Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-59721 | AOSX-10-001065 | SV-74151r1_rule | Medium |
Description |
---|
The built-in root account is disabled by default and administrator users are required to use sudo to run a process with the UID '0'. If another account with UID '0' exists, this is a sign of a network intrusion or a malicious user that is attempting to circumvent security controls. |
STIG | Date |
---|---|
Apple OS X 10.10 (Yosemite) Workstation Security Technical Implementation Guide | 2017-01-05 |
Check Text ( C-60491r1_chk ) |
---|
To list all of the accounts with a UID of '0', run this command: sudo dscl . -list /Users UniqueID | grep -w 0 | wc -l If the result is not '1', this is a finding. |
Fix Text (F-65131r1_fix) |
---|
Investigate as to why any additional accounts were set up with a UID of '0'. Remove any invalid accounts. |