Cyber Trackr - Free Compliance Library
Cyber Trackr
The Free Compliance Library

MAC OSX 10.5 Security Technical Implementation Guide

  • Version/Release: V1R2
  • Published: 2011-07-29
  • Expand All:
  • Severity:
  • Sort:
Compare

Select any two versions of this STIG to compare the individual requirements

View

Select any old version/release of this STIG to view the previous requirements

MAC OSX 10.5 Security Technical Implementation Guide
c
The hard drive(s) on the system must be formatted using the HFS+ (Hierarchical File System)format.
High - V-25185 - SV-31216r1_rule
RMF Control
Severity
High
CCI
Version
OSX00005
Vuln IDs
  • V-25185
Rule IDs
  • SV-31216r1_rule
This is a category 1 finding because the ability to set access permissions and audit critical directories and files is only available by using the HFS+ file system. The capability to assign access permissions to file objects is a DoD policy requirement.System AdministratorECCD-1, ECCD-2
Checks: C-31659r1_chk

OSX00005-1. Click on Finder icon 2. Click on Applications 3. Under Utilities, click on Terminal. 4. Enter command: diskutil info / 5. Ensure File System is Journaled HFS+

Fix: F-28138r1_fix

OSX00005-Manual option during image build process. Choose HFS+ formatted drive.

b
OSX00015-Create administrator accounts with difficult-to-guess names
Medium - V-25200 - SV-31233r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00015
Vuln IDs
  • V-25200
Rule IDs
  • SV-31233r1_rule
The administrator account has unlimited privileges to the system. Creating a complex name improves the protection of this account and the system. When creating an administrator account, do not use administrator, do not use the name of the machine, etc.System AdministratorIAIA-1, IAIA-2
Checks: C-31666r1_chk

1. Select Finder. 2. Select Applications. 3. Select System Preferences. 4. Select Accounts. 5. Verify there are no easy to guess administrator account names. If any accounts have easy to guess names, then this is a finding.

Fix: F-28147r1_fix

1. Select Finder. 2. Select Applications. 3. Select System Preferences. 4. Select Accounts. 5. Rename or recreate accounts with difficult-to-guess names.

b
OSX00020-Maximum password age
Medium - V-25204 - SV-31239r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00020
Vuln IDs
  • V-25204
Rule IDs
  • SV-31239r1_rule
The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the passwords. Further, scheduled changing of passwords hinders the ability of unauthorized system users to crack passwords and gain access to a system. System AdministratorIAIA-1, IAIA-2
Checks: C-31667r1_chk

Open a terminal session and use the following command to view the setting for Maximum password age: sudo pwpolicy -n -getglobalpolicy | tr " " "\n" | grep maxMinutesUntilChangePassword. If the value of maxMinutesUntilChangePassword is greater than 86400, then this is a finding. Note: If the command returns a response of: password server is not configured, the system is not managed. Use the following command for non-managed systems: pwpolicy -n /Local/Default -getglobalpolicy | tr " " "\n" | grep maxMinutesUntilChangePassword. If the value of maxMinutesUntilChangePassword is greater than 86400, then this is a finding.

Fix: F-28150r1_fix

Open a terminal session and use the following command to set the value for maximum password age: sudo pwpolicy -n -setglobalpolicy “maxMinutesUntilChangePassword=86400”. Note: For non-managed system, use the command: pwpolicy -n /Local/Default -setglobalpolicy "maxMinutesUntilChangePassword=86400".

b
OSX00025-Minimum password age
Medium - V-25226 - SV-31267r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00025
Vuln IDs
  • V-25226
Rule IDs
  • SV-31267r1_rule
Permitting passwords to be changed in immediate succession within the same day, allows users to cycle passwords through their history database. This enables users to effectively negate the purpose of mandating periodic password changes. System AdministratorIAIA-1, IAIA-2
Checks: C-31673r1_chk

Open a terminal session and use the following command to view the setting for Minimum password age: sudo pwpolicy -n -getglobalpolicy | tr " " "\n" | grep minMinutesUntilChangePassword. If the value of minMinutesUntilChangePassword is less than 1440, then this is a finding. Note: If the command returns a response of: password server is not configured, the system is not managed. Use the following command for non-managed systems: pwpolicy -n /Local/Default -getglobalpolicy | tr " " "\n" | grep minMinutesUntilChangePassword. If the value of minMinutesUntilChangePassword is less than 1440, then this is a finding.

Fix: F-28156r1_fix

Open a terminal session and use the following command to set the value for minimum password age: sudo pwpolicy -n -setglobalpolicy “minMinutesUntilChangePassword=1440”. Note: For non-managed system, use the command: pwpolicy -n /Local/Default -setglobalpolicy "minMinutesUntilChangePassword=1440".

b
OSX00030-Minimum password length
Medium - V-25230 - SV-31272r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00030
Vuln IDs
  • V-25230
Rule IDs
  • SV-31272r1_rule
Information systems not protected with strong password schemes, including passwords of minimum length, provide the opportunity for anyone to crack the password, thus, gaining access to the system and causing the device, information, or the local network to be compromised or lead to a denial of service.System AdministratorIAIA-1, IAIA-2
Checks: C-31676r1_chk

Open a terminal session and use the following command to view the setting for minimum password length: sudo pwpolicy -n -getglobalpolicy | tr " " "\n" | grep minChars. If the value of minChars is less than 15, then this is a finding. Note: If the command returns a response of: password server is not configured, the system is not managed. Use the following command for non-managed systems: pwpolicy -n /Local/Default -getglobalpolicy | tr " " "\n" | grep minChars. If the value of minChars is less than 15, then this is a finding.

Fix: F-28160r1_fix

Open a terminal session and use the following command to set the value for minimum password length: sudo pwpolicy -n -setglobalpolicy “minChars=15”. Note: For non-managed system, use the command: pwpolicy -n /Local/Default -setglobalpolicy "minChars=15".

b
OSX00035-Create complex passwords for user accounts
Medium - V-25236 - SV-31279r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00035
Vuln IDs
  • V-25236
Rule IDs
  • SV-31279r1_rule
Configure the local system to verify that newly-created passwords conform to DoD password complexity policy. Passwords must contain 1 character from the following 4 classes: English uppercase letters, English lowercase letters, Westernized Arabic numerals, and non-alphanumeric characters. Sites are responsible for installing password complexity software that complies with current DoD requirements. System AdministratorIAIA-1
Checks: C-31678r1_chk

Open a terminal session and run the following commands: 1) pwpolicy –n -getglobalpolicy | tr " " "\n" | grep requiresAlpha 2) pwpolicy –n -getglobalpolicy | tr " " "\n" | grep requiresNumeric 3) pwpolicy –n -getglobalpolicy | tr " " "\n" | grep requiresMixedCase 4) pwpolicy –n -getglobalpolicy | tr " " "\n" | grep requiresSymbol. All values should equal 1. If not, then this is a finding. Note: If the command returns a response of: password server is not configured, the system is not managed. Add the path /Local/Default to the above commands, an example would be: pwpolicy -n /Local/Default -getglobalpolicy | tr " " "\n" | grep requiresAlpha .

Fix: F-28165r1_fix

Open a terminal session and run the following command: sudo pwpolicy -n - setglobalpolicy "requiresAlpha=1 requiresNumeric=1 requiresMixedCase=1 requiresSymbol=1". For non managed systems the path /Local/Default would need to be added to the command, an example would be: pwpolicy -n /Local/Default - setglobalpolicy "requiresAlpha=1 requiresNumeric=1 requiresMixedCase=1 requiresSymbol=1"

b
OSX00040-Check newly-created password content for account or user name
Medium - V-25238 - SV-31281r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00040
Vuln IDs
  • V-25238
Rule IDs
  • SV-31281r1_rule
Configure the local system to verify that newly-created passwords do not contain user's account name or parts of the user's full name that exceed two consecutive characters. System AdministratorIAIA-1, IAIA-2
Checks: C-31679r1_chk

Open a terminal session and use the following command to view the setting for Password cannot be name: sudo pwpolicy -n -getglobalpolicy | tr " " "\n" | grep passwordCannotBeName. If the value of passwordCannotBeName is not equal to 1, then this is a finding. Note: If the command returns a response of: password server is not configured, the system is not managed. Use the following command for non-managed systems: pwpolicy -n /Local/Default -getglobalpolicy | tr " " "\n" | grep passwordCannotBeName. If the value of passwordCannotBeName is not equal to 1, then this is a finding.

Fix: F-28166r1_fix

Open a terminal session and use the following command to set the value for Password cannot be name: sudo pwpolicy -n -setglobalpolicy “passwordCannotBeName=1”. Note: For non-managed system, use the command: pwpolicy -n /Local/Default -setglobalpolicy "passwordCannotBeName=1".

b
OSX00045-Account lockout duration
Medium - V-25240 - SV-31284r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00045
Vuln IDs
  • V-25240
Rule IDs
  • SV-31284r1_rule
The amount of time that a user's account is locked after multiple failed login attempts.System AdministratorECLO-1, ECLO-2
Checks: C-31680r1_chk

Open a terminal session and use the following command to view the setting for Account lockout duration: sudo pwpolicy -n -getglobalpolicy | tr " " "\n" | grep minutesUntilFailedLoginReset. If the value of minutesUntilFailedLoginReset is greater than 0, then this is a finding. Note: If the command returns a response of: password server is not configured, the system is not managed. Use the following command for non-managed systems: pwpolicy -n /Local/Default -getglobalpolicy | tr " " "\n" | grep minutesUntilFailedLoginReset. If the value of minutesUntilFailedLoginReset is greater than 0, then this is a finding.

Fix: F-28167r1_fix

Open a terminal session and use the following command to set the value for Account lockout duration: sudo pwpolicy -n -setglobalpolicy “minutesUntilFailedLoginReset=0”. Note: For non-managed system, use the command: pwpolicy -n /Local/Default -setglobalpolicy "minutesUntilFailedLoginReset=0".

b
OSX00050-Account lockout threshold
Medium - V-25241 - SV-31288r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00050
Vuln IDs
  • V-25241
Rule IDs
  • SV-31288r1_rule
The account lockout feature, when enabled, prevents brute-force password attacks on the system. The higher this value is, the less effective the account lockout feature will be in protecting the local system. The number of bad logon attempts should be reasonably small to minimize the possibility of a successful password attack while allowing for honest errors made during a normal user logon. System AdministratorECLO-1, ECLO-2
Checks: C-31681r1_chk

Open a terminal session and use the following command to view the setting for Account lockout threshold: sudo pwpolicy -n -getglobalpolicy | tr " " "\n" | grep maxFailedLoginAttemps. If the value of maxFailedLoginAttemps is more than 3, then this is a finding. Note: If the command returns a response of: password server is not configured, the system is not managed. Use the following command for non-managed systems: pwpolicy -n /Local/Default -getglobalpolicy | tr " " "\n" | grep maxFailedLoginAttemps. If the value of maxFailedLoginAttemps is more than 3, then this is a finding.

Fix: F-28168r1_fix

Open a terminal session and use the following command to set the value for Account lockout threshold: sudo pwpolicy -n -setglobalpolicy “maxFailedLoginAttemps=3”. Note: For non-managed system, use the command: pwpolicy -n /Local/Default -setglobalpolicy "maxFailedLoginAttemps=3".

b
OSX00055-Application software updates
Medium - V-25251 - SV-31297r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00055
Vuln IDs
  • V-25251
Rule IDs
  • SV-31297r1_rule
Major software vendors release security patches and hot fixes to their products when security vulnerabilities are discovered. It is essential that these updates be applied in a timely manner to prevent unauthorized persons from exploiting identified vulnerabilities. Unsupported software should be updated or removed.If any of the patches not installed are ‘Critical’, then this should be elevated to a Category 1System AdministratorVIVM-1
Checks: C-31683r1_chk

Open a terminal session and enter the following command: sudo softwareupdate --list or sudo softwareupdate --list --all Review the result for proper versions and current patch level. GUI procedures: 1. Choose Apple (?) > Software Update. 2. Select 'Scheduled Check & Installed Updates' 3. Verify all current software updates are installed. If the current software updates are not installed, then this is a finding. Note: This check does not show 3rd party software or updates.

Fix: F-28170r1_fix

Ensure all software is kept up-to-date with manufacturer's updates, especially security updates and patches. Note: Do not enable Automatic Updating as this will conflict with V-25298

b
OSX00060-Disable Wi-Fi Support Software
Medium - V-25252 - SV-31299r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00060
Vuln IDs
  • V-25252
Rule IDs
  • SV-31299r1_rule
Many organizations restrict the use of wireless technology in their network environment. However, most Mac computers have wireless capability built in, and simply turning it off may not meet your organization’s wireless technology restrictions. You might need to remove components from Mac OS X to disable them from being turned on in System Preferences. Although wireless technology gives your network more flexibility with your users, it can cause security vulnerabilities you may be unaware of. It is recommended that wherever possible, wireless access be disabled for security reasons. Important: Repeat these instructions every time a system update is installed.System AdministratorECSC-1
Checks: C-31684r1_chk

1. Open a terminal session. 2. View the /System/Library/Extensions folder. 3. Ensure the following files do NOT exist: AppleAirPort.kext, AppleAirPort2.kext, and AppleAirPortFW.kext If any of the files exist, then this is a finding.

Fix: F-28171r1_fix

To remove support for WiFi at the kext file level: open a terminal session and use the following commands to remove the following files. sudo srm -rf /System/Library/Extensions/AppleAirPort.kext sudo srm -rf /System/Library/Extensions/AppleAirPort2.kext sudo srm -rf /System/Library/Extensions/AppleAirPortFW.kext GUI procedures: 1. Open the /System/Library/Extensions folder. 2. Drag the following files to the Trash: AppleAirPort.kext, AppleAirPort2.kext, AppleAirPortFW.kext 3. Open Terminal and enter the following command: $ sudo touch /System/Library/Extensions 4. Choose Finder > Secure Empty Trash to delete the file. 5. Restart the system.

b
OSX00065-Disable Bluetooth Support Software
Medium - V-25253 - SV-31301r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00065
Vuln IDs
  • V-25253
Rule IDs
  • SV-31301r1_rule
Bluetooth technology and associated devices are susceptible to general wireless networking threats, such as denial of service attacks, eavesdropping, man-in-the-middle attacks, message modification, and resource misappropriation. Remove Bluetooth support for peripherals such as keyboards, mice, or phones. This task requires you to have administrator privileges. Important: Repeat these instructions every time a system update is installed. Support should be removed at the kext file level.System AdministratorECSC-1
Checks: C-31685r1_chk

1. Open a terminal session. 2. View the /System/Library/Extensions folder. 3. Ensure the following files do NOT exist: IOBluetoothFamily.kext and IOBluetoothHIDDriver.kext. If the files exist, then this is a finding.

Fix: F-28172r1_fix

Open a terminal session and enter the following commands to remove the files: sudo srm -rf /System/Library/Extensions/IOBluetoothFamily.kext sudo srm -rf /System/Library/Extensions/IOBluetoothHIDDriver.kext sudo touch /System/Library/Extensions

b
OSX00070-Disable Audio Recording Support Software
Medium - V-25254 - SV-31303r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00070
Vuln IDs
  • V-25254
Rule IDs
  • SV-31303r1_rule
Your computer might be in an environment where recording devices such as cameras or microphones are not permitted. You can protect your organization’s privacy by disabling these devices. Remove support for the microphone and audio subsystem. This may disable audio playback. Important: Repeat these instructions every time a system update is installed.System AdministratorECSC-1
Checks: C-31686r1_chk

1. Open System Preferences -> Sound. 2. Select Internal microphone and ensure "Input Volume" is set to zero. 3. Select Line-In (if present) and ensure "Input Volume" is set to zero. 4. Select Display Audio and ensure "USB" is set to zero. If any of the parameters are not set to zero, then this is a finding.

Fix: F-28173r1_fix

Open a terminal session and enter the following commands to remove the files: sudo srm -rf /System/Library/Extensions/AppleOnboardAudio.kext sudo srm -rf /System/Library/Extensions/AppleUSBAudio.kext sudo srm -rf /System/Library/Extensions/AppleDeviceTreeUpdater.kext sudo srm -rf /System/Library/Extensions/IOAudioFamily.kext sudo srm -rf /System/Library/Extensions/VirtualAudioDriver.kext sudo touch /System/Library/Extensions GUI Procedures: 1. Open the /System/Library/Extensions folder. 2. To remove support for audio components such as the microphone, drag the following files to the Trash: AppleOnboardAudio.kext, AppleUSBAudio.kext, AudioDeviceTreeUpdater.kext, IOAudioFamily.kext, and VirtualAudioDriver.kext 3. Open Terminal and enter the following command: $ sudo touch System/Library/Extensions The touch command changes the modified date of the /System/Library/Extensions folder. When the folder has a new modified date, the Extension cache files (located in /System/Library/) are deleted and rebuilt by Mac OS X. 4. Choose Finder -> Secure Empty Trash to delete the file. 5. Restart the system.

b
OSX00075-Disable Video Recording Support Software
Medium - V-25255 - SV-31305r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00075
Vuln IDs
  • V-25255
Rule IDs
  • SV-31305r1_rule
Your computer might be in an environment where recording devices such as cameras or microphones are not permitted. You can protect your organization’s privacy by disabling these devices. Remove support for an external or built-in iSight camera. Note: The support for external iSight cameras should be removed on all machines. Removing only support for internal iSight cameras would still leave support for external cameras available. You can also have an Apple Authorized Technician remove the built-in video camera hardware from your Apple computer. Important: Repeat these instructions every time a system update is installed. System AdministratorECSC-1
Checks: C-31687r1_chk

1. Open the /System/Library/Extensions folder. 2. Ensure the following file does NOT exist:Apple_iSight.kext. 3. Control click the IOUSBFamily.kext and select Show Package Contents. 4. Open the /Contents/PlugIns/ folder. 5. Ensure the following file does NOT exist: AppleUSBVideoSupport.kext

Fix: F-28174r1_fix

Open a terminal session and enter the following commands to remove the files: sudo srm -rf /System/Library/Extensions/Apple_iSight.kext sudo srm -rf /System/Library/Extensions/IOUSBFamily.kext/Contents/Plugins/AppleUSBVideoSupport.kext sudo touch /System/Library/Extensions GUI Procedures: 1. Open the /System/Library/Extensions folder. 2. To remove support for the external iSight camera, drag the following file to the Trash:Apple_iSight.kext. 3. To remove support for the built-in iSight camera, control click the IOUSBFamily.kext and select Show Package Contents. 4. Open the /Contents/PlugIns/ folder. 5. Drag the following file to the Trash: AppleUSBVideoSupport.kext 6. Open Terminal and enter the following command: $ sudo touch /System/Library/Extensions The touch command changes the modified date of the /System/Library/Extensions folder. When the folder has a new modified date, the Extension cache files (located in /System/Library/) are deleted and rebuilt by Mac OS X. 7. Choose Finder -> Secure Empty Trash to delete the file. 8. Restart the system.

b
OSX00090-Remove Infrared (IR) Support
Medium - V-25258 - SV-31311r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00090
Vuln IDs
  • V-25258
Rule IDs
  • SV-31311r1_rule
To prevents unauthorized users from controlling your computer through the infrared receiver. Remove IR hardware support. This task requires you to have administrator privileges. You can also have an Apple Authorized Technician remove IR hardware from your Apple computer. Important: Repeat these instructions every time a system update is installed. System AdministratorECSC-1
Checks: C-31690r1_chk

1. Open a terminal session. 2. View the /System/Library/Extensions folder. 3. Ensure the following file does NOT exist: AppleIRController.kext If the file exists, then this is a finding.

Fix: F-28177r1_fix

Open a terminal session and enter the following commands to remove the file: srm -rf /System/Library/Extensions/AppleIRController.kext sudo touch /System/Library/Extensions GUI Procedures: 1. Open the /System/Library/Extensions 2. Drag the following file to the Trash: AppleIRController.kext 3. Open Terminal and enter the following command: $ sudo touch /System/Library/Extensions The touch command changes the modified date of the /System/Library/Extensions folder. When the folder has a new modified date, the Extension cache files (located in /System/Library) are deleted and rebuilt automatically by Mac OS X. 4. Choose Finder -> Secure Empty Trash to delete the file. 5. Restart the system.

c
OSX00095-Require an Open Firmware or EFI password
High - V-25259 - SV-31313r1_rule
RMF Control
Severity
High
CCI
Version
OSX00095
Vuln IDs
  • V-25259
Rule IDs
  • SV-31313r1_rule
PowerPC-based computers use Open Firmware to control hardware. This is similar to the BIOS on an x86 PC. Open Firmware is the hardware base layer for Mac OS X and is a possible point of intrusion. By protecting it from unauthorized access, you can prevent attackers from gaining access to your computer. System AdministratorECSC-1
Checks: C-31691r1_chk

1. Log in with an administrator account and open the Firmware Password Utility (located on the Mac OS X installation disc in /Applications/Utilities/) 2 Verify the "Require password to change Open Firmware settings" is selected.

Fix: F-28178r1_fix

1. Log in with an administrator account and open the Firmware Password Utility (located on the Mac OS X installation disc in /Applications/Utilities/). 2. Click Change. 3. Select “Require password to change Open Firmware settings.” 4. In the Password and Verify fields, enter a new Open Firmware or EFI password, and click OK. This password can be up to eight characters. Do not use the capital letter “U” in an Open Firmware password. If you do, your password will not be recognized during the startup process. 5. Close the Firmware Password Utility.

b
OSX00100-Create an access warning for the login window
Medium - V-25260 - SV-31315r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00100
Vuln IDs
  • V-25260
Rule IDs
  • SV-31315r1_rule
Configure the system to display a logon banner that meets the DoD standards for a valid legal notice to users. You can use a login window or Terminal access warning to provide notice of a computer’s ownership, to warn against unauthorized access, or to remind authorized users of their consent to monitoring. ECWM-1
Checks:

Fix:

b
OSX00105-Create an access warning for the command line
Medium - V-25261 - SV-31317r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00105
Vuln IDs
  • V-25261
Rule IDs
  • SV-31317r1_rule
Configure the system to display a warning banner that meets the DoD standards with a valid legal notice to users. Terminal access warnings provide notice of a computer’s ownership, to warn against unauthorized access, or to remind authorized users of their consent to monitoring. System AdministratorECWM-1
Checks: C-31692r1_chk

Open a terminal session. The warning banner should be displayed in the terminal. If the following DoD warning banner is not displayed, then this is a finding. You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests—not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. Note: Any OS versions that do not support the full text version must state the following: “I've read & consent to terms in IS user agreem't.” Note: Deviations are not permitted except as authorized by the Deputy Assistant Secretary of Defense for Information and Identity Assurance.

Fix: F-28179r1_fix

1. Open a terminal session 2. Verify the /etc/motd file exists. If not, use the touch command to create the file. 3. Edit the file and enter the appropriate DoD warning banner information. 4. Save the file. 5. Open a new terminal session and verify the banner is displayed.

c
OSX00110-Restrict sudo usage to access sudo commands in a single terminal, and for only one sudo instance at a time
High - V-25262 - SV-31319r1_rule
RMF Control
Severity
High
CCI
Version
OSX00110
Vuln IDs
  • V-25262
Rule IDs
  • SV-31319r1_rule
Do not allow direct root login because the logs cannot identify which administrator logged in. Instead, log in using accounts with administrator privileges, and then use the sudo command to perform actions as root. These limit the use of the sudo command to a single command per authentication and also ensure that, even if a timeout is activated, that later sudo commands are limited to the terminal in which authentication occurred. Note: Admin privilege may be needed to perform some commands.System AdministratorECSC-1
Checks: C-31693r1_chk

1. Open a terminal session and use the following command to view the values: more /etc/sudoers 2. Ensure the following items exist: Defaults tty_tickets Defaults timestamp_timeout=0 If the values are not present, then this is a finding. Note: Admin privilege may be needed to perform some commands.

Fix: F-28180r1_fix

Open a terminal session and enter the following commands to set the values in the /etc/sudoers file: echo "Defaults tty_tickets" >> /etc/sudoers echo "Defaults timestamp_timeout=0" >> /etc/sudoers Note: Admin privilege may be needed to perform some commands.

b
OSX00115-Securely configure LDAPv3 access (if it is used)
Medium - V-25263 - SV-31323r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00115
Vuln IDs
  • V-25263
Rule IDs
  • SV-31323r1_rule
When configuring LDAPv3, do not add DHCP-supplied LDAP servers to automatic search policies if you cannot secure the network the computer is running on. If you do, someone can create a rogue DHCP. System AdministratorECCT-1, ECCT-2
Checks: C-31694r1_chk

Open Finder Click Applications Double Click Utility Double Click Directory Utility Click the Show Advanced Options button Click Services tab Click the Lock and enter the password to unlock the options(if needed) Click the LDAPv3 service Click the Pencil icon Highlight the Server Name/Configuration Name Click Edit Click the Connection tab and verify "Encrypt using SSL" is selected. If "Encrypt using SSL" is not selected, then this is a finding.

Fix: F-28181r1_fix

Open Finder Click Applications Double Click Utility Double Click Directory Utility Click the Show Advanced Options button Click Services tab Click the Lock and enter the password to unlock the options(if needed) Click the LDAPv3 service Click the Pencil icon Highlight the Server Name/Configuration Name Click Edit Click the Connection tab and select "Encrypt using SSL"

b
OSX00120-LDAP Authentication, Use authentication when connecting to LDAPv3.
Medium - V-25264 - SV-31325r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00120
Vuln IDs
  • V-25264
Rule IDs
  • SV-31325r1_rule
When configuring LDAPv3 for LDAP authentication, do not add DHCP-supplied LDAP servers to automatic search policies if you cannot secure the network the computer is running on. If you do, someone can create a rogue DHCP. Use authentication when connecting to LDAPv3 directories and disable clear text passwords for all LDAPv3 directories. Digitally sign all LDAPv3 packets (requires Kerberos). Encrypt all LDAPv3 packets (requires SSL or Kerberos). Block man-in-the-middle attacks (requires Kerberos). System AdministratorDCNR-1, ECCT-1, ECCT-2
Checks: C-31695r1_chk

Open Finder Click Applications Double Click Utility Double Click Directory Utility Click the Show Advanced Options button Click Services tab Click the Lock and enter the password to unlock the options(if needed) Click the LDAPv3 service Click the Pencil icon Highlight the Server Name/Configuration Name Click Edit Click the Security tab and verify the "Use authentication when connecting" is checked. If option is not checked, then this is a finding.

Fix: F-28182r1_fix

Open Finder Click Applications Double Click Utility Double Click Directory Utility Click the Show Advanced Options button Click Services tab Click the Lock and enter the password to unlock the options(if needed) Click the LDAPv3 service Click the Pencil icon Highlight the Server Name/Configuration Name Click Edit Click on Security tab and select "Use authentication when connecting"

c
OSX00125-Securely configure Active Directory Access
High - V-25265 - SV-31327r1_rule
RMF Control
Severity
High
CCI
Version
OSX00125
Vuln IDs
  • V-25265
Rule IDs
  • SV-31327r1_rule
The “Allow administration by” setting should not be used in sensitive environments. It can cause unintended privilege escalation issues because any member of the group specified will have administrator privileges on your computer. System AdministratorDCNR-1, ECCT-1, ECCT-2
Checks: C-31696r1_chk

1. Open the Directory Utilities. 2. Click the Services tab. 3. Double-click on Active Directory. 4. Click on Show Advanced Options. 5. Click on Administrative tab and ensure "Allow administration by" is not selected. If "Allow administration by" is selected, then this is a finding.

Fix: F-28183r1_fix

1. Open the Directory Utilities. 2. Click the Services tab. 3. Double-click on Active Directory. 4. Click on Show Advanced Options. 5. Click on Administrative tab and deselect "Allow administration by" option.

b
OSX00135-Assign POSIX access permissions based on user categories.
Medium - V-25267 - SV-31331r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00135
Vuln IDs
  • V-25267
Rule IDs
  • SV-31331r1_rule
Changing permissions on a user's home directory from 750 to 700 will disable Apple file sharing. User's home directory POSIX permissions should be set to 700. System AdministratorECSC-1
Checks: C-31698r1_chk

To use the command line utility to check permissions: Open a Terminal session, access the home directory, and type ls -ls, and ensure home directory has permission set to 700. If permissions are not set to 700, then this is a finding.

Fix: F-28185r1_fix

To use the command line utility, open a terminal session and sudo chmod 700 for each users home directory.

b
OSX00140-Enable security auditing
Medium - V-25268 - SV-31333r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00140
Vuln IDs
  • V-25268
Rule IDs
  • SV-31333r1_rule
Auditing is the capture and maintenance of information about security-related events. Auditing helps determine the causes and the methods used for successful and failed access attempts.System AdministratorECAR-1, ECAR-2, ECAR-3
Checks: C-31699r1_chk

1.Open a terminal session and edit the /etc/hostconfig file, by using the command (sudo pico /etc/hostconfig). 2. Verify the following line exists: AUDIT=-YES- If the value is not YES, then this is a finding. Cancel out of file without saving.

Fix: F-28186r1_fix

1.Open a terminal session and edit the /etc/hostconfig file, by using the command (sudo pico /etc/hostconfig). 2. Add the following line to the file: AUDIT=-YES- 3. Save the file. 4. Restart the machine.

b
OSX00145-Configure security auditing
Medium - V-25269 - SV-31335r3_rule
RMF Control
Severity
Medium
CCI
Version
OSX00145
Vuln IDs
  • V-25269
Rule IDs
  • SV-31335r3_rule
Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions and analyze compromises that have occurred as well as detect an attack that has begun or is about to begin. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Without an audit trail that provides information as to event that occurred and if it was successful or unsuccessful, it is difficult to analyze a series of events to determine the steps used by an attacker to compromise a system or network, or what exactly happened that led to a denial of service. Collecting data such as the successful and unsuccessful events is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. System AdministratorECAR-1, ECAR-2, ECAR-3
Checks: C-31700r2_chk

1. Install the Common Criteria Tools for OS X 10.5. 2. Open the /etc/security/audit_control file. 3. Find the line that begins with "flags". 4. Ensure that line includes the following: flags: lo,ad,-all,-fr,fd,fm,^-fa,^-fc,^-cl. If the file does not contain appropriate flags, then this is a finding.

Fix: F-28187r2_fix

1. Install the Common Criteria Tools for OS X 10.5. 2. Open a terminal session and edit the /etc/security/audit_control file. 3. Find the line that begins with "flags". 4. Replace that line with the following: flags:lo,ad,-all,-fr,fd,fm,^-fa,^-fc,^-cl. 5. Save the file

b
OSX00150-Enable local logging
Medium - V-25270 - SV-31337r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00150
Vuln IDs
  • V-25270
Rule IDs
  • SV-31337r1_rule
The default configuration in /etc/newsyslog.conf file is configured for local logging in the /var/log folder. The computer is set to rotate log files using the periodic launchd job according to time intervals specified in the /etc/newsyslog.conf file. System AdministratorECAR-1, ECAR-2, ECAR-3
Checks: C-31702r1_chk

1. Open a terminal session and enter the command: more /etc/newsyslog.conf 2. If the count values are not set to 14, then this is a finding.

Fix: F-28188r1_fix

Open a terminal session and enter the command: sudo pico /etc/newsyslog.conf and set all count values to 14.

b
OSX00155-Enable remote logging
Medium - V-25271 - SV-31339r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00155
Vuln IDs
  • V-25271
Rule IDs
  • SV-31339r1_rule
In addition to local logging, consider using remote logging. Local logs can be altered if the computer is compromised. System AdministratorECAR-1, ECAR-2, ECAR-3
Checks: C-31703r1_chk

1 Open a terminal session and enter the command: more /etc/syslog.conf 2. Ensure the name or IP address of the site's log server is listed 'your.log.server'. If the name or IP address of the log server is not listed, then this is a finding.

Fix: F-28189r1_fix

1. Open a terminal session and enter the command: sudo pico /etc/syslog.conf 2. Add the following line to the top of the file, replacing your.log.server with the name or IP address of the log server, and keeping all other lines intact: *.* @your.log.server 3. Exit, saving changes. 4. Reboot the system.

c
OSX00160-Install an antivirus tool
High - V-25272 - SV-31341r1_rule
RMF Control
Severity
High
CCI
Version
OSX00160
Vuln IDs
  • V-25272
Rule IDs
  • SV-31341r1_rule
Installing antivirus tools helps prevent infection of your computer by viruses and helps prevent your computer from becoming a host used to spread viruses to other computers. These tools quickly identify suspicious content and compare them to known malicious content. See the https://www.cybercom.mil website for approved AV tools. System AdministratorECVP-1
Checks: C-31704r1_chk

Verify an approved anti-virus tool is installed on the system.

Fix: F-28190r1_fix

Install an approved anti-virus tool on the system.

b
OSX00165-Securely configure /etc/sshd_config - Prevent root login
Medium - V-25273 - SV-31343r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00165
Vuln IDs
  • V-25273
Rule IDs
  • SV-31343r1_rule
Prevent logging in as root through SSH. This should be set for all SSH methods of authenticating. System AdministratorCOBR-1, ECPA-1
Checks: C-31705r1_chk

1. Open a terminal session and enter the command: more /etc/sshd_config 2. Ensure the value PermitRootLogin is set to No. If the value PermitRootLogin is not set to No, then this is a finding.

Fix: F-28191r1_fix

1. Open a terminal session and enter the command: sudo pico /etc/sshd_config 2. Edit the value PermitRootLogin and set it to No. 3. Save the file

a
OSX00170-Securely configure /etc/sshd_config - Login Grace Time
Low - V-25274 - SV-31345r1_rule
RMF Control
Severity
Low
CCI
Version
OSX00170
Vuln IDs
  • V-25274
Rule IDs
  • SV-31345r1_rule
Reduces the time allowed to authenticate to 30 seconds. System AdministratorECSC-1
Checks: C-31706r1_chk

1. Open a terminal session and enter the following command: more /etc/sshd_config 2. Ensure the value LoginGraceTime is set to 30 or less. If the value LoginGraceTime is not set to 30 or less, then this is a finding.

Fix: F-28192r1_fix

1. Open a terminal session and enter the following command: sudo pico /etc/sshd_config 2. Edit the value: LoginGraceTime to 30. 3. Save the file.

b
OSX00175-Securely configure /etc/sshd_config - Protocol version
Medium - V-25275 - SV-31347r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00175
Vuln IDs
  • V-25275
Rule IDs
  • SV-31347r1_rule
Restrict OpenSSH so it uses only SSH Protocol 2. This should be set for all SSH methods of authenticating. System AdministratorECSC-1
Checks: C-31707r1_chk

1. Open a terminal session and enter the command: more /etc/sshd_config 2. Ensure the value Protocol is set to 2. If the value Protocol is not set to 2, then this is a finding.

Fix: F-28193r1_fix

1. Open a terminal session and enter the following command: sudo pico /etc/sshd_config 2. Edit the value: Protocol to 2. 3.Save the file.

c
OSX00180-Securely configure /etc/sshd_config - Empty passwords
High - V-25276 - SV-31349r1_rule
RMF Control
Severity
High
CCI
Version
OSX00180
Vuln IDs
  • V-25276
Rule IDs
  • SV-31349r1_rule
Denies access to accounts without passwords. This should be set for all SSH methods of authenticating. System AdministratorECSC-1
Checks: C-31708r1_chk

1. Open a terminal session and enter the command: more /etc/sshd_config 2. Ensure the value PermitEmptyPasswords is set to No. If the value is not set to No, then this is a finding.

Fix: F-28194r1_fix

1. Open a terminal session and enter the following command: sudo pico /etc/sshd_config 2. Change the value:PermitEmptyPasswords to No. 3. Save the file

b
OSX00185-Change Global umask
Medium - V-25277 - SV-31351r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00185
Vuln IDs
  • V-25277
Rule IDs
  • SV-31351r1_rule
The default umask setting of 022 (in octal) removes group and other write permissions. Group members and other users can read and run these files or folders. Changing the umask setting to 027 enables group members to read files and folders and prevents others from accessing the files and folders. System AdministratorECCD-1, ECCD-2
Checks: C-31709r1_chk

1. Open a terminal session and enter the following command: launchctl umask. 2. Ensure the permission is set to 27. If the permission is not set to 27, then this is a finding.

Fix: F-28195r1_fix

1. Open a terminal session and enter the following command: sudo echo "umask 027" >> /etc/launchd.conf

b
OSX00190-Remove the MobileMe preference pane from System Preferences
Medium - V-25278 - SV-31353r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00190
Vuln IDs
  • V-25278
Rule IDs
  • SV-31353r1_rule
Remove the MobileMe preference pane from System Preferences-MobileMe is a suite of Internet tools that help you synchronize data and other important information when you’re away from the computer. In sensitive environments don’t use MobileMe. If you must store critical data, only store it on your local computer. You should only transfer data over a secure network connection to a secure internal server. If you use MobileMe, enable it only for user accounts that don’t have access to critical data. It is not recommended that you enable MobileMe for administrator or root user accounts. System AdministratorECSC-1
Checks: C-31710r1_chk

1. Open System Preferences > MobileMe. 2. On the Sync pane, ensure "Synchronization with MobileMe" is not checked and all other options are disabled. If not, then this is a finding. Command Procedures: 1. Open a terminal session. 2. View the /System/Library/Extensions folder. 3. Ensure the following files do NOT exist: Mac.prefPane and Internet.prefPane. If any of the files exist, then this is a finding.

Fix: F-28196r1_fix

1. Open System Preferences-> MobileMe. 2. On the Sync pane, uncheck "Synchronization with MobileMe" and disable all other options. Command Procedures: Open a terminal session and enter the following commands to remove the file: sudo rm -R /System/Library/PreferencePanes/Mac.prefPane sudo rm -R /System/Library/PreferencePanes/Internet.prefPane sudo touch /System/Library/Extensions

b
OSX00195-Software Update Server URL is restricted to authorized DoD server
Medium - V-25279 - SV-31355r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00195
Vuln IDs
  • V-25279
Rule IDs
  • SV-31355r1_rule
Your computer can look for software updates on an internal software update server. By using an internal software update server, you reduce the amount of data transferred outside of the network. Your organization can control which updates can be installed on your computer.System AdministratorVIVM-1
Checks: C-31711r1_chk

Open a terminal session and enter the following command: defaults read com.apple.SoftwareUpdate CatalogURL The value returned is the current Software Update Server. Verify it is an approved SUS. If no value is returned, the system is using a default Apple Update Server and this would be a finding.

Fix: F-28197r1_fix

Open a terminal session and enter one of the following commands: defaults write com.apple.SoftwareUpdate CatalogURL 'new_SUS_URL' (where 'new_SUS_URL' is the URL or the address of the appropriate government SUS to be used).

b
OSX00200-Disable ability for administrative accounts to unlock Screen Saver
Medium - V-25280 - SV-31357r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00200
Vuln IDs
  • V-25280
Rule IDs
  • SV-31357r1_rule
The default setting creates a possible point of attack, because the more users you have in the admin group the more you depend on those users to protect their user names and passwords. By changing the rule in system.login.screensaver to authenticatesession-owner, users of the admin group cannot unlock the screen saver. System AdministratorECPA-1, PESL-1
Checks: C-31712r1_chk

1. Open a terminal session and enter the following command: more /etc/authorization 2. Ensure the "system.login.screensaver" key includes the value "authenticate-session-owner". If not, then this is a finding.

Fix: F-28198r1_fix

1. Open a terminal session and edit the following file: /etc/authorization 2. Change "authenticate-session-owner-or-admin " to "authenticate-session-owner" in the "system.login.screensaver" key. 3. Save the file.

b
OSX00205-Remove the setuid bit from the System Preferences.app file.
Medium - V-25281 - SV-31359r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00205
Vuln IDs
  • V-25281
Rule IDs
  • SV-31359r1_rule
Remove setuid bit from Install Assistant, because attackers try to influence or co-opt the execution of setuid programs in order to try to elevate their privileges. There is benefit in removing the setuid bit from programs that may not need it. There is also benefit in restricting to administrators the right to execute a setuid program.System AdministratorECCD-1, ECCD-2
Checks: C-31713r1_chk

1. Open a terminal session and enter the following command: ls - ls /Applications/SystemPreferences.app/Contents/Resources/installAssistant 2. Ensure the file permissions are set to -rwxrwxr-x. If the permission is not the same or more restrictive, then this is a finding.

Fix: F-28199r1_fix

1. Open a terminal session and enter the following command: chmod 775 /Applications/System Preferences.app/Contents/Resources/installAssistant.

b
OSX00210-Remove setuid bit from ODBC Admin tool.
Medium - V-25282 - SV-31361r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00210
Vuln IDs
  • V-25282
Rule IDs
  • SV-31361r1_rule
Because attackers try to influence or co-opt the execution of setuid programs in order to try to elevate their privileges, there is benefit in removing the setuid bit from programs that may not need it. There is also benefit in restricting to administrators the right to execute a setuid program.System AdministratorECCD-1, ECCD-2
Checks: C-31714r1_chk

1. Open a terminal session and enter the following command: ls -ls /Applications/Utilities/ODBC Administrator.app/Contents/Resources/iodbcadmintool 2. Ensure the file permissions are set to -rwxr-xr-x. If the permission is not the same or more restrictive, then this is a finding.

Fix: F-28200r1_fix

1. Open a terminal session and enter the following command: chmod 755 /Applications/Utilities/ODBC Administrator.app/Contents/Resources/iodbcadmintool

b
OSX00215-Remove setuid bit from Apple Remote Desktop
Medium - V-25283 - SV-31363r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00215
Vuln IDs
  • V-25283
Rule IDs
  • SV-31363r1_rule
Because attackers try to influence or co-opt the execution of setuid programs in order to try to elevate their privileges, there is benefit in removing the setuid bit from programs that may not need it. There is also benefit in restricting to administrators the right to execute a setuid program. System AdministratorECCD-1, ECCD-2
Checks: C-31715r1_chk

1. Open a terminal session and enter the following command: ls -ls /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent 2. Ensure the file permissions are set to -rwxr-xr-x. If the permission is not the same or more restrictive, then this is a finding.

Fix: F-28201r1_fix

1. Open a terminal session and enter the following command: chmod 755 /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent

b
OSX00220-Remove setuid bit from WebDAV Web Services
Medium - V-25284 - SV-31365r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00220
Vuln IDs
  • V-25284
Rule IDs
  • SV-31365r1_rule
Because attackers try to influence or co-opt the execution of setuid programs in order to try to elevate their privileges, there is benefit in removing the setuid bit from programs that may not need it. There is also benefit in restricting to administrators the right to execute a setuid program. System AdministratorECCD-1, ECCD-2
Checks: C-31716r1_chk

1. Open a terminal session and enter the following command: ls -ls /System/Library/Extensions/webdav_fs.kext/Contents/Resources/load_webdav 2. Ensure the file permissions are set to -rwxr-xr-x. If the permission is not the same or more restrictive, then this is a finding.

Fix: F-28202r1_fix

1. Open a terminal session and enter the following command: chmod 755 /System/Library/Extensions/webdav_fs.kext/Contents/Resources/load_webdav

b
OSX00225-Remove setuid bit from Apple File Protocol.
Medium - V-25285 - SV-31367r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00225
Vuln IDs
  • V-25285
Rule IDs
  • SV-31367r1_rule
Because attackers try to influence or co-opt the execution of setuid programs in order to try to elevate their privileges, there is benefit in removing the setuid bit from programs that may not need it. There is also benefit in restricting to administrators the right to execute a setuid program. System AdministratorECCD-1, ECCD-2
Checks: C-31717r1_chk

1. Open a terminal session and enter the following command: ls -ls /System/Library/Filesystems/AppleShare/afpLoad 2. Ensure the file permissions are set to -rwxr-xr-x. If the permission is not the same or more restrictive, then this is a finding.

Fix: F-28203r1_fix

1. Open a terminal session and enter the following command: chmod 755 /System/Library/Filesystems/AppleShare/afpLoad

b
OSX00230-Remove setuid bit from Apple File Protocol Sharing
Medium - V-25286 - SV-31369r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00230
Vuln IDs
  • V-25286
Rule IDs
  • SV-31369r1_rule
Because attackers try to influence or co-opt the execution of setuid programs in order to try to elevate their privileges, there is benefit in removing the setuid bit from programs that may not need it. There is also benefit in restricting to administrators the right to execute a setuid program. System AdministratorECCD-1, ECCD-2
Checks: C-31718r1_chk

1. Open a terminal session and enter the following command: ls -ls /System/Library/Filesystems/AppleShare/check_afp.app/Contents/MacOS/check_afp 2. Ensure the file permissions are set to -rwx--x--x. If the permission is not the same or more restrictive, then this is a finding.

Fix: F-28204r1_fix

1. Open a terminal session and enter the following command: chmod 711 /System/Library/Filesystems/AppleShare/check_afp.app/Contents/MacOS/check_afp

b
OSX00235-Remove setuid bit from dumpemacs
Medium - V-25287 - SV-31371r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00235
Vuln IDs
  • V-25287
Rule IDs
  • SV-31371r1_rule
Because attackers try to influence or co-opt the execution of setuid programs in order to try to elevate their privileges, there is benefit in removing the setuid bit from programs that may not need it. There is also benefit in restricting to administrators the right to execute a setuid program. System AdministratorECCD-1, ECCD-2
Checks: C-31719r1_chk

1. Open a terminal session and enter the following command: ls -ls /usr/libexec/dumpemacs 2. Ensure the file permissions are set to -r-xr-xr-x. If the permission is not the same or more restrictive, then this is a finding.

Fix: F-28205r1_fix

1. Open a terminal session and enter the following command: chmod 555 /usr/libexec/dumpemacs

b
OSX00240-Remove setuid bit from XGrid
Medium - V-25288 - SV-31373r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00240
Vuln IDs
  • V-25288
Rule IDs
  • SV-31373r1_rule
Because attackers try to influence or co-opt the execution of setuid programs in order to try to elevate their privileges, there is benefit in removing the setuid bit from programs that may not need it. There is also benefit in restricting to administrators the right to execute a setuid program. System AdministratorECCD-1, ECCD-2
Checks: C-31720r1_chk

1. Open a terminal session and enter the following command: ls -ls /usr/libexec/xgrid/IdleTool 2. Ensure the file permissions are set to -r-xr-xr-x. If the permission is not the same or more restrictive, then this is a finding.

Fix: F-28206r1_fix

1. Open a terminal session and enter the following command: chmod 555 /usr/libexec/xgrid/IdleTool

b
OSX00245-Remove setuid bit from Hosting VPN Services
Medium - V-25289 - SV-31375r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00245
Vuln IDs
  • V-25289
Rule IDs
  • SV-31375r1_rule
Because attackers try to influence or co-opt the execution of setuid programs in order to try to elevate their privileges, there is benefit in removing the setuid bit from programs that may not need it. There is also benefit in restricting to administrators the right to execute a setuid program. System AdministratorECCD-1, ECCD-2
Checks: C-31722r1_chk

1. Open a terminal session and enter the following command: ls -ls /usr/sbin/vpnd 2. Ensure the file permissions are set to -r-xr-xr-x. If the permission is not the same or more restrictive, then this is a finding.

Fix: F-28208r1_fix

1. Open a terminal session and enter the following command: chmod 555 /usr/sbin/vpnd

b
OSX00250-Remove setuid bit from Network Configuration
Medium - V-25290 - SV-31377r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00250
Vuln IDs
  • V-25290
Rule IDs
  • SV-31377r1_rule
Because attackers try to influence or co-opt the execution of setuid programs in order to try to elevate their privileges, there is benefit in removing the setuid bit from programs that may not need it. There is also benefit in restricting to administrators the right to execute a setuid program. System AdministratorECCD-1, ECCD-2
Checks: C-31723r1_chk

1. Open a terminal session and enter the following command: ls -ls /sbin/route 2. Ensure the file permissions are set to -r-xr-xr-x. If the permission is not the same or more restrictive, then this is a finding.

Fix: F-28209r1_fix

1. Open a terminal session and enter the following command: chmod 555 /sbin/route

b
OSX00255-Remove setuid bit from IPC Statistics
Medium - V-25291 - SV-31379r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00255
Vuln IDs
  • V-25291
Rule IDs
  • SV-31379r1_rule
Because attackers try to influence or co-opt the execution of setuid programs in order to try to elevate their privileges, there is benefit in removing the setuid bit from programs that may not need it. There is also benefit in restricting to administrators the right to execute a setuid program. System AdministratorECCD-1, ECCD-2
Checks: C-31724r1_chk

1. Open a terminal session and enter the following command: ls -ls /usr/bin/ipcs 2. Ensure the file permissions are set to -r-x--x--x. If the permission is not the same or more restrictive, then this is a finding.

Fix: F-28210r1_fix

1. Open a terminal session and enter the following command: chmod 511 /usr/bin/ipcs

b
OSX00260-Remove setuid bit from Remote Access (unsecure)
Medium - V-25292 - SV-31381r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00260
Vuln IDs
  • V-25292
Rule IDs
  • SV-31381r1_rule
Because attackers try to influence or co-opt the execution of setuid programs in order to try to elevate their privileges, there is benefit in removing the setuid bit from programs that may not need it. There is also benefit in restricting to administrators the right to execute a setuid program. System AdministratorECCD-1, ECCD-2
Checks: C-31725r1_chk

1. Open a terminal session and enter the following command: ls -ls /bin/rcp 2. Ensure the file permissions are set to -r-xr-xr-x. If the permission is not the same or more restrictive, then this is a finding.

Fix: F-28211r1_fix

1. Open a terminal session and enter the following command: chmod 555 /bin/rcp

b
OSX00265-Remove setuid bit from Remote Access (unsecure rlogin)
Medium - V-25293 - SV-31383r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00265
Vuln IDs
  • V-25293
Rule IDs
  • SV-31383r1_rule
Because attackers try to influence or co-opt the execution of setuid programs in order to try to elevate their privileges, there is benefit in removing the setuid bit from programs that may not need it. There is also benefit in restricting to administrators the right to execute a setuid program. System AdministratorECCD-1, ECCD-2
Checks: C-31726r1_chk

1. Open a terminal session and enter the following command: ls -ls /usr/bin/rlogin 2. Ensure the file permissions are set to -r-xr-xr-x. If the permission is not the same or more restrictive, then this is a finding.

Fix: F-28212r1_fix

1. Open a terminal session and enter the following command: chmod 555 /usr/bin/rlogin

b
OSX00270-Remove setuid bit from Remote Access (rsh unsecure)
Medium - V-25294 - SV-31385r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00270
Vuln IDs
  • V-25294
Rule IDs
  • SV-31385r1_rule
Because attackers try to influence or co-opt the execution of setuid programs in order to try to elevate their privileges, there is benefit in removing the setuid bit from programs that may not need it. There is also benefit in restricting to administrators the right to execute a setuid program. System AdministratorECCD-1, ECCD-2
Checks: C-31727r1_chk

1. Open a terminal session and enter the following command: ls -ls /usr/bin/rsh 2. Ensure the file permissions are set to -r-xr-xr-x. If the permission is not the same or more restrictive, then this is a finding.

Fix: F-28213r1_fix

1. Open a terminal session and enter the following command: chmod 555 /usr/bin/rsh

b
OSX00275-Remove setuid bit from System Activity Reporting
Medium - V-25295 - SV-31387r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00275
Vuln IDs
  • V-25295
Rule IDs
  • SV-31387r1_rule
Because attackers try to influence or co-opt the execution of setuid programs in order to try to elevate their privileges, there is benefit in removing the setuid bit from programs that may not need it. There is also benefit in restricting to administrators the right to execute a setuid program. System AdministratorECCD-1, ECCD-2
Checks: C-31728r1_chk

1. Open a terminal session and enter the following command: ls -ls /usr/lib/sa/sadc 2. Ensure the file permissions are set to -r-xr-xr-x. If the permission is not the same or more restrictive, then this is a finding.

Fix: F-28214r1_fix

1. Open a terminal session and enter the following command: chmod 555 /usr/lib/sa/sadc

a
OSX00280-Set the correct date and time
Low - V-25296 - SV-31389r1_rule
RMF Control
Severity
Low
CCI
Version
OSX00280
Vuln IDs
  • V-25296
Rule IDs
  • SV-31389r1_rule
Correct date and time settings are required for authentication protocols, like Kerberos. Incorrect date and time settings can cause security issues. System AdministratorECSC-1
Checks: C-31729r1_chk

1. Open System Preferences->Date&Time Panel. 2. Ensure the correct date and time is set. If the date and time are not correct, then this is a finding.

Fix: F-28215r1_fix

1. Open System Preferences->Date&Time Panel. 2. Set the correct date and time.

a
OSX00285-Set a secure time server
Low - V-25297 - SV-31391r1_rule
RMF Control
Severity
Low
CCI
Version
OSX00285
Vuln IDs
  • V-25297
Rule IDs
  • SV-31391r1_rule
Correct date and time settings are required for authentication protocols, like Kerberos. Incorrect date and time settings can cause security issues. You can use Date & Time preferences to set the date and time based on a Network Time Protocol (NTP) server. If you require automatic date and time, use a trusted, internal NTP server. System AdministratorECSC-1
Checks: C-31730r1_chk

1. Open System Preferences->Date&Time Panel. 2. Ensure "Set date & time automatically" is selected. 3. In the box for the time server, ensure either the URL or the address of a valid federal government NTP server or the URL or address of a local domain controller is entered.

Fix: F-28216r1_fix

1. Open System Preferences> Date&Time Panel. 2. Select "Set date & time automatically". 3. In the box for the time server, type either the URL or IP address of a valid federal government NTP server or local domain controller.

b
OSX00290-Disable Auto Update feature
Medium - V-25298 - SV-31393r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00290
Vuln IDs
  • V-25298
Rule IDs
  • SV-31393r1_rule
You should install and verify updates on a test computer before installing them on your operational computer. When you install a software update using Software Update or an installer package, you must authenticate with an administrator’s name and password. This reduces the chance of accidental or malicious installation of software updates.System AdministratorECSC-1
Checks: C-31731r1_chk

1. Open System Preferences->Software Updates. 2. Click the Scheduled Check pane. 3. Ensure the “Check for updates" and “Download important updates automatically” options are unchecked. If the options are checked, then this is a finding. Command Procedures: 1. Open a terminal session and enter the following command: softwareupdate --schedule 2. Verify 'Automatic check' is off. If the option is not off, then this is a finding.

Fix: F-28217r1_fix

1. Open System Preferences->Software Updates. 2. Click the Scheduled Check pane. 3. Deselect “Check for updates" and “Download important updates automatically”. Command Procedues: Open a terminal session and enter the following command to disable auto update feature: softwareupdate --schedule off

b
OSX00295-Disable Guest Account login
Medium - V-25299 - SV-31395r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00295
Vuln IDs
  • V-25299
Rule IDs
  • SV-31395r1_rule
The guest account is used to give a user temporary access to your computer. The guest account should be disabled by default because it does not require a password to log in on the computer. If this account is enabled and not securely configured, malicious users can gain access to your computer without the use of a password. System AdministratorIAAC-1
Checks: C-31732r1_chk

1. Open System Preferences->Accounts Panel. 2. Click on Guest Account 3. Ensure "Allow guests to login to this computer" option is unchecked. If the option is checked, then this is a finding.

Fix: F-28218r1_fix

1. Open System Preferences->Accounts Panel. 2. Click on Guest Account 3. Deselect "Allow guests to login to this computer".

b
OSX00300-Do not allow guests to connect to shared folders
Medium - V-25300 - SV-31397r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00300
Vuln IDs
  • V-25300
Rule IDs
  • SV-31397r1_rule
Whether or not the guest account itself is enabled, disable guest account access to shared files and folders by deselecting the “Allow guest to connect to shared folders” checkbox. If you permit the guest account to access shared folders, an attacker can easily attempt to access shared folders without a password.System AdministratorECAN-1, ECSC-1
Checks: C-31733r1_chk

1. Open System Preferences->Accounts Panel. 2. Click on Guest Account. 3. Ensure "Allow Guests to connect to shared folders" option is unchecked. If the option is checked, then this is a finding.

Fix: F-28219r1_fix

1. Open System Preferences->Accounts Panel. 2. Click on Guest Account. 3. Deselect "Allow Guests to connect to shared folders".

b
OSX00310-Configure Login Window to display as entry for name and password.
Medium - V-25302 - SV-31401r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00310
Vuln IDs
  • V-25302
Rule IDs
  • SV-31401r1_rule
If not properly configured, the logon screen provides a list of local usernames available for logon. A user could use this information to attempt to login as a different user. System AdministratorECSC-1
Checks: C-31736r1_chk

1. Open System Preferences->Accounts Panel. 2. Select Login Options. 3. Ensure "Display login window as:" is set to "Name & password". If the option is not set to "Name & Password", then this is a finding.

Fix: F-28222r1_fix

1. Open System Preferences->Accounts Panel. 2. Select Login Options. 3. Set "Display login window as:" to 'Name & password'.

a
OSX00315-Do not show the Restart, Sleep, and Shutdown buttons
Low - V-25303 - SV-31403r1_rule
RMF Control
Severity
Low
CCI
Version
OSX00315
Vuln IDs
  • V-25303
Rule IDs
  • SV-31403r1_rule
By disabling this button, the user cannot restart the computer without pressing the power key or logging in. System AdministratorECSC-1
Checks: C-31737r1_chk

1. Open System Preferences->Accounts Panel. 2. Select Login Options. 3. Ensure the "Show the Restart, Sleep, and Shutdown buttons" option is not checked. If the option is checked, then this is a finding.

Fix: F-28223r1_fix

1. Open System Preferences->Accounts Panel. 2. Select Login Options. 3. Deselect the "Show the Restart, Sleep, and Shutdown buttons" to disable this option.

c
OSX00320-Do not show Input menu in login window
High - V-25304 - SV-31405r1_rule
RMF Control
Severity
High
CCI
Version
OSX00320
Vuln IDs
  • V-25304
Rule IDs
  • SV-31405r1_rule
Showing input menu in the login window could compromise the integrity of the information, and could also allow someone shoulder surfing to gain unauthorized access to the system.System AdministratorIAAC-1
Checks: C-31739r1_chk

1. Open System Preferences->Accounts Panel. 2. Select Login Options. 3. Ensure the "Show input menu in login window" is not checked. If the option is checked, then this is a finding.

Fix: F-28224r1_fix

1. Open System Preferences->Accounts Panel. 2. Select Login Options. 3. Deselect "Show input menu in login window" to disable this option.

c
OSX00325-Do not show password hints
High - V-25305 - SV-31407r1_rule
RMF Control
Severity
High
CCI
Version
OSX00325
Vuln IDs
  • V-25305
Rule IDs
  • SV-31407r1_rule
Providing information in the password hint field could compromise the integrity of the password. Showing password hint could allow someone shoulder surfing to gain information that could lead to unauthorized access to the system. System AdministratorIAAC-1
Checks: C-31740r1_chk

1. Open System Preferences->Accounts Panel. 2. Select Login Options. 3. Ensure the "Show password hints" is not checked. If the option is checked, then this is a finding.

Fix: F-28225r1_fix

1. Open System Preferences->Accounts Panel. 2. Select Login Options. 3. Deselect "Show password hints" to disable this option.

b
OSX00330-Disable Fast User Switching
Medium - V-25306 - SV-31409r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00330
Vuln IDs
  • V-25306
Rule IDs
  • SV-31409r1_rule
Fast User Switching allows multiple users to log in simultaneously. This makes it difficult to track user actions and allows users to run malicious applications in the background while another user is using the computer.System AdministratorIAAC-1
Checks: C-31741r1_chk

1. Open System Preferences->Accounts Panel. 2. Select Login Options. 3. Ensure the "Enable Fast User Switching" is not checked. If the option is checked, then this is a finding.

Fix: F-28226r1_fix

1. Open System Preferences->Accounts Panel. 2. Select Login Options. 3. Deselect "Enable Fast User Switching" to disable this option.

c
OSX00335-Do not use password-related hint field
High - V-25307 - SV-31411r1_rule
RMF Control
Severity
High
CCI
Version
OSX00335
Vuln IDs
  • V-25307
Rule IDs
  • SV-31411r1_rule
If a hint is provided, the user is presented with the hint after three failed authentication attempts. Password-related information provided in the field could compromise the integrity of the password. Adding contact information for your organization’s technical support is convenient and doesn’t compromise password integrity.System AdministratorIAAC-1
Checks: C-31742r1_chk

1. Open System Preferences->Accounts Panel, for each account. 2. Click 'reset password' (Change Password for current user). 3. Ensure no data exists in the password hints field. 4. Click Cancel. If any accounts have hints data, then this is a finding. Note: The password Hints Field may include contact information for the organization's technical support.

Fix: F-28227r1_fix

1. Open System Preferences -> Accounts Panel, for each account. 2. Click 'reset password' (Change Password for current user). 3. Remove any data that exists in the password hints field. Note: The password Hints Field may include contact information for the organization's technical support.

c
OSX00340-Do not allow computer to perform automatic actions for blank CD
High - V-25308 - SV-31413r1_rule
RMF Control
Severity
High
CCI
Version
OSX00340
Vuln IDs
  • V-25308
Rule IDs
  • SV-31413r1_rule
To secure CDs and DVDs (blank), do not allow the computer to perform automatic actions when the user inserts a disc. When you disable automatic actions in System Preferences, you must disable these actions for every user account on the computer.System AdministratorECSC-1
Checks: C-31743r1_chk

1. Open System Preferences - > CDs and DVDs. 2. Ensure "When you insert a blank CD:" is set to 'Ignore'. If the option is not set to "Ignore", then this is a finding.

Fix: F-28228r1_fix

1. Open System Preferences - > CDs and DVDs. 2. Set "When you insert a blank CD:" to 'Ignore'.

c
OSX00345-Do not allow computer to perform automatic actions for music CD
High - V-25309 - SV-31415r1_rule
RMF Control
Severity
High
CCI
Version
OSX00345
Vuln IDs
  • V-25309
Rule IDs
  • SV-31415r1_rule
To secure CDs and DVDs (music), do not allow the computer to perform automatic actions when the user inserts a disc. When you disable automatic actions in System Preferences, you must disable these actions for every user account on the computer. System AdministratorECSC-1
Checks: C-31744r1_chk

1. Open System Preferences - > CDs and DVDs. 2. Ensure "When you insert a music CD:" is set to 'Ignore'. If the option is not set to "Ignore", then this is a finding.

Fix: F-28229r1_fix

1. Open System Preferences - > CDs and DVDs. 2. Set "When you insert a music CD:" to 'Ignore'.

c
OSX00350-Do not allow computer to perform automatic actions for picture CD.
High - V-25310 - SV-31417r1_rule
RMF Control
Severity
High
CCI
Version
OSX00350
Vuln IDs
  • V-25310
Rule IDs
  • SV-31417r1_rule
To secure CDs and DVDs (pictures), do not allow the computer to perform automatic actions when the user inserts a disc. When you disable automatic actions in System Preferences, you must disable these actions for every user account on the computer.System AdministratorECSC-1
Checks: C-31745r1_chk

1. Open System Preferences - > CDs and DVDs. 2. Ensure "When you insert a picture CD:" is set to 'Ignore'. If the option is not set to "Ignore", then this is a finding.

Fix: F-28230r1_fix

1. Open System Preferences - > CDs and DVDs. 2. Set "When you insert a picture CD:" to 'Ignore'.

c
OSX00355-Do not allow computer to perform automatic actions for video DVD
High - V-25311 - SV-31419r1_rule
RMF Control
Severity
High
CCI
Version
OSX00355
Vuln IDs
  • V-25311
Rule IDs
  • SV-31419r1_rule
To secure CDs and DVDs (video), do not allow the computer to perform automatic actions when the user inserts a disc. When you disable automatic actions in System Preferences, you must disable these actions for every user account on the computer. System AdministratorECSC-1
Checks: C-31746r1_chk

1. Open System Preferences - > CDs and DVDs. 2. Ensure "When you insert a video DVD:" is set to 'Ignore'. If the option is not set to "Ignore", then this is a finding.

Fix: F-28231r1_fix

1. Open System Preferences - > CDs and DVDs. 2. Set "When you insert a video DVD:" to 'Ignore'.

b
OSX00360-System must have a password-protected Screen Saver configured to DoD requirements.
Medium - V-25312 - SV-31421r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00360
Vuln IDs
  • V-25312
Rule IDs
  • SV-31421r1_rule
You need to configure a password-protected screen saver to prevent unauthorized users from accessing unattended computers. You should also set a short inactivity interval to decrease the amount of time the unattended computer is unlocked. This check has two steps, the first step is to turn on the screen saver option and set it to 15 minutes or less, the second step is to require a password to unlock the screen saver.System AdministratorPESL-1
Checks: C-31747r1_chk

Open System Preferences->Desktop & Screen Saver. Select the screen saver tab. Ensure the "Start screen saver" slider is set to 15 minutes or less. If not, then this is a finding.

Fix: F-28232r1_fix

Open System Preferences->Desktop & Screen Saver. Select the screen saver tab. Set the 'Start screen saver" slider to 15 minutes or less.

b
OSX00370-Do not allow computer to restart after a power failure.
Medium - V-25314 - SV-31425r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00370
Vuln IDs
  • V-25314
Rule IDs
  • SV-31425r1_rule
You can also use the Options pane to make settings depending on your power supply (power adapter, UPS, or battery). Don’t set the computer to restart after a power failure. System AdministratorECSC-1
Checks: C-31749r1_chk

1. Open System Preferences - > Energy Saver - > Options Pane. 2. Ensure "Restart automatically after a power failure" is not checked. If the option is checked, then this is a finding. Note: For some Mac Books systems the "Restart automatically after a power failure" option is located on the "Power Adapter" pane.

Fix: F-28234r1_fix

1. Open System Preferences - > Energy Saver - > Options Pane. 2. Deselect "Restart automatically after a power failure" to disable this option. Note: For some Mac Books systems the "Restart automatically after a power failure" option is located on the "Power Adapter" pane.

b
OSX00375-Do not allow computer to use corners to disable the screen saver.
Medium - V-25317 - SV-31429r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00375
Vuln IDs
  • V-25317
Rule IDs
  • SV-31429r1_rule
Your computer should require authentication when waking from sleep or screen saver. You can configure Exposé & Spaces preferences to allow you to quickly start the screen saver if you move your mouse cursor to a corner of the screen. Don’t configure a corner to disable the screen saver.System AdministratorPESL-1
Checks: C-31752r1_chk

1. Open System Preferences->Exposé & Spaces, Exposé pane. 2. Ensure no corners are set to "Disable Screen saver" in the 'Active Screen Corners' section for each user account. If any account is set to disable screen savers via corners, then this is a finding.

Fix: F-28237r1_fix

1. Open System Preferences->Exposé & Spaces, Exposé pane. 2. Remove any corners which are set to "Disable Screen saver" in the 'Active Screen Corners' section for each user account.

b
OSX00380-Do not allow Bluetooth devices to wake the computer.
Medium - V-25318 - SV-31431r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00380
Vuln IDs
  • V-25318
Rule IDs
  • SV-31431r1_rule
If Bluetooth is not required, turn it off. If Bluetooth is necessary, disable allowing Bluetooth devices to wake the computer. System AdministratorECSC-1
Checks: C-31753r1_chk

1. Open System Preferences -> Open Keyboard & Mouse preferences. 2. Click Bluetooth tab. 3. Ensure “Allow Bluetooth devices to wake this computer” is not checked. If the option is checked, then this is a finding.

Fix: F-28239r1_fix

1. Open System Preferences -> Keyboard & Mouse preferences. 2. Click Bluetooth tab. 3. Deselect “Allow Bluetooth devices to wake this computer”.

b
OSX00385-Disable unused hardware devices for Airport
Medium - V-25320 - SV-31434r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00385
Vuln IDs
  • V-25320
Rule IDs
  • SV-31434r1_rule
It is recommended that you disable unused hardware devices listed in Network preferences. Enabled, unused devices (such as AirPort and Bluetooth) are a security risk. Hardware is listed in Network preferences only if the hardware is installed in the computer. System AdministratorECSC-1
Checks: C-31755r1_chk

1. Open System Preferences - > Network. 2. From the list of hardware devices, select AirPort. 3. Ensure the 'Status' is set to 'Inactive'. If the service is not inactive or removed, then this is a finding.

Fix: F-28240r1_fix

1. Open System Preferences - > Network. 2. From the list of hardware devices, select AirPort. 3. Set this service to 'Inactive' by clicking the gear sign and selecting "Make Service Inactive". Remove service if required by site requirements by clicking the minus sign. (From the "Configure" pop-up menu, choose 'Manually'.)

b
OSX00390-Disable unused hardware devices for Bluetooth
Medium - V-25321 - SV-31436r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00390
Vuln IDs
  • V-25321
Rule IDs
  • SV-31436r1_rule
It is recommend that you disable unused hardware devices listed in Network preferences. Enabled, unused devices (such as AirPort and Bluetooth) are a security risk. Hardware is listed in Network preferences only if the hardware is installed in the computer. System AdministratorECSC-1
Checks: C-31756r1_chk

1. Open System Preferences - > Network. 2. From the list of hardware devices, select Bluetooth. 3. Ensure the "Status" is set to 'Inactive'. If the service is not inactive or removed, then this is a finding.

Fix: F-28242r1_fix

1. Open System Preferences - > Network. 2. From the list of hardware devices, select Bluetooth. 3. Set this service to Inactive by clicking the gear sign and selecting "Make Service Inactive". Remove service if required by site requirements by clicking the minus sign. (From the "Configure" pop-up menu, choose 'Manually'.)

b
OSX00395-Disable unused hardware devices for Firewire
Medium - V-25323 - SV-31439r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00395
Vuln IDs
  • V-25323
Rule IDs
  • SV-31439r1_rule
It is recommend that you disable unused hardware devices listed in Network preferences. Enabled, unused devices (Firewire) are a security risk. Hardware is listed in Network preferences only if the hardware is installed in the computer. System AdministratorECSC-1
Checks: C-31758r1_chk

1. Open System Preferences - > Network. 2. From the list of hardware devices, select Firewire. 3. Ensure the "Status" is set to 'Inactive'. If the service is not set to inactive or removed, then this is a finding.

Fix: F-28243r1_fix

1. Open System Preferences - > Network. 2. From the list of hardware devices, select Firewire. 3. Set this service to 'Inactive' by clicking the gear sign and selecting "Make Service Inactive". Remove service if required by site requirements by clicking the minus sign. (From the "Configure" pop-up menu, choose 'Manually'.)

b
OSX00400-Disable IPv6, if not being used.
Medium - V-25324 - SV-31441r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00400
Vuln IDs
  • V-25324
Rule IDs
  • SV-31441r1_rule
It is recommended that you disable unused hardware devices listed in Network preferences. Enabled, unused devices (such as AirPort and Bluetooth) are a security risk. Hardware is listed in Network preferences only if the hardware is installed in the computer. Note: this must be disabled on each network interface.System AdministratorECSC-1
Checks: C-31759r1_chk

1. Open System Preferences - > Network. 2. Click Advanced. 3. Click the TCP/IP tab 4. Ensure "Configure IPv6" is set to 'Off'. If option is not set to 'Off', then this is a finding. Note: this must be checked on all network interfaces.

Fix: F-28244r1_fix

1. Open System Preferences - > Network. 2. Click Advanced 3. CLick the TCP/IP tab and set "Configure IPv6" to 'Off', if not actively being used. Note: this must be disabled on each network interface.

b
OSX00405- Disable Auto play of movies.
Medium - V-25325 - SV-31443r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00405
Vuln IDs
  • V-25325
Rule IDs
  • SV-31443r1_rule
Allowing movies to play automatically will not allow the user to first perform an anti-virus scan of the files to detect malware or unauthorized code. System AdministratorECSC-1
Checks: C-31760r1_chk

1. Open System Preferences->QuickTime, Browser Pane. 2. Ensure "Play Movies Automatically" is not checked. If the option is checked, then this is a finding.

Fix: F-28245r1_fix

1. Open System Preferences->QuickTime, Browser Pane. 2. Deselect "Play Movies Automatically".

b
OSX00410-Disable disk cache of movies
Medium - V-25326 - SV-31445r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00410
Vuln IDs
  • V-25326
Rule IDs
  • SV-31445r1_rule
Only download QuickTime movies from trusted, secure sources. By default, QuickTime stores downloaded movies in a cache. If someone gains access to your account, he/she can see your previously viewed movies, even if you did not save them as files. You can change QuickTime preferences to disable the storing of movies in a cache (in /Users/user name/Library/Caches/QuickTime/downloads/). System AdministratorDCSL-1
Checks: C-31761r1_chk

1. Open System Preferences->QuickTime, Browser Pane. 2. Ensure "Save Movies in disk cache" is not checked. If option is checked, then this is a finding.

Fix: F-28246r1_fix

1. Open System Preferences->QuickTime, Browser Pane. 2. Deselect "Save Movies in disk cache".

b
OSX00415-Securely configure QuickTime Advanced preferences
Medium - V-25327 - SV-31447r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00415
Vuln IDs
  • V-25327
Rule IDs
  • SV-31447r1_rule
Securely configure QuickTime Advanced preferences, Load Flash and ensure if option is given under Advanced tab, confirm value to be checked (i.e., "Kiosk Mode" or "Kiosk Mode: Hides option to save movies & to change settings from within the web browser"). System AdministratorDCSL-1
Checks: C-31762r1_chk

1. Open System Preferences->QuickTime. 2. Click Advanced tab. 3. Ensure "Enable Kiosk Mode" is selected. If setting is not checked, then this is a finding.

Fix: F-28247r1_fix

1. Open System Preferences->QuickTime, Advanced Pane. 2. Select "Enable Kiosk Mode".

b
OSX00420-Require password to wake this computer from sleep or screen saver.
Medium - V-25328 - SV-31449r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00420
Vuln IDs
  • V-25328
Rule IDs
  • SV-31449r1_rule
Require a password to wake this computer from sleep or screen saver. This helps prevent unauthorized access on unattended computers. Although there is a lock button for Security references, users don’t need to be authorized as an administrator to make changes. Enable this password requirement for every user account on the computer.System AdministratorPESL-1
Checks: C-31763r1_chk

1. Open System Preferences->Security. 2 Select General tab. 3. Ensure "Require password to wake this computer from sleep or screen saver" is checked. If option is not checked, then this is a finding.

Fix: F-28248r1_fix

1. Open System Preferences->Security. 2 Select General tab. 3. Select "Require password to wake this computer from sleep or screen saver".

c
OSX00425-Disable automatic login
High - V-25329 - SV-31451r1_rule
RMF Control
Severity
High
CCI
Version
OSX00425
Vuln IDs
  • V-25329
Rule IDs
  • SV-31451r1_rule
Disabling automatic login is necessary for any level of security. If you enable automatic login, an intruder can log in without authenticating. Even if you automatically log in with a restricted user account, it is still easier to perform malicious actions on the computer. System AdministratorIAAC-1
Checks: C-31765r1_chk

1. Open System Preferences->Security. 2. Select General tab. 3. Ensure "Disable automatic login" option is checked. If option is not checked, then this is a finding.

Fix: F-28249r1_fix

1. Open System Preferences->Security. 2. Select General tab. 3. Select "Disable automatic login".

b
OSX00430-Require a password to unlock each System Preference Pane
Medium - V-25330 - SV-31453r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00430
Vuln IDs
  • V-25330
Rule IDs
  • SV-31453r1_rule
Some system preferences are unlocked when you log in with an administrator account. By requiring a password, digital token, smart card, or biometric reader to unlock secure system preferences, you require extra authentication. System AdministratorECSC-1
Checks: C-31766r1_chk

1. Open System Preferences->Security. 2. Select General tab. 3. Ensure "Require password to unlock each System Preferences Pane" is checked. If option is not checked, then this is a finding.

Fix: F-28250r1_fix

1. Open System Preferences->Security. 2. Select General tab. 3. Select "Require password to unlock each System Preferences Pane".

a
OSX00435-Disable Logout after X minutes of activity
Low - V-25331 - SV-31455r1_rule
RMF Control
Severity
Low
CCI
Version
OSX00435
Vuln IDs
  • V-25331
Rule IDs
  • SV-31455r1_rule
Although you might want to enable automatic logout based on inactivity, there are reasons why you should disable this feature. First, it can disrupt your workflow. Second, it can close applications or processes without your approval (but a password-protected screen saver will not close applications). Third, because automatic logout can be interrupted, it provides a false sense of security. System AdministratorECSC-1
Checks: C-31767r1_chk

1. Open System Preferences->Security. 2. Select General tab. 3. Ensure "Log out after x minutes of inactivity" is not checked. If it is checked, then this is afinding.

Fix: F-28251r1_fix

1. Open System Preferences->Security. 2. Select General tab. 3. Deselect "Log out after x minutes of inactivity".

b
OSX00440-Use secure virtual memory
Medium - V-25332 - SV-31457r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00440
Vuln IDs
  • V-25332
Rule IDs
  • SV-31457r1_rule
Use secure virtual memory. The system’s virtual memory swap file stores inactive physical memory contents, freeing your physical memory. By default on some systems, the swap file is unencrypted. This file can contain confidential data such as documents and passwords. By using secure virtual memory, you secure the swap file at a cost of slightly slower speed (because Mac OS X must encrypt and decrypt the secure swap file). System AdministratorECRC-1
Checks: C-31769r1_chk

1. Open System Preferences->Security. 2. Select General tab. 3. Ensure "Use Secure Virtual Memory" is checked. If option is not checked, then this is a finding.

Fix: F-28252r1_fix

1. Open System Preferences->Security. 2. Select General tab. 3. Select "Use Secure Virtual Memory".

b
OSX00445-Disable remote control infrared receiver.
Medium - V-25333 - SV-31459r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00445
Vuln IDs
  • V-25333
Rule IDs
  • SV-31459r1_rule
If you are not using a remote control, disable the infrared receiver. This prevents unauthorized users from controlling your computer through the infrared receiver. System AdministratorECSC-1
Checks: C-31771r1_chk

1. Open System Preferences->Security. 2. Select General tab. 3. Ensure "Disable remote control infrared receiver" is checked. If the option is not checked, then this is a finding.

Fix: F-28253r1_fix

1. Open System Preferences->Security. 2. Select General tab. 3. Select "Disable remote control infrared receiver".

b
OSX00450-Pair infrared receiver with a specific IR remote (if receiver was not disabled previously)
Medium - V-25334 - SV-31461r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00450
Vuln IDs
  • V-25334
Rule IDs
  • SV-31461r1_rule
If you use an Apple IR Remote Control, pair it to your computer by clicking Pair. When you pair it, no other IR remote can control your computer. IR receiver paired with a specific IR remote (if IR receiver was not disabled previously) System AdministratorECSC-1
Checks: C-31773r1_chk

If IR Receiver is disabled, then mark this check N/A. See V25333/OSX00445. If IR is enabled, then ensure it is paired to this computer by performing the following: 1. Open System Preferences->Security Pane. 2. Select General tab. 3. Ensure IR Remote Control is paired to this system.

Fix: F-28256r1_fix

1. Open System Preferences->Security Pane. 2. Select General tab. 3. Click "Pair" to pair IR Remote Control to this system.

b
OSX00455-Allow only essential services through firewall.
Medium - V-25335 - SV-31463r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00455
Vuln IDs
  • V-25335
Rule IDs
  • SV-31463r1_rule
Allowing only essential services through the firewall alleviates the potential for unwanted services to run on the system and cuts down on system usage. System AdministratorECND-1
Checks: C-31774r1_chk

1. Open System Preferences->Security. 2. Select Firewall tab. 3. Ensure "Set access for specific services and applications" is selected and only essential Services and Applications are listed in the 'Allow incoming connections' section. If not, then this is a finding. .

Fix: F-28257r1_fix

1. Open System Preferences->Security. 2. Select Firewall tab. 3. Select Set access for specific services and applications 4. Add only essential services and applications for incoming connections and remove unneeded services and applications.

b
OSX00460-Enable Firewall logging
Medium - V-25336 - SV-31465r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00460
Vuln IDs
  • V-25336
Rule IDs
  • SV-31465r1_rule
Enable Firewall Logging to provide information about firewall activity. System AdministratorECSC-1
Checks: C-31775r1_chk

1. Open System Preferences->Security. 2. Select Firewall tab. 3. Click on Advanced. 4. Ensure "Enable Firewall logging" is checked. If option is not checked, then this is a finding. Note: If the Mac OS X firewall has not been configured this setting will be unavailable.

Fix: F-28258r1_fix

1. Open System Preferences->Security. 2. Select Firewall tab. 3. Click on Advanced. 4. Select "Enable Firewall logging".

b
OSX00465-Enable Stealth Mode on the firewall (mobile platforms only)
Medium - V-25337 - SV-31467r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00465
Vuln IDs
  • V-25337
Rule IDs
  • SV-31467r1_rule
Enable Stealth Mode to prevent the computer from sending responses to uninvited traffic. System AdministratorECSC-1
Checks: C-31776r1_chk

This check applies to mobile platforms only. 1. Open System Preferences->Security. 2. Select Firewall tab. 3. Click on Advanced. 4. Ensure "Enable Stealth mode" is checked. If the option is not checked, then this is a finding.

Fix: F-28259r1_fix

1. Open System Preferences->Security. 2. Select Firewall tab. 3. Click on Advanced. 4. Select "Enable Stealth mode".

b
OSX00470-Do not allow DVD or CD Sharing
Medium - V-25338 - SV-31469r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00470
Vuln IDs
  • V-25338
Rule IDs
  • SV-31469r1_rule
Allows users of other computers to remotely use the DVD or CD drive on your computer. System AdministratorECCD-1
Checks: C-31777r1_chk

1. Open System Preferences->Sharing. 2. Ensure "DVD or CD Sharing" service does not have the 'On' box checked. If the box is checked, then this is a finding.

Fix: F-28260r1_fix

1. Open System Preferences->Sharing. 2. Uncheck the 'On' box for "DVD or CD Sharing" service.

b
OSX00475-Do not allow Screen Sharing
Medium - V-25339 - SV-31471r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00475
Vuln IDs
  • V-25339
Rule IDs
  • SV-31471r1_rule
Allows users of other computers to remotely view and control the computer. System AdministratorECCD-1
Checks: C-31779r1_chk

1. Open System Preferences->Sharing. 2. Ensure "Screen Sharing" service does not have the 'On' box checked. If the box is checked, then this is a finding.

Fix: F-28261r1_fix

1. Open System Preferences->Sharing. 2. Uncheck the 'On' box for "Screen Sharing" service.

b
OSX00480-Do not allow File Sharing
Medium - V-25340 - SV-31473r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00480
Vuln IDs
  • V-25340
Rule IDs
  • SV-31473r1_rule
Gives users of other computers access to each user’s Public folder. System AdministratorECCD-1
Checks: C-31780r1_chk

1. Open System Preferences->Sharing. 2. Ensure the "On'" box for "File Sharing" service is not checked. If the box is checked, then this is a finding.

Fix: F-28262r1_fix

1. Open System Preferences->Sharing. 2. Uncheck the "On" box for "File Sharing" service.

b
OSX00485-Do not allow Printer Sharing
Medium - V-25341 - SV-31475r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00485
Vuln IDs
  • V-25341
Rule IDs
  • SV-31475r1_rule
Allows other computers to access a printer connected to this computer. System AdministratorECCD-1
Checks: C-31781r1_chk

1. Open System Preferences->Sharing. 2. Ensure the "On'" box for "Printer Sharing" service is not checked. If the box is checked, then this is a finding.

Fix: F-28263r1_fix

1. Open System Preferences->Sharing. 2. Uncheck the "On" box for "Printer Sharing" service.

b
OSX00490-Do not allow Web Sharing
Medium - V-25342 - SV-31477r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00490
Vuln IDs
  • V-25342
Rule IDs
  • SV-31477r1_rule
Allows a network user to view websites located in /Sites. System AdministratorECCD-1
Checks: C-31782r1_chk

1. Open System Preferences->Sharing. 2. Ensure the "On'" box for "Web Sharing" service is not checked. If the box is checked, then this is a finding.

Fix: F-28264r1_fix

1. Open System Preferences->Sharing. 2. Uncheck the "On" box for "Web Sharing" service.

b
OSX00495-Do not allow Remote Login
Medium - V-25343 - SV-31479r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00495
Vuln IDs
  • V-25343
Rule IDs
  • SV-31479r1_rule
This feature allows users to access the computer remotely.System AdministratorECCD-1
Checks: C-31783r1_chk

1. Open System Preferences->Sharing. 2. Ensure the "On'" box for "Remote Login" service is not checked. If the box is checked, then this is a finding.

Fix: F-28265r1_fix

1. Open System Preferences->Sharing. 2. Uncheck the "On" box for "Remote Login" service.

b
OSX00500-Do not allow Remote Management
Medium - V-25346 - SV-31483r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00500
Vuln IDs
  • V-25346
Rule IDs
  • SV-31483r1_rule
Allows the computer to be accessed using Apple Remote Desktop. System AdministratorECCD-1
Checks: C-31784r1_chk

1. Open System Preferences->Sharing. 2. Ensure the "On'" box for "Remote Management" service is not checked. If the box is checked, then this is a finding.

Fix: F-28271r1_fix

1. Open System Preferences->Sharing. 2. Uncheck the "On" box for "Remote Management" service.

b
OSX00505-Do not allow system to receive Remote Apple Events from other computers.
Medium - V-25348 - SV-31486r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00505
Vuln IDs
  • V-25348
Rule IDs
  • SV-31486r1_rule
Allows the computer to receive Apple events from other computers. System AdministratorECCD-1
Checks: C-31785r1_chk

1. Open System Preferences->Sharing. 2. Ensure the "On'" box for "Remote Apple Events" service is not checked. If the box is checked, then this is a finding.

Fix: F-28272r1_fix

1. Open System Preferences->Sharing. 2. Uncheck the "On" box for "Remote Apple Events" service.

b
OSX00510-Do not allow Xgrid Sharing
Medium - V-25349 - SV-31488r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00510
Vuln IDs
  • V-25349
Rule IDs
  • SV-31488r1_rule
Allows computers on a network to work together in a grid to process a job. System AdministratorECCD-1
Checks: C-31786r1_chk

1. Open System Preferences->Sharing. 2. Ensure the "On'" box for "Xgrid Sharing" service is not checked. If the box is checked, then this is a finding.

Fix: F-28273r1_fix

1. Open System Preferences->Sharing. 2. Uncheck the "On" box for "Xgrid Sharing" service.

b
OSX00515-Do not allow Internet Sharing
Medium - V-25350 - SV-31490r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00515
Vuln IDs
  • V-25350
Rule IDs
  • SV-31490r1_rule
Allows other users to connect with computers on your local network, through your Internet connection. System AdministratorECCD-1
Checks: C-31787r1_chk

1. Open System Preferences->Sharing. 2. Ensure the "On'" box for "Internet Sharing" service is not checked. If the box is checked, then this is a finding.

Fix: F-28275r1_fix

1. Open System Preferences->Sharing. 2. Uncheck the "On" box for "Internet Sharing" service.

b
OSX00520-Do not allow Bluetooth Sharing
Medium - V-25351 - SV-31492r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00520
Vuln IDs
  • V-25351
Rule IDs
  • SV-31492r1_rule
Allows other Bluetooth-enabled computers and devices to share files with your computer. System AdministratorECCD-1, ECWN-1
Checks: C-31788r1_chk

1. Open System Preferences->Sharing. 2. Ensure the "On'" box for "Bluetooth Sharing" service is not checked. If the box is checked, then this is a finding.

Fix: F-28276r1_fix

1. Open System Preferences->Sharing. 2. Uncheck the "On" box for "Bluetooth Sharing" service.

b
OSX00525-Configure Mail using SSL
Medium - V-25354 - SV-31496r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00525
Vuln IDs
  • V-25354
Rule IDs
  • SV-31496r1_rule
When setting up user mail accounts, select "use SSL" in advanced options. This setting is for the Mail app included with OS X. Instructions will be different for other mail applications, but all mail applications should be set up secured using some form of encryption. Note: if you are not using the Mac Mail application this check does not apply. System AdministratorECCT-1, ECCT-2
Checks: C-31789r1_chk

1. Choose Mail > Preferences, and then click Accounts. 2. Select an account, and then click Advanced. 3. Ensure "Use SSL" is selected. 4. From the Authentication pop-up menu, ensure an authentication method is selected (e.g., MD5 Challenge-Response, NTLM, Kerberos Version 5 (GSSAPI), or Authenticated POP (APOP)). 5. Click Account Information. 6. From the Outgoing Mail Server (SMTP) pop-up menu, select Edit Server List. 7. From the server list, select your outgoing mail server, and then click Advanced. 8. Ensure Secure Socket Layer (SSL) is selected. 9. From the Authentication pop-up menu, ensure an authentication method is selected (e.g., MD5 Challenge-Response, NTLM, or Kerberos Version 5 (GSSAPI)). Note: if you are not using the Mac Mail Application is check does not apply.

Fix: F-28278r1_fix

1. Choose Mail > Preferences, and then click Accounts. 2. Select an account, and then click Advanced. 3. Select "Use SSL". 4. From the Authentication pop-up menu, select authentication method (e.g., MD5 Challenge-Response, NTLM, Kerberos Version 5 (GSSAPI), or Authenticated POP (APOP)). 5. Click Account Information. 6. From the Outgoing Mail Server (SMTP) pop-up menu, select Edit Server List. 7. From the server list, select your outgoing mail server and then click Advanced. 8. Select "Secure Socket Layer (SSL)". 9. From the Authentication pop-up menu, select authentication method (e.g., MD5 Challenge-Response, NTLM, or Kerberos Version 5 (GSSAPI)). 10. Close the preferences window, and then click Save in the message that appears.

a
OSX00530-Disable iTunes Store
Low - V-25355 - SV-31498r1_rule
RMF Control
Severity
Low
CCI
Version
OSX00530
Vuln IDs
  • V-25355
Rule IDs
  • SV-31498r1_rule
iTunes store allows a user to purchase and download music, videos, and podcasts, which could inadvertently introduce malware on the system. Note: the fix must be performed for each user. System AdministratorECSC-1
Checks: C-31790r1_chk

Open Finder, Select Applications, Double click the iTunes application, On the top menu bar click iTunes and from the drop down menu select Preferences, Click on the Parental icon, Verify the Disable iTunes Store is checked, if not then this is a finding

Fix: F-28280r1_fix

Open Finder, Select Applications, Double click the iTunes application, On the top menu bar click iTunes and from the drop down menu select Preferences, Click on the Parental icon, Click on the Disable iTunes Store option. Note: This must be performed for each user.

a
OSX00535-Set Finder to always empty Trash securely
Low - V-25356 - SV-31500r1_rule
RMF Control
Severity
Low
CCI
Version
OSX00535
Vuln IDs
  • V-25356
Rule IDs
  • SV-31500r1_rule
In Mac OS X Leopard, you can configure Finder to always securely erase items placed in the Trash. This prevents data you’ve placed in the Trash from being restored.System AdministratorECRC-1
Checks: C-31791r1_chk

1. Open Finder-> Preferences -> Advanced. 2. Ensure "Empty Trash Securely" is checked. If the option is not checked, then this is a finding. This must be done for each user on the system.

Fix: F-28281r1_fix

1. Open Finder-> Preferences -> Advanced. 2. Select "Empty Trash Securely". This must be done for each user on the system.

b
OSX00540-Remove iDisk from Finder sidebar
Medium - V-25358 - SV-31505r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00540
Vuln IDs
  • V-25358
Rule IDs
  • SV-31505r1_rule
Your iDisk data is stored on Internet servers and is protected by your MobileMe account. However, if your MobileMe account is accessed by an unauthorized user, your data can be compromised. Don’t store sensitive data on iDisk. Keep sensitive data local and encrypted on your computer.System AdministratorECRC-1
Checks: C-31792r1_chk

1 Open Finder > Preferences > Sidebar. 2. Ensure the iDisk icon is not selected. If the option is selected, then this is a finding. This must be done for each user on the system.

Fix: F-28282r1_fix

1 Open Finder -> Preferences -> Sidebar. 2. De-select the iDisk icon. This must be done for each user on the system.

b
OSX00565-Set strong password policy options for managed users
Medium - V-25366 - SV-31552r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00565
Vuln IDs
  • V-25366
Rule IDs
  • SV-31552r1_rule
Setting a strong password for managed users will deter intruders from easily guessing the password and will provide greater protection against masquerading. System AdministratorECPA-1
Checks: C-31817r1_chk

Verify with the SA that the site has a password policy. If the site does not have a password policy, then this is a finding.

Fix: F-28318r1_fix

The site must create a password policy that meets the requirements of the DoD information system.

c
OSX00655-Disable root administrator account
High - V-25371 - SV-31523r1_rule
RMF Control
Severity
High
CCI
Version
OSX00655
Vuln IDs
  • V-25371
Rule IDs
  • SV-31523r1_rule
The most powerful user account in Mac OS X is the system administrator or root account. By default, the root account on Mac OS X is disabled and it is recommended you do not enable it. The root account is primarily used for performing UNIX commands. Generally, actions that involve critical system files require you to perform those actions as root. System AdministratorIAAC-1
Checks: C-31799r1_chk

Open Finder Click Applications Click Utility Double click Directory Utility Click the Lock and enter the password to unlock the options Click the Edit tab (Directory Utility bar on top) and verify the "Disable Root User" option appears. If the "Enable Root User" option is visible, then this is a finding.

Fix: F-28294r1_fix

Open Finder Click Applications Click Utility Double click Directory Utility Click the Lock and enter the password to unlock the options Click the Edit tab (Directory Utility bar on top) Click Disable Root User

b
OSX00660-Physical Security
Medium - V-25372 - SV-31525r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00660
Vuln IDs
  • V-25372
Rule IDs
  • SV-31525r1_rule
Inadequate physical protection can undermine all other security precautions utilized to protect the system. This can jeopardize the confidentiality, availability, and integrity of the system. Physical security of the AIS is the first line protection of any system. Physical security of the Automated Information System (AIS) must meet DoD requirements. System AdministratorPECF-2
Checks: C-31800r1_chk

Interview the SA to determine if equipment is located in an controlled access area.

Fix: F-28295r1_fix

Relocate equipment to a controlled access area.

b
OSX00665-Shared User Accounts are not permitted on the system
Medium - V-25373 - SV-31527r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00665
Vuln IDs
  • V-25373
Rule IDs
  • SV-31527r1_rule
Shared accounts do not provide individual accountability for system access and resource usage. Shared user accounts are not permitted on the system. System AdministratorIAGA-1
Checks: C-31801r1_chk

Interview the SA to determine if any shared accounts exist. Any shared account must be documented with the IAO. Documentation should include the reason for the account, who has access to this account, and how the risk of using a shared account (which provides no individual identification and accountability) is mitigated. Note: As an example, a shared account may be permitted for a help desk or a site security personnel machine, if that machine is stand-alone and has no access to the network.

Fix: F-28296r1_fix

Remove any shared accounts that do not meet the exception requirements listed.

b
OSX00670-Operating System Updates
Medium - V-25374 - SV-31529r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00670
Vuln IDs
  • V-25374
Rule IDs
  • SV-31529r1_rule
Failure to install the most current operating system updates leaves a system vulnerable to exploitation. Current OS updates and patches correct known security and system vulnerabilities. If an OS is at an unsupported level this will be upgraded to a Category I finding since new vulnerabilities may not be patched. Note to administrators: Apple only supports the current major version and one previous major version of Mac OS X.If an OS is at an unsupported level this will be upgraded to a Category I finding since new vulnerabilities may not be patched. System AdministratorVIVM-1
Checks: C-31802r1_chk

1. Open a terminal session and enter one of the following commands: sudo softwareupdate --list or sudo softwareupdate --list --all. 2. Review the results and verify the current approved software patches are applied.

Fix: F-28297r1_fix

Install the current OS updates and patches.

a
OSX00675-System Recovery Backups
Low - V-25375 - SV-31531r1_rule
RMF Control
Severity
Low
CCI
Version
OSX00675
Vuln IDs
  • V-25375
Rule IDs
  • SV-31531r1_rule
Recovery of a damaged or compromised system in a timely basis is difficult without a system information backup. A system backup will usually include sensitivie information such as user accounts that could be used in an attack. As a valuable system resource, the system backup should be protected and stored in a physically secure location. System AdministratorCODB-1
Checks: C-31803r1_chk

Interview the SA to determine if system recovery backup procedures are in place that comply with DoD requirements. Any of the following would be a finding: •The site does not maintain emergency system recovery data. •The emergency system recovery data is not protected from destruction and stored in a locked storage container. •The emergency system recovery data has not been updated following the last system modification.

Fix: F-28298r1_fix

Implement data backup procedures that comply with DoD requirements.

b
OSX00685-Emergency Administrator Account
Medium - V-25376 - SV-31533r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00685
Vuln IDs
  • V-25376
Rule IDs
  • SV-31533r1_rule
This check verifies that a backup administrator account has been created to ensure system availability in the event that no administrators are able or available to access the system.System AdministratorECPA-1
Checks: C-31804r1_chk

Interview the SA to determine if an emergency administrator account exists and is stored with its password in a secure location.

Fix: F-28299r1_fix

Create and maintain an emergency admininstrator account for emergency situations.

b
OSX00690-Administrator Account Password Changes
Medium - V-25377 - SV-31535r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00690
Vuln IDs
  • V-25377
Rule IDs
  • SV-31535r1_rule
This check verifies that the passwords for the default and emergency administrator accounts are changed at least annually or when any member of the administrative team leaves the organization.System AdministratorECPA-1
Checks: C-31805r1_chk

Interview the SA or IAM to determine if the site has a policy that requires the default and backup admin passwords to be changed at least annually or when any member of the administrative team leaves the organization.

Fix: F-13549r1_fix

Define a policy for required password changes for the default and backup admin account.

b
OSX00695-Application Account Passwords
Medium - V-25378 - SV-31537r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00695
Vuln IDs
  • V-25378
Rule IDs
  • SV-31537r1_rule
Setting application accounts to expire may cause applications to stop functioning. The site will have a policy that application account passwords manually generated and entered by a system administrator are changed at least annually or when a system administrator with knowledge of the password leaves the organization. Application/service account passwords will be at least 15 characters and follow complexity requirements for all passwords. Interview the system administrators on their policy for application/service accounts. If it does not meet the above requirements, this is a finding. System AdministratorECPA-1
Checks: C-31806r1_chk

The site should have a local policy to ensure that passwords for application/service accounts are at least 15 characters in length and meet complexity requirements for all passwords. Application/service account passwords manually generated and entered by a system administrator must be changed at least annually or whenever a system administrator that has knowledge of the password leaves the organization. Interview the system administrators on their policy for application/service accounts. If it does not meet the above requirements, this is a finding.

Fix: F-28300r1_fix

Create application/service account passwords that are at least 15 characters in length and meet complexity requirements. Change application/service account passwords that are manually generated and entered by a system administrator at least annually or whenever an administrator with knowledge of the password leaves the organization.

b
OSX00700-Enable Automatic Screen Saver initiation when token removed from machine
Medium - V-25379 - SV-31539r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00700
Vuln IDs
  • V-25379
Rule IDs
  • SV-31539r1_rule
Determines what should happen when the smart card for a logged-on user is removed from the smart card reader. Note: if you are not using a smart card application this check does not apply. System AdministratorECSC-1
Checks: C-31807r1_chk

1. Open System Preferences. 2. Click the Security Icon 3. Click the General Tab 3. Ensure "Activate screen saver when login token is removed" option is selected. If the option is not selected, then this is a finding. Note: if you are not using a smart card application this check does not apply.

Fix: F-28301r1_fix

1. Open System Preferences. 2. Click the Security Icon 3. Click the General Tab 4. Select "Activate screen saver when login token is removed".

b
OSX00680-Incorrect Permission for Event Logs
Medium - V-25380 - SV-31541r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00680
Vuln IDs
  • V-25380
Rule IDs
  • SV-31541r1_rule
Event logs are susceptible to unauthorized, and possibly anonymous, tampering if proper permissions are not applied. System AdministratorECTP-1
Checks: C-31808r1_chk

The following files are used in the auditing process and access to these files should be restricted to an auditor’s group. If the file permissions are not at least as restrictive as listed below then this is a finding. Open a terminal session and verify the following permissions: /usr/sbin/auditd 555 /usr/sbin/audit 555 /usr/sbin/auditreduce 744 /etc/security/rc.audit 400 /etc/security/audit_control 400 /etc/security/audit_class 444 /etc/security/audit_event 444 /etc/security/audit_user 400 /etc/security/audit_warn 555

Fix: F-28302r1_fix

Open a terminal session and set the following file permissions: /usr/sbin/auditd 555 /usr/sbin/audit 555 /usr/sbin/auditreduce 744 /etc/security/rc.audit 400 /etc/security/audit_control 400 /etc/security/audit_class 444 /etc/security/audit_event 444 /etc/security/audit_user 400 /etc/security/audit_warn 555

b
OSX00705-Securely configure Spotlight Panel
Medium - V-25413 - SV-31599r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00705
Vuln IDs
  • V-25413
Rule IDs
  • SV-31599r1_rule
You can use Spotlight to search your computer for files. Spotlight searches the name, the meta-information associated with each file, and the contents of each file. Spotlight finds files regardless of their placement in the file system. You must still properly set access permissions on folders containing confidential files.System AdministratorECCD-1
Checks: C-31956r1_chk

To securely configure Spotlight preferences: 1. Open System Preferences 2. Click the Spotlight Icon. 3. In the Search Results pane, verify the categories you don’t want searchable by Spotlight are unchecked. 4. Click the Privacy pane. 5. Verify the correct folders and disks are in the Privacy pane; these are not searchable by Spotlight.

Fix: F-28370r1_fix

To securely configure Spotlight preferences: 1. Open System Perferences 2. Click the Spotlight Icon. 2. In the Search Results pane, deselect categories you don’t want searchable by Spotlight. 3. Click the Privacy pane. 4. Click the Add button or drag a folder or disk into the Privacy pane. 5. Folders and disks in the Privacy pane are now not searchable by Spotlight.

c
OSX00121-Disable clear text passwords for all LDAPv3 directories
High - V-25557 - SV-31775r1_rule
RMF Control
Severity
High
CCI
Version
OSX00121
Vuln IDs
  • V-25557
Rule IDs
  • SV-31775r1_rule
Disable the use of clear text passwords when accessing LDAPv3 directories.System AdministratorECCT-1, ECCT-2
Checks: C-32098r1_chk

Open Finder Click Applications Double Click Utility Double Click Directory Utility Click the Show Advanced Options button Click Services tab Click the Lock and enter the password to unlock the options(if needed) Click the LDAPv3 service Click the Pencil icon Highlight the Server Name/Configuration Name Click Edit Click on Security tab and verify the "Disable clear text passwords" is checked. If the value is not checked, then this is a finding.

Fix: F-28496r1_fix

Open Finder Click Applications Double Click Utility Double Click Directory Utility Click the Show Advanced Options button Click Services tab Click the Lock and enter the password to unlock the options(if needed) Click the LDAPv3 service Click the Pencil icon Highlight the Server Name/Configuration Name Click Edit Click the Security tab and select "Disable clear text passwords"

b
OSX00122-Digitally sign all LDAPv3 packets
Medium - V-25559 - SV-31778r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00122
Vuln IDs
  • V-25559
Rule IDs
  • SV-31778r1_rule
To protect the data between the client and LDAPv3 directory the traffic should be digitally sign.System AdministratorECCT-1, ECCT-2
Checks: C-32099r1_chk

Open Finder Click Applications Double Click Utility Double Click Directory Utility Click the Show Advanced Options button Click Services tab Click the Lock and enter the password to unlock the options(if needed) Click the LDAPv3 service Click the Pencil icon Highlight the Server Name/Configuration Name Click Edit Click on Security tab and verify the "Digitally sign all packets (requires Kerberos)" is checked. If the value is not checked, then this is a finding.

Fix: F-28497r1_fix

Open Finder Click Applications Double Click Utility Double Click Directory Utility Click the Show Advanced Options button Click Services tab Click the Lock and enter the password to unlock the options(if needed) Click the LDAPv3 service Click the Pencil icon Highlight the Server Name/Configuration Name Click Edit Click on Security tab and select "Digitally sign all packets (requires Kerberos)"

b
OSX00123-Encrypt all LDAPv3 packets
Medium - V-25561 - SV-31781r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00123
Vuln IDs
  • V-25561
Rule IDs
  • SV-31781r1_rule
To ensure data confidentially all traffic between the client and the LDAPv3 should be encrypted.System AdministratorECCT-1, ECCT-2
Checks: C-32100r1_chk

Open Finder Click Applications Double Click Utility Double Click Directory Utility Click the Show Advanced Options button Click Services tab Click the Lock and enter the password to unlock the options(if needed) Click the LDAPv3 service Click the Pencil icon Highlight the Server Name/Configuration Name Click Edit Click on Security tab and verify the "Encrypt all packets (requires SSL or Kerberos)" is checked. If the value is not checked, then this is a finding.

Fix: F-28498r1_fix

Open Finder Click Applications Double Click Utility Double Click Directory Utility Click the Show Advanced Options button Click Services tab Click the Lock and enter the password to unlock the options(if needed) Click the LDAPv3 service Click the Pencil icon Highlight the Server Name/Configuration Name Click Edit Click on Security tab and select "Encrypt all packets (requires SSL or Kerberos)"

b
OSX00124-LDAPv3 Block man-in-the-middle attacks
Medium - V-25563 - SV-31783r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00124
Vuln IDs
  • V-25563
Rule IDs
  • SV-31783r1_rule
To prevent LDAPv3 man-in-the-middle attacks the system must be properly configured.System AdministratorECCT-1, ECCT-2
Checks: C-32101r1_chk

Open Finder Click Applications Double Click Utility Double Click Directory Utility Click the Show Advanced Options button Click Services tab Click the Lock and enter the password to unlock the options(if needed) Click the LDAPv3 service Click the Pencil icon Highlight the Server Name/Configuration Name Click Edit Click on Security tab and verify the "Block man-in-the-middle attacks (requires Kerberos)" is checked. If the value is not checked, then this is a finding

Fix: F-28499r1_fix

Open Finder Click Applications Double Click Utility Double Click Directory Utility Click the Show Advanced Options button Click Services tab Click the Lock and enter the password to unlock the options(if needed) Click the LDAPv3 service Click the Pencil icon Highlight the Server Name/Configuration Name Click Edit Click the Security tab and select "Block man-in-the-middle attacks (requires Kerberos)"

c
OSX00341-Do not allow computer to perform automatic actions for blank DVD
High - V-25606 - SV-31838r1_rule
RMF Control
Severity
High
CCI
Version
OSX00341
Vuln IDs
  • V-25606
Rule IDs
  • SV-31838r1_rule
To secure CDs and DVDs (blank), do not allow the computer to perform automatic actions when the user inserts a disc. When you disable automatic actions in System Preferences, you must disable these actions for every user account on the computer.System AdministratorECCD-1
Checks: C-32185r1_chk

1. Open System Preferences - > CDs and DVDs. 2. Ensure "When you insert a blank DVD:" is set to 'Ignore'. If the option is not set to "Ignore", then this is a finding.

Fix: F-28558r1_fix

1. Open System Preferences - > CDs and DVDs. 2. Set "When you insert a blank DVD:" to 'Ignore'.

b
OSX00012-Verify file permissions
Medium - V-25881 - SV-32237r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00012
Vuln IDs
  • V-25881
Rule IDs
  • SV-32237r1_rule
This command will check a very large number of files on the system against what the package manager's database indicates they should be. This command will catch improperly loosened permissions.System AdministratorDCSW-1
Checks: C-32702r1_chk

This command should indicate any files having an incorrect owner or permissions less restrictive than what the original permissions were set to. If the results indicate the owner or permissions changed, this is a finding.

Fix: F-28790r1_fix

Run the command: sudo diskutil repairPermissions / Note: If permissions were made more restrictive than the package manager expects (as later rules require), then these tightened permissions will need to be reapplied after running this command.

b
OSX00467-Disable Bonjour
Medium - V-25882 - SV-32239r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00467
Vuln IDs
  • V-25882
Rule IDs
  • SV-32239r1_rule
Bonjour is unnecessary in a managed environment and presents an attack surface. Its behavior, which trusts the local network, is especially inappropriate on portable devices which may connect to untrusted networks.System AdministratorECSC-1
Checks: C-32703r1_chk

Run the command: sudo launchctl list If a line for com.apple.mDNSResponder appears, then this is a finding. Note: This command must NOT be run on Mac OS X 10.6, as it will disable all DNS resolution.

Fix: F-28791r1_fix

Run the command: sudo launchctl -w unload com.apple.mDNSResponder to disable Bonjour.

b
OSX00010-Do not install unnecessary packages, check for installed packages and remove packages that are not needed.
Medium - V-25187 - SV-31262r1_rule
RMF Control
Severity
Medium
CCI
Version
OSX00010
Vuln IDs
  • V-25187
Rule IDs
  • SV-31262r1_rule
Removing unused packages frees disk space and reduces the risk of attackers finding vulnerabilities in unused components.System AdministratorECSC-1
Checks: C-31669r1_chk

Verify unnecessary packages are not installed. Open a terminal session and enter the following command: pkgutil / --pkgs Review the packages that are installed, determine if the installed packages are needed. If not, then this is a finding.

Fix: F-28155r1_fix

Review the packages that are installed using the following command: pkgutil / --pkgs Determine if the installed packages are needed. If not, verify any dependencies and use the rm command to remove them.