The macOS system must be configured with a firmware password to prevent access to single user mode and booting from alternative media.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-257232	APPL-13-003013	SV-257232r905329_rule		Medium

Description
Single user mode and the boot picker, as well as numerous other tools, are available on macOS through booting while holding the "Option" key down. Setting a firmware password restricts access to these tools.

STIG	Date
Apple macOS 13 (Ventura) Security Technical Implementation Guide	2023-06-20

Details

Check Text ( C-60917r905327_chk )
For Apple Silicon-based systems, this is not applicable. Verify the macOS system is configured with a firmware password with the following command: /usr/bin/sudo /usr/sbin/firmwarepasswd -check Password Enabled:Yes If "Password Enabled" is not set to "Yes", this is a finding.

Fix Text (F-60858r905328_fix)
Configure the macOS system with a firmware password with the following command: /usr/bin/sudo /usr/sbin/firmwarepasswd -setpasswd Note: If firmware password or passcode is forgotten, the only way to reset the forgotten password is through a machine-specific binary generated and provided by Apple. Users must schedule a support call and provide proof of purchase before the firmware binary will be generated.

Fix Text (F-60858r905328_fix)

Configure the macOS system with a firmware password with the following command:

/usr/bin/sudo /usr/sbin/firmwarepasswd -setpasswd

Note: If firmware password or passcode is forgotten, the only way to reset the forgotten password is through a machine-specific binary generated and provided by Apple. Users must schedule a support call and provide proof of purchase before the firmware binary will be generated.