DISA STIG library V1R8
| Ref | Title | Text | |
|---|---|---|---|
| APPL-15-000054 | The macOS system must limit SSHD to FIPS-compliant connections. | Verify the macOS system is configured to limit SSHD to FIPS-compliant connections with the following command: fips_sshd_config=("Ciphers [email protected]" "HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@o | |
| APPL-15-000057 | The macOS system must limit SSH to FIPS-compliant connections. | Verify the macOS system is configured to limit SSH to FIPS-compliant connections with the following command: fips_ssh_config=("Ciphers [email protected]" "HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@ope | |
| APPL-15-001150 | The macOS system must disable password authentication for SSH. | Verify the macOS system is configured to disable password authentication for SSH with the following command: /usr/sbin/sshd -G | /usr/bin/grep -Ec '^(passwordauthentication\s+no|kbdinteractiveauthentication\s+no)' If the result is not "2", | |
| APPL-15-002038 | The macOS system must disable Trivial File Transfer Protocol (TFTP) service. | Verify the macOS system is configured to disable TFTP service with the following command: /bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.tftpd" => disabled' If the result is not "1", this is a finding. | |
| APPL-15-002060 | The macOS system must apply gatekeeper settings to block applications from unidentified developers. | Verify the macOS system is configured to apply gatekeeper settings to block applications from unidentified developers with the following commands: /usr/bin/osascript -l JavaScript << EOS function run() { let pref1 = ObjC.unwrap($.NSUserDefa | |
| APPL-15-002062 | The macOS system must disable Bluetooth when no approved device is connected. | Verify the macOS system is configured to disable Bluetooth with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCXBluetooth')\ .objectForKey('DisableBluetooth').js EOS If t | |
| APPL-15-002064 | The macOS system must enable gatekeeper. | Verify the macOS system is configured to enable gatekeeper with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ .objectForKey('EnableAssessment').js | |
| APPL-15-002066 | The macOS system must disable unattended or automatic login to the system. | Verify the macOS system is configured to disable unattended or automatic login to the system with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ .objectForKe | |
| APPL-15-002069 | The macOS system must require an administrator password to modify systemwide preferences. | Verify the macOS system is configured to require administrator privileges to modify systemwide settings with the following command: authDBs=("system.preferences" "system.preferences.energysaver" "system.preferences.network" "system.preferen | |
| APPL-15-005001 | The macOS system must ensure System Integrity Protection is enabled. | Verify the macOS system is configured to enable System Integrity Protection with the following command: /usr/bin/csrutil status | /usr/bin/grep -c 'System Integrity Protection status: enabled.' If the result is not "1", this is a finding. | |
| APPL-15-005020 | The macOS system must enforce FileVault. | Verify the macOS system is configured to enforce FileVault with the following command: dontAllowDisable=$(/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ .objectForKey('dontAllowFDEDisable' |
11 of 160.