The macOS system must implement DoD-approved encryption to protect the confidentiality and integrity of remote access sessions including transmitted data and data during preparation for transmission.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-95803	AOSX-14-000010	SV-104941r1_rule		High

Description
Without confidentiality and integrity protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session. Remote access is access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Encryption provides a means to secure the remote connection to prevent unauthorized access to the data traversing the remote access connection (e.g., Remote Desktop Protocol [RDP]), thereby providing a degree of confidentiality. The encryption strength of a mechanism is selected based on the security categorization of the information.

Description

Without confidentiality and integrity protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session. Remote access is access to DoD non-public information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Encryption provides a means to secure the remote connection to prevent unauthorized access to the data traversing the remote access connection (e.g., Remote Desktop Protocol [RDP]), thereby providing a degree of confidentiality. The encryption strength of a mechanism is selected based on the security categorization of the information.

STIG	Date
Apple OS X 10.14 (Mojave) Security Technical Implementation Guide	2019-07-23

Details

Check Text ( C-94633r1_chk )
For systems that allow remote access through SSH, run the following command: /usr/bin/sudo /bin/launchctl print-disabled system \| /usr/bin/grep com.openssh.sshd If the results do not show the following, this is a finding. "com.openssh.sshd" => false

Fix Text (F-101471r1_fix)
To enable the SSH service, run the following command: /usr/bin/sudo /bin/launchctl enable system/com.openssh.sshd The system may need to be restarted for the update to take effect.