Title

The application firewall must be enabled. (Cat II impact)

Discussion

The Application Firewall is the built-in firewall that comes with Mac OS X and must be enabled. Firewalls protect computers from network attacks by blocking or limiting access to open network ports. Application firewalls limit which applications are allowed to communicate over the network.

Check Content

If an approved HBSS solution is installed per AOSX-10-000835, this is not applicable. To check if the OS X firewall has been enabled, run the following command: sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate If the result is 'disabled', this is a finding.

Fix Text

To enable the firewall run the following command: sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on

Additional Identifiers

Rule ID: SV-74155r1_rule

Vulnerability ID: V-59725

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.