Check: APPL-14-001150
Apple macOS 14 (Sonoma) STIG:
APPL-14-001150
(in versions v1 r2 through v1 r1)
Title
The macOS system must disable password authentication for SSH. (Cat I impact)
Discussion
If remote logon through SSH is enabled, password-based authentication must be disabled for user logon. All users must go through multifactor authentication to prevent unauthenticated access and potential compromise to the system. Note: /etc/ssh/sshd_config will be automatically modified to its original state following any update or major upgrade to the operating system. Satisfies: SRG-OS-000067-GPOS-00035,SRG-OS-000105-GPOS-00052,SRG-OS-000106-GPOS-00053,SRG-OS-000107-GPOS-00054,SRG-OS-000108-GPOS-00055,SRG-OS-000112-GPOS-00057,SRG-OS-000125-GPOS-00065,SRG-OS-000375-GPOS-00160
Check Content
Verify the macOS system is configured to disable password authentication for SSH with the following command: /usr/sbin/sshd -G | /usr/bin/grep -Ec '^(passwordauthentication\s+no|kbdinteractiveauthentication\s+no)' If the result is not "2", this is a finding.
Fix Text
Configure the macOS system to disable password authentication for SSH with the following command: include_dir=$(/usr/bin/awk '/^Include/ {print $2}' /etc/ssh/sshd_config | /usr/bin/tr -d '*') if [[ -z $include_dir ]]; then /usr/bin/sed -i.bk "1s/.*/Include \/etc\/ssh\/sshd_config.d\/\*/" /etc/ssh/sshd_config fi echo "passwordauthentication no" >> "${include_dir}01-mscp-sshd.conf" echo "kbdinteractiveauthentication no" >> "${include_dir}01-mscp-sshd.conf" for file in $(ls ${include_dir}); do if [[ "$file" == "100-macos.conf" ]]; then continue fi if [[ "$file" == "01-mscp-sshd.conf" ]]; then break fi /bin/mv ${include_dir}${file} ${include_dir}20-${file} done
Additional Identifiers
Rule ID: SV-259477r941053_rule
Vulnerability ID: V-259477
Group Title: SRG-OS-000067-GPOS-00035
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000186 |
The information system, for PKI-based authentication, enforces authorized access to the corresponding private key. |
| CCI-000765 |
The information system implements multifactor authentication for network access to privileged accounts. |
| CCI-000766 |
The information system implements multifactor authentication for network access to non-privileged accounts. |
| CCI-000767 |
The information system implements multifactor authentication for local access to privileged accounts. |
| CCI-000768 |
The information system implements multifactor authentication for local access to non-privileged accounts. |
| CCI-000877 |
The organization employs strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions. |
| CCI-001941 |
The information system implements replay-resistant authentication mechanisms for network access to privileged accounts. |
| CCI-001948 |
The information system implements multifactor authentication for remote access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access. |
Controls
| Number | Title |
|---|---|
| IA-2 (1) |
Network Access To Privileged Accounts |
| IA-2 (2) |
Network Access To Non-Privileged Accounts |
| IA-2 (3) |
Local Access To Privileged Accounts |
| IA-2 (4) |
Local Access To Non-Privileged Accounts |
| IA-2 (8) |
Network Access To Privileged Accounts - Replay Resistant |
| IA-2 (11) |
Remote Access - Separate Device |
| IA-5 (2) |
Pki-Based Authentication |
| MA-4 |
Nonlocal Maintenance |