STIGQter: STIG Summary: Apple OS X 10.14 (Mojave) Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The macOS system must use multifactor authentication in the establishment of nonlocal maintenance and diagnostic sessions.

DISA Rule

SV-209624r610285_rule

Vulnerability Number

V-209624

Group Title

SRG-OS-000125-GPOS-00065

Rule Version

AOSX-14-003024

Severity

CAT II

CCI(s)

• CCI-000877 - The organization employs strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.

Weight

10

Fix Recommendation

For non-directory bound systems, this setting is enforced using the "Smart Card Policy" configuration profile.

Note: Before applying the "Smart Card Policy", the supplemental guidance provided with the STIG should be consulted to ensure continued access to the operating system.

To ensure that passcode based logins are disabled in sshd, run the following command:

/usr/bin/sudo /usr/bin/sed -i.bak 's/^[\#]*ChallengeResponseAuthentication.*/ChallengeResponseAuthentication no/' /etc/ssh/sshd_config
/usr/bin/sudo /usr/bin/sed -i.bak 's/^[\#]*PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config

Check Contents

If the system is connected to a directory server, this is Not Applicable.

The following command ensures that a mandatory smart card policy is enforced:

# /usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep enforceSmartCard
enforceSmartCard=1

If the command returns null, or any other value, this is a finding.

The following command ensures that passwords are disabled in the SSHD configuration file:

# grep -e ^[\#]*PasswordAuthentication.* -e ^[\#]*ChallengeResponseAuthentication.* /etc/ssh/sshd_config
If this command returns null, or anything other than exactly this text, with no leading hash(#), this is a finding:

"PasswordAuthentication no
ChallengeResponseAuthentication no"

Vulnerability Number

V-209624

Documentable

False

Rule Version

AOSX-14-003024

Severity Override Guidance

If the system is connected to a directory server, this is Not Applicable.

The following command ensures that a mandatory smart card policy is enforced:

# /usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep enforceSmartCard
enforceSmartCard=1

If the command returns null, or any other value, this is a finding.

The following command ensures that passwords are disabled in the SSHD configuration file:

# grep -e ^[\#]*PasswordAuthentication.* -e ^[\#]*ChallengeResponseAuthentication.* /etc/ssh/sshd_config
If this command returns null, or anything other than exactly this text, with no leading hash(#), this is a finding:

"PasswordAuthentication no
ChallengeResponseAuthentication no"

Check Content Reference

M

Target Key

2930

Comments