The macOS system must not have a guest account.

From Apple OS X 10.13 Security Technical Implementation Guide

Associated with: CCI-001813

SV-96329r1_rule The macOS system must not have a guest account.

Vulnerability discussion

Only authorized individuals should be allowed to obtain access to operating system components. Permitting access via a guest account provides unauthenticated access to any person.

Check content

To check if the guest user exists, run the following command: dscl . list /Users | grep -i Guest To verify that Guest user cannot unlock volume, run the following command: fdesetup list To check if the system is configured to prohibit user installation of software, first check to ensure the Parental Controls are enabled with the following command: /usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep -E '(DisableGuestAccount | EnableGuestAccount)’ If the result is null or not: DisableGuestAccount = 1; EnableGuestAccount = 0; This is a finding.

Fix text

Remove the guest user with the following command: sudo dscl . delete /Users/Guest "This can also be managed with "Login Window Policy" configuration profile.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.