DISA STIG library V1R4
| Ref | Title | Text | |
|---|---|---|---|
| APPL-26-000054 | The macOS system must limit SSHD to FIPS-compliant connections. | Verify the macOS system is configured to limit SSHD to FIPS-compliant connections with the following command: fips_sshd_config=("Ciphers [email protected]" "HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@o | |
| APPL-26-000057 | The macOS system must limit SSH to FIPS-compliant connections. | Verify the macOS system is configured to limit SSH to FIPS-compliant connections with the following command: fips_ssh_config=("Ciphers [email protected]" "HostbasedAcceptedAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@ope | |
| APPL-26-001150 | The macOS system must disable password authentication for SSH. | Verify the macOS system is configured to disable password authentication for SSH with the following command: /usr/sbin/sshd -G | /usr/bin/grep -Ec '^(passwordauthentication\s+no|kbdinteractiveauthentication\s+no)' If the result is not "2", | |
| APPL-26-002038 | The macOS system must disable Trivial File Transfer Protocol (TFTP) service. | Verify the macOS system is configured to disable TFTP service with the following command: result="FAIL" enabled=$(/bin/launchctl print-disabled system | /usr/bin/grep '"com.apple.tftpd" => enabled') running=$(/bin/launchctl print system/com | |
| APPL-26-002060 | The macOS system must apply gatekeeper settings to block applications from unidentified developers. | Verify the macOS system is configured to apply gatekeeper settings to block applications from unidentified developers with the following commands: /usr/bin/osascript -l JavaScript << EOS function run() { let pref1 = ObjC.unwrap($.NSUserDefa | |
| APPL-26-002062 | The macOS system must disable Bluetooth when no approved device is connected. | Verify the macOS system is configured to disable Bluetooth with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCXBluetooth')\ .objectForKey('DisableBluetooth').js EOS If t | |
| APPL-26-002064 | The macOS system must enable gatekeeper. | Verify the macOS system is configured to enable gatekeeper with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.systempolicy.control')\ .objectForKey('EnableAssessment').js | |
| APPL-26-002066 | The macOS system must disable unattended or automatic login to the system. | Verify the macOS system is configured to disable unattended or automatic login to the system with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ .objectForKe | |
| APPL-26-002069 | The macOS system must require an administrator password to modify systemwide preferences. | Verify the macOS system is configured to require administrator privileges to modify systemwide settings with the following command: authDBs=("system.preferences" "system.preferences.energysaver" "system.preferences.network" "system.preferen | |
| APPL-26-005001 | The macOS system must ensure System Integrity Protection (SIP) is enabled. | Verify the macOS system is configured to enable SIP with the following command: /usr/bin/csrutil status | /usr/bin/grep -c 'System Integrity Protection status: enabled.' If the result is not "1", this is a finding. | |
| APPL-26-005020 | The macOS system must enforce FileVault. | Verify the macOS system is configured to enforce FileVault with the following command: dontAllowDisable=$(/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ .objectForKey('dontAllowFDEDisable' | |
| APPL-26-006000 | The macOS system must be a version supported by the vendor. | Verify the operating system version. Click the Apple icon on the menu at the top left corner of the screen. Select the "About This Mac" option. If the operating system version is no longer supported by the vendor, this is a finding. | |
| APPL-26-999999 | The macOS system must install security-relevant software updates within 30 days unless the time period is directed by an authoritative source (e.g., IAVM, CTOs, DTMs, STIGs). | Verify security-relevant software updates are installed on the operating system within 30 days with the following command: softwareupdate_date_epoch=$(/bin/date -j -f "%Y-%m-%d" "$(/usr/bin/defaults read /Library/Preferences/com.apple.Softw |
13 of 160.