An error occurred:

Apple OS X 10.14 (Mojave) STIG

Apple OS X 10.14 (Mojave) Security Technical Implementation Guide

ID Vuln ID Title Cat Status
AOSX-14-000021 V-209537 The macOS system must enforce an account lockout time period of 15 minutes in which a user makes three consecutive invalid logon attempts. Cat II
AOSX-14-000022 V-209538 The macOS system must enforce the limit of three consecutive invalid logon attempts by a user before the user account is locked. Cat II
AOSX-14-000023 V-209539 The macOS system must display the Standard Mandatory DoD Notice and Consent Banner before granting remote access to the operating system. Cat II
AOSX-14-000024 V-209540 The macOS system must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system via SSH. Cat II
AOSX-14-000025 V-209541 The macOS system must be configured so that any connection to the system must display the Standard Mandatory DoD Notice and Consent Banner before granting GUI access to the system. Cat II
AOSX-14-000030 V-209542 The macOS system must be configured so that log files must not contain access control lists (ACLs). Cat II
AOSX-14-000031 V-209543 The macOS system must be configured so that log folders must not contain access control lists (ACLs). Cat II
AOSX-14-000032 V-225094 The macOS system must be configured with dedicated user accounts to decrypt the hard disk upon startup. Cat II
AOSX-14-000040 V-209544 The macOS system must use replay-resistant authentication mechanisms and implement cryptographic mechanisms to protect the integrity of and verify remote disconnection at the termination of nonlocal maintenance and diagnostic communications, when used for nonlocal maintenance sessions. Cat II
AOSX-14-000050 V-209545 The macOS system must limit the number of concurrent SSH sessions to 10 for all accounts and/or account types. Cat II
AOSX-14-000051 V-209546 The macOS system must be configured with the SSH daemon ClientAliveInterval option set to 900 or less. Cat II
AOSX-14-000052 V-209547 The macOS system must be configured with the SSH daemon ClientAliveCountMax option set to 0. Cat II
AOSX-14-000053 V-209548 The macOS system must be configured with the SSH daemon LoginGraceTime set to 30 or less. Cat II
AOSX-14-000054 V-233628 The macOS system must implement approved Ciphers to protect the confidentiality of SSH connections. Cat II
AOSX-14-000055 V-233691 The macOS system must use only Message Authentication Codes (MACs) employing FIPS 140-2 validated cryptographic hash algorithms. Cat II

Print

Display this benchmark in a printer-friendly format for off-line reference. This display does not include any commands.

Version Changes

If there are multiple versions of this benchmark, Xylok can display the differences between any changes in the checks.