mirror of
https://github.com/usnistgov/macos_security.git
synced 2026-02-03 14:03:24 +00:00
Multiple issues with pwpolicy_ on Sequoia (Using Jamf Connect with EntraID as the OIDC Provider) #57
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @wewenttothemoon on GitHub.
Hello, I am reaching out because we are implementing CIS_LVL2 for Sequoia in our organization, and I am running across an issue with:
pwpolicy_account_lockout_enforce failed (Result: , Expected: "{'string': 'yes'}")
pwpolicy_account_lockout_timeout_enforce failed (Result: , Expected: "{'string': 'yes'}")
pwpolicy_alpha_numeric_enforce failed (Result: 0, Expected: "{'integer': 1}")
pwpolicy_custom_regex_enforce failed (Result: false, Expected: "{'string': 'true'}")
pwpolicy_history_enforce failed (Result: , Expected: "{'string': 'yes'}")
pwpolicy_max_lifetime_enforce failed (Result: , Expected: "{'integer': 365}")
pwpolicy_minimum_length_enforce failed (Result: false, Expected: "{'string': 'true'}")
pwpolicy_special_character_enforce failed (Result: , Expected: "{'string': 'true'}")
As you can see above, it fails to return any values. When I originally looked at /usr/bin/policy -getaccountpolicies this was the output:
After I read another bug post, I ran the sudo pwpolicy -clearaccountpolicies command, which results in a blank plist, no key/values.
I then reapplied the config profile with the com.apple.mobiledevice.passwordpolicy.plist which is:
However, it seems even after reapplying the config profile, the -getaccountpolicies command still returns a blank .plist with no key/values. (Also rebooted the system several times). I then created a brand-new Config Profile and deployed it to my test device, with the same result (after again running -clearaccountpolicies). I can see the new config profile under Device Management, but it seems to not be populating the pwpolicy -getaccountpolicies.
I was wondering if it was possible that this is occurring because we are using Jamf Connect (Jamf Pro) with EntraID as the OIDC provider?
The com.apple.mobiledevice.passwordpolicy.plist was generated using Jamf Compliance Editor with our org ODV's.
Device is Apple M3 Pro on Sequoia 15.4.1
@robertgendler commented on GitHub:
Sure is. But when you upload a plist and not mobileconfig file to jamf it pushes it to machines as mcx payload....which causes you the issues.
@wewenttothemoon commented on GitHub:
@robertgendler Thank you for quick feedback!
Understood, the password policy from EntraID is coming from AD via Entra Sync with no writeback enabled, so I was trying to match the same values we use as our ADDefaultDomainPasswordPolicy.
I've raised an issue in https://github.com/Jamf-Concepts/jamf-compliance-editor as suggested!
This is absolutely a dumb question, but how would I go about working with the project directly to generate the correct config profile?
@wewenttothemoon commented on GitHub:
@robertgendler I was reviewing the documentation for cis_lvl2 and correct me if I am wrong but isn't this the same as the .plist I used above?
@robertgendler commented on GitHub:
No question is dumb. But check out the wiki https://github.com/usnistgov/macos_security/wiki/Getting-Started
Then you can get to https://github.com/usnistgov/macos_security/wiki/Generate-Configuration-Profiles
@robertgendler commented on GitHub:
If you're using some sort of password policy from EntraID...lean into that and don't set your local pwpolicy.
2nd it looks as though Jamf Compliance Editor set this with an mcx preference. That's not compatible with com.apple.mobiledevice.passwordpolicy. You may want to file an issue with them https://github.com/Jamf-Concepts/jamf-compliance-editor as working with the project directly and not through an application, it works as it should.
@wewenttothemoon commented on GitHub:
@robertgendler Ahhh I see what you mean! Yup, I just uploaded the mobileconfig file it generated to Jamf Pro and it maps it to passcode:
It did complain about it not being compatible with the regex:
But like you said I will try to regenerate this .mobileconfig after following https://github.com/usnistgov/macos_security/wiki/Generate-Configuration-Profiles
And it seems to work now!
The failures are expected as I haven't set the ODV variables in the script yet.
Thank you so much @robertgendler !
@wewenttothemoon commented on GitHub:
@robertgendler Noted, I will keep that in mind! Crap... now I have to double check anything else I've deployed as an MCX preference... Again, many thanks for your time and invaluable guidance!
@robertgendler commented on GitHub:
Ya Jamf doesn't recognize all configuration keys.
You may want to sign the profile with a certificate. Then jamf won't complain. But you also can't edit or view it or do anything beyond scoping it then.