Check: APPL-15-001150
Apple macOS 15 (Sequoia) STIG:
APPL-15-001150
(in versions v1 r4 through v1 r1)
Title
The macOS system must disable password authentication for SSH. (Cat I impact)
Discussion
If remote login through SSH is enabled, password-based authentication must be disabled for user login. All users must go through multifactor authentication to prevent unauthenticated access and potential compromise to the system. NOTE: /etc/ssh/sshd_config will be automatically modified to its original state following any update or major upgrade to the operating system. Satisfies: SRG-OS-000067-GPOS-00035, SRG-OS-000105-GPOS-00052, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055, SRG-OS-000112-GPOS-00057, SRG-OS-000125-GPOS-00065, SRG-OS-000375-GPOS-00160
Check Content
Verify the macOS system is configured to disable password authentication for SSH with the following command: /usr/sbin/sshd -G | /usr/bin/grep -Ec '^(passwordauthentication\s+no|kbdinteractiveauthentication\s+no)' If the result is not "2", this is a finding.
Fix Text
Configure the macOS system to disable password authentication for SSH with the following command: include_dir=$(/usr/bin/awk '/^Include/ {print $2}' /etc/ssh/sshd_config | /usr/bin/tr -d '*') if [[ -z $include_dir ]]; then /usr/bin/sed -i.bk "1s/.*/Include \/etc\/ssh\/sshd_config.d\/\*/" /etc/ssh/sshd_config fi echo "passwordauthentication no" >> "${include_dir}01-mscp-sshd.conf" echo "kbdinteractiveauthentication no" >> "${include_dir}01-mscp-sshd.conf" for file in $(ls ${include_dir}); do if [[ "$file" == "100-macos.conf" ]]; then continue fi if [[ "$file" == "01-mscp-sshd.conf" ]]; then break fi /bin/mv ${include_dir}${file} ${include_dir}20-${file} done
Additional Identifiers
Rule ID: SV-268477r1034371_rule
Vulnerability ID: V-268477
Group Title: SRG-OS-000067-GPOS-00035
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000186 |
For public key-based authentication, enforce authorized access to the corresponding private key. |
| CCI-000765 |
Implement multifactor authentication for access to privileged accounts. |
| CCI-000766 |
Implement multifactor authentication for access to non-privileged accounts. |
| CCI-000877 |
Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions. |
| CCI-001941 |
Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts. |
| CCI-004046 |
Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access. |
Controls
| Number | Title |
|---|---|
| IA-2(1) |
Multi-factor Authentication to Privileged Accounts |
| IA-2(2) |
Multi-factor Authentication to Non-privileged Accounts |
| IA-2(6) |
Access to Accounts —separate Device |
| IA-2(8) |
Access to Accounts — Replay Resistant |
| IA-5(2) |
Public Key-based Authentication |
| MA-4 |
Nonlocal Maintenance |