6.1.4 Disable 'Allow guests to connect to shared folders' - AFP Sharing

Information

Not allowing guests to connect to shared folders mitigates the risk of an untrusted user doing basic reconnaissance and possibly use privilege escalation attacks to take control of the system.

Solution

Perform the following to implement the prescribed state:
1. Open System Preferences
2. Select Users & Groups
3. Select Guest User
4. Uncheck Allow guests to connect to shared folders
Alternatively:
1. Run the following command in Terminal:
sudo defaults write /Library/Preferences/com.apple.AppleFileServer guestAccess -bool no

See Also

https://benchmarks.cisecurity.org/tools2/osx/CIS_Apple_OSX_10.9_Benchmark_v1.0.0.pdf

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2

Plugin: Unix

Control ID: 6ab81692648dc1581c7efd1cad78dfe5fd829b648271a5a44cf31252c60cac3b