The macOS system must be configured with dedicated user accounts to decrypt the hard disk upon startup.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-225094 | AOSX-14-000032 | SV-225094r610285_rule | Medium |
| Description |
|---|
| When "FileVault" and Multifactor Authentication are configured on the operating system, a dedicated user must be configured to ensure that the implemented Multifactor Authentication rules are enforced. If a dedicated user is not configured to decrypt the hard disk upon startup, the system will allow a user to bypass Multifactor Authentication rules during initial startup and first login. |
| STIG | Date |
|---|---|
| Apple OS X 10.14 (Mojave) Security Technical Implementation Guide | 2021-11-19 |
Details
| Check Text ( C-26786r569431_chk ) |
|---|
| Retrieve a list of authorized FileVault users: # sudo fdesetup list fvuser,85F41F44-22B3-6CB7-85A1-BCC2EA2B887A If any unauthorized users are listed, this is a finding. Verify that the defined FileVault users are disabled: Note: This procedure must be ran for each defined FileVault User. # sudo dscl . read /Users/ AuthenticationAuthority: ;ShadowHash;HASHLIST: If the FileVault user is not disabled, this is a finding. Verify that password forwarding has been disabled on the system: # sudo defaults read /Library/Preferences/com.apple.loginwindow | grep "DisableFDEAutologin" DisableFDEAutologin = 1; If "DisableFDEAutologin" is not set to a value of "1", this is a finding. |
| Fix Text (F-26774r569432_fix) |
|---|
| Create an authorized user account that will be used to unlock the disk on startup. Disable the login ability of the newly created user account: # sudo dscl . append /Users/ Disable FileVaults Auto-login feature: # sudo defaults write /Library/Preferences/com.apple.loginwindow DisableFDEAutologin -bool YES Remove all FileVault login access from each user account defined on the system that is not a designated FileVault user: # sudo fdesetup remove -user |