usnistgov/macos_security
1
0
Fork 0
mirror of https://github.com/usnistgov/macos_security.git synced 2026-02-03 14:03:24 +00:00
Code Issues 21 Actions Packages Projects Releases Wiki Activity

handful of settings aren't "fixed" by compliance script #196

New Issue
Closed
opened 2026-01-19 18:29:36 +00:00 by michael · 4 comments
michael commented 2026-01-19 18:29:36 +00:00
Owner
Copy Link

Originally created by @bdruth on GitHub.

Originally assigned to: @robertgendler on GitHub.

Summary

After setting up a baseline using 800-53 Low, a handful of settings don't seem to be applied and/or fixed by the compliance script, specifically:

  • auth_ssh_password_authentication_disable
  • pwpolicy_lower_case_character_enforce
  • pwpolicy_minimum_lifetime_enforce
  • pwpolicy_upper_case_character_enforce

Steps to reproduce

  1. create baseline policy that includes these controls
  2. generate profiles
  3. install profiles / copy preferences to /Library/Preferences & reboot
  4. set pwpolicy plist in compliance script
  5. run --check and --fix and --check again to see if settings are in compliance

Operating System version

Ventura 13.1

Intel or Apple Silicon

Intel via VMware Fusion

What is the current bug behavior?

no matter how many times I run --fix / reboot / etc. - the --check is still failing with the above keys

output from --fix seems OK, no indication of an error

What is the expected correct behavior?

Running --fix should correct things found by --check and a subsequent --check should pass.

Relevant logs and/or screenshots

From --fix

Wed Jan 18 16:32:43 UTC 2023 Running the command to configure the settings for: auth_ssh_password_authentication_disable ...
Wed Jan 18 16:32:45 UTC 2023 Running the command to configure the settings for: pwpolicy_lower_case_character_enforce ...
Setting global account policies
Wed Jan 18 16:32:46 UTC 2023 Running the command to configure the settings for: pwpolicy_minimum_lifetime_enforce ...
Setting global account policies
Wed Jan 18 16:32:46 UTC 2023 Running the command to configure the settings for: pwpolicy_upper_case_character_enforce ...
Setting global account policies

Output of checks

From --check

Wed Jan 18 17:04:59 UTC 2023 auth_ssh_password_authentication_disable failed (Result: 1, Expected: {integer: 2})
XPath set is empty
Wed Jan 18 17:05:05 UTC 2023 pwpolicy_lower_case_character_enforce failed (Result: , Expected: {string: yes})
XPath set is empty
Wed Jan 18 17:05:05 UTC 2023 pwpolicy_minimum_lifetime_enforce failed (Result: , Expected: {string: yes})
XPath set is empty
Wed Jan 18 17:05:05 UTC 2023 pwpolicy_upper_case_character_enforce failed (Result: , Expected: {string: yes})

Possible fixes

unknown at this time - very new to this effort / process

Originally created by @bdruth on GitHub. Originally assigned to: @robertgendler on GitHub. ### Summary After setting up a baseline using 800-53 Low, a handful of settings don't seem to be applied and/or fixed by the compliance script, specifically: * `auth_ssh_password_authentication_disable` * `pwpolicy_lower_case_character_enforce` * `pwpolicy_minimum_lifetime_enforce` * `pwpolicy_upper_case_character_enforce` ### Steps to reproduce 1. create baseline policy that includes these controls 2. generate profiles 3. install profiles / copy preferences to `/Library/Preferences` & reboot 4. set pwpolicy plist in compliance script 5. run `--check` and `--fix` and `--check` again to see if settings are in compliance ### Operating System version Ventura 13.1 ### Intel or Apple Silicon Intel via VMware Fusion ### What is the current *bug* behavior? no matter how many times I run `--fix` / reboot / etc. - the `--check` is still failing with the above keys output from `--fix` seems OK, no indication of an error ### What is the expected *correct* behavior? Running `--fix` should correct things found by `--check` and a subsequent `--check` should pass. ### Relevant logs and/or screenshots From `--fix` ``` Wed Jan 18 16:32:43 UTC 2023 Running the command to configure the settings for: auth_ssh_password_authentication_disable ... Wed Jan 18 16:32:45 UTC 2023 Running the command to configure the settings for: pwpolicy_lower_case_character_enforce ... Setting global account policies Wed Jan 18 16:32:46 UTC 2023 Running the command to configure the settings for: pwpolicy_minimum_lifetime_enforce ... Setting global account policies Wed Jan 18 16:32:46 UTC 2023 Running the command to configure the settings for: pwpolicy_upper_case_character_enforce ... Setting global account policies ``` ### Output of checks From `--check` ``` Wed Jan 18 17:04:59 UTC 2023 auth_ssh_password_authentication_disable failed (Result: 1, Expected: {integer: 2}) XPath set is empty Wed Jan 18 17:05:05 UTC 2023 pwpolicy_lower_case_character_enforce failed (Result: , Expected: {string: yes}) XPath set is empty Wed Jan 18 17:05:05 UTC 2023 pwpolicy_minimum_lifetime_enforce failed (Result: , Expected: {string: yes}) XPath set is empty Wed Jan 18 17:05:05 UTC 2023 pwpolicy_upper_case_character_enforce failed (Result: , Expected: {string: yes}) ``` ### Possible fixes unknown at this time - very new to this effort / process
michael commented 2026-01-19 18:29:37 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

the pwpolicy rules listed will not apply a fix. As noted in the Fix

  
  To set local policy to require a minimum password lifetime, edit the current password policy to contain the following <dict> within the "policyCategoryPasswordContent":
  
  [source,xml]
  ----
  <dict>
  <key>policyContent</key>
  <string>policyAttributeLastPasswordChangeTime &lt; policyAttributeCurrentTime - (policyAttributeMinimumLifetimeHours * 60 * 60)</string>
  <key>policyIdentifier</key>
  <string>Minimum Password Lifetime</string>
  <key>policyParameters</key>
  <dict>
  <key>policyAttributeMinimumLifetimeHours</key>
  <integer>$ODV</integer>
  </dict>
  </dict>
  ----
  After saving the file and exiting to the command prompt, run the following command to load the new policy file, substituting the path to the file in place of "$pwpolicy_file".
  
  [source,bash]
  ----
  /usr/bin/pwpolicy setaccountpolicies $pwpolicy_file
  ----
NOTE: See the password policy supplemental on more information on how to implement password policies on macOS.```
@robertgendler commented on GitHub: the pwpolicy rules listed will not apply a fix. As noted in the Fix ``` This setting may be enforced using local policy or by a directory service. To set local policy to require a minimum password lifetime, edit the current password policy to contain the following <dict> within the "policyCategoryPasswordContent": [source,xml] ---- <dict> <key>policyContent</key> <string>policyAttributeLastPasswordChangeTime &lt; policyAttributeCurrentTime - (policyAttributeMinimumLifetimeHours * 60 * 60)</string> <key>policyIdentifier</key> <string>Minimum Password Lifetime</string> <key>policyParameters</key> <dict> <key>policyAttributeMinimumLifetimeHours</key> <integer>$ODV</integer> </dict> </dict> ---- After saving the file and exiting to the command prompt, run the following command to load the new policy file, substituting the path to the file in place of "$pwpolicy_file". [source,bash] ---- /usr/bin/pwpolicy setaccountpolicies $pwpolicy_file ---- NOTE: See the password policy supplemental on more information on how to implement password policies on macOS.```
michael commented 2026-01-19 18:29:37 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

It appears the setting changed in openssh from ChallengeResponseAuthentication to KbdInteractiveAuthentication for auth_ssh_password_authentication_disable

@robertgendler commented on GitHub: It appears the setting changed in openssh from `ChallengeResponseAuthentication` to `KbdInteractiveAuthentication` for auth_ssh_password_authentication_disable
michael commented 2026-01-19 18:29:37 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

In the rules folder there's a supplemental folder.

When you generate guidance, it's included at the end of the document.

@robertgendler commented on GitHub: In the rules folder there's a supplemental folder. When you generate guidance, it's included at the end of the document.
michael commented 2026-01-19 18:29:37 +00:00
Author
Owner
Copy Link

@bdruth commented on GitHub:

@robertgendler - thx for the addl info - what's the password policy supplemental that's referenced?

@bdruth commented on GitHub: @robertgendler - thx for the addl info - what's the _password policy supplemental_ that's referenced?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
michael
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: usnistgov/macos_security#196
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?