The macOS system must be configured with a firmware password to prevent access to single user mode and booting from alternative media.
An XCCDF Rule
Description
Single user mode and the boot picker, as well as numerous other tools are available on macOS through booting while holding the "Option" key down. Setting a firmware password restricts access to these tools.
- ID
- SV-252526r816483_rule
- Version
- APPL-12-003013
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
To set a firmware passcode use the following command.
sudo /usr/sbin/firmwarepasswd -setpasswd
Note: If firmware password or passcode is forgotten, the only way to reset the forgotten password is through the use of a machine specific binary generated and provided by Apple. Schedule a support call, and provide proof of purchase before the firmware binary will be generated.