STIGQter: STIG Summary: Apple OS X 10.14 (Mojave) Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The macOS system must use multifactor authentication for local and network access to privileged and non-privileged accounts.

DISA Rule

SV-209623r610285_rule

Vulnerability Number

V-209623

Group Title

SRG-OS-000105-GPOS-00052

Rule Version

AOSX-14-003020

Severity

CAT II

CCI(s)

• CCI-000765 - The information system implements multifactor authentication for network access to privileged accounts.
• CCI-000766 - The information system implements multifactor authentication for network access to non-privileged accounts.
• CCI-000767 - The information system implements multifactor authentication for local access to privileged accounts.
• CCI-000768 - The information system implements multifactor authentication for local access to non-privileged accounts.

Weight

10

Fix Recommendation

For non directory bound systems, this setting is enforced using the "Smart Card Policy" configuration profile.

Note: Before applying the "Smart Card Policy", the supplemental guidance provided with the STIG should be consulted to ensure continued access to the operating system.

The following commands must be run to disable passcode based authentication for SSHD:

/usr/bin/sudo /usr/bin/sed -i.bak 's/^[\#]*ChallengeResponseAuthentication.*/ChallengeResponseAuthentication no/' /etc/ssh/sshd_config
/usr/bin/sudo /usr/bin/sed -i.bak 's/^[\#]*PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config

Check Contents

If the system is connected to a directory server, this is Not Applicable.

To verify that the system is configured to enforce multi-factor authentication, run the following commands:

/usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep enforceSmartCard

If the results do not show the following, this is a finding.
"enforceSmartCard=1.

Run the following command to disable password based authentication in SSHD.

/usr/bin/grep -e ^[\#]*PasswordAuthentication.* -e ^[\#]*ChallengeResponseAuthentication.* /etc/ssh/sshd_config

If this command returns null, or anything other than exactly this text, with no leading hash(#), this is a finding:

"PasswordAuthentication no
ChallengeResponseAuthentication no"

Vulnerability Number

V-209623

Documentable

False

Rule Version

AOSX-14-003020

Severity Override Guidance

If the system is connected to a directory server, this is Not Applicable.

To verify that the system is configured to enforce multi-factor authentication, run the following commands:

/usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep enforceSmartCard

If the results do not show the following, this is a finding.
"enforceSmartCard=1.

Run the following command to disable password based authentication in SSHD.

/usr/bin/grep -e ^[\#]*PasswordAuthentication.* -e ^[\#]*ChallengeResponseAuthentication.* /etc/ssh/sshd_config

If this command returns null, or anything other than exactly this text, with no leading hash(#), this is a finding:

"PasswordAuthentication no
ChallengeResponseAuthentication no"

Check Content Reference

M

Target Key

2930

Comments