NIST Security Configuration Checklist for macOS 10.12

This page contains supplemental resources to NIST Special Publication (SP) 800-179 Revision 1, Guide to Securing macOS 10.12 Systems for IT Professionals: A NIST Security Configuration Checklist. The publication is located at https://csrc.nist.gov/publications/detail/sp/800-179/rev-1/draft.
Please send any comments to [email protected].

Settings Spreadsheet

The settings spreadsheet contains the information needed to configure a system on a per-setting basis. It includes each setting's identifier, command line instructions, and profile values. For a detailed explanation of the spreadsheet contents, see Appendix A of SP 800-179 Rev. 1.

Script Overview

The samc10_12 shell script performs 2 functions:

• set configuration items to specified NIST profile values for macOS version 10.12
• read the current system state for settings specified by the NIST profiles

All configuration settings are grouped into batches. This is done to allow specific portions of the settings to be run easily. Every setting has a unique Common Configuration Enumeration (CCE) identifier and its own script function. This is used to track any action performed by a setting throughout the script.

Some settings are user-specific. The script functions for these settings are aggregated in a list where they will be run for a specified user, or all users, as determined by the script options.

Usage

The script must be run as root. In order to run the script, the execute bit must be enabled. Enable execution with the following command: chmod +x samc10_12.sh After running the script, a system restart is required for some settings to take effect.

The -p and -s options provide the core functionality, and the other options modify how these behave. Except when using the -l or -h options, -p or -s should always be used.

Options

Examples

Run Script to Assess System State for All Users

1. Download the “samc10_12.sh” script. To avoid access permission errors, put the script in a directory accessible to all users, such as the /Users/Shared directory.
2. Open the Terminal program.
3. In Terminal, navigate to the directory where the script was downloaded using the cd command.
4. Type chmod +x samc10_12.sh and press "enter" to enable the execution permssion on the script. Note that if you have already downloaded the script and run this command, it is not necessary to do this again.
5. If you are not logged into an admin account, type su USERNAME, where USERNAME is an administrator account, and press “enter”. Then type your password when prompted.
6. Type sudo ./samc10_12.sh -pa and press "enter". This will run the script with the -p and -a options, which prints the system state for all users on the system.
7. Type your password when prompted, and the script will begin execution.

Run Script to Apply Enterprise Profile for All Users

1. Download the “samc10_12.sh” script. To avoid access permission errors, put the script in a directory accessible to all users, such as the /Users/Shared directory.
2. Open the Terminal program.
3. In Terminal, navigate to the directory where the script was downloaded using the cd command.
4. Type chmod +x samc10_12.sh and press "enter" to enable the execution permssion on the script. Note that if you have already downloaded the script and run this command, it is not necessary to do this again.
5. If you are not logged into an admin account, type su USERNAME, where USERNAME is an administrator account, and press “enter”. Then type your password when prompted.
6. Type sudo ./samc10_12.sh -s ent -a and press "enter". This will run the script with the -s and -a options, which applies the settings using the enterprise profile for all users on the system.
7. Type your password when prompted, and the script will begin execution.

Password Policy: Formatted .plist

The samc10_12_pwpolicy.plist file contains the password policies generated by the script and recommended by the publication.

FAQ

What version of macOS is supported by this script?
Only macOS 10.12 (Sierra) is supported.

How do I enable SSH on a host system after applying a configuration profile?
The configuration uses multiple methods to prevent SSH access. Using an administrative account, do the following on the host system to re-enable remote login:

1. Open System Preferences -> Sharing. Enable "Remote Login", and add the desired users to the "Allowed Access for" box.
2. In System Preferences -> Security & Privacy, open the "Firewall" tab. Open "Firewall Options" and uncheck "Block all incoming connections". This will allow SSH through the Application Firewall.
3. Open Terminal and run the command sudo nano /etc/ssh/sshd_config to edit the config file. Comment out or delete the Deny Users * line at the bottom. This line should be #DenyUsers * if it is commented out. Save and close the file.
4. Again in Terminal, run the command sudo nano /etc/pf.anchors/sam_pf_anchors to edit pf firewall rules. Comment out the line block in proto { tcp udp } to any port 22 so it becomes #block in proto { tcp udp } to any port 22. Save and close the file.
5. Restart the system.

How do I resync the keychain login password with the user login password?
A Keychain sync issue can occur after an account password expires and is reset, and can be fixed with one of the following:

1st Solution:

1. In the Keychain Access program, make sure the login keychain is selected, and click the lock at the top left.
2. Unlock the keychain, and enter the updated password.
3. A window should appear asking to enter the current password and to create a new password/verify new password.
4. Enter the old password in the first field, and your updated password in the new password/verify password fields.

2nd Solution:

1. Open Keychain Access, and go to “Preferences".
2. Under the "First Aid" tab, check off "Synchronize login keychain password with account”
3. Close the Preferences and open “Keychain First Aid” under the Keychain Access menu.
4. Click the “Repair” option on the right, and enter your updated password.