The 'ftp' service must be disabled as it sends all data in a clear-text form that can be easily intercepted and read. The macOS system must not use unencrypted FTP. The data needs to be protected at all times during transmission, and. The 'telnet' service must be disabled as it sends all data in a clear-text form that can be easily intercepted and read. Without confidentiality and integrity protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session. The macOS system must implement DoD-approved encryption to protect the confidentiality and integrity of remote access sessions including transmitted data and data during preparation for transmission. The 'sudo' command must be configured to prompt for the administrator's password at least once in each newly opened Terminal window or remote logon session, as this prevents a malicious user from. The macOS system must be configured with the sudoers file configured to authenticate users on a per -tty basis. The macOS system must be configured to disable the system preference pane for iCloud.

The macOS system must have the security assessment policy subsystem enabled.Īny changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the. Employing an automated mechanism to detect this. Malicious software can establish a base on individual desktops and servers. The macOS system must use a DoD antivirus program.Īn approved antivirus product must be installed and configured to run. Most approved directory services infrastructure solutions allow centralized. The macOS system must be integrated into a directory services infrastructure.ĭistinct user account databases on each separate system cause problems with username and password policy enforcement.

The 'tftp' service must be disabled as it sends all data in a clear-text form that can be easily intercepted and read.

Permitting access via a guest account provides unauthenticated access to any person. Only authorized individuals should be allowed to obtain access to operating system components. The macOS system must not have a guest account. These unnecessary capabilities or services are often. It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. The macOS system must be configured to disable rshd service. Findings (MAC III - Administrative Sensitive) Finding ID

Enable telnet on mac os 10.13