STIGQter STIGQter: STIG Summary: Apple OS X 10.14 (Mojave) Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The macOS system must enforce password complexity by requiring that at least one special character be used.

DISA Rule

SV-209620r610285_rule

Vulnerability Number

V-209620

Group Title

SRG-OS-000266-GPOS-00101

Rule Version

AOSX-14-003011

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

This setting may be enforced using the "Passcode Policy" configuration profile or by a directory service.

Check Contents

Password policy can be set with a configuration profile or the "pwpolicy" utility. If password policy is set with a configuration profile, run the following command to check if the system is configured to require that passwords contain at least one special character:

/usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep minComplexChars

If the return is null or not ” minComplexChars = 1”, this is a finding.

Run the following command to check if the system is configured to require that passwords not contain repeated sequential characters or characters in increasing and decreasing sequential order:

/usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep allowSimple

If "allowSimple" is not set to "0" or is undefined, this is a finding.

Vulnerability Number

V-209620

Documentable

False

Rule Version

AOSX-14-003011

Severity Override Guidance

Password policy can be set with a configuration profile or the "pwpolicy" utility. If password policy is set with a configuration profile, run the following command to check if the system is configured to require that passwords contain at least one special character:

/usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep minComplexChars

If the return is null or not ” minComplexChars = 1”, this is a finding.

Run the following command to check if the system is configured to require that passwords not contain repeated sequential characters or characters in increasing and decreasing sequential order:

/usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep allowSimple

If "allowSimple" is not set to "0" or is undefined, this is a finding.

Check Content Reference

M

Target Key

2930

Comments