id: auto-login-enabled

info:
  name: macOS Automatic Login Enabled
  author: geeknik
  severity: high
  description: |
    Checks if automatic login is enabled on macOS, allowing users to log in to the system without entering a password upon startup.
  impact: |
    Enabling automatic login can lead to unauthorized access to the user's account and data if the device is physically accessed.
  remediation: |
    Disable automatic login to require a password at startup and enhance physical security.
  tags: macos,audit,local,security

self-contained: true

code:
  - engine:
      - sh
      - bash
    source: |
      defaults read /Library/Preferences/com.apple.loginwindow autoLoginUser 2>&1

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 0

      - type: word
        words:
          - "does not exist"
        negative: true
# digest: 4a0a0047304502206e4abbed2d196fdcfbec430b63cb79ec4c970a766ae1dfa5699ed88c1df29841022100be4e6fe238b571547044d2a5d05526f69078c3f5536e4702b018e13149db8a7a:922c64590222798bb761d5b6d8e72950