Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
The macOS system must be configured to disable password forwarding for FileVault2.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-252455 | APPL-12-000033 | SV-252455r853263_rule | Medium |
| Description |
|---|
| When "FileVault" and Multifactor Authentication are configured on the operating system, a dedicated user must be configured to ensure that the implemented Multifactor Authentication rules are enforced. If a dedicated user is not configured to decrypt the hard disk upon startup, the system will allow a user to bypass Multifactor Authentication rules during initial startup and first login. |
| STIG | Date |
|---|---|
| Apple macOS 12 (Monterey) Security Technical Implementation Guide | 2023-08-28 |
Details
| Check Text ( C-55911r816177_chk ) |
|---|
| Verify that password forwarding has been disabled on the system: # /usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep "DisableFDEAutoLogin" DisableFDEAutologin = 1; If "DisableFDEAutologin" is not set to a value of "1", this is a finding. |
| Fix Text (F-55861r816178_fix) |
|---|
| This setting is enforced using the "Smart Card" configuration profile. |