Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-05-24 01:18:42 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 84

CIS 2.3.3.9 (#9752)

Browse source
This commit is contained in:
Sharon Katz 2023-02-08 15:43:03 -05:00 committed by GitHub
parent 5c0f635966
commit c248968ba3
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 64 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
ee/cis/macos-13/cis-policy-queries.yml
View file

@ -447,6 +447,33 @@ spec:
---
apiVersion: v1
kind: policy
spec:
name: CIS - Ensure Content Caching Is Disabled (MDM Required)
platforms: macOS
platform: darwin
description: |
Starting with 10.13 (macOS High Sierra), Apple introduced a service to make it easier to deploy data from Apple, including software updates, where there are bandwidth constraints to the Internet and fewer constraints or greater bandwidth exist on the local subnet. This capability can be very valuable for organizations that have throttled and possibly metered Internet connections. In heterogeneous enterprise networks with multiple subnets, the effectiveness of this capability would be determined by how many Macs were on each subnet at the time new, large updates were made available upstream. This capability requires the use of mac OS clients as P2P nodes for updated Apple content. Unless there is a business requirement to manage operational Internet connectivity and bandwidth user endpoints should not store content and act as a cluster to provision data.
resolution: |
Graphical Method:
Perform the following steps to disable Content Caching:
1. Open System Settings
2. SelectGeneral
3. SelectSharing
4. Set Content Caching to disabled
Profile Method:
Create or edit a configuration profile with the following information:
1. The PayloadType string is com.apple.applicationaccess
2. The key to include is allowContentCaching
3. The key must be set to <false/>
query: |
SELECT 1 WHERE EXISTS (SELECT * FROM managed_policies mp WHERE domain = 'com.apple.applicationaccess' AND name = 'allowContentCaching' AND value = 0)
AND NOT EXISTS (SELECT * FROM managed_policies mp WHERE domain = 'com.apple.applicationaccess' AND name = 'allowContentCaching' AND value != 0);
purpose: Informational
tags: compliance, CIS, CIS_Level2, CIS2.3.3.9
contributors: sharon-fdm
---
apiVersion: v1
kind: policy
spec:
name: CIS - Ensure Bluetooth Sharing Is Disabled
platforms: macOS

37
ee/cis/macos-13/test/profiles/2.3.3.9.mobileconfig Normal file
View file

@ -0,0 +1,37 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>PayloadDisplayName</key>
<string>test</string>
<key>PayloadType</key>
<string>com.apple.applicationaccess</string>
<key>PayloadIdentifier</key>
<string>com.fleetdm.cis-2.3.3.9.check</string>
<key>PayloadUUID</key>
<string>85956359-CF0A-46C8-BD7C-26060ABB9119</string>
<key>allowContentCaching</key>
<false/>
</dict>
</array>
<key>PayloadDescription</key>
<string>test</string>
<key>PayloadDisplayName</key>
<string>Ensure Content Caching Is Disabled</string>
<key>PayloadIdentifier</key>
<string>com.fleetdm.cis-2.3.3.9</string>
<key>PayloadRemovalDisallowed</key>
<false/>
<key>PayloadScope</key>
<string>System</string>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadUUID</key>
<string>AA4372B4-5D36-4660-A2FC-07067C94A91F</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</plist>