6.1.4 Ensure Guest Access to Shared Folders Is Disabled

Information

Allowing guests to connect to shared folders enables users to access selected shared folders and their contents from different computers on a network.

Rationale:

Not allowing guests to connect to shared folders mitigates the risk of an untrusted user doing basic reconnaissance and possibly using privilege escalation attacks to take control of the system.

Impact:

Unauthorized users could access shared files on the system.

Solution

Graphical Method:
Perform the following steps to no longer allow guest user access to shared folders:

Open 'System Preferences

Select 'Users & Groups

Select 'Guest User

Set Allow guest users to connect to shared folders to disabled

Terminal Method:
Run the following commands to verify that shared folders are not accessible to guest users:

$ /usr/bin/sudo /usr/sbin/sysadminctl -smbGuestAccess off

See Also

https://workbench.cisecurity.org/benchmarks/14563

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: 810f9ef87fcde9cbb27f42adba33ccbd7f711a9c9d91786042de83d2f5e3f93c