UCF STIG Viewer Logo

SMB File Sharing must be disabled unless required.


Overview

Finding ID Version Rule ID IA Controls Severity
V-59567 AOSX-10-000139 SV-73997r2_rule Medium
Description
File Sharing is usually non-essential and must be disabled if not required. Enabling any service increases the attack surface for an intruder. By disabling unnecessary services, the attack surface is minimized.
STIG Date
Apple OS X 10.10 (Yosemite) Workstation Security Technical Implementation Guide 2017-04-06

Details

Check Text ( C-60337r4_chk )
If SMB File Sharing is required, this is not applicable.

To check if the 'SMB File Sharing' service is disabled, use the following command:

sudo launchctl print-disabled system | grep com.apple.smbd

If the results do not show the following:

"com.apple.smbd" => true

this is a finding.
Fix Text (F-64977r1_fix)
To disable the 'SMB File Sharing' service, run the following command:

sudo launchctl disable system/com.apple.smbd

The system may need to be restarted for the update to take effect.