Check: AOSX-14-001100
Apple OS X 10.14 (Mojave) STIG:
AOSX-14-001100
(in versions v2 r6 through v1 r1)
Title
The macOS system must require individuals to be authenticated with an individual authenticator prior to using a group authenticator. (Cat II impact)
Discussion
Administrator users must never log in directly as root. To assure individual accountability and prevent unauthorized access, logging in as root over a remote connection must be disabled. Administrators should only run commands as root after first authenticating with their individual user names and passwords.
Check Content
To check if SSH has root logins enabled, run the following command: /usr/bin/sudo /usr/bin/grep ^PermitRootLogin /etc/ssh/sshd_config If there is no result, or the result is set to "yes", this is a finding.
Fix Text
To ensure that "PermitRootLogin" is disabled by sshd, run the following command: /usr/bin/sudo /usr/bin/sed -i.bak 's/^[\#]*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
Additional Identifiers
Rule ID: SV-209565r610285_rule
Vulnerability ID: V-209565
Group Title: SRG-OS-000109-GPOS-00056
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000770 |
The organization requires individuals to be authenticated with an individual authenticator when a group authenticator is employed. |
Controls
Number | Title |
---|---|
IA-2 (5) |
Group Authentication |