STIGQter: STIG Summary: Apple OS X 10.14 (Mojave) Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The macOS system must be configured so that the login command requires smart card authentication.

DISA Rule

SV-209626r610285_rule

Vulnerability Number

V-209626

Group Title

SRG-OS-000480-GPOS-00227

Rule Version

AOSX-14-003050

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Make a backup of the PAM LOGIN settings using the following command:
sudo cp /etc/pam.d/login /etc/pam.d/login_backup_`date "+%Y-%m-%d_%H:%M"`

Replace the contents of "/etc/pam.d/login" with the following:

# login: auth account password session
auth sufficient pam_smartcard.so
auth optional pam_krb5.so use_kcminit
auth optional pam_ntlm.so try_first_pass
auth optional pam_mount.so try_first_pass
auth required pam_opendirectory.so try_first_pass
auth required pam_deny.so
account required pam_nologin.so
account required pam_opendirectory.so
password required pam_opendirectory.so
session required pam_launchd.so
session required pam_uwtmp.so
session optional pam_mount.so

Check Contents

To verify that the "login" command has been configured to require smart card authentication, run the following command:

# cat /etc/pam.d/login | grep -i pam_smartcard.so

If the text that returns does not include the line, "auth sufficient pam_smartcard.so" at the TOP of the listing, this is a finding.

Vulnerability Number

V-209626

Documentable

False

Rule Version

AOSX-14-003050

Severity Override Guidance

To verify that the "login" command has been configured to require smart card authentication, run the following command:

# cat /etc/pam.d/login | grep -i pam_smartcard.so

If the text that returns does not include the line, "auth sufficient pam_smartcard.so" at the TOP of the listing, this is a finding.

Check Content Reference

M

Target Key

2930

Comments