

2. APPL-26-000057 CAT I The macOS system must limit SSH to FIPS-compliant connections.
   Recommended: apply AC-17(2), IA-7, SC-8(1), SC-13 mSCP os_ssh_fips_compliant
   How to apply

   mSCP rule

   os_ssh_fips_compliant

   Profile payload

   none; see the fix

3. APPL-26-001150 CAT I The macOS system must disable password authentication for SSH.
   Recommended: apply IA-2, IA-2(1), IA-2(2), IA-2(6), IA-2(8), IA-5(2), MA-4 mSCP auth_ssh_password_authentication_disable
   How to apply

   mSCP rule

   auth_ssh_password_authentication_disable

   Profile payload

   none; see the fix

   Declarative management

   {"declarationtype":"com.apple.configuration.services.configuration-files","service":"com.apple.sshd","config_file":"sshd_config","configuration_key":"KbdInteractiveAuthentication","configuration_value":false}

4. APPL-26-002038 CAT I The macOS system must disable Trivial File Transfer Protocol (TFTP) service.
   Recommended: apply AC-3, AC-17, IA-5(1) mSCP os_tftpd_disable
   How to apply

   mSCP rule

   os_tftpd_disable

   Profile payload

   none; see the fix

5. APPL-26-002060 CAT I The macOS system must apply gatekeeper settings to block applications from unidentified developers.
   Recommended: apply CM-5, CM-14, SI-7(1), SI-7(15) mSCP system_settings_gatekeeper_identified_developers_allowed
   How to apply

   mSCP rule

   system_settings_gatekeeper_identified_developers_allowed

   Profile payload

   com.apple.systempolicy.control: {"AllowIdentifiedDevelopers":true,"EnableAssessment":true}

6. APPL-26-002062 CAT I The macOS system must disable Bluetooth when no approved device is connected.
   Recommended: apply AC-18, AC-18(3), SC-8 mSCP system_settings_bluetooth_disable
   How to apply

   mSCP rule

   system_settings_bluetooth_disable

   Profile payload

   com.apple.ManagedClient.preferences: {"com.apple.MCXBluetooth":{"DisableBluetooth":true}}

7. APPL-26-002064 CAT I The macOS system must enable gatekeeper.
   Recommended: apply CM-5, CM-14, SI-3, SI-7(1), SI-7(15) mSCP os_gatekeeper_enable
   How to apply

   mSCP rule

   os_gatekeeper_enable

   Profile payload

   com.apple.systempolicy.control: {"EnableAssessment":true}

8. APPL-26-002066 CAT I The macOS system must disable unattended or automatic login to the system.
   Recommended: apply CM-6, IA-2, IA-5(13) mSCP system_settings_automatic_login_disable
   How to apply

   mSCP rule

   system_settings_automatic_login_disable

   Profile payload

   com.apple.loginwindow: {"com.apple.login.mcx.DisableAutoLoginClient":true}

9. APPL-26-002069 CAT I The macOS system must require an administrator password to modify systemwide preferences.
   Recommended: apply AC-6, AC-6(1), AC-6(2), AC-6(10) mSCP system_settings_system_wide_preferences_configure
   How to apply

   mSCP rule

   system_settings_system_wide_preferences_configure

   Profile payload

   none; see the fix

10. APPL-26-005001 CAT I The macOS system must ensure System Integrity Protection (SIP) is enabled.
    Recommended: apply AC-3, AU-6(4), AU-7, AU-7(1), AU-9, AU-9(3), AU-12, CM-5, CM-5(6), SC-4, SI-2, SI-7 mSCP os_sip_enable
    How to apply

    mSCP rule

    os_sip_enable

    Profile payload

    none; see the fix

11. APPL-26-005020 CAT I The macOS system must enforce FileVault.
    Recommended: apply SC-28, SC-28(1) mSCP system_settings_filevault_enforce
    How to apply

    mSCP rule

    system_settings_filevault_enforce

    Profile payload

    com.apple.MCX: {"dontAllowFDEDisable":true}

12. APPL-26-006000 CAT I The macOS system must be a version supported by the vendor.
    Recommended: apply SA-22 mSCP os_supported_operating_system
    How to apply

    mSCP rule

    os_supported_operating_system

    Profile payload

    none; see the fix

13. APPL-26-999999 CAT I The macOS system must install security-relevant software updates within 30 days unless the time period is directed by an authoritative source (e.g., IAVM, CTOs, DTMs, STIGs).
    Recommended: apply SI-2 mSCP system_settings_softwareupdate_current
    How to apply

    mSCP rule

    system_settings_softwareupdate_current

    Profile payload

    none; see the fix

    Organisation-defined values

    {"hint":"Maximum Days of Deferral (e.g. 30d)","recommended":"30d","cis_lvl1":"30d","cis_lvl2":"30d","stig":"30d","nlmapgov_base":"7d","nlmapgov_plus":"7d"}