Detections
Analytics

1.23 APPL-15-000090

Information

The macOS system must disable login to other users' active and locked sessions.

GROUP ID: V-268442
RULE ID: SV-268442r1034266

The ability to log in to another user's active or locked session must be disabled.

macOS has a privilege that can be granted to any user that will allow that user to unlock active users' sessions. Disabling the administrator's and/or user's ability to log in to another user's active and locked session prevents unauthorized people from viewing potentially sensitive and/or personal information.

NOTE: Configuring this setting will change the user experience and disable TouchID from unlocking the screen saver. To restore the user experience and allow TouchID to unlock the screen saver, run "/usr/bin/sudo /usr/bin/defaults write /Library/Preferences/com.apple.loginwindow screenUnlockMode -int 1". This setting can also be deployed with a configuration profile.

Satisfies: SRG-OS-000104-GPOS-00051, SRG-OS-000109-GPOS-00056

Solution

Configure the macOS system to disable login to other users' active and locked sessions with the following command:

/usr/bin/security authorizationdb write system.login.screensaver "authenticate-session-owner"

See Also

https://workbench.cisecurity.org/benchmarks/23761

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-2, CCI|CCI-000764, CCI|CCI-004045, Rule-ID|SV-268442r1034266_rule, STIG-ID|APPL-15-000090, Vuln-ID|V-268442

Plugin: Unix

Control ID: 8fad83246431bffa4675f532353644f515009fa34761ceb645da730af5e34c76