forked from usnistgov/applesec
-
Notifications
You must be signed in to change notification settings - Fork 0
/
samc10_12.sh
9929 lines (8407 loc) · 373 KB
/
samc10_12.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#!/bin/bash
#NIST GitHub repository for related project files:
#https://github.com/usnistgov/applesec
######################################################################
:<<'COMMENT_BLOCK'
License
This software was developed by employees of the National Institute of Standards
and Technology (NIST), an agency of the Federal Government and is being made
available as a public service. Pursuant to title 17 United States Code Section
105, works of NIST employees are not subject to copyright protection in the
United States. This software may be subject to foreign copyright. Permission
in the United States and in foreign countries, to the extent that NIST may hold
copyright, to use, copy, modify, create derivative works, and distribute this
software and its documentation without fee is hereby granted on a non-exclusive
basis, provided that this notice and disclaimer of warranty appears in all
copies.
THE SOFTWARE IS PROVIDED 'AS IS' WITHOUT ANY WARRANTY OF ANY KIND, EITHER
EXPRESSED, IMPLIED, OR STATUTORY, INCLUDING, BUT NOT LIMITED TO, ANY WARRANTY
THAT THE SOFTWARE WILL CONFORM TO SPECIFICATIONS, ANY IMPLIED WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND FREEDOM FROM
INFRINGEMENT, AND ANY WARRANTY THAT THE DOCUMENTATION WILL CONFORM TO THE
SOFTWARE, OR ANY WARRANTY THAT THE SOFTWARE WILL BE ERROR FREE. IN NO EVENT
SHALL NIST BE LIABLE FOR ANY DAMAGES, INCLUDING, BUT NOT LIMITED TO, DIRECT,
INDIRECT, SPECIAL OR CONSEQUENTIAL DAMAGES, ARISING OUT OF, RESULTING FROM, OR
IN ANY WAY CONNECTED WITH THIS SOFTWARE, WHETHER OR NOT BASED UPON WARRANTY,
CONTRACT, TORT, OR OTHERWISE, WHETHER OR NOT INJURY WAS SUSTAINED BY PERSONS OR
PROPERTY OR OTHERWISE, AND WHETHER OR NOT LOSS WAS SUSTAINED FROM, OR AROSE OUT
OF THE RESULTS OF, OR USE OF, THE SOFTWARE OR SERVICES PROVIDED HEREUNDER.
######################################################################
This shell script performs 2 functions:
1) set configuration items to specified NIST profile values
2) query configuration item values
It must be run as root.
usage:
samc -l # list the settings
samc -s ent | sslf | soho | oem # choose the profile to run
samc -p # print settings values
samc -h # usage message
samc -v # verbose
samc -u username # username to apply user-specific settings
samc -a # apply user-specific settings to all users
samc -k # skip time-consuming print/set operations
Note: "ent" is shorthand for "enterprise".
Commands this script uses to write configation info in macOS:
defaults
chmod
chgrp
chown
PlistBuddy
pwpolicy
pmset
scutil
socketfilterfw
dscl
systemsetup
kickstart
visudo
pfctl
spctl
launchctl
Design note:
All setting batches are invoked from the main function level and different
groups of settings can be commented out to focus on specific issues.
Each setting is implemented by a separate function that gets called from
different batch functons. Settings in similar categories are typically grouped
into each batch, and these batches are called by the main function.
Each separate setting function is responsible for writing
the various profiles, displaying current values, outputing a brief
message for listing the settings ls-style, and, when additional
verbosity makes sense, supporting the -v option.
Function status tags:
#Informal testing was unable to be completed on a VM
NEEDS_REAL_HARDWARE
COMMENT_BLOCK
######################################################################
#checks for root user before running any commands
if [ "$(id -u "$(whoami)")" != "0" ]; then
echo "Sorry, samc must be run with root privileges. Exiting..."
exit 1
fi
# Global variables.
# This script's command-line options are stored in these variables
list_flag=""
set_flag=""
profile_flag=""
print_flag=""
v_flag=""
all_users_flag=""
specific_user_flag=""
#Used to skip time-consuming print and set operations. This is used in the function
#CCE_79502_1_update_apple_software
skip_flag=""
home_path=""
owner=""
os_version="" #major release version, such as 10.12
processes_to_kill="" #processes that need to be restarted at the end of the script
new_system_name=""
user_list="" #non system-created user accounts (user accounts created for people)
full_user_list="" #the full list of users on the system
#audit log location is variable, so find it for later
audit_log_path="$(grep "^dir:" /etc/security/audit_control | sed "s/dir://")"
#directories containing library files
lib_dirs="/System/Library/Frameworks /Library/Frameworks /usr/lib /usr/local/lib"
#library files
lib_files="$(find $lib_dirs -type f 2> /dev/null | egrep "((\.a)|(\.so)|(\.dylib)[\.0-9]*)$")"
#needed for storing script temp files
script_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
#When using PlistBuddy, array values must be added by index, therefore creating the need
#for a global variable to keep track of the current array position for pwpolicy settings
pw_content_index=0
pw_change_index=0
pw_auth_index=0
#This variable holds settings that will be executed for all specified users
user_settings_list=""
######################################################################
main() {
parse_arguments "$@"
if [ "$v_flag" != "" ]; then
echo "SAM script verbose mode enabled."
fi
echo "Executing system-wide settings."
# sets the global variables: owner, group, and hw_uuid
determine_user_and_system_properties
auditing
authentication
built_in_applications
firewall
local_services
network_services
power_management
ssh
updates
wireless
#Contains functions for setting permissions in home directories
#Call this last of all the batch functions
access_control
# allows all user settings to be run for the specified users
apply_settings_for_selected_users
# performs tasks such as process killing
final_tasks
}
######################################################################
access_control() {
user_settings_list="$user_settings_list
CCE_79404_0_all_files_in_a_users_home_dir_are_owned_by_that_user
CCE_79407_3_files_in_home_dir_group_owned_by_owners_group
CCE_79409_9_user_home_directories_permissions"
CCE_79405_7_check_system_integrity_protection_status
CCE_79406_5_enable_gatekeeper
CCE_79408_1_set_umask
}
######################################################################
auditing() {
CCE_79410_7_audit_log_max_file_size
CCE_79411_5_audit_log_retention
CCE_79412_3_do_not_send_diagnostic_info_to_apple
CCE_79413_1_set_audit_control_flags
}
######################################################################
authentication() {
user_settings_list="$user_settings_list
CCE_79417_2_desktop_idle_time
CCE_79430_5_screensaver_grace_period
CCE_79431_3_start_screen_saver_hot_corner"
CCE_79414_9_add_cli_login_banner
CCE_79415_6_add_login_banner
CCE_79416_4_console_login
CCE_79418_0_fast_user_switching
CCE_79428_9_require_admin_password_for_system_prefs
CCE_79429_7_retries_until_hint
CCE_79432_1_sudo_timeout_period_set_to_0
CCE_79433_9_use_network_time_protocol
CCE_79434_7_users_list_on_login
#clears the current global password policy to ensure it is set properly with this script
if [ "$set_flag" != "" ]; then
pwpolicy -clearaccountpolicies
while IFS= read -r user_name; do
if [ "$user_name" != "" ]; then
pwpolicy -u "$user_name" -clearaccountpolicies
fi
done <<< "$user_list"
fi
CCE_79419_8_password_complex_passwords_alphabetic_char
CCE_79420_6_password_complex_passwords_numeric_char
CCE_79421_4_password_complex_passwords_symbolic_char
CCE_79422_2_password_enforce_password_history_restriction
CCE_79423_0_password_failed_login_lockout_policy
CCE_79424_8_password_guessable_pattern
CCE_79425_5_password_maximum_age
CCE_79426_3_password_minimum_length
CCE_79427_1_password_uppercase_and_lowercase
}
######################################################################
built_in_applications() {
user_settings_list="$user_settings_list
CCE_79437_0_disable_siri
CCE_79438_8_display_file_extensions
CCE_79439_6_dock_enable_autohide
CCE_79440_4_enable_safari_status_bar
CCE_79441_2_show_hidden_files
CCE_79442_0_terminal_secure_keyboard"
CCE_79435_4_disable_lookup_suggestions
}
######################################################################
firewall() {
CCE_79443_8_allow_signed_downloaded_sw_receive_connections
CCE_79444_6_allow_signed_sw_receive_connections
CCE_79445_3_enable_firewall_logging_detail_level
CCE_79446_1_pf_enable_firewall
CCE_79447_9_pf_rule_apple_file_service
CCE_79448_7_pf_rule_bonjour
CCE_79449_5_pf_rule_finger
CCE_79450_3_pf_rule_ftp
CCE_79451_1_pf_rule_http
CCE_79452_9_pf_rule_icmp
CCE_79453_7_pf_rule_imap
CCE_79454_5_pf_rule_imaps
CCE_79455_2_pf_rule_itunes_sharing
CCE_79456_0_pf_rule_mDNSResponder
CCE_79457_8_pf_rule_nfs
CCE_79458_6_pf_rule_optical_drive_sharing
CCE_79459_4_pf_rule_pop3
CCE_79460_2_pf_rule_pop3s
CCE_79461_0_pf_rule_printer_sharing
CCE_79462_8_pf_rule_remote_apple_events
CCE_79463_6_pf_rule_screen_sharing
CCE_79464_4_pf_rule_smb
CCE_79465_1_pf_rule_smtp
CCE_79466_9_pf_rule_ssh
CCE_79467_7_pf_rule_telnet
CCE_79468_5_pf_rule_tftp
CCE_79469_3_pf_rule_uucp
CCE_79470_1_turn_on_firewall
}
######################################################################
local_services() {
CCE_79476_8_disable_location_services
user_settings_list="$user_settings_list
CCE_79471_9_disable_auto_actions_on_blank_CD_insertion
CCE_79472_7_disable_auto_actions_on_blank_DVD_insertion
CCE_79473_5_disable_auto_music_CD_play
CCE_79474_3_disable_auto_picture_CD_display
CCE_79475_0_disable_auto_video_DVD_play"
}
######################################################################
network_services() {
# the first function run will influence the name for all 4 functions
CCE_79477_6_change_computer_name
CCE_79478_4_change_host_name
CCE_79479_2_change_local_host_name
CCE_79480_0_change_net_bios_name
CCE_79481_8_disable_apple_file_server
CCE_79482_6_disable_bluetooth_daemon
CCE_79483_4_disable_bonjour_advertising
CCE_79484_2_disable_nfs
CCE_79485_9_disable_wifi_services
CCE_79486_7_restrict_remote_apple_events_to_specific_users
CCE_79487_5_restrict_remote_management_to_specific_users
CCE_79488_3_restrict_screen_sharing_to_specified_users
}
######################################################################
power_management() {
CCE_79489_1_disable_computer_sleep
CCE_79490_9_disable_wake_for_network_access
CCE_79491_7_enable_display_sleep
}
######################################################################
ssh() {
CCE_79492_5_ssh_challenge_response_authentication_disallowed
CCE_79493_3_ssh_disable_pub_key_authentication
CCE_79494_1_ssh_disable_root_login
CCE_79495_8_ssh_keep_alive_messages
CCE_79496_6_ssh_login_grace_period
CCE_79497_4_ssh_max_auth_tries_4_or_less
CCE_79498_2_ssh_remove_non_fips_140_2_ciphers
CCE_79499_0_ssh_remove_non_fips_140_2_macs
CCE_79500_5_ssh_restrict_users
CCE_79501_3_ssh_set_client_timeout
}
######################################################################
updates() {
CCE_79502_1_update_apple_software
}
######################################################################
wireless() {
user_settings_list="$user_settings_list
CCE_79503_9_bluetooth_disable_wake_computer
CCE_79507_0_disable_airdrop
CCE_79509_6_show_bluetooth_status_in_menu_bar"
CCE_79504_7_bluetooth_open_setup_if_no_keyboard
CCE_79505_4_bluetooth_open_setup_if_no_mouse_trackpad
CCE_79506_2_bluetooth_turn_off_bluetooth
CCE_79508_8_disable_infrared_receiver
}
######################################################################
CCE_79415_6_add_login_banner () {
local doc="CCE_79415_6_add_login_banner (manual-test-PASSED)"
if [ "$list_flag" != "" ]; then echo "$doc"; fi
local friendly_name="GUI login banner"
local banner_file="/Library/Security/PolicyBanner.txt"
local policy_text=policy_text="You are accessing a Ulobby ApS information system, which includes: 1) this computer, 2) this computer network, 3) all computers connected to this network, and 4) all devices and storage media attached to this network or to a computer on this network. You understand and consent to the following: you may access this information system for authorized use only; you have no reasonable expectation of privacy regarding any communication of data transiting or stored on this information system; at any time and for any legitimate business purpose, Ulobby ApS may monitor, intercept, and search and seize any communication or data transiting or stored on this information system; and any communications or data transiting or stored on this information system may be disclosed or used for any lawful business purpose."
local banner_exists=0;
if [ -e "$banner_file" ]; then
banner_exists="$(grep -c "$policy_text" "$banner_file")"
fi
if [ "$print_flag" != "" ]; then
if [ "$banner_exists" -gt 0 ]; then
echo "$friendly_name is enabled"
else
echo "$friendly_name is disabled"
fi
fi
if [ "$set_flag" != "" ]; then
case $profile_flag in
"ent")
if [ "$banner_exists" -gt 0 ]; then
echo "$friendly_name already enabled"
else
echo "enabling $friendly_name";
echo "$policy_text" > "$banner_file"
fi
;;
"soho")
if [ "$banner_exists" -gt 0 ]; then
echo "$friendly_name already enabled"
else
echo "enabling $friendly_name";
echo "$policy_text" > "$banner_file"
fi
;;
"sslf")
if [ "$banner_exists" -gt 0 ]; then
echo "$friendly_name already enabled"
else
echo "enabling $friendly_name";
echo "$policy_text" > "$banner_file"
fi
;;
"oem")
if [ -e "$banner_file" ]; then
echo "disabling $friendly_name"
rm "$banner_file"
else
echo "$friendly_name already disabled";
fi
;;
esac
fi
#macOS 10.12
#Works on next user login.
}
######################################################################
CCE_79414_9_add_cli_login_banner () {
local doc="CCE_79414_9_add_cli_login_banner (manual-test-PASSED)"
if [ "$list_flag" != "" ]; then echo "$doc"; fi
local friendly_name="command line login banner"
local banner_file="/etc/motd"
local policy_text="You are accessing a U.S. Government information system, which includes: 1) this computer, 2) this computer network, 3) all computers connected to this network, and 4) all devices and storage media attached to this network or to a computer on this network. You understand and consent to the following: you may access this information system for authorized use only; you have no reasonable expectation of privacy regarding any communication of data transiting or stored on this information system; at any time and for any lawful Government purpose, the Government may monitor, intercept, and search and seize any communication or data transiting or stored on this information system; and any communications or data transiting or stored on this information system may be disclosed or used for any lawful Government purpose."
local banner_exists=0;
if [ -e "$banner_file" ]; then
banner_exists="$(grep -c "$policy_text" "$banner_file")"
fi
if [ "$print_flag" != "" ]; then
if [ "$banner_exists" -gt 0 ]; then
echo "$friendly_name is enabled"
else
echo "$friendly_name is disabled"
fi
fi
if [ "$set_flag" != "" ]; then
case $profile_flag in
"ent")
if [ "$banner_exists" -gt 0 ]; then
echo "$friendly_name already enabled"
else
echo "enabling $friendly_name";
echo "$policy_text" > "$banner_file"
fi
;;
"soho")
if [ "$banner_exists" -gt 0 ]; then
echo "$friendly_name already enabled"
else
echo "enabling $friendly_name";
echo "$policy_text" > "$banner_file"
fi
;;
"sslf")
if [ "$banner_exists" -gt 0 ]; then
echo "$friendly_name already enabled"
else
echo "enabling $friendly_name";
echo "$policy_text" > "$banner_file"
fi
;;
"oem")
if [ -e "$banner_file" ]; then
echo "disabling $friendly_name"
rm "$banner_file"
else
echo "$friendly_name already disabled";
fi
;;
esac
fi
#OS X 10.12
#Takes effect immediately.
}
######################################################################
CCE_79416_4_console_login () {
local doc="CCE_79416_4_console_login (manual-test-PASSED)"
if [ "$list_flag" != "" ]; then echo "$doc"; fi
local file="/Library/Preferences/com.apple.loginwindow.plist"
local friendly_name="console login"
local setting_name="DisableConsoleAccess"
local setting_value="0" #default value confirmed 10.12
local key_exists="0"
if [ -e "$file" ]; then
key_exists="$(defaults read "$file" | grep -c "$setting_name")"
fi
if [ "$key_exists" == "1" ]; then
setting_value="$(defaults read "$file" "$setting_name")"
fi
if [ "$print_flag" != "" ]; then
if [ "$setting_value" == "1" ]; then
echo "$friendly_name is disabled";
else
echo "$friendly_name is enabled"
fi
fi
if [ "$set_flag" != "" ]; then
case $profile_flag in
"ent")
if [ "$setting_value" == "1" ]; then
echo "$friendly_name is already disabled"
else
echo "disabling $friendly_name";
defaults write "$file" $setting_name -bool true
fi
;;
"soho")
if [ "$setting_value" == "1" ]; then
echo "$friendly_name is already disabled"
else
echo "disabling $friendly_name";
defaults write "$file" $setting_name -bool true
fi
;;
"sslf")
if [ "$setting_value" == "1" ]; then
echo "$friendly_name is already disabled"
else
echo "disabling $friendly_name";
defaults write "$file" $setting_name -bool true
fi
;;
"oem")
if [ "$setting_value" == "0" ]; then
echo "$friendly_name is already enabled"
else
echo "enabling $friendly_name";
defaults write "$file" $setting_name -bool false
fi
;;
esac
fi
# If console login is enabled, typing the string ">console" for the user
# name should give a console login. This can be done only when the Users &
# Groups option for "Display login window as:" is set to "Name and password"
# macOS 10.12
# Restart not required for setting to take effect. When testing on physical
# hardware, it froze after attempting to use console login when enabled.
}
######################################################################
CCE_79434_7_users_list_on_login () {
local doc="CCE_79434_7_users_list_on_login (manual-test-PASSED)"
if [ "$list_flag" != "" ]; then echo "$doc"; fi
local file="/Library/Preferences/com.apple.loginwindow.plist"
local friendly_name="login window user list"
local setting_name="SHOWFULLNAME"
local setting_value="0" #default value confirmed 10.12
local key_exists="0"
if [ -e "$file" ]; then
key_exists="$(defaults read "$file" | grep -c "$setting_name")"
fi
if [ "$key_exists" == "1" ]; then
setting_value="$(defaults read "$file" "$setting_name")"
fi
if [ "$print_flag" != "" ]; then
if [ "$setting_value" == "0" ]; then
echo "$friendly_name is displayed"
else
echo "$friendly_name is hidden"
fi
fi
if [ "$set_flag" != "" ]; then
case $profile_flag in
"ent")
if [ "$setting_value" == "1" ]; then
echo "$friendly_name is already disabled"
else
echo "disabling $friendly_name"
defaults write "$file" $setting_name -int 1
fi
;;
"soho")
if [ "$setting_value" == "0" ]; then
echo "$friendly_name is already disabled"
else
echo "disabling $friendly_name"
defaults write "$file" $setting_name -int 1
fi
;;
"sslf")
if [ "$setting_value" == "1" ]; then
echo "$friendly_name is already disabled"
else
echo "disabling $friendly_name"
defaults write "$file" $setting_name -int 1
fi
;;
"oem")
if [ "$setting_value" == "0" ]; then
echo "$friendly_name is already enabled"
else
echo "enabling $friendly_name"
defaults write "$file" $setting_name -int 0
fi
;;
esac
fi
#macOS 10.12 testing
#Works immediately after logging out.
}
######################################################################
CCE_79429_7_retries_until_hint () {
local doc="CCE_79429_7_retries_until_hint (manual-test-PASSED)"
if [ "$list_flag" != "" ]; then echo "$doc"; fi
local file="/Library/Preferences/com.apple.loginwindow.plist"
local friendly_name="password retries until hint"
local setting_name="RetriesUntilHint"
local setting_value="3" #default value confirmed 10.12
local key_exists="0"
if [ -e "$file" ]; then
key_exists="$(defaults read "$file" | grep -c "setting_name")"
fi
if [ "$key_exists" == "1" ]; then
setting_value="$(defaults read "$file" "setting_name")"
fi
if [ "$print_flag" != "" ]; then
if [ "$setting_value" == "0" ]; then
echo "$friendly_name is disabled"
else
echo "$friendly_name is $setting_value"
fi
fi
if [ "$set_flag" != "" ]; then
case $profile_flag in
"ent")
if [ "$setting_value" == "0" ]; then
echo "$friendly_name is already disabled"
else
echo "disabling $friendly_name"
defaults write "$file" $setting_name -int 0
fi
;;
"soho")
if [ "$setting_value" == "0" ]; then
echo "$friendly_name is already disabled"
else
echo "disabling $friendly_name"
defaults write "$file" $setting_name -int 0
fi
;;
"sslf")
if [ "$setting_value" == "0" ]; then
echo "$friendly_name is already disabled"
else
echo "disabling $friendly_name"
defaults write "$file" $setting_name -int 0
fi
;;
"oem")
if [ "$setting_value" == "3" ]; then
echo "$friendly_name is already set to 3"
else
echo "setting $friendly_name to 3"
defaults write "$file" $setting_name -int 3
fi
;;
esac
fi
# macOS 10.12 testing
# Tested manually; hints enabled or disabled both in preferences and
# on login. Preferences subpane needs to be closed and reopened to
# refresh the setting state.
}
######################################################################
CCE_79418_0_fast_user_switching () {
local doc="CCE_79418_0_fast_user_switching (manual-test-PASSED)"
if [ "$list_flag" != "" ]; then echo "$doc"; fi
local file="/Library/Preferences/.GlobalPreferences.plist"
local friendly_name="fast user switching"
local setting_name="MultipleSessionEnabled"
local setting_value="0" #default value confirmed 10.12
local key_exists="0"
if [ -e "$file" ]; then
key_exists="$(defaults read "$file" | grep -c "setting_name")"
fi
if [ "$key_exists" == "1" ]; then
setting_value="$(defaults read "$file" "setting_name")"
fi
if [ "$print_flag" != "" ]; then
if [ "$setting_value" == "0" ]; then
echo "$friendly_name is disabled"
else
echo "$friendly_name is enabled"
fi
fi
if [ "$set_flag" != "" ]; then
case $profile_flag in
"ent")
if [ "$setting_value" == "0" ]; then
echo "$friendly_name is already disabled"
else
echo "disabling $friendly_name"
defaults write "$file" $setting_name -bool false
fi
;;
"soho")
echo "$friendly_name is unchanged"
;;
"sslf")
if [ "$setting_value" == "0" ]; then
echo "$friendly_name is already disabled"
else
echo "disabling $friendly_name"
defaults write "$file" $setting_name -bool false
fi
;;
"oem")
if [ "$setting_value" == "0" ]; then
echo "$friendly_name is already disabled"
else
echo "disabling $friendly_name"
defaults write "$file" $setting_name -bool false
fi
;;
esac
fi
# macOS 10.12
# Tested manually. Have to login again or switch users for the new
# setting to take effect.
#Fast user switching is disabled by default when there is only one user
#account. When the second account is created, fast user switching is turned on.
#If fast user switching is disabled, and the second user account is deleted, the
#setting remains disabled. However, if a second user account is created again,
#then fast user switching will be enabled automatically by the system.
}
#
# Set file permissions only if the existing permissions exceed the permission arguments.
# For example, if an existing file at 740 is being changed to 650, it would result in 640.
# This prevents the script from making files more permissive.
#
# $1 : file path
# $2 : owner to set
# $3 : group to set
# $4 : UNIX mode bits to set (including sticky/setuid)
#
set_max_file_permission () {
if [ -e "$1" ]; then
if [ "$4" != "" ]; then
local u_bits="$(echo "$4" | cut -c1)"
local g_bits="$(echo "$4" | cut -c2)"
local o_bits="$(echo "$4" | cut -c3)"
local u_subtract=""
local g_subtract=""
local o_subtract=""
#only change the set id permissions if it is included in the parameter (if $4
#is 4 characters long)
if [ "${#4}" -eq "4" ]; then
local id_bits="$(echo "$4" | cut -c1)"
u_bits="$(echo "$4" | cut -c2)"
g_bits="$(echo "$4" | cut -c3)"
o_bits="$(echo "$4" | cut -c4)"
#set id permissions
if [ "$id_bits" -lt "4" ]; then
u_subtract="s"
#subtract 4 so that we can check for set gid on execute(2) permission
else
id_bits=$(( id_bits - 4 ))
fi
if [ "$id_bits" -lt "2" ]; then
g_subtract="s"
fi
fi
#user permissions
if [ "$u_bits" -lt "4" ]; then
u_subtract="${u_subtract}r"
#subtract 4 so that we can check for write(2) and execute(1) permissions
else
u_bits=$(( u_bits - 4 ))
fi
if [ "$u_bits" -lt "2" ]; then
u_subtract="${u_subtract}w"
else
u_bits=$(( u_bits - 2 ))
fi
if [ "$u_bits" -lt "1" ]; then
u_subtract="${u_subtract}x"
fi
#group permissions
if [ "$g_bits" -lt "4" ]; then
g_subtract="${g_subtract}r"
else
g_bits=$(( g_bits - 4 ))
fi
if [ "$g_bits" -lt "2" ]; then
g_subtract="${g_subtract}w"
else
g_bits=$(( g_bits - 2 ))
fi
if [ "$g_bits" -lt "1" ]; then
g_subtract="${g_subtract}x"
fi
#other permissions
if [ "$o_bits" -lt "4" ]; then
o_subtract="${o_subtract}r"
else
o_bits=$(( o_bits - 4 ))
fi
if [ "$o_bits" -lt "2" ]; then
o_subtract="${o_subtract}w"
else
o_bits=$(( o_bits - 2 ))
fi
if [ "$o_bits" -lt "1" ]; then
o_subtract="${o_subtract}x"
fi
chmod u-${u_subtract} "$1"
chmod g-${g_subtract} "$1"
chmod o-${o_subtract} "$1"
fi
if [ "$2" != "" ]; then
chown "$2" "$1"
fi
if [ "$3" != "" ]; then
chgrp "$3" "$1"
fi
else
if [ "$v_flag" != "" ]; then
echo "NOT FOUND($1)" >&2
fi
fi
}
######################################################################
CCE_79430_5_screensaver_grace_period () {
local doc="CCE_79430_5_screensaver_grace_period (manual-test-PASSED)"
local file=$home_path/Library/Preferences/ByHost/com.apple.screensaver.$hw_uuid.plist
local file2=$home_path/Library/Preferences/com.apple.screensaver.plist
local friendly_name="screensaver grace period"
local delay="300" # default value for 10.12
local target_delay=5 # number of seconds to set grace period to
local setting_name=askForPasswordDelay
# if the ByHost file exists, then first try to access it
if [ -e "$file" ]; then
local key_exists="$(defaults read "$file" | grep -c "$setting_name")"
if [ "$key_exists" == 1 ]; then
delay="$(defaults read "$file" "$setting_name")"
# if the key is not present, then try to read file2
else
if [ -e "$file2" ]; then
key_exists="$(defaults read "$file2" | grep -c "$setting_name")"
if [ "$key_exists" == 1 ]; then
delay="$(defaults read "$file2" "$setting_name")"
file="$file2" # since $file2 has the key, change that one
fi
fi
fi
#if ByHost file doesn't exist, try to access file2
elif [ -e "$file2" ]; then
key_exists="$(defaults read "$file2" | grep -c "$setting_name")"
if [ "$key_exists" == 1 ]; then
delay="$(defaults read "$file2" "$setting_name")"
file="$file2" # since $file2 has the key, change that one
fi
# else do nothing, since neither file exists, and the default value will be used
fi
if [ "$list_flag" != "" ]; then echo "$doc"; fi
if [ "$print_flag" != "" ]; then
if [ "$delay" != "0" ]; then
echo "$delay seconds $friendly_name";
else
echo "$friendly_name is disabled";
fi
fi
if [ "$set_flag" != "" ]; then
case $profile_flag in
"ent")
if [ "$delay" != "$target_delay" ]; then
echo "setting screensaver grace period to $target_delay seconds";
defaults write "$file" "$setting_name" -int "$target_delay"
add_processes_to_kill_list Dock cfprefsd
else
echo "$friendly_name is already set to $target_delay seconds"
fi
;;
"soho")
if [ "$delay" != "$target_delay" ]; then
echo "setting screensaver grace period to $target_delay seconds";
defaults write "$file" "$setting_name "-int "$target_delay"
add_processes_to_kill_list Dock cfprefsd
else
echo "$friendly_name is already set to $target_delay seconds"
fi
;;
"sslf")
if [ "$delay" != "$target_delay" ]; then
echo "setting screensaver grace period to $target_delay seconds";
defaults write "$file" "$setting_name" -int "$target_delay"
add_processes_to_kill_list Dock cfprefsd
else
echo "$friendly_name is already set to $target_delay seconds"
fi
;;
"oem")
if [ "$delay" != "300" ]; then
echo "setting screensaver grace period to 300 seconds";
defaults write "$file" "$setting_name" -int 300
add_processes_to_kill_list Dock cfprefsd
else
echo "$friendly_name is already set to 300 seconds"
fi