3.6 Ensure Firewall is configured to log

Information

The socketfilter firewall is what is used when the firewall is turned on in the Security PreferencePane. In order to appropriately monitor what access is allowed and denied logging must be enabled.

Rationale:

In order to troubleshoot the successes and failures of a firewall logging should be enabled.

Impact:

Detailed logging may result in excessive storage.

Solution

Run the following command to enable logging of the firewall

$ sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setloggingmode on

Turning on log mode

Additional Information:

More info http://krypted.com/tag/socketfilterfw/

See Also

https://workbench.cisecurity.org/files/3013

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12c.

Plugin: Unix

Control ID: 63077217efa4a395ed01891bd1ff589aab63f064936e25ef6427747831929479