issue 23

#23
krispayne · Nov 30, 2016 · b4866fa · b4866fa
1 parent 54b6408
commit b4866fa
Showing 1 changed file with 8 additions and 2 deletions.
diff --git a/ElCapitan_CIS.sh b/ElCapitan_CIS.sh
@@ -726,8 +726,14 @@ systemAccess() {
 
     # 5.11 Disable ability to login to another user's active and locked session
     # Level 1 Scored
-    # Need sed here to edit /etc/pam.d/screensaver
-    # I believe this is off by default.
+
+    if [[ $(grep -ic "group=admin,wheel fail_safe" /etc/pam.d/screensaver) -eq 0 ]]; then
+        ScriptLogging "  Admins disabled from unlocking other users sessions."
+    else
+        ScriptLogging "  Admins allowed to unlock other users sessions...."
+        sed -i.bak s/admin,//g /etc/pam.d/screensaver
+        ScriptLogging "  Admins disabled from unlocking other users sessions."
+    fi
 
     # 5.12 Create a custom message for the Login Screen
     # Level 1 Scored