macOS STIGs

All 160 CAT I 11 CAT II 147CAT III 2 Browse in the Register

CAT II 147

Any vulnerability, the exploitation of which has a potential to result in loss of confidentiality, availability or integrity.

APPL-15-000001 CAT II V-268420 · SRG-OS-000028-GPOS-00009

The macOS system must prevent Apple Watch from terminating a session lock.

Maps to AC-11 via CCI-000056

Check
Verify the macOS system is configured to prevent Apple Watch from terminating a session lock with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowAutoUnlock').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to prevent Apple Watch from terminating a session lock by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-000002 CAT II V-268421 · SRG-OS-000028-GPOS-00009

The macOS system must enforce screen saver password.

Maps to AC-11 via CCI-000056

Check
Verify the macOS system is configured to prompt users to enter a password to unlock the screen saver with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ .objectForKey('askForPassword').js EOS If the result is not "true", this is a finding.

Fix
Configure the macOS system to prompt users to enter a password to unlock the screen saver by installing the "com.apple.screensaver" configuration profile.
APPL-15-000003 CAT II V-268422 · SRG-OS-000028-GPOS-00009

The macOS system must enforce session lock no more than five seconds after screen saver is started.

Maps to AC-11 via CCI-000056

Check
Verify the macOS system is configured to initiate a session lock within five seconds of the screen saver starting with the following command: /usr/bin/osascript -l JavaScript << EOS function run() { let delay = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ .objectForKey('askForPasswordDelay')) if ( delay <= 5 ) { return("true") } else { return("false") } } EOS If the result is not "true", this is a finding.

Fix
Configure the macOS system to initiate a session lock within five seconds of the screen saver starting by installing the "com.apple.screensaver" configuration profile.
APPL-15-000005 CAT II V-268423 · SRG-OS-000030-GPOS-00011

The macOS system must configure user session lock when a smart token is removed.

Maps to AC-11 via CCI-000057

Check
Verify the macOS system is configured to lock the user session when a smart token is removed with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ .objectForKey('tokenRemovalAction').js EOS If the result is not "1", this is a finding.

Fix
Configure the macOS system to lock the user session when a smart token is removed by installing the "com.apple.security.smartcard" configuration profile. NOTE: To ensure continued access to the operating system, consult the supplemental guidance provided with the STIG before applying the configuration profile.
APPL-15-000007 CAT II V-268424 · SRG-OS-000031-GPOS-00012

The macOS system must disable hot corners.

Maps to AC-11(1) via CCI-000060

Check
Verify the macOS system is configured to disable hot corners with the following command: /usr/bin/profiles -P -o stdout | /usr/bin/grep -Ec '"wvous-bl-corner" = 0|"wvous-br-corner" = 0|"wvous-tl-corner" = 0|"wvous-tr-corner" = 0' If the result is not "4", this is a finding.

Fix
Configure the macOS system to disable hot corners by installing the "com.apple.ManagedClient.preferences" configuration profile.
APPL-15-000009 CAT II V-268425 · SRG-OS-000031-GPOS-00012

The macOS system must prevent AdminHostInfo from being available at LoginWindow.

Maps to AC-11(1) via CCI-000060

Check
Verify the macOS system is configured to prevent AdminHostInfo from being available at LoginWindow with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ .objectIsForcedForKey('AdminHostInfo') EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to prevent AdminHostInfo from being available at LoginWindow by installing the "com.apple.loginwindow" configuration profile.
APPL-15-000012 CAT II V-268426 · SRG-OS-000002-GPOS-00002

The macOS system must automatically remove or disable temporary or emergency user accounts within 72 hours.

Maps to AC-2(2) via CCI-000016, CCI-001682

Check
Verify that a password policy is enforced by a directory service by asking the system administrator (SA) or information system security officer (ISSO). If no policy is enforced by a directory service, a password policy can be set with the "pwpolicy" utility. The variable names may vary depending on how the policy was set. If no temporary or emergency accounts are defined on the system, this is not applicable. To check if the password policy is configured to disable a temporary or emergency account after 72 hours, run the following command to output the password policy to the screen, substituting the correct user name in place of username: /usr/bin/pwpolicy -u username getaccountpolicies | tail -n +2 If there is no output, and password policy is not controlled by a directory service, this is a finding. Otherwise, look for the line "policyCategoryAuthentication". In the array that follows, there should be a section that contains a check that allows users to log in if "policyAttributeCurrentTime" is less than the result of adding "policyAttributeCreationTime" to 72 hours (259299 seconds). The check might use a variable defined in its "policyParameters" section. If the check does not exist or if the check adds too great an amount of time to "policyAttributeCreationTime", this is a finding.

Fix
This setting may be enforced using local policy or by a directory service. To set local policy to disable a temporary or emergency user, create a plain text file containing the following: policyCategoryAuthentication policyContent policyAttributeCurrentTime < policyAttributeCreationTime+259299 policyIdentifier Disable Tmp Accounts After saving the file and exiting to the command prompt, run the following command to load the new policy file, substituting the correct user name in place of "username" and the path to the file in place of "/path/to/file". /usr/bin/pwpolicy -u username setaccountpolicies /path/to/file
APPL-15-000014 CAT II V-268427 · SRG-OS-000355-GPOS-00143

The macOS system must enforce time synchronization.

Maps to SC-45, SC-45(1) via CCI-004923, CCI-004926, CCI-004922

Check
Verify the macOS system is configured to enforce time synchronization with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.timed')\ .objectForKey('TMAutomaticTimeOnlyEnabled').js EOS If the result is not "true", this is a finding.

Fix
Configure the macOS system to enforce time synchronization by installing the "com.apple.ManagedClient.preferences" configuration profile.
APPL-15-000022 CAT II V-268428 · SRG-OS-000021-GPOS-00005

The macOS system must limit consecutive failed login attempts to three.

Maps to AC-7 via CCI-000044, CCI-002238

Check
Verify the macOS system is configured to limit consecutive failed login attempts to three with the following command: /usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMaximumFailedAuthentications"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 <= 3) {print "yes"} else {print "no"}}' | /usr/bin/uniq If the result is not "yes", this is a finding.

Fix
Configure the macOS system to limit consecutive failed login attempts to three by installing the "com.apple.mobiledevice.passwordpolicy" configuration profile.
APPL-15-000023 CAT II V-268429 · SRG-OS-000023-GPOS-00006

The macOS system must display a policy banner at remote login.

Maps to AC-8 via CCI-000048, CCI-000050

Check
Verify the macOS system is configured to display the Standard Mandatory DoW Notice and Consent Banner before granting remote access to the operating system. Verify the operating system has the correct text listed in the "/etc/banner" file with the following command: /usr/bin/more /etc/banner The command must return the following text: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." If the operating system does not display a login banner before granting remote access or the banner does not match the Standard Mandatory DoW Notice and Consent Banner, this is a finding. If the text in the "/etc/banner" file does not match the Standard Mandatory DoW Notice and Consent Banner, this is a finding.

Fix
Configure the macOS system to display the Standard Mandatory DoW Notice and Consent Banner before granting remote access to the operating system by creating a text file containing the required DoW text. Name the file "banner" and place it in "/etc/".
APPL-15-000024 CAT II V-269093 · SRG-OS-000023-GPOS-00006

The macOS system must enforce SSH to display a policy banner.

Maps to AC-8 via CCI-000048, CCI-000050

Check
Verify the macOS system is configured to display the contents of "/etc/banner" before granting access to the system with the following command: /usr/sbin/sshd -G | /usr/bin/grep -c "^banner /etc/banner" If the command does not return "1", this is a finding.

Fix
Configure the macOS system to display the contents of "/etc/banner" before granting access to the system with the following command: include_dir=$(/usr/bin/awk '/^Include/ {print $2}' /etc/ssh/sshd_config | /usr/bin/tr -d '*') if [[ -z $include_dir ]]; then /usr/bin/sed -i.bk "1s/.*/Include \/etc\/ssh\/sshd_config.d\/\*/" /etc/ssh/sshd_config fi /usr/bin/grep -qxF 'banner /etc/banner' "${include_dir}01-mscp-sshd.conf" 2>/dev/null || echo "banner /etc/banner" >> "${include_dir}01-mscp-sshd.conf" for file in $(ls ${include_dir}); do if [[ "$file" == "100-macos.conf" ]]; then continue fi if [[ "$file" == "01-mscp-sshd.conf" ]]; then break fi /bin/mv ${include_dir}${file} ${include_dir}20-${file} done
APPL-15-000025 CAT II V-268431 · SRG-OS-000023-GPOS-00006

The macOS system must display the Standard Mandatory DoW Notice and Consent Banner at the login window.

Maps to AC-8 via CCI-000048, CCI-000050, CCI-001384, CCI-001385, CCI-001386, CCI-001387, CCI-001388

Check
Verify the macOS system is configured to display a policy banner with the following command: /bin/ls -ld /Library/Security/PolicyBanner.rtf* | /usr/bin/wc -l | /usr/bin/tr -d ' ' If the command does not return "1", this is a finding. The banner text of the document must read: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." If the text is not worded exactly this way, this is a finding.

Fix
Configure the macOS system to display a policy banner by creating an RTF file containing the required text. Name the file "PolicyBanner.rtfd" and place it in "/Library/Security/". Update the permissions of the "/Library/Security/PolicyBanner.rtfd" file with the following command: /usr/bin/sudo /bin/chmod 644 /Library/Security/PolicyBanner.rtfd
APPL-15-000030 CAT II V-268432 · SRG-OS-000057-GPOS-00027

The macOS system must configure audit log files to not contain access control lists (ACLs).

Maps to AU-9 via CCI-000162, CCI-000163, CCI-000164, CCI-001493, CCI-001494, CCI-001495

Check
Verify the macOS system is configured without ACLs applied to log files with the following command: /bin/ls -le $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" If the result is not "0", this is a finding.

Fix
Configure the macOS system without ACLs applied to log files with the following command: /bin/chmod -RN /var/audit
APPL-15-000031 CAT II V-268433 · SRG-OS-000057-GPOS-00027

The macOS system must configure the audit log folder to not contain access control lists (ACLs).

Maps to AU-9 via CCI-000162, CCI-000163, CCI-000164, CCI-001493, CCI-001494, CCI-001495

Check
Verify the macOS system is configured without ACLs applied to log folders with the following command: /bin/ls -lde /var/audit | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" If the result is not "0", this is a finding.

Fix
Configure the macOS system without ACLs applied to log folders with the following command: /bin/chmod -N /var/audit
APPL-15-000033 CAT II V-268434 · SRG-OS-000080-GPOS-00048

The macOS system must disable FileVault automatic login.

Maps to AC-3 via CCI-000213

Check
Verify the macOS system is configured to disable FileVault automatic login with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ .objectForKey('DisableFDEAutoLogin').js EOS If the result is not "true", this is a finding.

Fix
Configure the macOS system to disable FileVault automatic login by installing the "com.apple.loginwindow" configuration profile. NOTE: To ensure continued access to the operating system, consult the supplemental guidance provided with the STIG before applying the configuration profile.
APPL-15-000051 CAT II V-268435 · SRG-OS-000163-GPOS-00072

The macOS system must configure SSHD ClientAliveInterval to 900.

Maps to SC-10 via CCI-001133

Check
Verify the macOS system is configured to set the SSHD ClientAliveInterval to 900 with the following command: /usr/sbin/sshd -G | /usr/bin/awk '/clientaliveinterval/{print $2}' If the result is not "900", this is a finding.

Fix
Configure the macOS system to set the SSHD ClientAliveInterval to 900 with the following command: include_dir=$(/usr/bin/awk '/^Include/ {print $2}' /etc/ssh/sshd_config | /usr/bin/tr -d '*') if [[ -z $include_dir ]]; then /usr/bin/sed -i.bk "1s/.*/Include \/etc\/ssh\/sshd_config.d\/\*/" /etc/ssh/sshd_config fi /usr/bin/grep -qxF 'clientaliveinterval 900' "${include_dir}01-mscp-sshd.conf" 2>/dev/null || echo "clientaliveinterval 900" >> "${include_dir}01-mscp-sshd.conf" for file in $(ls ${include_dir}); do if [[ "$file" == "100-macos.conf" ]]; then continue fi if [[ "$file" == "01-mscp-sshd.conf" ]]; then break fi /bin/mv ${include_dir}${file} ${include_dir}20-${file} done
APPL-15-000052 CAT II V-268436 · SRG-OS-000163-GPOS-00072

The macOS system must configure SSHD ClientAliveCountMax to 1.

Maps to SC-10 via CCI-001133

Check
Verify the macOS system is configured to set the SSHD ClientAliveCountMax to 1 with the following command: /usr/sbin/sshd -G | /usr/bin/awk '/clientalivecountmax/{print $2}' If the result is not "1", this is a finding.

Fix
Configure the macOS system to set the SSHD ClientAliveCountMax to 1 with the following command: include_dir=$(/usr/bin/awk '/^Include/ {print $2}' /etc/ssh/sshd_config | /usr/bin/tr -d '*') if [[ -z $include_dir ]]; then /usr/bin/sed -i.bk "1s/.*/Include \/etc\/ssh\/sshd_config.d\/\*/" /etc/ssh/sshd_config fi /usr/bin/grep -qxF 'clientalivecountmax 1' "${include_dir}01-mscp-sshd.conf" 2>/dev/null || echo "clientalivecountmax 1" >> "${include_dir}01-mscp-sshd.conf" for file in $(ls ${include_dir}); do if [[ "$file" == "100-macos.conf" ]]; then continue fi if [[ "$file" == "01-mscp-sshd.conf" ]]; then break fi /bin/mv ${include_dir}${file} ${include_dir}20-${file} done
APPL-15-000053 CAT II V-268437 · SRG-OS-000163-GPOS-00072

The macOS system must set login grace time to 30.

Maps to SC-10 via CCI-001133

Check
Verify the macOS system is configured to set Login Grace Time to 30 with the following command: /usr/sbin/sshd -G | /usr/bin/awk '/logingracetime/{print $2}' If the result is not "30", this is a finding.

Fix
Configure the macOS system to set Login Grace Time to 30 with the following command: include_dir=$(/usr/bin/awk '/^Include/ {print $2}' /etc/ssh/sshd_config | /usr/bin/tr -d '*') if [[ -z $include_dir ]]; then /usr/bin/sed -i.bk "1s/.*/Include \/etc\/ssh\/sshd_config.d\/\*/" /etc/ssh/sshd_config fi /usr/bin/grep -qxF 'logingracetime 30' "${include_dir}01-mscp-sshd.conf" 2>/dev/null || echo "logingracetime 30" >> "${include_dir}01-mscp-sshd.conf" for file in $(ls ${include_dir}); do if [[ "$file" == "100-macos.conf" ]]; then continue fi if [[ "$file" == "01-mscp-sshd.conf" ]]; then break fi /bin/mv ${include_dir}${file} ${include_dir}20-${file} done
APPL-15-000060 CAT II V-268440 · SRG-OS-000021-GPOS-00005

The macOS system must set account lockout time to 15 minutes.

Maps to AC-7 via CCI-000044, CCI-002238

Check
Verify the macOS system is configured to set account lockout time to 15 minutes with the following command: /usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="autoEnableInSeconds"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1/60 >= 15 ) {print "yes"} else {print "no"}}' | /usr/bin/uniq If the result is not "yes", this is a finding.

Fix
Configure the macOS system to set account lockout time to 15 minutes by installing the "com.apple.mobiledevice.passwordpolicy" configuration profile.
APPL-15-000070 CAT II V-268441 · SRG-OS-000029-GPOS-00010

The macOS system must enforce screen saver timeout.

Maps to AC-11 via CCI-000057

Check
Verify the macOS system is configured to initiate the screen saver timeout after 15 minutes of inactivity with the following command: /usr/bin/osascript -l JavaScript << EOS function run() { let timeout = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\ .objectForKey('idleTime')) if ( timeout <= 900 ) { return("true") } else { return("false") } } EOS If the result is not "true", this is a finding.

Fix
Configure the macOS system to initiate the screen saver after 15 minutes of inactivity by installing the "com.apple.screensaver" configuration profile.
APPL-15-000090 CAT II V-268442 · SRG-OS-000104-GPOS-00051

The macOS system must disable login to other users' active and locked sessions.

Maps to IA-2, IA-2(5) via CCI-000764, CCI-004045

Check
Verify the macOS system is configured to disable login to other users' active and locked sessions with the following command: /usr/bin/security authorizationdb read system.login.screensaver 2>&1 | /usr/bin/grep -c 'authenticate-session-owner' If the result is not "1", this is a finding.

Fix
Configure the macOS system to disable login to other users' active and locked sessions with the following command: /usr/bin/security authorizationdb write system.login.screensaver "authenticate-session-owner"
APPL-15-000100 CAT II V-268443 · SRG-OS-000104-GPOS-00051

The macOS system must disable root login.

Maps to CM-5(1), IA-2, IA-2(5) via CCI-000764, CCI-004045, CCI-001813

Check
Verify the macOS system is configured to disable root login with the following command: /usr/bin/dscl . -read /Users/root UserShell 2>&1 | /usr/bin/grep -c "/usr/bin/false" If the result is not "1", this is a finding.

Fix
Configure the macOS system to disable root login with the following command: /usr/bin/dscl . -create /Users/root UserShell /usr/bin/false
APPL-15-000110 CAT II V-268444 · SRG-OS-000163-GPOS-00072

The macOS system must configure the SSH ServerAliveInterval to 900.

Maps to SC-10 via CCI-001133

Check
Verify the macOS system is configured to set the SSH ServerAliveInterval to 900 with the following command: ret="pass" for u in $(/usr/bin/dscl . -list /Users UniqueID | /usr/bin/awk '$2 > 500 {print $1}'); do sshCheck=$(/usr/bin/sudo -u $u /usr/bin/ssh -G . | /usr/bin/grep -c "^serveraliveinterval 900") if [[ "$sshCheck" == "0" ]]; then ret="fail" break fi done /bin/echo $ret If the result is not "pass", this is a finding.

Fix
Configure the macOS system to set the SSH ServerAliveInterval to 900 with the following command: include_dir=$(/usr/bin/awk '/^Include/ {print $2}' /etc/ssh/ssh_config | /usr/bin/tr -d '*') ssh_config_string=("ServerAliveInterval 900") for ssh_config in $ssh_config_string; do ssh_setting=$(echo $ssh_config | /usr/bin/cut -d " " -f1) /usr/bin/grep -qEi "^$ssh_setting" "${include_dir}01-mscp-ssh.conf" && /usr/bin/sed -i "" "s/^$ssh_setting.*/${ssh_config}/" "${include_dir}01-mscp-ssh.conf" || echo "$ssh_config" >> "${include_dir}01-mscp-ssh.conf" for u in $(/usr/bin/dscl . list /users shell | /usr/bin/egrep -v '(^_)|(root)|(/usr/bin/false)' | /usr/bin/awk '{print $1}'); do config=$(/usr/bin/sudo -u $u /usr/bin/ssh -Gv . 2>&1) configfiles=$(echo "$config" | /usr/bin/awk '/Reading configuration data/ {print $NF}'| /usr/bin/tr -d '\r') configarray=( ${(f)configfiles} ) if ! echo $config | /usr/bin/grep -q -i "$ssh_config" ; then for c in $configarray; do if [[ "$c" == "/etc/ssh/crypto.conf" ]]; then continue fi /usr/bin/sudo -u $u /usr/bin/grep -qEi "^$ssh_setting" "$c" && /usr/bin/sed -i "" "s/^$ssh_setting.*/${ssh_config}/I" "$c" if [[ "$c" =~ ".ssh/config" ]]; then if /usr/bin/grep -qEi "$ssh_setting" "$c" 2> /dev/null; then old_file=$(cat ~$u/.ssh/config) echo "$ssh_config" > ~$u/.ssh/config echo "$old_file" >> ~$u/.ssh/config fi fi done fi done done
APPL-15-000120 CAT II V-268445 · SRG-OS-000163-GPOS-00072

The macOS system must configure SSHD channel timeout to 900.

Maps to AC-12, SC-10 via CCI-001133, CCI-002361

Check
Verify the macOS system is configured to set the SSHD Channel Timeout to 900 with the following command: /usr/sbin/sshd -G | /usr/bin/awk -F "=" '/channeltimeout session:*/{print $2}' If the result is not "900", this is a finding.

Fix
Configure the macOS system to set the SSHD ChannelTimeout to 900 with the following command: include_dir=$(/usr/bin/awk '/^Include/ {print $2}' /etc/ssh/sshd_config | /usr/bin/tr -d '*') if [[ -z $include_dir ]]; then /usr/bin/sed -i.bk "1s/.*/Include \/etc\/ssh\/sshd_config.d\/\*/" /etc/ssh/sshd_config fi /usr/bin/grep -qxF 'channeltimeout session:*=900' "${include_dir}01-mscp-sshd.conf" 2>/dev/null || echo "channeltimeout session:*=900" >> "${include_dir}01-mscp-sshd.conf" for file in $(ls ${include_dir}); do if [[ "$file" == "100-macos.conf" ]]; then continue fi if [[ "$file" == "01-mscp-sshd.conf" ]]; then break fi /bin/mv ${include_dir}${file} ${include_dir}20-${file} done
APPL-15-000130 CAT II V-268446 · SRG-OS-000163-GPOS-00072

The macOS system must configure SSHD unused connection timeout to 900.

Maps to AC-12, SC-10 via CCI-001133, CCI-002361

Check
Verify the macOS system is configured to set the SSHD unused connection timeout to 900 with the following command: /usr/sbin/sshd -G | /usr/bin/awk '/unusedconnectiontimeout/{print $2}' If the result is not "900", this is a finding.

Fix
Configure the macOS system to set the SSHD unused connection timeout to 900 with the following command: include_dir=$(/usr/bin/awk '/^Include/ {print $2}' /etc/ssh/sshd_config | /usr/bin/tr -d '*') if [[ -z $include_dir ]]; then /usr/bin/sed -i.bk "1s/.*/Include \/etc\/ssh\/sshd_config.d\/\*/" /etc/ssh/sshd_config fi /usr/bin/grep -qxF 'unusedconnectiontimeout 900' "${include_dir}01-mscp-sshd.conf" 2>/dev/null || echo "unusedconnectiontimeout 900" >> "${include_dir}01-mscp-sshd.conf" for file in $(ls ${include_dir}); do if [[ "$file" == "100-macos.conf" ]]; then continue fi if [[ "$file" == "01-mscp-sshd.conf" ]]; then break fi /bin/mv ${include_dir}${file} ${include_dir}20-${file} done
APPL-15-000140 CAT II V-268447 · SRG-OS-000163-GPOS-00072

The macOS system must set SSH Active Server Alive Maximum to 0.

Maps to SC-10 via CCI-001133

Check
Verify the macOS system is configured to set SSH Active Server Alive Maximum to 0 with the following command: ret="pass" for u in $(/usr/bin/dscl . -list /Users UniqueID | /usr/bin/awk '$2 > 500 {print $1}'); do sshCheck=$(/usr/bin/sudo -u $u /usr/bin/ssh -G . | /usr/bin/grep -c "^serveralivecountmax 0") if [[ "$sshCheck" == "0" ]]; then ret="fail" break fi done /bin/echo $ret If the result is not "pass", this is a finding.

Fix
Configure the macOS system to set SSH Active Server Alive Maximum to 0 with the following command: include_dir=$(/usr/bin/awk '/^Include/ {print $2}' /etc/ssh/ssh_config | /usr/bin/tr -d '*') ssh_config=("ServerAliveCountMax 0") ssh_setting=$(echo $ssh_config | /usr/bin/cut -d " " -f1) /usr/bin/grep -qEi "^$ssh_setting" "${include_dir}01-mscp-ssh.conf" && /usr/bin/sed -i "" "s/^$ssh_setting.*/${ssh_config}/" "${include_dir}01-mscp-ssh.conf" || echo "$ssh_config" >> "${include_dir}01-mscp-ssh.conf" for u in $(/usr/bin/dscl . list /users shell | /usr/bin/egrep -v '(^_)|(root)|(/usr/bin/false)' | /usr/bin/awk '{print $1}'); do config=$(/usr/bin/sudo -u $u /usr/bin/ssh -Gv . 2>&1) configfiles=$(echo "$config" | /usr/bin/awk '/Reading configuration data/ {print $NF}'| /usr/bin/tr -d '\r') configarray=( ${(f)configfiles} ) if ! echo $config | /usr/bin/grep -q -i "$ssh_config" ; then for c in $configarray; do if [[ "$c" == "/etc/ssh/crypto.conf" ]]; then continue fi /usr/bin/sudo -u $u /usr/bin/grep -qEi "^$ssh_setting" "$c" && /usr/bin/sed -i "" "s/^$ssh_setting.*/${ssh_config}/I" "$c" if [[ "$c" =~ ".ssh/config" ]]; then if /usr/bin/grep -qEi "$ssh_setting" "$c" 2> /dev/null; then old_file=$(cat ~$u/.ssh/config) echo "$ssh_config" > ~$u/.ssh/config echo "$old_file" >> ~$u/.ssh/config fi fi done fi done
APPL-15-000160 CAT II V-268448 · SRG-OS-000279-GPOS-00109

The macOS system must enforce auto logout after 86400 seconds of inactivity.

Maps to AC-12 via CCI-002361

Check
Verify the macOS system is configured to enforce auto logout after 86400 seconds of inactivity with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('.GlobalPreferences')\ .objectForKey('com.apple.autologout.AutoLogOutDelay').js EOS If the result is not "86400", this is a finding.

Fix
Configure the macOS system to enforce auto logout after 86400 seconds of inactivity by installing the "com.apple.GlobalPreferences" configuration profile.
APPL-15-000170 CAT II V-268449 · SRG-OS-000355-GPOS-00143

The macOS system must be configured to use an authorized time server.

Maps to SC-45(1) via CCI-004923, CCI-004926

Check
Verify the macOS system is configured to use an authorized time server with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ .objectForKey('timeServer').js EOS If the result is not an authoritative time server that is synchronized with redundant USNO time servers as designated for the appropriate DoW network, this is a finding.

Fix
Configure the macOS system to use an authorized time server by installing the "com.apple.MCX" configuration profile.
APPL-15-000180 CAT II V-268450 · SRG-OS-000355-GPOS-00143

The macOS system must enable the time synchronization daemon.

Maps to SC-45, SC-45(1) via CCI-004923, CCI-004926, CCI-004922

Check
Verify the macOS system is configured to enable the time synchronization daemon with the following command: /bin/launchctl list | /usr/bin/grep -c com.apple.timed If the result is not "1", this is a finding.

Fix
Configure the macOS system to enable the time synchronization daemon with the following command: /bin/launchctl load -w /System/Library/LaunchDaemons/com.apple.timed.plist NOTE: The service "timed" cannot be unloaded or loaded while System Integrity Protection (SIP) is enabled.
APPL-15-000190 CAT II V-268451 · SRG-OS-000064-GPOS-00033

The macOS system must configure sudo to log events.

Maps to AU-12 via CCI-000172

Check
Verify the macOS system is configured to log privilege escalation with the following command: /usr/bin/sudo /usr/bin/sudo -V | /usr/bin/grep -c "Log when a command is allowed by sudoers" If the result is not "1", this is a finding.

Fix
Configure the macOS system to log privilege escalation with the following command: /usr/bin/find /etc/sudoers* -type f -exec sed -i '' '/^Defaults[[:blank:]]*\!log_allowed/s/^/# /' '{}' \; /bin/echo "Defaults log_allowed" >> /etc/sudoers.d/mscp
APPL-15-001001 CAT II V-268452 · SRG-OS-000004-GPOS-00004

The macOS system must be configured to audit all administrative action events.

Maps to AC-2(4), AC-6(9), AU-12, CM-5(1), MA-4(1) via CCI-000018, CCI-001403, CCI-001404, CCI-001405, CCI-002130, CCI-002234, CCI-003938, CCI-002884, CCI-000172

Check
Verify the macOS system is configured to audit privileged access with the following command: /usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'ad' If the result is not "1", this is a finding.

Fix
Configure the macOS system to audit privileged access with the following command: /usr/bin/grep -qE "^flags.*[^-]ad" /etc/security/audit_control || /usr/bin/sed -i.bak '/^flags/ s/$/,ad/' /etc/security/audit_control; /usr/sbin/audit -s A text editor may also be used to implement the required updates to the "/etc/security/audit_control" file.
APPL-15-001002 CAT II V-268453 · SRG-OS-000032-GPOS-00013

The macOS system must be configured to audit all login and logout events.

Maps to AC-17(1), AU-12, MA-4(1) via CCI-000067, CCI-000172, CCI-002884

Check
Verify the macOS system is configured to audit all login and logout events with the following command: /usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '^lo' If the result is not "1", this is a finding.

Fix
Configure the macOS system to audit all login and logout events with the following command: /usr/bin/grep -qE "^flags.*[^-]lo" /etc/security/audit_control || /usr/bin/sed -i.bak '/^flags/ s/$/,lo/' /etc/security/audit_control; /usr/sbin/audit -s A text editor may also be used to implement the required updates to the "/etc/security/audit_control" file.
APPL-15-001003 CAT II V-268454 · SRG-OS-000037-GPOS-00015

The macOS system must enable security auditing.

Maps to AU-3, AU-3(1), AU-8, AU-9, AU-12, AU-12(3), AU-14(1), CM-5(1), MA-3(5), MA-4(1) via CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000159, CCI-001464, CCI-001487, CCI-001494, CCI-001495, CCI-001914, CCI-001889, CCI-001890, CCI-003938, CCI-002884, CCI-000172, CCI-004188

Check
Verify the macOS system is configured to enable the auditd service with the following command: LAUNCHD_RUNNING=$(/bin/launchctl list | /usr/bin/grep -c com.apple.auditd) AUDITD_RUNNING=$(/usr/sbin/audit -c | /usr/bin/grep -c "AUC_AUDITING") if [[ $LAUNCHD_RUNNING == 1 ]] && [[ -e /etc/security/audit_control ]] && [[ $AUDITD_RUNNING == 1 ]]; then echo "pass" else echo "fail" fi If the result is not "pass", this is a finding.

Fix
Configure the macOS system to enable the auditd service with the following command: if [[ ! -e /etc/security/audit_control ]] && [[ -e /etc/security/audit_control.example ]];then /bin/cp /etc/security/audit_control.example /etc/security/audit_control fi /bin/launchctl enable system/com.apple.auditd /bin/launchctl bootstrap system /System/Library/LaunchDaemons/com.apple.auditd.plist /usr/sbin/audit -i
APPL-15-001010 CAT II V-268455 · SRG-OS-000047-GPOS-00023

The macOS system must be configured to shut down upon audit failure.

Maps to AU-5 via CCI-000140

Check
Verify the macOS system is configured to shut down upon audit failure with the following command: /usr/bin/awk -F':' '/^policy/ {print $NF}' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'ahlt' If the result is not "1", this is a finding.

Fix
Configure the macOS system to shut down upon audit failure with the following command: /usr/bin/sed -i.bak 's/^policy.*/policy: ahlt,argv/' /etc/security/audit_control; /usr/sbin/audit -s
APPL-15-001012 CAT II V-268456 · SRG-OS-000057-GPOS-00027

The macOS system must configure audit log files to be owned by root.

Maps to AU-9 via CCI-000162, CCI-000163, CCI-000164, CCI-001493, CCI-001494, CCI-001495

Check
Verify the macOS system is configured with audit log files owned by root with the following command: /bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$3} END {print s}' If the result is not "0", this is a finding.

Fix
Configure the macOS system with audit log files owned by root with the following command: /usr/sbin/chown -R root /var/audit/*
APPL-15-001013 CAT II V-268457 · SRG-OS-000057-GPOS-00027

The macOS system must configure audit log folders to be owned by root.

Maps to AU-9 via CCI-000162, CCI-000163, CCI-000164, CCI-001493, CCI-001494, CCI-001495

Check
Verify the macOS system is configured with audit log folders owned by root with the following command: /bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $3}' If the result is not "0", this is a finding.

Fix
Configure the macOS system with audit log folders owned by root with the following command: /usr/sbin/chown root /var/audit
APPL-15-001014 CAT II V-268458 · SRG-OS-000057-GPOS-00027

The macOS system must configure the audit log files group to wheel.

Maps to AU-9 via CCI-000162, CCI-000163, CCI-000164, CCI-001493, CCI-001494, CCI-001495

Check
Verify the macOS system is configured with audit log files group-owned by wheel with the following command: /bin/ls -n $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{s+=$4} END {print s}' If the result is not "0", this is a finding.

Fix
Configure the macOS system with audit log files group-owned by wheel with the following command: /usr/bin/chgrp -R wheel /var/audit/*
APPL-15-001015 CAT II V-268459 · SRG-OS-000057-GPOS-00027

The macOS system must configure the audit log folders group to wheel.

Maps to AU-9 via CCI-000162, CCI-000163, CCI-000164, CCI-001493, CCI-001494, CCI-001495

Check
Verify the macOS system is configured with audit log folders group-owned by wheel with the following command: /bin/ls -dn $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $4}' If the result is not "0", this is a finding.

Fix
Configure the macOS system with audit log folders group-owned by wheel with the following command: /usr/bin/chgrp wheel /var/audit
APPL-15-001016 CAT II V-268460 · SRG-OS-000057-GPOS-00027

The macOS system must configure audit log files to mode 440 or less permissive.

Maps to AU-9 via CCI-000162, CCI-000163, CCI-000164, CCI-001493, CCI-001494, CCI-001495

Check
Verify the macOS system is configured with audit log files set to mode 440 or less with the following command: /bin/ls -l $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '!/-r--r-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' If the result is not "0", this is a finding.

Fix
Configure the macOS system with audit log files set to mode 440 with the following command: /bin/chmod 440 /var/audit/*
APPL-15-001017 CAT II V-268461 · SRG-OS-000057-GPOS-00027

The macOS system must configure audit log folders to mode 700 or less permissive.

Maps to AU-9 via CCI-000162, CCI-000163, CCI-000164, CCI-001493, CCI-001494, CCI-001495

Check
Verify the macOS system is configured with audit log folders set to mode 700 or less permissive with the following command: /usr/bin/stat -f %A $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') If the result is not a mode of 700 or less permissive, this is a finding.

Fix
Configure the macOS system with audit log folders set to mode 700 with the following command: /bin/chmod 700 /var/audit
APPL-15-001020 CAT II V-268462 · SRG-OS-000057-GPOS-00027

The macOS system must be configured to audit all deletions of object attributes.

Maps to AU-9, AU-12, CM-5(1), MA-4(1) via CCI-000162, CCI-000163, CCI-000164, CCI-000172, CCI-001493, CCI-001494, CCI-001495, CCI-003938, CCI-002884

Check
Verify the macOS system is configured to audit all deletions of object attributes with the following command: /usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fd' If the result is not "1", this is a finding.

Fix
Configure the macOS system to audit all deletions of object attributes with the following command: /usr/bin/grep -qE "^flags.*-fd" /etc/security/audit_control || /usr/bin/sed -i.bak '/^flags/ s/$/,-fd/' /etc/security/audit_control;/usr/sbin/audit -s
APPL-15-001021 CAT II V-268463 · SRG-OS-000057-GPOS-00027

The macOS system must be configured to audit all changes of object attributes.

Maps to AU-9, AU-12, CM-5(1), MA-4(1) via CCI-000162, CCI-000163, CCI-000164, CCI-000172, CCI-001493, CCI-001494, CCI-001495, CCI-003938, CCI-002884

Check
Verify the macOS system is configured to audit all changes of object attributes with the following command: /usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '^fm' If the result is not "1", this is a finding.

Fix
Configure the macOS system to audit all changes of object attributes with the following command: /usr/bin/grep -qE "^flags.*fm" /etc/security/audit_control || /usr/bin/sed -i.bak '/^flags/ s/$/,fm/' /etc/security/audit_control;/usr/sbin/audit -s
APPL-15-001022 CAT II V-268464 · SRG-OS-000057-GPOS-00027

The macOS system must be configured to audit all failed read actions on the system.

Maps to AU-9, AU-12, CM-5(1), MA-4(1) via CCI-000162, CCI-000163, CCI-000164, CCI-000172, CCI-001493, CCI-001494, CCI-001495, CCI-003938, CCI-002884

Check
Verify the macOS system is configured to audit all failed read actions on the system with the following command: /usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fr' If the result is not "1", this is a finding.

Fix
Configure the macOS system to audit all failed read actions on the system with the following command: /usr/bin/grep -qE "^flags.*-fr" /etc/security/audit_control || /usr/bin/sed -i.bak '/^flags/ s/$/,-fr/' /etc/security/audit_control;/usr/sbin/audit -s
APPL-15-001023 CAT II V-268465 · SRG-OS-000057-GPOS-00027

The macOS system must be configured to audit all failed write actions on the system.

Maps to AU-9, AU-12, CM-5(1), MA-4(1) via CCI-000162, CCI-000163, CCI-000164, CCI-000172, CCI-001493, CCI-001494, CCI-001495, CCI-003938, CCI-002884

Check
Verify the macOS system is configured to audit all failed write actions on the system with the following command: /usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-fw' If the result is not "1", this is a finding.

Fix
Configure the macOS system to audit all failed write actions on the system with the following command: /usr/bin/grep -qE "^flags.*-fw" /etc/security/audit_control || /usr/bin/sed -i.bak '/^flags/ s/$/,-fw/' /etc/security/audit_control;/usr/sbin/audit -s
APPL-15-001024 CAT II V-269094 · SRG-OS-000365-GPOS-00152

The macOS system must be configured to audit all failed program execution on the system.

Maps to AU-12, CM-5(1) via CCI-003938, CCI-000172

Check
Verify the macOS system is configured to audit all failed program execution on the system with the following command: /usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec '\-ex' If the result is not "1", this is a finding.

Fix
Configure the macOS system to audit all failed program execution on the system with the following command: /usr/bin/grep -qE "^flags.*-ex" /etc/security/audit_control || /usr/bin/sed -i.bak '/^flags/ s/$/,-ex/' /etc/security/audit_control; /usr/sbin/audit -s
APPL-15-001030 CAT II V-268468 · SRG-OS-000046-GPOS-00022

The macOS system must configure audit capacity warning.

Maps to AU-5, AU-5(1) via CCI-000139, CCI-001855

Check
Verify the macOS system is configured to require a minimum of 25 percent free disk space for audit record storage with the following command: /usr/bin/awk -F: '/^minfree/{print $2}' /etc/security/audit_control If the result is not "25", this is a finding.

Fix
Configure the macOS system to require a minimum of 25 percent free disk space for audit record storage with the following command: /usr/bin/sed -i.bak 's/.*minfree.*/minfree:25/' /etc/security/audit_control; /usr/sbin/audit -s
APPL-15-001031 CAT II V-268469 · SRG-OS-000047-GPOS-00023

The macOS system must configure audit failure notification.

Maps to AU-5, AU-5(2) via CCI-000140, CCI-001858

Check
Verify the macOS system is configured to produce audit failure notification with the following command: /usr/bin/grep -c "logger -s -p" /etc/security/audit_warn If the result is not "1", this is a finding.

Fix
Configure the macOS system to produce audit failure notification with the following command: /usr/bin/sed -i.bak 's/logger -p/logger -s -p/' /etc/security/audit_warn; /usr/sbin/audit -s
APPL-15-001044 CAT II V-268470 · SRG-OS-000365-GPOS-00152

The macOS system must be configured to audit all authorization and authentication events.

Maps to AU-12, CM-5(1), MA-4(1) via CCI-003938, CCI-002884, CCI-000172

Check
Verify the macOS system is configured to audit login events with the following command: /usr/bin/awk -F':' '/^flags/ { print $NF }' /etc/security/audit_control | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ec 'aa' If the result is not "1", this is a finding.

Fix
Configure the macOS system to audit login events with the following command: /usr/bin/grep -qE "^flags.*[^-]aa" /etc/security/audit_control || /usr/bin/sed -i.bak '/^flags/ s/$/,aa/' /etc/security/audit_control; /usr/sbin/audit -s
APPL-15-001060 CAT II V-268471 · SRG-OS-000066-GPOS-00034

The macOS system must set smart card certificate trust to moderate.

Maps to IA-2(12), IA-5(2), SC-23(5) via CCI-000185, CCI-001954, CCI-004068, CCI-002470

Check
Verify the macOS system is configured to check the revocation status of user certificates with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ .objectForKey('checkCertificateTrust').js EOS If the result is not "2", this is a finding.

Fix
Configure the macOS system to check the revocation status of user certificates by installing the "com.apple.security.smartcard" configuration profile. NOTE: To ensure continued access to the operating system, consult the supplemental guidance provided with the STIG before applying the configuration profile.
APPL-15-001100 CAT II V-268472 · SRG-OS-000109-GPOS-00056

The macOS system must disable root login for SSH.

Maps to CM-5(1), IA-2(5) via CCI-004045, CCI-001813

Check
Verify the macOS system is configured to disable root login for SSH with the following command: /usr/sbin/sshd -G | /usr/bin/awk '/permitrootlogin/{print $2}' If the result is not "no", this is a finding.

Fix
Configure the macOS system to disable root login for SSH with the following command: include_dir=$(/usr/bin/awk '/^Include/ {print $2}' /etc/ssh/sshd_config | /usr/bin/tr -d '*') if [[ -z $include_dir ]]; then /usr/bin/sed -i.bk "1s/.*/Include \/etc\/ssh\/sshd_config.d\/\*/" /etc/ssh/sshd_config fi /usr/bin/grep -qxF 'permitrootlogin no' "${include_dir}01-mscp-sshd.conf" 2>/dev/null || echo "permitrootlogin no" >> "${include_dir}01-mscp-sshd.conf" for file in $(ls ${include_dir}); do if [[ "$file" == "100-macos.conf" ]]; then continue fi if [[ "$file" == "01-mscp-sshd.conf" ]]; then break fi /bin/mv ${include_dir}${file} ${include_dir}20-${file} done
APPL-15-001110 CAT II V-268473 · SRG-OS-000057-GPOS-00027

The macOS system must configure audit_control group to wheel.

Maps to AU-9, AU-12 via CCI-000162, CCI-000163, CCI-000164, CCI-000171, CCI-001493, CCI-001494, CCI-001495

Check
Verify the macOS system is configured with the audit_control group to wheel with the following command: /bin/ls -dn /etc/security/audit_control | /usr/bin/awk '{print $4}' If the result is not "0", this is a finding.

Fix
Configure the macOS system with the audit_control group to wheel with the following command: /usr/bin/chgrp wheel /etc/security/audit_control
APPL-15-001120 CAT II V-268474 · SRG-OS-000057-GPOS-00027

The macOS system must configure audit_control owner to root.

Maps to AU-9, AU-12 via CCI-000162, CCI-000163, CCI-000164, CCI-000171, CCI-001493, CCI-001494, CCI-001495

Check
Verify the macOS system is configured with the audit_control owner to root with the following command: /bin/ls -dn /etc/security/audit_control | /usr/bin/awk '{print $3}' If the result is not "0", this is a finding.

Fix
Configure the macOS system with the audit_control owner to root with the following command: /usr/sbin/chown root /etc/security/audit_control
APPL-15-001130 CAT II V-268475 · SRG-OS-000057-GPOS-00027

The macOS system must configure audit_control owner to mode 440 or less permissive.

Maps to AU-9, AU-12 via CCI-000162, CCI-000163, CCI-000164, CCI-000171, CCI-001493, CCI-001494, CCI-001495

Check
Verify the macOS system is configured with the audit_control to mode 440 or less with the following command: /bin/ls -l /etc/security/audit_control | /usr/bin/awk '!/-r--[r-]-----|current|total/{print $1}' | /usr/bin/wc -l | /usr/bin/xargs If the result is not "0", this is a finding.

Fix
Configure the macOS system with the audit_control to mode 440 with the following command: /bin/chmod 440 /etc/security/audit_control
APPL-15-001140 CAT II V-269095 · SRG-OS-000057-GPOS-00027

The macOS system must configure audit_control to not contain access control lists (ACLs).

Maps to AU-9, AU-12 via CCI-000162, CCI-000163, CCI-000164, CCI-000171, CCI-001493, CCI-001494, CCI-001495

Check
Verify the macOS system is configured without ACLs applied to audit_control with the following command: /bin/ls -le /etc/security/audit_control | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" If the result is not "0", this is a finding.

Fix
Configure the macOS system without ACLs applied to audit_control with the following command: /bin/chmod -N /etc/security/audit_control
APPL-15-002001 CAT II V-268478 · SRG-OS-000080-GPOS-00048

The macOS system must disable Server Message Block (SMB) sharing.

Maps to AC-3 via CCI-000213

Check
Verify the macOS system is configured to disable SMB sharing with the following command: /bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.smbd" => disabled' If the result is not "1", this is a finding.

Fix
Configure the macOS system to disable SMB sharing with the following command: /bin/launchctl disable system/com.apple.smbd The system may need to be restarted for the update to take effect.
APPL-15-002003 CAT II V-268479 · SRG-OS-000080-GPOS-00048

The macOS system must disable Network File System (NFS) service.

Maps to AC-3 via CCI-000213

Check
Verify the macOS system is configured to disable NFS service with the following command: /bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.nfsd" => disabled' If the result is not "1", this is a finding.

Fix
Configure the macOS system to disable NFS service with the following command: /bin/launchctl disable system/com.apple.nfsd The system may need to be restarted for the update to take effect.
APPL-15-002004 CAT II V-268480 · SRG-OS-000095-GPOS-00049

The macOS system must disable Location Services.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable Location Services with the following command: /usr/bin/sudo -u _locationd /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.locationd')\ .objectForKey('LocationServicesEnabled').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable Location Services with the following command: /usr/bin/defaults write /var/db/locationd/Library/Preferences/ByHost/com.apple.locationd LocationServicesEnabled -bool false; pid=$(/bin/launchctl list | /usr/bin/awk '/com.apple.locationd/ { print $1 }') kill -9 $pid
APPL-15-002005 CAT II V-268481 · SRG-OS-000095-GPOS-00049

The macOS system must disable Bonjour multicast.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable Bonjour multicast with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.mDNSResponder')\ .objectForKey('NoMulticastAdvertisements').js EOS If the result is not "true", this is a finding.

Fix
Configure the macOS system to disable Bonjour multicast by installing the "com.apple.mDNSResponder" configuration profile.
APPL-15-002006 CAT II V-268482 · SRG-OS-000080-GPOS-00048

The macOS system must disable Unix-to-Unix Copy Protocol (UUCP) service.

Maps to AC-3 via CCI-000213

Check
Verify the macOS system is configured to disable UUCP service with the following command: /bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.uucp" => disabled' If the result is not "1", this is a finding.

Fix
Configure the macOS system to disable UUCP service with the following command: /bin/launchctl disable system/com.apple.uucp The system may need to be restarted for the update to take effect.
APPL-15-002007 CAT II V-268483 · SRG-OS-000095-GPOS-00049

The macOS system must disable Internet Sharing.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable Internet Sharing with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ .objectForKey('forceInternetSharingOff').js EOS If the result is not "true", this is a finding.

Fix
Configure the macOS system to disable Internet Sharing by installing the "com.apple.MCX" configuration profile.
APPL-15-002008 CAT II V-268484 · SRG-OS-000080-GPOS-00048

The macOS system must disable the built-in web server.

Maps to AC-3 via CCI-000213

Check
Verify the macOS system is configured to disable the built-in web server with the following command: /bin/launchctl print-disabled system | /usr/bin/grep -c '"org.apache.httpd" => disabled' If the result is not "1", this is a finding.

Fix
Configure the macOS system to disable the built-in web server with the following command: /bin/launchctl disable system/org.apache.httpd The system may need to be restarted for the update to take effect.
APPL-15-002009 CAT II V-268485 · SRG-OS-000080-GPOS-00048

The macOS system must disable AirDrop.

Maps to AC-3, AC-18(1), CM-7 via CCI-000213, CCI-000381, CCI-001443

Check
Verify the macOS system is configured to disable AirDrop with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowAirDrop').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable AirDrop by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-002010 CAT II V-268486 · SRG-OS-000095-GPOS-00049

The macOS system must disable FaceTime.app.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable FaceTime.app with the following command: /usr/bin/osascript -l JavaScript << EOS function run() { let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ .objectForKey('familyControlsEnabled')) let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ .objectForKey('pathBlackList').js for ( let app in pathlist ) { if ( ObjC.unwrap(pathlist[app]) == "/Applications/FaceTime.app" && pref1 == true ){ return("true") } } return("false") } EOS If the result is not "true", this is a finding.

Fix
Configure the macOS system to disable FaceTime.app by installing the "com.apple.applicationaccess.new" configuration profile.
APPL-15-002012 CAT II V-268487 · SRG-OS-000095-GPOS-00049

The macOS system must disable the iCloud Calendar services.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable iCloud Calendar services with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudCalendar').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable iCloud Calendar services by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-002013 CAT II V-268488 · SRG-OS-000095-GPOS-00049

The macOS system must disable iCloud Reminders.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable iCloud Reminders with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudReminders').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable iCloud Reminders by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-002014 CAT II V-268489 · SRG-OS-000095-GPOS-00049

The macOS system must disable iCloud Address Book.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable iCloud Address Book with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudAddressBook').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable iCloud Address Book by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-002015 CAT II V-268490 · SRG-OS-000095-GPOS-00049

The macOS system must disable iCloud Mail.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable iCloud Mail with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudMail').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable iCloud Mail by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-002016 CAT II V-268491 · SRG-OS-000095-GPOS-00049

The macOS system must disable iCloud Notes.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable iCloud Notes with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudNotes').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable iCloud Notes by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-002017 CAT II V-268492 · SRG-OS-000095-GPOS-00049

The macOS system must disable the camera.

Maps to CM-7 via CCI-000381

Check
If the device or operating system does not have a camera installed, this requirement is not applicable. This requirement is not applicable to mobile devices (smartphones and tablets), where the use of the camera is a local authorizing official (AO) decision. This requirement is not applicable to dedicated video teleconference (VTC) suites in approved VTC locations that are centrally managed. For an external camera, if there is not a method for the operator to manually disconnect camera at the end of collaborative computing sessions, this is a finding. For a built-in camera, the camera must be protected by a camera cover (e.g., laptop camera cover slide) when not in use. If the built-in camera is not protected with a camera cover or is not physically disabled, this is a finding. If the camera is not disconnected, covered, or physically disabled, verify the macOS system is configured to disable the camera with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCamera').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable the camera by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-002020 CAT II V-268493 · SRG-OS-000095-GPOS-00049

The macOS system must disable Siri.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable Siri with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowAssistant').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable Siri by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-002021 CAT II V-268494 · SRG-OS-000205-GPOS-00083

The macOS system must disable sending diagnostic and usage data to Apple.

Maps to SI-11 via CCI-001312, CCI-001314

Check
Verify the macOS system is configured to disable sending diagnostic and usage data to Apple with the following command: /usr/bin/osascript -l JavaScript << EOS function run() { let pref1 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SubmitDiagInfo')\ .objectForKey('AutoSubmit').js let pref2 = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowDiagnosticSubmission').js if ( pref1 == false && pref2 == false ){ return("true") } else { return("false") } } EOS If the result is not "true", this is a finding.

Fix
Configure the macOS system to disable sending diagnostic and usage data to Apple by installing the "com.apple.SubmitDiagInfo" configuration profile.
APPL-15-002022 CAT II V-268495 · SRG-OS-000080-GPOS-00048

The macOS system must disable Remote Apple Events.

Maps to AC-3, CM-7 via CCI-000213, CCI-000382

Check
Verify the macOS system is configured to disable Remote Apple Events with the following command: /bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.AEServer" => disabled' If the result is not "1", this is a finding.

Fix
Configure the macOS system to disable Remote Apple Events with the following commands: /usr/sbin/systemsetup -setremoteappleevents off /bin/launchctl disable system/com.apple.AEServer NOTE: Systemsetup with -setremoteappleevents flag will fail unless Full Disk Access to systemsetup or its parent process is granted. This requires supervision.
APPL-15-002023 CAT II V-269096 · SRG-OS-000095-GPOS-00049

The macOS system must disable sending audio recordings and transcripts to Apple.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable sending audio recordings and transcripts with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.Accessibility')\ .objectForKey('AXSAudioDonationSiriImprovementEnabled').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable sending audio recordings and transcripts by installing the "com.apple.accessibility" configuration profile.
APPL-15-002024 CAT II V-269566 · SRG-OS-000095-GPOS-00049

The macOS system must disable sending search data from Spotlight to Apple.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable sending search data from Spotlight with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ .objectForKey('Search Queries Data Sharing Status').js EOS If the result is not "2", this is a finding.

Fix
Configure the macOS system to disable sending search data from Spotlight by installing the "com.apple.assistant.support" configuration profile.
APPL-15-002035 CAT II V-268496 · SRG-OS-000095-GPOS-00049

The macOS system must disable Apple ID setup during Setup Assistant.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable Apple ID setup during Setup Assistant with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ .objectForKey('SkipCloudSetup').js EOS If the result is not "true", this is a finding.

Fix
Configure the macOS system to disable Apple ID setup during Setup Assistant by installing the "com.apple.SetupAssistant.managed" configuration profile.
APPL-15-002036 CAT II V-268497 · SRG-OS-000095-GPOS-00049

The macOS system must disable Privacy Setup services during Setup Assistant.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable Privacy Setup services during Setup Assistant with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ .objectForKey('SkipPrivacySetup').js EOS If the result is not "true", this is a finding.

Fix
Configure the macOS system to disable Privacy Setup services during Setup Assistant by installing the "com.apple.SetupAssistant.managed" configuration profile.
APPL-15-002037 CAT II V-268498 · SRG-OS-000095-GPOS-00049

The macOS system must disable iCloud storage setup during Setup Assistant.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable iCloud storage setup during Setup Assistant with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ .objectForKey('SkipiCloudStorageSetup').js EOS If the result is not "true", this is a finding.

Fix
Configure the macOS system to disable iCloud storage setup during Setup Assistant by installing the "com.apple.SetupAssistant.managed" configuration profile.
APPL-15-002039 CAT II V-268500 · SRG-OS-000095-GPOS-00049

The macOS system must disable Siri Setup during Setup Assistant.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable Siri Setup during Setup Assistant with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ .objectForKey('SkipSiriSetup').js EOS If the result is not "true", this is a finding.

Fix
Configure the macOS system to disable Siri Setup during Setup Assistant by installing the "com.apple.SetupAssistant.managed" configuration profile.
APPL-15-002040 CAT II V-268501 · SRG-OS-000095-GPOS-00049

The macOS system must disable iCloud Keychain Sync.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable iCloud Keychain Sync with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudKeychainSync').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable iCloud Keychain Sync by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-002041 CAT II V-268502 · SRG-OS-000095-GPOS-00049

The macOS system must disable iCloud Document Sync.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable iCloud Document Sync with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudDocumentSync').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable iCloud Document Sync by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-002042 CAT II V-268503 · SRG-OS-000095-GPOS-00049

The macOS system must disable iCloud Bookmarks.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable iCloud Bookmarks with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudBookmarks').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable iCloud Bookmarks by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-002043 CAT II V-268504 · SRG-OS-000095-GPOS-00049

The macOS system must disable iCloud Photo Library.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable the iCloud Photo Library with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudPhotoLibrary').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable the iCloud Photo Library by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-002050 CAT II V-268505 · SRG-OS-000080-GPOS-00048

The macOS system must disable Screen Sharing and Apple Remote Desktop.

Maps to AC-3 via CCI-000213

Check
Verify the macOS system is configured to disable Screen Sharing and Apple Remote Desktop with the following command: /bin/launchctl print-disabled system | /usr/bin/grep -c '"com.apple.screensharing" => disabled' If the result is not "1", this is a finding.

Fix
Configure the macOS system to disable Screen Sharing and Apple Remote Desktop with the following command: /bin/launchctl disable system/com.apple.screensharing The system may need to be restarted for the update to take effect. NOTE: This will apply to the whole system.
APPL-15-002052 CAT II V-268506 · SRG-OS-000095-GPOS-00049

The macOS system must disable the System Settings pane for Wallet and Apple Pay.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable the System Settings pane for Wallet and Apple Pay with the following command: /usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c "com.apple.WalletSettingsExtension" If the result is not "1", this is a finding.

Fix
Configure the macOS system to disable the System Settings pane for Wallet and Apple Pay by installing the "com.apple.systempreferences" configuration profile.
APPL-15-002053 CAT II V-268507 · SRG-OS-000095-GPOS-00049

The macOS system must disable the system settings pane for Siri.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable the system settings pane for Siri with the following command: /usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.Siri-Settings.extension If the result is not "1", this is a finding.

Fix
Configure the macOS system to disable the system settings pane for Siri by installing the "com.apple.systempreferences" configuration profile.
APPL-15-002063 CAT II V-268510 · SRG-OS-000364-GPOS-00151

The macOS system must disable the guest account.

Maps to CM-5(1) via CCI-001813

Check
Verify the macOS system is configured to disable the guest account with the following command: /usr/bin/osascript -l JavaScript << EOS function run() { let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ .objectForKey('DisableGuestAccount')) let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ .objectForKey('EnableGuestAccount')) if ( pref1 == true && pref2 == false ) { return("true") } else { return("false") } } EOS If the result is not "true", this is a finding.

Fix
Configure the macOS system to disable the guest account by installing the "com.apple.MCX" configuration profile.
APPL-15-002068 CAT II V-268513 · SRG-OS-000480-GPOS-00230

The macOS system must secure users' home folders.

Maps to CM-6 via CCI-000366

Check
Verify the macOS system is configured so that permissions are set correctly on user home directories with the following command: /usr/bin/find /System/Volumes/Data/Users -mindepth 1 -maxdepth 1 -type d ! $ -perm 700 -o -perm 711 $ | /usr/bin/grep -v "Shared" | /usr/bin/grep -v "Guest" | /usr/bin/wc -l | /usr/bin/xargs If the result is not "0", this is a finding.

Fix
Configure the macOS system to set the appropriate permissions for each user on the system with the following command: IFS=$'\n' for userDirs in $( /usr/bin/find /System/Volumes/Data/Users -mindepth 1 -maxdepth 1 -type d ! $ -perm 700 -o -perm 711 $ | /usr/bin/grep -v "Shared" | /usr/bin/grep -v "Guest" ); do /bin/chmod og-rwx "$userDirs" done unset IFS
APPL-15-002080 CAT II V-268515 · SRG-OS-000095-GPOS-00049

The macOS system must disable Airplay Receiver.

Maps to AC-18(1), CM-7 via CCI-000381, CCI-001443

Check
Verify the macOS system is configured to disable Airplay Receiver with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowAirPlayIncomingRequests').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable Airplay Receiver by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-002090 CAT II V-268516 · SRG-OS-000028-GPOS-00009

The macOS system must disable TouchID for unlocking the device.

Maps to AC-11 via CCI-000056

Check
Verify the macOS system is configured to disable TouchID for unlocking the device with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowFingerprintForUnlock').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable TouchID for unlocking the device by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-002100 CAT II V-268517 · SRG-OS-000080-GPOS-00048

The macOS system must disable Media Sharing.

Maps to AC-3 via CCI-000213

Check
Verify the macOS system is configured to disable Media Sharing with the following commands: /usr/bin/osascript -l JavaScript << EOS function run() { let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowMediaSharing')) let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowMediaSharingModification')) if ( pref1 == false && pref2 == false ) { return("true") } else { return("false") } } EOS If the result is not "true", this is a finding.

Fix
Configure the macOS system to disable Media Sharing by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-002110 CAT II V-268518 · SRG-OS-000080-GPOS-00048

The macOS system must disable Bluetooth Sharing.

Maps to AC-3, CM-7 via CCI-000213, CCI-000381

Check
Verify the macOS system is configured to disable Bluetooth sharing with the following commands: CURRENT_USER=$( /usr/sbin/scutil <<< "show State:/Users/ConsoleUser" | /usr/bin/awk '/Name :/ && ! /loginwindow/ { print $3 }' ) /usr/bin/sudo -u "$CURRENT_USER" /usr/bin/defaults -currentHost read com.apple.Bluetooth PrefKeyServicesEnabled If the result is not "0", this is a finding.

Fix
Configure the macOS system to disable Bluetooth sharing with the following commands: CURRENT_USER=$( /usr/sbin/scutil <<< "show State:/Users/ConsoleUser" | /usr/bin/awk '/Name :/ && ! /loginwindow/ { print $3 }' ) /usr/bin/sudo -u "$CURRENT_USER" /usr/bin/defaults -currentHost write com.apple.Bluetooth PrefKeyServicesEnabled -bool false
APPL-15-002120 CAT II V-268519 · SRG-OS-000095-GPOS-00049

The macOS system must disable AppleID and internet Account Modification.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable account modification with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowAccountModification').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable Account Modification by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-002140 CAT II V-268521 · SRG-OS-000095-GPOS-00049

The macOS system must disable Content Caching service.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable Content Caching service with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowContentCaching').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable Content Caching service by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-002150 CAT II V-268522 · SRG-OS-000095-GPOS-00049

The macOS system must disable iCloud Desktop and Document folder sync.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable iCloud Desktop and Document folder synchronization with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudDesktopAndDocuments').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable iCloud Desktop and Document folder synchronization by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-002160 CAT II V-268523 · SRG-OS-000095-GPOS-00049

The macOS system must disable iCloud Game Center.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable iCloud Game Center with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowGameCenter').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable iCloud Game Center by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-002170 CAT II V-268524 · SRG-OS-000095-GPOS-00049

The macOS system must disable iCloud Private Relay.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable the iCloud Private Relay with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudPrivateRelay').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable the iCloud Private Relay by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-002180 CAT II V-268525 · SRG-OS-000095-GPOS-00049

The macOS system must disable Find My service.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable Find My service with the following command: /usr/bin/osascript -l JavaScript << EOS function run() { let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowFindMyDevice')) let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowFindMyFriends')) let pref3 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.icloud.managed')\ .objectForKey('DisableFMMiCloudSetting')) if ( pref1 == false && pref2 == false && pref3 == true ) { return("true") } else { return("false") } } EOS If the result is not "true", this is a finding.

Fix
Configure the macOS system to disable Find My service by installing the "com.apple.applicationaccess" and "com.apple.icloud.managed" configuration profiles.
APPL-15-002200 CAT II V-268526 · SRG-OS-000095-GPOS-00049

The macOS system must disable Personalized Advertising.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable Personalized Advertising with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowApplePersonalizedAdvertising').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable Personalized Advertising by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-002210 CAT II V-268527 · SRG-OS-000095-GPOS-00049

The macOS system must disable sending Siri and Dictation information to Apple.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable sending Siri and Dictation information to Apple with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.assistant.support')\ .objectForKey('Siri Data Sharing Opt-In Status').js EOS If the result is not "2", this is a finding.

Fix
Configure the macOS system to disable sending Siri and Dictation information to Apple by installing the "com.apple.assistant.support" configuration profile.
APPL-15-002220 CAT II V-268528 · SRG-OS-000095-GPOS-00049

The macOS system must enforce On Device Dictation.

Maps to CM-7 via CCI-000381

Check
For Intel-based systems, this is not applicable. Verify the macOS system is configured to enforce On Device Only Dictation with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('forceOnDeviceOnlyDictation').js EOS If the result is not "true", this is a finding.

Fix
Configure the macOS system to enforce On Device Only Dictation by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-002230 CAT II V-268529 · SRG-OS-000095-GPOS-00049

The macOS system must disable Dictation.

Maps to CM-7 via CCI-000381

Check
For Apple Silicon-based systems, this is not applicable. Verify the macOS system is configured to disable Dictation with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowDictation').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable Dictation by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-002240 CAT II V-268530 · SRG-OS-000095-GPOS-00049

The macOS system must disable Printer Sharing.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable Printer Sharing with the following command: /usr/sbin/cupsctl | /usr/bin/grep -c "_share_printers=0" If the result is not "1", this is a finding.

Fix
Configure the macOS system to disable Printer Sharing with the following commands: /usr/sbin/cupsctl --no-share-printers /usr/bin/lpstat -p | awk '{print $2}'| /usr/bin/xargs -I{} lpadmin -p {} -o printer-is-shared=false
APPL-15-002250 CAT II V-268531 · SRG-OS-000095-GPOS-00049

The macOS system must disable Remote Management.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable Remote Management with the following command: /usr/libexec/mdmclient QuerySecurityInfo | /usr/bin/grep -c "RemoteDesktopEnabled = 0" If the result is not "1", this is a finding.

Fix
Configure the macOS system to disable Remote Management with the following commands: /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -deactivate -stop
APPL-15-002260 CAT II V-268532 · SRG-OS-000095-GPOS-00049

The macOS system must disable the Bluetooth System Settings pane.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable the Bluetooth System Settings pane with the following command: /usr/bin/profiles show -output stdout-xml | /usr/bin/xmllint --xpath '//key[text()="DisabledSystemSettings"]/following-sibling::*[1]' - | /usr/bin/grep -c com.apple.BluetoothSettings If the result is not "1", this is a finding.

Fix
Configure the macOS system to disable the Bluetooth System Settings pane by installing the "com.apple.systempreferences" configuration profiles.
APPL-15-002270 CAT II V-268533 · SRG-OS-000095-GPOS-00049

The macOS system must disable the iCloud Freeform services.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable iCloud Freeform services with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowCloudFreeform').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable iCloud Freeform services by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-002271 CAT II V-272477 · SRG-OS-000080-GPOS-00048

The macOS system must disable iPhone Mirroring.

Maps to AC-3, AC-18(1), CM-7 via CCI-000213, CCI-000381, CCI-001443

Check
Verify the macOS system is configured to disable iPhone Mirroring with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowiPhoneMirroring').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable iPhone Mirroring by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-003001 CAT II V-268534 · SRG-OS-000403-GPOS-00182

The macOS system must issue or obtain public key certificates from an approved service provider.

Maps to SC-17, SC-23(5) via CCI-002470, CCI-004909

Check
Verify the macOS system is configured to issue or obtain public key certificates from an approved service provider with the following command: /usr/bin/security dump-keychain /Library/Keychains/System.keychain | /usr/bin/awk -F'"' '/labl/ {print $4}' If the result does not contain a list of approved certificate authorities, this is a finding.

Fix
Configure the macOS system to issue or obtain public key certificates from an approved service provider by obtaining the approved certificates from the appropriate authority and install them to the System Keychain.
APPL-15-003007 CAT II V-268535 · SRG-OS-000071-GPOS-00039

The macOS system must require that passwords contain a minimum of one numeric character.

Maps to IA-5(1) via CCI-004066

Check
Verify the macOS system is configured to require that passwords contain a minimum of one numeric character with the following command: /usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyIdentifier"]/following-sibling::*[1]/text()' - | /usr/bin/grep "requireAlphanumeric" -c If the result is not "1", this is a finding.

Fix
Configure the macOS system to require that passwords contain a minimum of one numeric character by installing the "com.apple.mobiledevice.passwordpolicy" configuration profile.
APPL-15-003008 CAT II V-268536 · SRG-OS-000076-GPOS-00044

The macOS system must restrict maximum password lifetime to 180 days.

Maps to IA-5(1) via CCI-004066

Check
Verify the macOS system is configured to restrict maximum password lifetime to 180 days with the following command: /usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeExpiresEveryNDays"]/following-sibling::*[1]/text()' - If the result is not "180" or less, this is a finding.

Fix
Configure the macOS system to restrict maximum password lifetime to 180 days by installing the "com.apple.mobiledevice.passwordpolicy" configuration profile.
APPL-15-003010 CAT II V-268537 · SRG-OS-000078-GPOS-00046

The macOS system must require a minimum password length of 14 characters.

Maps to IA-5(1) via CCI-004066

Check
Verify the macOS system is configured to enforce a minimum 14-character password length with the following command: /usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath 'boolean(//*[contains(text(),"policyAttributePassword matches '\''.{14,}'\''")])' - If the result is not "true", this is a finding.

Fix
Configure the macOS system to enforce a 14-character password length by installing the "com.apple.mobiledevice.passwordpolicy" configuration profile.
APPL-15-003011 CAT II V-268538 · SRG-OS-000266-GPOS-00101

The macOS system must require that passwords contain a minimum of one special character.

Maps to IA-5(1) via CCI-004066

Check
Verify the macOS system is configured to require passwords contain a minimum of one special character with the following command: /usr/bin/pwpolicy -getaccountpolicies 2>/dev/null | /usr/bin/tail -n +2 | /usr/bin/xmllint --xpath "//string[contains(text(), \"policyAttributePassword matches '(.*[^a-zA-Z0-9].*){\")]" - 2>/dev/null | /usr/bin/awk -F"{|}" '{if ($2 >= 1) {print "true"} else {print "false"}}' If the result is not "true", this is a finding.

Fix
Configure the macOS system to require that passwords contain a minimum of one special character by installing the "com.apple.mobiledevice.passwordpolicy" configuration profile.
APPL-15-003012 CAT II V-268539 · SRG-OS-000079-GPOS-00047

The macOS system must disable password hints.

Maps to IA-6 via CCI-000206

Check
Verify the macOS system is configured to disable password hints with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ .objectForKey('RetriesUntilHint').js EOS If the result is not "0", this is a finding.

Fix
Configure the macOS system to disable password hints by installing the "com.apple.loginwindow" configuration profile.
APPL-15-003013 CAT II V-268540 · SRG-OS-000480-GPOS-00227

The macOS system must enable firmware password.

Maps to CM-6 via CCI-000366

Check
For Apple Silicon systems, this is not applicable. Verify the macOS system is configured with a firmware password with the following command: /usr/sbin/firmwarepasswd -check | /usr/bin/grep -c "Password Enabled: Yes" If the result is not "1", this is a finding.

Fix
Configure the macOS system with a firmware password with the following command: /usr/sbin/firmwarepasswd -setpasswd NOTE: If firmware password or passcode is forgotten, the only way to reset the forgotten password is through a machine-specific binary generated and provided by Apple. Users must schedule a support call and provide proof of purchase before the firmware binary will be generated.
APPL-15-003014 CAT II V-268541 · SRG-OS-000079-GPOS-00047

The macOS system must remove password hints from user accounts.

Maps to IA-6 via CCI-000206

Check
Verify the macOS system is configured to remove password hints from user accounts with the following command: HINT=$(/usr/bin/dscl . -list /Users hint | /usr/bin/awk '{ print $2 }') if [ -z "$HINT" ]; then echo "PASS" else echo "FAIL" fi If the result is not "PASS", this is a finding.

Fix
Configure the macOS system to remove password hints from user accounts with the following command: for u in $(/usr/bin/dscl . -list /Users UniqueID | /usr/bin/awk '$2 > 500 {print $1}'); do /usr/bin/dscl . -delete /Users/$u hint done
APPL-15-003020 CAT II V-268542 · SRG-OS-000067-GPOS-00035

The macOS system must enforce smart card authentication.

Maps to IA-2(1), IA-2(2), IA-2(6), IA-2(8), IA-2(12), IA-5(2) via CCI-000186, CCI-000765, CCI-000766, CCI-001941, CCI-004046, CCI-001953, CCI-004047

Check
Verify the macOS system is configured to enforce multifactor authentication with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ .objectForKey('enforceSmartCard').js EOS If the result is not "true", this is a finding.

Fix
Configure the macOS system to enforce multifactor authentication by installing the "com.apple.security.smartcard" configuration profile. NOTE: To ensure continued access to the operating system, consult the supplemental guidance provided with the STIG before applying the configuration profile.
APPL-15-003030 CAT II V-268543 · SRG-OS-000068-GPOS-00036

The macOS system must allow smart card authentication.

Maps to IA-2(1), IA-2(2), IA-2(8), IA-2(12), IA-5(2) via CCI-000187, CCI-000765, CCI-000766, CCI-001941, CCI-001953

Check
Verify the macOS system is configured to allow smart card authentication with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.smartcard')\ .objectForKey('allowSmartCard').js EOS If the result is not "true", this is a finding.

Fix
Configure the macOS system to enforce multifactor authentication by installing the "com.apple.security.smartcard" configuration profile. NOTE: To ensure continued access to the operating system, consult the supplemental guidance provided with the STIG before applying the configuration profile.
APPL-15-003050 CAT II V-268544 · SRG-OS-000105-GPOS-00052

The macOS system must enforce multifactor authentication for login.

Maps to IA-2(1), IA-2(2), IA-2(6), IA-2(8) via CCI-000765, CCI-000766, CCI-001941, CCI-004047

Check
Verify the macOS system is configured to enforce multifactor authentication for login with the following command: /usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.so)' /etc/pam.d/login If the result is not "2", this is a finding.

Fix
Configure the macOS system to enforce multifactor authentication for login with the following commands: /bin/cat > /etc/pam.d/login << LOGIN_END # login: auth account password session auth sufficient pam_smartcard.so auth optional pam_krb5.so use_kcminit auth optional pam_ntlm.so try_first_pass auth optional pam_mount.so try_first_pass auth required pam_opendirectory.so try_first_pass auth required pam_deny.so account required pam_nologin.so account required pam_opendirectory.so password required pam_opendirectory.so session required pam_launchd.so session required pam_uwtmp.so session optional pam_mount.so LOGIN_END /bin/chmod 644 /etc/pam.d/login /usr/sbin/chown root:wheel /etc/pam.d/login
APPL-15-003051 CAT II V-268545 · SRG-OS-000105-GPOS-00052

The macOS system must enforce multifactor authentication for the su command.

Maps to IA-2(1), IA-2(2), IA-2(6), IA-2(8) via CCI-000765, CCI-000766, CCI-001941, CCI-004047

Check
Verify the macOS system is configured to enforce multifactor authentication for the su command with the following command: /usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_rootok.so)' /etc/pam.d/su If the result is not "2", this is a finding.

Fix
Configure the macOS system to enforce multifactor authentication for the su command with the following commands: /bin/cat > /etc/pam.d/su << SU_END # su: auth account password session auth sufficient pam_smartcard.so auth required pam_rootok.so auth required pam_group.so no_warn group=admin,wheel ruser root_only fail_safe account required pam_permit.so account required pam_opendirectory.so no_check_shell password required pam_opendirectory.so session required pam_launchd.so SU_END # Fix new file ownership and permissions /bin/chmod 644 /etc/pam.d/su /usr/sbin/chown root:wheel /etc/pam.d/su
APPL-15-003052 CAT II V-268546 · SRG-OS-000105-GPOS-00052

The macOS system must enforce multifactor authentication for privilege escalation through the sudo command.

Maps to IA-2(1), IA-2(2), IA-2(6), IA-2(8) via CCI-000765, CCI-000766, CCI-001941, CCI-004047

Check
Verify the macOS system is configured to enforce multifactor authentication for privilege escalation through the sudo command with the following command: /usr/bin/grep -Ec '^(auth\s+sufficient\s+pam_smartcard.so|auth\s+required\s+pam_deny.so)' /etc/pam.d/sudo If the result is not "2", this is a finding.

Fix
Configure the macOS system to enforce multifactor authentication for privilege escalation through the sudo command with the following commands: /bin/cat > /etc/pam.d/sudo << SUDO_END # sudo: auth account password session auth sufficient pam_smartcard.so auth required pam_opendirectory.so auth required pam_deny.so account required pam_permit.so password required pam_deny.so session required pam_permit.so SUDO_END /bin/chmod 444 /etc/pam.d/sudo /usr/sbin/chown root:wheel /etc/pam.d/sudo
APPL-15-003060 CAT II V-268547 · SRG-OS-000069-GPOS-00037

The macOS system must require that passwords contain a minimum of one lowercase character and one uppercase character.

Maps to IA-5(1) via CCI-004066, CCI-004065

Check
Verify the macOS system is configured to require that passwords contain a minimum of one lowercase character and one uppercase character with the following command: /usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath 'boolean(//*[contains(text(),"policyAttributePassword matches '\''^(?=.*[A-Z])(?=.*[a-z])(?=.*[0-9]).*$'\''")])' - If the result is not "true", this is a finding.

Fix
Configure the macOS system to require at least one lowercase character and one uppercase character in password complexity by installing the "com.apple.mobiledevice.passwordpolicy" configuration profile.
APPL-15-003070 CAT II V-268548 · SRG-OS-000075-GPOS-00043

The macOS system must set minimum password lifetime to 24 hours.

Maps to IA-5(1) via CCI-004066

Check
Verify the macOS system is configured to set minimum password lifetime to 24 hours with the following command: /usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeMinimumLifetimeHours"]/following-sibling::integer[1]/text()' - | /usr/bin/awk '{ if ($1 >= 24 ) {print "yes"} else {print "no"}}' If the result is not "yes", this is a finding.

Fix
Configure the macOS system to set minimum password lifetime to 24 hours. This setting may be enforced using local policy. To set local policy to require a minimum password lifetime, edit the current password policy to contain the following within the "policyCategoryPasswordContent": [source,xml] ---- policyContent policyAttributeLastPasswordChangeTime < policyAttributeCurrentTime - (policyAttributeMinimumLifetimeHours * 60 * 60) policyIdentifier Minimum Password Lifetime policyParameters policyAttributeMinimumLifetimeHours 24 ---- After saving the file and exiting to the command prompt, run the following command to load the new policy file, substituting the path to the file in place of "$pwpolicy_file". [source,bash] ---- /usr/bin/pwpolicy setaccountpolicies $pwpolicy_file ----
APPL-15-003080 CAT II V-268549 · SRG-OS-000118-GPOS-00060

The macOS system must disable accounts after 35 days of inactivity.

Maps to AC-2(3) via CCI-003627, CCI-003628

Check
Verify the macOS system is configured to disable accounts after 35 days of inactivity with the following command: /usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeInactiveDays"]/following-sibling::integer[1]/text()' - If the result is not "35", this is a finding.

Fix
Configure the macOS system to disable accounts after 35 days of inactivity with the following command: This setting may be enforced using local policy. To set local policy to disable an inactive user after 35 days, edit the current password policy to contain the following within the "policyCategoryAuthentication": [source,xml] ---- policyContent policyAttributeLastAuthenticationTime > policyAttributeCurrentTime - (policyAttributeInactiveDays * 24 * 60 * 60) policyIdentifier Inactive Account policyParameters policyAttributeInactiveDays 35 ---- After saving the file and exiting to the command prompt, run the following command to load the new policy file, substituting the path to the file in place of "$pwpolicy_file". [source,bash] ---- /usr/bin/pwpolicy setaccountpolicies $pwpolicy_file ----
APPL-15-004001 CAT II V-268550 · SRG-OS-000205-GPOS-00083

The macOS system must configure Apple System Log (ASL) files owned by root and group to wheel.

Maps to SI-11 via CCI-001312, CCI-001314

Check
Verify the macOS system is configured with ASL files owned by root and group to wheel with the following command: /usr/bin/stat -f '%Su:%Sg:%N' $(/usr/bin/grep -e '^>' /etc/asl.conf /etc/asl/* | /usr/bin/awk '{ print $2 }') 2> /dev/null | /usr/bin/awk '!/^root:wheel:/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' If the result is not "0", this is a finding.

Fix
Configure the macOS system with ASL files owned by root and group to wheel with the following command: /usr/sbin/chown root:wheel $(/usr/bin/stat -f '%Su:%Sg:%N' $(/usr/bin/grep -e '^>' /etc/asl.conf /etc/asl/* | /usr/bin/awk '{ print $2 }') 2> /dev/null | /usr/bin/awk '!/^root:wheel:/{print $1}' | /usr/bin/awk -F":" '!/^root:wheel:/{print $3}')
APPL-15-004002 CAT II V-268551 · SRG-OS-000205-GPOS-00083

The macOS system must configure Apple System Log (ASL) files to mode 640 or less permissive.

Maps to SI-11 via CCI-001312, CCI-001314

Check
Verify the macOS system is configured with ASL files to mode 640 or less permissive with the following command: /usr/bin/stat -f '%A:%N' $(/usr/bin/grep -e '^>' /etc/asl.conf /etc/asl/* | /usr/bin/awk '{ print $2 }') 2> /dev/null | /usr/bin/awk '!/640/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' If the result is not "0", this is a finding.

Fix
Configure the macOS system with ASL files to mode 640 with the following command: /bin/chmod 640 $(/usr/bin/stat -f '%A:%N' $(/usr/bin/grep -e '^>' /etc/asl.conf /etc/asl/* | /usr/bin/awk '{ print $2 }') 2> /dev/null | /usr/bin/awk -F":" '!/640/{print $2}')
APPL-15-004022 CAT II V-274881 · SRG-OS-000373-GPOS-00156

The macOS system must require users to reauthenticate for privilege escalation when using the "sudo" command.

Maps to IA-11, SC-11 via CCI-002038, CCI-004895

Check
Verify the macOS system requires reauthentication when using the "sudo" command to elevate privileges with the following command: /usr/bin/sudo /usr/bin/sudo -V | /usr/bin/grep -c "Authentication timestamp timeout: 0.0 minutes" If the result is not "1", this is a finding.

Fix
Configure the macOS system to require reauthentication when using "sudo" with the following command: /usr/bin/find /etc/sudoers* -type f -exec sed -i '' '/timestamp_timeout/d' '{}' \; /bin/echo "Defaults timestamp_timeout=0" >> /etc/sudoers.d/mscp
APPL-15-004030 CAT II V-268552 · SRG-OS-000205-GPOS-00083

The macOS system must configure system log files owned by root and group to wheel.

Maps to SI-11 via CCI-001312, CCI-001314

Check
Verify the macOS system is configured with system log files owned by root and group to wheel with the following command: /usr/bin/stat -f '%Su:%Sg:%N' $(/usr/bin/grep -v '^#' /etc/newsyslog.conf | /usr/bin/awk '{ print $1 }') 2> /dev/null | /usr/bin/awk '!/^root:wheel:/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' If the result is not "0", this is a finding.

Fix
Configure the macOS system with system log files owned by root and group to wheel with the following command: /usr/sbin/chown root:wheel $(/usr/bin/stat -f '%Su:%Sg:%N' $(/usr/bin/grep -v '^#' /etc/newsyslog.conf | /usr/bin/awk '{ print $1 }') 2> /dev/null | /usr/bin/awk -F":" '!/^root:wheel:/{print $3}')
APPL-15-004040 CAT II V-268553 · SRG-OS-000205-GPOS-00083

The macOS system must configure system log files to mode 640 or less permissive.

Maps to SI-11 via CCI-001312, CCI-001314

Check
Verify the macOS system is configured with system log files set to mode 640 or less permissive with the following command: /usr/bin/stat -f '%A:%N' $(/usr/bin/grep -v '^#' /etc/newsyslog.conf | /usr/bin/awk '{ print $1 }') 2> /dev/null | /usr/bin/awk '!/640/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' If the result is not "0", this is a finding.

Fix
Configure the macOS system with system log files set to mode 640 or less permissive with the following command: /bin/chmod 640 $(/usr/bin/stat -f '%A:%N' $(/usr/bin/grep -v '^#' /etc/newsyslog.conf | /usr/bin/awk '{ print $1 }') 2> /dev/null | /usr/bin/awk '!/640/{print $1}' | awk -F":" '!/640/{print $2}')
APPL-15-004060 CAT II V-274880 · SRG-OS-000373-GPOS-00156

The macOS system must configure sudoers timestamp type.

Maps to IA-11, SC-11 via CCI-002038, CCI-004895

Check
Verify the macOS system is configured with sudoers timestamp type with the following command: /usr/bin/sudo /usr/bin/sudo -V | /usr/bin/awk -F": " '/Type of authentication timestamp record/{print $2}' If the result is not "tty", this is a finding.

Fix
Configure the macOS system with sudoers timestamp type with the following command: /usr/bin/find /etc/sudoers* -type f -exec sed -i '' '/timestamp_type/d; /!tty_tickets/d' '{}' \;
APPL-15-005050 CAT II V-268557 · SRG-OS-000480-GPOS-00232

The macOS system must enable macOS Application Firewall.

Maps to CM-6 via CCI-000366

Check
Verify the macOS system is configured to enable the Application Firewall with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall')\ .objectForKey('EnableFirewall').js EOS If the result is not "true", this is a finding.

Fix
Configure the macOS system to enable the Application Firewall by installing the "com.apple.security.firewall" configuration profile.
APPL-15-005052 CAT II V-268558 · SRG-OS-000104-GPOS-00051

The macOS system must configure the login window to prompt for username and password.

Maps to IA-2 via CCI-000764

Check
Verify the macOS system is configured to prompt for username and password at the login window with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\ .objectForKey('SHOWFULLNAME').js EOS If the result is not "true", this is a finding.

Fix
Configure the macOS system to prompt for username and password at the login window by installing the "com.apple.loginwindow" configuration profile.
APPL-15-005054 CAT II V-268559 · SRG-OS-000095-GPOS-00049

The macOS system must disable the TouchID prompt during Setup Assistant.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable the TouchID prompt during Setup Assistant with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ .objectForKey('SkipTouchIDSetup').js EOS If the result is not "true", this is a finding.

Fix
Configure the macOS system to disable the TouchID prompt during Setup Assistant by installing the "com.apple.SetupAssistant.managed" configuration profile.
APPL-15-005055 CAT II V-268560 · SRG-OS-000095-GPOS-00049

The macOS system must disable the Screen Time prompt during Setup Assistant.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable the Screen Time prompt during Setup Assistant with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ .objectForKey('SkipScreenTime').js EOS If the result is not "true", this is a finding.

Fix
Configure the macOS system to disable the Screen Time prompt during Setup Assistant by installing the "com.apple.SetupAssistant.managed" configuration profile.
APPL-15-005056 CAT II V-268561 · SRG-OS-000095-GPOS-00049

The macOS system must disable Unlock with Apple Watch during Setup Assistant.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable Unlock with Apple Watch during Setup Assistant with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SetupAssistant.managed')\ .objectForKey('SkipUnlockWithWatch').js EOS If the result is not "true", this is a finding.

Fix
Configure the macOS system to disable Unlock with Apple Watch during Setup Assistant by installing the "com.apple.SetupAssistant.managed" configuration profile.
APPL-15-005058 CAT II V-268562 · SRG-OS-000080-GPOS-00048

The macOS system must disable Handoff.

Maps to AC-3, AC-18(1), CM-7 via CCI-000213, CCI-000381, CCI-001443

Check
Verify the macOS system is configured to disable Handoff with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowActivityContinuation').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable Handoff by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-005060 CAT II V-268563 · SRG-OS-000095-GPOS-00049

The macOS system must disable proximity-based password sharing requests.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable proximity-based password sharing requests with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowPasswordProximityRequests').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable proximity-based password sharing requests by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-005061 CAT II V-268564 · SRG-OS-000095-GPOS-00049

The macOS system must disable Erase Content and Settings.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable Erase Content and Settings with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowEraseContentAndSettings').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable Erase Content and Settings by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-005070 CAT II V-268565 · SRG-OS-000080-GPOS-00048

The macOS system must enable Authenticated Root.

Maps to AC-3 via CCI-000213

Check
Verify the macOS system is configured to enable authenticated root with the following command: /usr/libexec/mdmclient QuerySecurityInfo | /usr/bin/grep -c "AuthenticatedRootVolumeEnabled = 1;" If the result is not "1", this is a finding.

Fix
Configure the macOS system to enable authenticated root with the following command: /usr/bin/csrutil authenticated-root enable NOTE: To reenable "Authenticated Root", boot the affected system into "Recovery" mode, launch "Terminal" from the "Utilities" menu, and run the command.
APPL-15-005080 CAT II V-268566 · SRG-OS-000362-GPOS-00149

The macOS system must prohibit user installation of software into /users/.

Maps to CM-11(2) via CCI-003980

Check
Verify the macOS system is configured to prohibit user installation of software into /users/ with the following command: /usr/bin/osascript -l JavaScript << EOS function run() { let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ .objectForKey('familyControlsEnabled')) let pathlist = $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess.new')\ .objectForKey('pathBlackList').js for ( let app in pathlist ) { if ( ObjC.unwrap(pathlist[app]) == "/Users/" && pref1 == true ){ return("true") } } return("false") } EOS If the result is not "true", this is a finding.

Fix
Configure the macOS system to prohibit user installation of software into /users/ by installing the "com.apple.applicationaccess.new" configuration profile.
APPL-15-005090 CAT II V-268567 · SRG-OS-000378-GPOS-00163

The macOS system must authorize USB devices before allowing connection.

Maps to CM-7(9), IA-3 via CCI-001958, CCI-003959

Check
Verify the macOS system is configured to authorize USB devices before allowing connection with the following command: /usr/bin/osascript -l JavaScript << EOS function run() { let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowUSBRestrictedMode')) if ( pref1 == false ) { return("false") } else { return("true") } } EOS If the result is not "true", this is a finding.

Fix
Configure the macOS system to authorize USB devices before allowing connection by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-005100 CAT II V-268568 · SRG-OS-000445-GPOS-00199

The macOS system must ensure Secure Boot level is set to "full".

Maps to SI-6 via CCI-002696, CCI-002699, CCI-002702

Check
Verify the macOS system is configured to ensure Secure Boot level is set to "full" using the following command: /usr/libexec/mdmclient QuerySecurityInfo | /usr/bin/grep -c "SecureBootLevel = full" If the result is not "1", this is a finding.

Fix
Configure the macOS system to ensure Secure Boot level is set to "full" by booting into Recovery Mode and enabling Full Secure Boot.
APPL-15-005110 CAT II V-268569 · SRG-OS-000480-GPOS-00227

The macOS system must enforce enrollment in Mobile Device Management (MDM).

Maps to CM-6 via CCI-000366

Check
Verify the macOS system is configured to enforce enrollment in mobile device management with the following command: /usr/bin/profiles status -type enrollment | /usr/bin/awk -F: '/MDM enrollment/ {print $2}' | /usr/bin/grep -c "Yes (User Approved)" If the result is not "1", this is a finding.

Fix
Configure the macOS system by ensuring that the system is enrolled via UAMDM.
APPL-15-005120 CAT II V-268570 · SRG-OS-000480-GPOS-00227

The macOS system must enable Recovery Lock.

Maps to CM-6 via CCI-000366

Check
For non-Apple Silicon systems, this is not applicable. Verify the macOS system is configured with Recovery Lock with the following command: /usr/libexec/mdmclient QuerySecurityInfo | /usr/bin/grep -c "IsRecoveryLockEnabled = 1" If the result is not "1", this is a finding.

Fix
Configure the macOS system with Recovery Lock with the SetRecoveryLock command. This can be used to set a Recovery Lock password and must be from the MDM.
APPL-15-005130 CAT II V-268571 · SRG-OS-000480-GPOS-00227

The macOS system must enforce installation of XProtect Remediator and Gatekeeper updates automatically.

Maps to CM-6 via CCI-000366

Check
Verify the macOS system is configured to enforce installation of XProtect Remediator and Gatekeeper updates automatically with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate')\ .objectForKey('ConfigDataInstall').js EOS If the result is not "true", this is a finding.

Fix
Configure the macOS system to enforce installation of XProtect Remediator and Gatekeeper updates automatically by installing the "com.apple.SoftwareUpdate" configuration profile.
APPL-15-005140 CAT II V-268572 · SRG-OS-000095-GPOS-00049

The macOS system must disable Genmoji.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable Genmoji with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowGenmoji').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable Genmoji by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-005150 CAT II V-268573 · SRG-OS-000095-GPOS-00049

The macOS system must disable Apple Intelligence Image Generation.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable Apple Intelligence Image Generation with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowImagePlayground').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable Apple Intelligence Image Generation by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-005160 CAT II V-268574 · SRG-OS-000095-GPOS-00049

The macOS system must disable Apple Intelligence Writing Tools.

Maps to CM-7 via CCI-000381

Check
Verify the macOS system is configured to disable Apple Intelligence Writing Tools with the following command: /usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\ .objectForKey('allowWritingTools').js EOS If the result is not "false", this is a finding.

Fix
Configure the macOS system to disable Apple Intelligence Writing Tools by installing the "com.apple.applicationaccess" configuration profile.
APPL-15-999999 CAT II V-268575 · SRG-OS-000439-GPOS-00195

The macOS system must install security-relevant software updates within 30 days unless the time period is directed by an authoritative source (e.g., IAVM, CTOs, DTMs, STIGs).

Maps to SI-2 via CCI-002605

Check
Verify security-relevant software updates are installed on the operating system within 30 days unless the time period is directed by an authoritative source (e.g., IAVM, CTOs, DTMs, STIGs). Click the Apple icon on the menu at the top left corner of the screen. Select the "About This Mac" option. Select the "More Info..." button. Under the macOS section, there are details about the update version. Compare this to the latest available macOS update version. If the installed updates are not the latest and the latest updates have been available for 30 days or more, this is a finding.

Fix
Install the latest updates within 30 days unless the time period is directed by an authoritative source (e.g., IAVM, CTOs, DTMs, STIGs).

macOS STIGs

CAT II 147

The macOS system must prevent Apple Watch from terminating a session lock.

The macOS system must enforce screen saver password.

The macOS system must enforce session lock no more than five seconds after screen saver is started.

The macOS system must configure user session lock when a smart token is removed.

The macOS system must disable hot corners.

The macOS system must prevent AdminHostInfo from being available at LoginWindow.

The macOS system must automatically remove or disable temporary or emergency user accounts within 72 hours.

The macOS system must enforce time synchronization.

The macOS system must limit consecutive failed login attempts to three.

The macOS system must display a policy banner at remote login.

The macOS system must enforce SSH to display a policy banner.

The macOS system must display the Standard Mandatory DoW Notice and Consent Banner at the login window.

The macOS system must configure audit log files to not contain access control lists (ACLs).

The macOS system must configure the audit log folder to not contain access control lists (ACLs).

The macOS system must disable FileVault automatic login.

The macOS system must configure SSHD ClientAliveInterval to 900.

The macOS system must configure SSHD ClientAliveCountMax to 1.

The macOS system must set login grace time to 30.

The macOS system must set account lockout time to 15 minutes.

The macOS system must enforce screen saver timeout.

The macOS system must disable login to other users' active and locked sessions.

The macOS system must disable root login.

The macOS system must configure the SSH ServerAliveInterval to 900.

The macOS system must configure SSHD channel timeout to 900.

The macOS system must configure SSHD unused connection timeout to 900.

The macOS system must set SSH Active Server Alive Maximum to 0.

The macOS system must enforce auto logout after 86400 seconds of inactivity.

The macOS system must be configured to use an authorized time server.

The macOS system must enable the time synchronization daemon.

The macOS system must configure sudo to log events.

The macOS system must be configured to audit all administrative action events.

The macOS system must be configured to audit all login and logout events.

The macOS system must enable security auditing.

The macOS system must be configured to shut down upon audit failure.

The macOS system must configure audit log files to be owned by root.

The macOS system must configure audit log folders to be owned by root.

The macOS system must configure the audit log files group to wheel.

The macOS system must configure the audit log folders group to wheel.

The macOS system must configure audit log files to mode 440 or less permissive.

The macOS system must configure audit log folders to mode 700 or less permissive.

The macOS system must be configured to audit all deletions of object attributes.

The macOS system must be configured to audit all changes of object attributes.

The macOS system must be configured to audit all failed read actions on the system.

The macOS system must be configured to audit all failed write actions on the system.

The macOS system must be configured to audit all failed program execution on the system.

The macOS system must configure audit capacity warning.

The macOS system must configure audit failure notification.

The macOS system must be configured to audit all authorization and authentication events.

The macOS system must set smart card certificate trust to moderate.

The macOS system must disable root login for SSH.

The macOS system must configure audit_control group to wheel.

The macOS system must configure audit_control owner to root.

The macOS system must configure audit_control owner to mode 440 or less permissive.

The macOS system must configure audit_control to not contain access control lists (ACLs).

The macOS system must disable Server Message Block (SMB) sharing.

The macOS system must disable Network File System (NFS) service.

The macOS system must disable Location Services.

The macOS system must disable Bonjour multicast.

The macOS system must disable Unix-to-Unix Copy Protocol (UUCP) service.

The macOS system must disable Internet Sharing.

The macOS system must disable the built-in web server.

The macOS system must disable AirDrop.

The macOS system must disable FaceTime.app.

The macOS system must disable the iCloud Calendar services.

The macOS system must disable iCloud Reminders.

The macOS system must disable iCloud Address Book.

The macOS system must disable iCloud Mail.

The macOS system must disable iCloud Notes.

The macOS system must disable the camera.

The macOS system must disable Siri.

The macOS system must disable sending diagnostic and usage data to Apple.

The macOS system must disable Remote Apple Events.

The macOS system must disable sending audio recordings and transcripts to Apple.

The macOS system must disable sending search data from Spotlight to Apple.

The macOS system must disable Apple ID setup during Setup Assistant.

The macOS system must disable Privacy Setup services during Setup Assistant.

The macOS system must disable iCloud storage setup during Setup Assistant.

The macOS system must disable Siri Setup during Setup Assistant.