usnistgov/macos_security
1
0
Fork 0
mirror of https://github.com/usnistgov/macos_security.git synced 2026-03-03 17:02:01 +00:00
Code Issues 21 Actions Packages Projects Releases Wiki Activity

discussion, check, result change

Browse Source
This commit is contained in:
Bob Gendler
2021-10-14 13:38:03 -04:00
parent 06f39c5264
commit 137b77d323
1 changed files with 7 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
rules/os/os_directory_services_configured.yaml
View File

@@ -1,15 +1,13 @@
id: os_directory_services_configured
title: "The macOS system must be integrated into a directory services infrastructure."
title: "Integrate System into a Directory Services Infrastructure"
discussion: |
Distinct user account databases on each separate system cause problems with username and password policy enforcement. Most approved directory services infrastructure solutions allow centralized management of users and passwords.
The macOS system _MUST_ be integrated into a directory services infrastructure.
A directory service infrastructure enables centralized user and rights management, as well as centralized control over computer and user configurations. Integrating the macOS systems used throughout an organization into a directory services infrastructure ensures more administrator oversight and security than allowing distinct user account databases to exist on each separate system.
check: |
If the system is using a mandatory Smart Card Policy, this is Not Applicable.
To determine if the system is integrated to a directory service, ask the System Administrator (SA) or Information System Security Officer (ISSO) or run the following command:
/usr/bin/dscl localhost -list . | /usr/bin/grep -vE '(Contact|Search|Local|^$)'
If nothing is returned, or if the system is not integrated into a directory service infrastructure, this is a finding.
/usr/bin/dscl localhost -list . | /usr/bin/grep -vE '(Contact|Search|Local|^$)'; /bin/echo $?
result:
integer: 0
fix: |
Integrate the system into an existing directory services infrastructure.
references: