macOS must be configured with a firmware password to prevent access to single user mode and booting from alternative media.

Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

macOS must be configured with a firmware password to prevent access to single user mode and booting from alternative media.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-95975	AOSX-14-003013	SV-105113r1_rule		Medium

Description
Single user mode and the boot picker, as well as numerous other tools are available on macOS through booting while holding the "Option" key down. Setting a firmware password restricts access to these tools.

STIG	Date
Apple OS X 10.14 (Mojave) Security Technical Implementation Guide	2019-07-23

Details

Check Text ( C-94807r1_chk )
To check that password hints are disabled, run the following command: # sudo /usr/sbin/firmwarepasswd -check If the return is not, "Password Enabled: Yes", this is a finding.

Fix Text (F-101643r1_fix)
To set a firmware passcode use the following command. sudo /usr/sbin/firmwarepasswd -setpasswd Note: If firmware password or passcode is forgotten, the only way to reset the forgotten password is through the use of a machine specific binary generated and provided by Apple. Schedule a support call, and provide proof of purchase before the firmware binary will be generated.