Check: APPL-14-001150
Apple macOS 14 (Sonoma) STIG:
APPL-14-001150
(in versions v2 r2 through v1 r1)
Title
The macOS system must disable password authentication for SSH. (Cat I impact)
Discussion
If remote logon through SSH is enabled, password-based authentication must be disabled for user logon. All users must go through multifactor authentication to prevent unauthenticated access and potential compromise to the system. Note: /etc/ssh/sshd_config will be automatically modified to its original state following any update or major upgrade to the operating system. Satisfies: SRG-OS-000067-GPOS-00035,SRG-OS-000105-GPOS-00052,SRG-OS-000106-GPOS-00053,SRG-OS-000107-GPOS-00054,SRG-OS-000108-GPOS-00055,SRG-OS-000112-GPOS-00057,SRG-OS-000125-GPOS-00065,SRG-OS-000375-GPOS-00160
Check Content
Verify the macOS system is configured to disable password authentication for SSH with the following command: /usr/sbin/sshd -G | /usr/bin/grep -Ec '^(passwordauthentication\s+no|kbdinteractiveauthentication\s+no)' If the result is not "2", this is a finding.
Fix Text
Configure the macOS system to disable password authentication for SSH with the following command: include_dir=$(/usr/bin/awk '/^Include/ {print $2}' /etc/ssh/sshd_config | /usr/bin/tr -d '*') if [[ -z $include_dir ]]; then /usr/bin/sed -i.bk "1s/.*/Include \/etc\/ssh\/sshd_config.d\/\*/" /etc/ssh/sshd_config fi echo "passwordauthentication no" >> "${include_dir}01-mscp-sshd.conf" echo "kbdinteractiveauthentication no" >> "${include_dir}01-mscp-sshd.conf" for file in $(ls ${include_dir}); do if [[ "$file" == "100-macos.conf" ]]; then continue fi if [[ "$file" == "01-mscp-sshd.conf" ]]; then break fi /bin/mv ${include_dir}${file} ${include_dir}20-${file} done
Additional Identifiers
Rule ID: SV-259477r1009591_rule
Vulnerability ID: V-259477
Group Title: SRG-OS-000067-GPOS-00035
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000186 |
For public key-based authentication, enforce authorized access to the corresponding private key. |
| CCI-000765 |
Implement multifactor authentication for access to privileged accounts. |
| CCI-000766 |
Implement multifactor authentication for access to non-privileged accounts. |
| CCI-000767 |
The information system implements multifactor authentication for local access to privileged accounts. |
| CCI-000768 |
The information system implements multifactor authentication for local access to non-privileged accounts. |
| CCI-000877 |
Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions. |
| CCI-001941 |
Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts. |
| CCI-001948 |
The information system implements multifactor authentication for remote access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access. |
| CCI-004046 |
Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access. |
Controls
| Number | Title |
|---|---|
| IA-2(1) |
Network Access to Privileged Accounts |
| IA-2(2) |
Network Access to Non-privileged Accounts |
| IA-2(3) |
Local Access to Privileged Accounts |
| IA-2(4) |
Local Access to Non-privileged Accounts |
| IA-2(8) |
Network Access to Privileged Accounts - Replay Resistant |
| IA-2(11) |
Remote Access - Separate Device |
| IA-5(2) |
Pki-based Authentication |
| MA-4 |
Nonlocal Maintenance |