Skip to content
Log In

The macOS system must remove password hints from user accounts.

An XCCDF Rule

Description

User accounts must not contain password hints. Password hints leak information about passwords that are currently in use and can lead to loss of confidentiality.

ID
SV-259544r958470_rule
Version
APPL-14-003014
Severity
Medium
References
Updated

Remediation Templates

A Manual Procedure

Configure the macOS system to remove password hints from user accounts with the following command:

for u in $(/usr/bin/dscl . -list /Users UniqueID | /usr/bin/awk '$2 > 500 {print $1}'); do
  /usr/bin/dscl . -delete /Users/$u hint
done