UCF STIG Viewer Logo

The OS X system must be configured to disable SMB File Sharing unless it is required.


Overview

Finding ID Version Rule ID IA Controls Severity
V-75987 AOSX-12-000139 SV-90675r1_rule Medium
Description
File Sharing is usually non-essential and must be disabled if not required. Enabling any service increases the attack surface for an intruder. By disabling unnecessary services, the attack surface is minimized.
STIG Date
Apple OS X 10.12 Security Technical Implementation Guide 2018-12-24

Details

Check Text ( C-75671r1_chk )
If SMB File Sharing is required, this is not applicable.

To check if the SMB File Sharing service is disabled, use the following command:

/usr/bin/sudo /bin/launchctl print-disabled system | /usr/bin/grep com.apple.smbd

If the results do not show the following, this is a finding:

"com.apple.smbd" => true
Fix Text (F-82625r1_fix)
To disable the SMB File Sharing service, run the following command:

/usr/bin/sudo /bin/launchctl disable system/com.apple.smbd

The system may need to be restarted for the update to take effect.