id: os_root_disable
title: Disable Root Login
discussion: |
  To assure individual accountability and prevent unauthorized access, logging in as root at the login window _MUST_ be disabled.

  The macOS system _MUST_ require individuals to be authenticated with an individual authenticator prior to using a group authenticator, and administrator users _MUST_ never log in directly as root.
check: |
  /usr/bin/dscl . -read /Users/root UserShell 2>&1 | /usr/bin/grep -c "/usr/bin/false"
result:
  integer: 1
fix: |
  [source,bash]
  ----
  /usr/bin/dscl . -create /Users/root UserShell /usr/bin/false
  ----
references:
  cce:
    - CCE-94279-7
  cci:
    - CCI-000764
    - CCI-000770
    - CCI-001813
    - CCI-004045
  800-53r5:
    - IA-2
    - IA-2(5)
  800-53r4:
    - IA-2
    - IA-2(5)
  800-171r3:
    - 03.05.01
  cis:
    benchmark:
      - 5.6 (level 1)
    controls v8:
      - 5.4
  cmmc:
    - IA.L1-3.5.1
    - IA.L1-3.5.2
  srg:
    - SRG-OS-000364-GPOS-00151
    - SRG-OS-000109-GPOS-00056
    - SRG-OS-000104-GPOS-00051
  disa_stig:
    - APPL-15-000100
  bio:
    - 5.16.02
macOS:
  - '15.0'
tags:
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
  - 800-53r4_low
  - 800-53r4_moderate
  - 800-53r4_high
  - 800-171
  - cis_lvl1
  - cis_lvl2
  - cisv8
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - cmmc_lvl1
  - stig
  - cnssi-1253_moderate
  - nlmapgov_plus
severity: medium
mobileconfig: false
mobileconfig_info:
