Title

The root account must be disabled. (Cat I impact)

Discussion

The most powerful user account in Mac OS X is the system administrator or root account. By default, the root account on Mac OS X is disabled and it is recommended to not enable it. The root account is primarily used for performing UNIX commands. Generally, actions involving critical system files require performing those actions as root.

Check Content

Open Finder. Click the Hard Drive icon. Double Click System. Double Click Library. Double Click CoreServices. Double Click Directory Utility. Click the Lock and enter the password to unlock the options. Click the Edit menu (Directory Utility bar on top) and verify that "Enable Root User" appears. If the "Disable Root User" option is visible, this is a finding.

Fix Text

Open Finder Click the Hard Drive icon. Double Click System. Double Click Library. Double Click CoreServices. Double Click Directory Utility. Click the Lock and enter the password to unlock the options. Click the Edit menu (Directory Utility bar on top). Click Disable Root User.

Additional Identifiers

Rule ID: SV-38568r1_rule

Vulnerability ID: V-25371

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.