Title

The macOS system must be configured with dedicated user accounts to decrypt the hard disk upon startup. (Cat II impact)

Discussion

When "FileVault" and Multifactor Authentication are configured on the operating system, a dedicated user must be configured to ensure that the implemented Multifactor Authentication rules are enforced. If a dedicated user is not configured to decrypt the hard disk upon startup, the system will allow a user to bypass Multifactor Authentication rules during initial startup and first login.

Check Content

For Apple Silicon-based systems, this is Not Applicable. For Intel-based Macs, retrieve a list of authorized FileVault users: $ sudo fdesetup list fvuser,85F41F44-22B3-6CB7-85A1-BCC2EA2B887A If any unauthorized users are listed, this is a finding. Verify that the shell for authorized FileVault users is set to “/usr/bin/false”, which prevents console logins: $ sudo dscl . read /Users/<FileVault_User> UserShell UserShell: /usr/bin/false If the FileVault users' shell is not set to "/usr/bin/false", this is a finding.

Fix Text

Note: In previous versions of macOS, this setting was implemented differently. Systems that used the previous method should prepare the system for the new method by creating a new unlock user, verifying its ability to unlock FileVault after reboot, then deleting the old FileVault unlock user. Disable the login ability of the newly created user account: $ sudo /usr/bin/dscl . change /Users/<FileVault_User> UserShell </path/to/current/shell> /usr/bin/false Remove all FileVault login access from each user account defined on the system that is not a designated FileVault user: $ sudo fdesetup remove -user <username>

Additional Identifiers

Rule ID: SV-252454r853262_rule

Vulnerability ID: V-252454

Group Title: SRG-OS-000480-GPOS-00227

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.