Merge branch 'main' into feat-setup-experience
This commit is contained in:
Gabriel Hernandez
@@ -160,9 +160,15 @@ module.exports = {
|
||||
};
|
||||
},
|
||||
})
|
||||
.intercept((error)=>{
|
||||
.intercept(async (error)=>{
|
||||
// Note: with this current behavior, all errors from this upload are currently swallowed and a softwareUploadFailed response is returned.
|
||||
// FUTURE: Test to make sure that uploading duplicate software to a team results in a 409 response.
|
||||
// Before handline errors, decide what to do about the file uploaded to s3, if this is undeployed software, we'll leave it alone, but if this was a temporary file created to transfer it between teams on the Fleet instance, we'll delete the file.
|
||||
if(!software.id) {// If the software does not have an ID, it not stored in the app's database/s3 bucket, so we can safely delete the file in s3.
|
||||
await sails.rm(sails.config.uploads.prefixForFileDeletion+softwareFd);
|
||||
}
|
||||
// Log a warning containing an error
|
||||
sails.log.warn(`When attempting to upload a software installer, an unexpected error occurred communicating with the Fleet API, ${require('util').inspect(error, {depth: 0})}`);
|
||||
return {'softwareUploadFailed': error};
|
||||
});
|
||||
// console.timeEnd(`transfering ${software.name} to fleet instance for team id ${team}`);
|
||||
@@ -229,9 +235,15 @@ module.exports = {
|
||||
};
|
||||
},
|
||||
})
|
||||
.intercept((error)=>{
|
||||
.intercept(async (error)=>{
|
||||
// Note: with this current behavior, all errors from this upload are currently swallowed and a softwareUploadFailed response is returned.
|
||||
// FUTURE: Test to make sure that uploading duplicate software to a team results in a 409 response.
|
||||
// Before handling errors, decide what to do about the file uploaded to s3, if this is undeployed software, we'll leave it alone, but if this was a temporary file created to transfer it between teams on the Fleet instance, we'll delete the file.
|
||||
if(!software.id) {
|
||||
await sails.rm(sails.config.uploads.prefixForFileDeletion+softwareFd);
|
||||
}
|
||||
// Log a warning containing an error
|
||||
sails.log.warn(`When attempting to upload a software installer, an unexpected error occurred communicating with the Fleet API, ${require('util').inspect(error, {depth: 0})}`);
|
||||
return {'softwareUploadFailed': error};
|
||||
});
|
||||
// console.timeEnd(`transfering ${software.name} to fleet instance for team id ${teamApid}`);
|
||||
|
||||
@@ -33,6 +33,10 @@ module.exports = {
|
||||
statusCode: 409,
|
||||
},
|
||||
|
||||
softwareUploadFailed: {
|
||||
description:'An unexpected error occurred communicating with the Fleet API'
|
||||
}
|
||||
|
||||
},
|
||||
|
||||
|
||||
@@ -51,8 +55,8 @@ module.exports = {
|
||||
};
|
||||
await UndeployedSoftware.create(newSoftwareInfo);
|
||||
} else {
|
||||
uploadedSoftware = await sails.uploadOne(newSoftware, {bucket: sails.config.uploads.bucketWithPostfix});
|
||||
for(let teamApid of teams) {
|
||||
uploadedSoftware = await sails.uploadOne(newSoftware, {bucket: sails.config.uploads.bucketWithPostfix});
|
||||
var WritableStream = require('stream').Writable;
|
||||
await sails.cp(uploadedSoftware.fd, {bucket: sails.config.uploads.bucketWithPostfix}, {
|
||||
adapter: ()=>{
|
||||
@@ -96,8 +100,14 @@ module.exports = {
|
||||
};
|
||||
}
|
||||
})
|
||||
.intercept({response: {status: 409}}, (error)=>{
|
||||
.intercept({response: {status: 409}}, async (error)=>{
|
||||
await sails.rm(sails.config.uploads.prefixForFileDeletion+uploadedSoftware.fd);
|
||||
return {'softwareAlreadyExistsOnThisTeam': error};
|
||||
})
|
||||
.intercept({name: 'AxiosError'}, async (error)=>{
|
||||
await sails.rm(sails.config.uploads.prefixForFileDeletion+uploadedSoftware.fd);
|
||||
sails.log.warn(`When attempting to upload a software installer, an unexpected error occurred communicating with the Fleet API, ${require('util').inspect(error, {depth: 0})}`);
|
||||
return {'softwareUploadFailed': error};
|
||||
});
|
||||
}
|
||||
// Remove the file from the s3 bucket after it has been sent to the Fleet server.
|
||||
|
||||
@@ -43,7 +43,7 @@ parasails.registerComponent('cloud-error', {
|
||||
// ╩ ╩ ╩ ╩ ╩╩═╝
|
||||
template: `
|
||||
<div>
|
||||
<p :class="{ 'm-0': beWithoutMargins }" class="text-danger"><slot name="default">An error occured while processing your request. Please check your information and try again, or <a href="/contact">contact support</a> if the error persists.</slot></p>
|
||||
<p :class="{ 'm-0': beWithoutMargins }" class="text-danger"><slot name="default">An unexpected error occurred communicating with the Fleet API</slot></p>
|
||||
</div>
|
||||
`,
|
||||
|
||||
|
||||
@@ -95,6 +95,7 @@ parasails.registerPage('software', {
|
||||
this.modal = '';
|
||||
this.formErrors = {};
|
||||
this.formData = {};
|
||||
this.cloudError = '';
|
||||
this.showAdvancedOptions = false;
|
||||
await this.forceRender();
|
||||
},
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# macOS 13.0 Ventura benchmark
|
||||
|
||||
Fleet's policies have been written against v1.0 of the benchmark. You can refer to the [CIS website](https://www.cisecurity.org/cis-benchmarks) for full details about this version.
|
||||
Fleet's policies have been written against v2.1.0 of the benchmark. You can refer to the [CIS website](https://www.cisecurity.org/cis-benchmarks) for full details about this version.
|
||||
|
||||
For requirements and usage details, see the [CIS Benchmarks](https://fleetdm.com/docs/using-fleet/cis-benchmarks) documentation.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
# The latest version of CIS Benchmarks for macOS as of January 2023 was used which was benchmark 1.0 for macOS 13.0 https://workbench.cisecurity.org/benchmarks/10541
|
||||
# The latest version of CIS Benchmarks for macOS as of August 2024 was used which was benchmark 2.1.0 for macOS 13
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
@@ -517,6 +517,23 @@ spec:
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: CIS - Ensure the Time Service Is Enabled
|
||||
platforms: macOS
|
||||
platform: darwin
|
||||
description: |
|
||||
In macOS 10.14, Apple replace ntp with timed for time services, and is used to ensure correct time is kept. Correct date and time settings are required for authentication protocols, file creation, modification dates and log entries.
|
||||
resolution: |
|
||||
Ask your system administrator to deploy a script that will configure:
|
||||
/usr/bin/sudo /bin/launchctl load -w /System/Library/LaunchDaemons/com.apple.timed.plist
|
||||
query: |
|
||||
SELECT 1 WHERE EXISTS(SELECT * FROM processes WHERE path = '/usr/libexec/timed');
|
||||
purpose: Informational
|
||||
tags: compliance, CIS, CIS_Level1
|
||||
contributors: defensivedepth
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: CIS - Ensure Time Is Set Within Appropriate Limits (Fleetd Required)
|
||||
platforms: macOS
|
||||
@@ -1366,10 +1383,10 @@ spec:
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: CIS - Ensure Location Services Is in the Menu Bar
|
||||
name: CIS - Ensure 'Show Location Icon in Control Center when System Services Request Your Location' Is Enabled
|
||||
platforms: macOS
|
||||
platform: darwin
|
||||
description: Checks that Location Services option is presented in the Menu Bar.
|
||||
description: This setting provides the user an understanding of the current status of Location Services and which applications are using it.
|
||||
resolution: |
|
||||
Automated method:
|
||||
Ask your system administrator to deploy an MDM profile that enables the "location services" icon in menu bar when System Services request your location.
|
||||
@@ -1383,7 +1400,7 @@ spec:
|
||||
location is set to your organization's parameters
|
||||
query: SELECT 1 FROM plist WHERE path='/Library/Preferences/com.apple.locationmenu.plist' AND key='ShowSystemServices' AND value=1;
|
||||
purpose: Informational
|
||||
tags: compliance, CIS, CIS_Level2, CIS-macos-13-2.6.1.2
|
||||
tags: compliance, CIS, CIS_Level2
|
||||
contributors: sharon-fdm
|
||||
---
|
||||
apiVersion: v1
|
||||
@@ -1713,15 +1730,16 @@ spec:
|
||||
that can be attempted against the RAM that has the encryption keys or the running operating system protected
|
||||
by a login screen.
|
||||
|
||||
Mac systems should be set to hibernate after sleeping for a risk-acceptable time period.
|
||||
MacBooks should be set so that the `standbydelay` is 15 minutes (900 seconds) or less.
|
||||
Mac systems should be set to hibernate after sleeping for a risk-acceptable time period.
|
||||
Organizations may still decide to use hibernate after sleeping if there is a security need
|
||||
(ex. international travel), but it can cause kernel panics in Apple Silicon Macs.
|
||||
resolution: |
|
||||
Ask your system administrator to deploy the following script to Macbook devices:
|
||||
if [[ $(uname -m) == 'arm64' ]]; then
|
||||
# Apple silicon
|
||||
/usr/bin/sudo /usr/bin/pmset -a standby 900
|
||||
/usr/bin/sudo /usr/bin/pmset -a destroyfvkeyonstandby 1
|
||||
/usr/bin/sudo /usr/bin/pmset -a hibernatemode 25
|
||||
else
|
||||
# Intel
|
||||
/usr/bin/sudo /usr/bin/pmset -a standbydelaylow 900
|
||||
@@ -1762,12 +1780,11 @@ spec:
|
||||
SELECT 1 FROM system_info WHERE cpu_type = 'arm64e'
|
||||
) AND EXISTS (
|
||||
SELECT
|
||||
CAST(JSON_EXTRACT(battery, '$.standby') AS INTEGER) AS standby,
|
||||
CAST(JSON_EXTRACT(battery, '$.hibernatemode') AS INTEGER) AS hibernatemode
|
||||
CAST(JSON_EXTRACT(battery, '$.standby') AS INTEGER) AS standby
|
||||
FROM (
|
||||
SELECT JSON_EXTRACT(json_result, '$.Battery Power:') AS battery FROM pmset WHERE getting = 'custom'
|
||||
)
|
||||
WHERE standby <= 900 AND hibernatemode = 25
|
||||
WHERE standby <= 900
|
||||
)
|
||||
)
|
||||
);
|
||||
@@ -2184,10 +2201,10 @@ spec:
|
||||
platforms: macOS
|
||||
platform: darwin
|
||||
description: |
|
||||
macOS's audit facility, auditd, receives notifications from the kernel when certain system calls, such as open, fork, and exit, are made. These notifications are captured and written to an audit log.
|
||||
macOS's audit facility, auditd, receives notifications from the kernel when certain system calls, such as open, fork, and exit, are made. These notifications are captured and written to an audit log. Apple has deprecated auditd as of macOS 11.0 Big Sur. In macOS 14.0 Sonoma it is no longer enabled by default.
|
||||
resolution: |
|
||||
Automated method:
|
||||
Ask your system administrator to deploy the following script which will enable security auditing:
|
||||
Ask your system administrator to deploy the following script which will load auditd and create the audit_control file:
|
||||
/usr/bin/sudo /bin/launchctl load -w /System/Library/LaunchDaemons/com.apple.auditd.plist
|
||||
query: |
|
||||
SELECT 1 WHERE EXISTS (
|
||||
@@ -2635,14 +2652,11 @@ spec:
|
||||
platforms: macOS
|
||||
platform: darwin
|
||||
description: |
|
||||
Software sometimes insists on being installed in the /System/Volumes/Data/System Directory and has inappropriate world-writable permissions.
|
||||
Macs with writable files in System should be investigated forensically. A file with open writable permissions is a sign of at best a rogue application.
|
||||
It could also be a sign of a computer compromise and a persistent presence on the system.
|
||||
The audit check excludes the "Drop Box" folder that is part of Apple's default user template.
|
||||
Software sometimes insists on being installed in the /System/Volumes/Data/System Directory and has inappropriate world-writable permissions. Macs with writable files in System should be investigated forensically. A file with open writable permissions is a sign of at best a rogue application. It could also be a sign of a computer compromise and a persistent presence on the system.
|
||||
resolution: |
|
||||
Ask your system administrator to deploy a script that will ensure folders are not world-writable in the /System folder.
|
||||
/usr/bin/sudo IFS=$'\n'
|
||||
for sysPermissions in $( /usr/bin/find /System/Volumes/Data/System -type d -perm -2 | /usr/bin/grep -v "Drop Box" );
|
||||
for sysPermissions in $( /usr/bin/find /System/Volumes/Data/System -type d -perm -2 | /usr/bin/grep -vE "Drop Box|locks" );
|
||||
do
|
||||
/bin/chmod -R o-w "$sysPermissions"
|
||||
done
|
||||
@@ -2666,11 +2680,15 @@ spec:
|
||||
platform: darwin
|
||||
description: |
|
||||
Software sometimes insists on being installed in the /System/Volumes/Data/Library Directory and has inappropriate world-writable permissions.
|
||||
Folders in /System/Volumes/Data/Library should not be world-writable. The audit check excludes the /System/Volumes/Data/Library/Caches and /System/Volumes/Data/Library/Preferences/Audio/Data folders where the sticky bit is set.
|
||||
Folders in /System/Volumes/Data/Library should not be world-writable. Macs with writable files in System should be investigated forensically.
|
||||
A file with open writable permissions is a sign of at best a rogue application. It could also be a sign of a computer compromise and a
|
||||
persistent presence on the system.
|
||||
|
||||
The audit check excludes the /System/Volumes/Data/Library/Caches and /System/Volumes/Data/Library/Preferences/Audio/Data folders where the sticky bit is set.
|
||||
resolution: |
|
||||
Ask your system administrator to deploy a script that will ensure folders are not world-writable in the /System folder.
|
||||
/usr/bin/sudo IFS=$'\n'
|
||||
for libPermissions in $( /usr/bin/find /System/Volumes/Data/Library -type d -perm -2 | /usr/bin/grep -v Caches | /usr/bin/grep -v /Preferences/Audio/Data);
|
||||
for libPermissions in $(/usr/bin/find /System/Volumes/Data/Library -type d -perm -2 | /usr/bin/grep -Ev "Caches|/Preferences/Audio/Data|locks");
|
||||
do
|
||||
/bin/chmod -R o-w "$libPermissions"
|
||||
done
|
||||
@@ -3006,16 +3024,16 @@ spec:
|
||||
resolution: |
|
||||
Automated method:
|
||||
Ask your system administrator to deploy a script that runs the following:
|
||||
/usr/bin/sudo /usr/bin/security authorizationdb write system.login.screensaver use-login-window-ui
|
||||
/usr/bin/sudo /usr/bin/security authorizationdb write system.login.screensaver authenticate-session-owner
|
||||
query: |
|
||||
SELECT 1 WHERE EXISTS (
|
||||
SELECT JSON_EXTRACT(json_result, '$.rule') AS rule
|
||||
FROM authdb
|
||||
WHERE right_name = 'system.login.screensaver' AND
|
||||
rule LIKE '%use-login-window-ui%'
|
||||
rule LIKE '%authenticate-session-owner%'
|
||||
);
|
||||
purpose: Informational
|
||||
tags: compliance, CIS, CIS_Level1, CIS-macos-13-5.7
|
||||
tags: compliance, CIS, CIS_Level1
|
||||
contributors: lucasmrod
|
||||
---
|
||||
apiVersion: v1
|
||||
@@ -3449,6 +3467,30 @@ spec:
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: CIS - Ensure Show Status Bar Is Enabled (MDM Required)
|
||||
platforms: macOS
|
||||
platform: darwin
|
||||
description: |
|
||||
The Status Bar in Safari shows the full URL of any link on hover. It protects the user from visiting sites where the domain has been obfuscated by allowing the user to review whether the link points to an unexpected location.
|
||||
resolution: |
|
||||
Automated method:
|
||||
Profile Method:
|
||||
Create or edit a configuration profile with the following information:
|
||||
1. The PayloadType string is com.apple.Safari
|
||||
2. The key to include is ShowOverlayStatusBar
|
||||
3. The key must be set to: <true/>
|
||||
query: |
|
||||
SELECT 1 FROM managed_policies WHERE
|
||||
domain='com.apple.Safari' AND
|
||||
name='ShowOverlayStatusBar' AND
|
||||
(value = 1 OR value = 'true');
|
||||
purpose: Informational
|
||||
tags: compliance, CIS, CIS_Level1
|
||||
contributors: defensivedepth
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: CIS - Ensure Secure Keyboard Entry Terminal.app Is Enabled (MDM Required)
|
||||
platforms: macOS
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# macOS 14.0 Sonoma benchmark
|
||||
# macOS 14 Sonoma benchmark
|
||||
|
||||
Fleet's policies have been written against v1.0 of the benchmark. You can refer to the [CIS website](https://www.cisecurity.org/cis-benchmarks) for full details about this version.
|
||||
Fleet's policies have been written against v1.1.0 of the benchmark. You can refer to the [CIS website](https://www.cisecurity.org/cis-benchmarks) for full details about this version.
|
||||
|
||||
For requirements and usage details, see the [CIS Benchmarks](https://fleetdm.com/docs/using-fleet/cis-benchmarks) documentation.
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
# The latest version of CIS Benchmarks for macOS as of January 2024 for macOS 14.
|
||||
# The latest version of CIS Benchmarks for macOS as of August 2024 for macOS 14.
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
@@ -518,17 +518,19 @@ spec:
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: CIS - Ensure Time Is Set Within Appropriate Limits (Fleetd Required)
|
||||
name: CIS - Ensure the Time Service Is Enabled
|
||||
platforms: macOS
|
||||
platform: darwin
|
||||
description: |
|
||||
Correct date and time settings are required for authentication protocols, file creation, modification dates and log entries.
|
||||
The time offset compared to time.apple.com must be between -270.x and 270.x seconds.
|
||||
resolution: Make sure the device can connect to time.apple.com to synchronize time.
|
||||
query: SELECT * FROM sntp_request WHERE server = 'time.apple.com' AND clock_offset_ms <= 270000 AND clock_offset_ms >= -270000;
|
||||
In macOS 10.14, Apple replace ntp with timed for time services, and is used to ensure correct time is kept. Correct date and time settings are required for authentication protocols, file creation, modification dates and log entries.
|
||||
resolution: |
|
||||
Ask your system administrator to deploy a script that will configure:
|
||||
/usr/bin/sudo /bin/launchctl load -w /System/Library/LaunchDaemons/com.apple.timed.plist
|
||||
query: |
|
||||
SELECT 1 WHERE EXISTS(SELECT * FROM processes WHERE path = '/usr/libexec/timed');
|
||||
purpose: Informational
|
||||
tags: compliance, CIS, CIS_Level1
|
||||
contributors: lucasmrod
|
||||
contributors: defensivedepth
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
@@ -1366,10 +1368,10 @@ spec:
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: CIS - Ensure Location Services Is in the Menu Bar
|
||||
name: CIS - Ensure 'Show Location Icon in Control Center when System Services Request Your Location' Is Enabled
|
||||
platforms: macOS
|
||||
platform: darwin
|
||||
description: Checks that Location Services option is presented in the Menu Bar.
|
||||
description: This setting provides the user an understanding of the current status of Location Services and which applications are using it.
|
||||
resolution: |
|
||||
Automated method:
|
||||
Ask your system administrator to deploy an MDM profile that enables the "location services" icon in menu bar when System Services request your location.
|
||||
@@ -1713,15 +1715,16 @@ spec:
|
||||
that can be attempted against the RAM that has the encryption keys or the running operating system protected
|
||||
by a login screen.
|
||||
|
||||
Mac systems should be set to hibernate after sleeping for a risk-acceptable time period.
|
||||
MacBooks should be set so that the `standbydelay` is 15 minutes (900 seconds) or less.
|
||||
Mac systems should be set to hibernate after sleeping for a risk-acceptable time period.
|
||||
Organizations may still decide to use hibernate after sleeping if there is a security need
|
||||
(ex. international travel), but it can cause kernel panics in Apple Silicon Macs.
|
||||
resolution: |
|
||||
Ask your system administrator to deploy the following script to Macbook devices:
|
||||
if [[ $(uname -m) == 'arm64' ]]; then
|
||||
# Apple silicon
|
||||
/usr/bin/sudo /usr/bin/pmset -a standby 900
|
||||
/usr/bin/sudo /usr/bin/pmset -a destroyfvkeyonstandby 1
|
||||
/usr/bin/sudo /usr/bin/pmset -a hibernatemode 25
|
||||
else
|
||||
# Intel
|
||||
/usr/bin/sudo /usr/bin/pmset -a standbydelaylow 900
|
||||
@@ -1762,12 +1765,11 @@ spec:
|
||||
SELECT 1 FROM system_info WHERE cpu_type = 'arm64e'
|
||||
) AND EXISTS (
|
||||
SELECT
|
||||
CAST(JSON_EXTRACT(battery, '$.standby') AS INTEGER) AS standby,
|
||||
CAST(JSON_EXTRACT(battery, '$.hibernatemode') AS INTEGER) AS hibernatemode
|
||||
CAST(JSON_EXTRACT(battery, '$.standby') AS INTEGER) AS standby
|
||||
FROM (
|
||||
SELECT JSON_EXTRACT(json_result, '$.Battery Power:') AS battery FROM pmset WHERE getting = 'custom'
|
||||
)
|
||||
WHERE standby <= 900 AND hibernatemode = 25
|
||||
WHERE standby <= 900
|
||||
)
|
||||
)
|
||||
);
|
||||
@@ -2213,11 +2215,12 @@ spec:
|
||||
platforms: macOS
|
||||
platform: darwin
|
||||
description: |
|
||||
macOS's audit facility, auditd, receives notifications from the kernel when certain system calls, such as open, fork, and exit, are made. These notifications are captured and written to an audit log.
|
||||
macOS's audit facility, auditd, receives notifications from the kernel when certain system calls, such as open, fork, and exit, are made. These notifications are captured and written to an audit log. Apple has deprecated auditd as of macOS 11.0 Big Sur. In macOS 14.0 Sonoma it is no longer enabled by default..
|
||||
resolution: |
|
||||
Automated method:
|
||||
Ask your system administrator to deploy the following script which will enable security auditing:
|
||||
Ask your system administrator to deploy the following script which will enable security auditing and create the audit_control file::
|
||||
/usr/bin/sudo /bin/launchctl load -w /System/Library/LaunchDaemons/com.apple.auditd.plist
|
||||
/usr/bin/sudo /bin/cp /etc/security/audit_control.example /etc/security/audit_control
|
||||
query: |
|
||||
SELECT 1 WHERE EXISTS (
|
||||
SELECT
|
||||
@@ -2664,14 +2667,11 @@ spec:
|
||||
platforms: macOS
|
||||
platform: darwin
|
||||
description: |
|
||||
Software sometimes insists on being installed in the /System/Volumes/Data/System Directory and has inappropriate world-writable permissions.
|
||||
Macs with writable files in System should be investigated forensically. A file with open writable permissions is a sign of at best a rogue application.
|
||||
It could also be a sign of a computer compromise and a persistent presence on the system.
|
||||
The audit check excludes the "Drop Box" folder that is part of Apple's default user template.
|
||||
Software sometimes insists on being installed in the /System/Volumes/Data/System Directory and has inappropriate world-writable permissions. Macs with writable files in System should be investigated forensically. A file with open writable permissions is a sign of at best a rogue application. It could also be a sign of a computer compromise and a persistent presence on the system.
|
||||
resolution: |
|
||||
Ask your system administrator to deploy a script that will ensure folders are not world-writable in the /System folder.
|
||||
/usr/bin/sudo IFS=$'\n'
|
||||
for sysPermissions in $( /usr/bin/find /System/Volumes/Data/System -type d -perm -2 | /usr/bin/grep -v "Drop Box" );
|
||||
for sysPermissions in $( /usr/bin/find /System/Volumes/Data/System -type d -perm -2 | /usr/bin/grep -vE "Drop Box|locks" );
|
||||
do
|
||||
/bin/chmod -R o-w "$sysPermissions"
|
||||
done
|
||||
@@ -3035,13 +3035,13 @@ spec:
|
||||
resolution: |
|
||||
Automated method:
|
||||
Ask your system administrator to deploy a script that runs the following:
|
||||
/usr/bin/sudo /usr/bin/security authorizationdb write system.login.screensaver use-login-window-ui
|
||||
/usr/bin/sudo /usr/bin/security authorizationdb write system.login.screensaver authenticate-session-owner
|
||||
query: |
|
||||
SELECT 1 WHERE EXISTS (
|
||||
SELECT JSON_EXTRACT(json_result, '$.rule') AS rule
|
||||
FROM authdb
|
||||
WHERE right_name = 'system.login.screensaver' AND
|
||||
rule LIKE '%use-login-window-ui%'
|
||||
rule LIKE '%authenticate-session-owner%'
|
||||
);
|
||||
purpose: Informational
|
||||
tags: compliance, CIS, CIS_Level1
|
||||
@@ -3448,6 +3448,30 @@ spec:
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: CIS - Ensure Show Status Bar Is Enabled (MDM Required)
|
||||
platforms: macOS
|
||||
platform: darwin
|
||||
description: |
|
||||
The Status Bar in Safari shows the full URL of any link on hover. It protects the user from visiting sites where the domain has been obfuscated by allowing the user to review whether the link points to an unexpected location.
|
||||
resolution: |
|
||||
Automated method:
|
||||
Profile Method:
|
||||
Create or edit a configuration profile with the following information:
|
||||
1. The PayloadType string is com.apple.Safari
|
||||
2. The key to include is ShowOverlayStatusBar
|
||||
3. The key must be set to: <true/>
|
||||
query: |
|
||||
SELECT 1 FROM managed_policies WHERE
|
||||
domain='com.apple.Safari' AND
|
||||
name='ShowOverlayStatusBar' AND
|
||||
(value = 1 OR value = 'true');
|
||||
purpose: Informational
|
||||
tags: compliance, CIS, CIS_Level1
|
||||
contributors: defensivedepth
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: policy
|
||||
spec:
|
||||
name: CIS - Ensure Secure Keyboard Entry Terminal.app Is Enabled (MDM Required)
|
||||
platforms: macOS
|
||||
|
||||
@@ -33,6 +33,7 @@ import (
|
||||
"github.com/google/uuid"
|
||||
)
|
||||
|
||||
// Deprecated: use the new GetABMTokens API endpoint.
|
||||
func (svc *Service) GetAppleBM(ctx context.Context) (*fleet.AppleBM, error) {
|
||||
if err := svc.authz.Authorize(ctx, &fleet.AppleBM{}, fleet.ActionRead); err != nil {
|
||||
return nil, err
|
||||
@@ -663,10 +664,9 @@ func (svc *Service) InitiateMDMAppleSSO(ctx context.Context) (string, error) {
|
||||
return "", ctxerr.Wrap(ctx, err, "InitiateSSO getting metadata")
|
||||
}
|
||||
|
||||
serverURL := appConfig.ServerSettings.ServerURL
|
||||
authSettings := sso.Settings{
|
||||
Metadata: metadata,
|
||||
AssertionConsumerServiceURL: serverURL + svc.config.Server.URLPrefix + "/api/v1/fleet/mdm/sso/callback",
|
||||
AssertionConsumerServiceURL: appConfig.MDMUrl() + svc.config.Server.URLPrefix + "/api/v1/fleet/mdm/sso/callback",
|
||||
SessionStore: svc.ssoSessionStore,
|
||||
OriginalURL: "/api/v1/fleet/mdm/sso/callback",
|
||||
}
|
||||
@@ -727,8 +727,8 @@ func (svc *Service) mdmSSOHandleCallbackAuth(ctx context.Context, auth fleet.Aut
|
||||
*metadata,
|
||||
auth,
|
||||
settings.EntityID,
|
||||
appConfig.ServerSettings.ServerURL,
|
||||
appConfig.ServerSettings.ServerURL+svc.config.Server.URLPrefix+"/api/v1/fleet/mdm/sso/callback",
|
||||
appConfig.MDMUrl(),
|
||||
appConfig.MDMUrl()+svc.config.Server.URLPrefix+"/api/v1/fleet/mdm/sso/callback",
|
||||
)
|
||||
if err != nil {
|
||||
return "", "", "", ctxerr.Wrap(ctx, err, "validating sso response")
|
||||
@@ -1170,7 +1170,7 @@ func (svc *Service) GetMDMManualEnrollmentProfile(ctx context.Context) ([]byte,
|
||||
|
||||
mobileConfig, err := apple_mdm.GenerateEnrollmentProfileMobileconfig(
|
||||
appConfig.OrgInfo.OrgName,
|
||||
appConfig.ServerSettings.ServerURL,
|
||||
appConfig.MDMUrl(),
|
||||
string(assets[fleet.MDMAssetSCEPChallenge].Value),
|
||||
topic,
|
||||
)
|
||||
|
||||
Reference in New Issue
Block a user