Details

The socketfilter firewall is what is used when the firewall is turned on in the Security Preference Pane. In order to appropriately monitor what access is allowed and denied logging must be enabled.

Rationale:

In order to troubleshoot the successes and failures of a firewall, logging should be enabled.

Impact:

Detailed logging may result in excessive storage.

Solution

Run the following command to enable logging of the firewall:

$ sudo /usr/libexec/ApplicationFirewall/socketfilterfw –setloggingmode on

Turning on log mode

Additional Information:

More info http://krypted.com/tag/socketfilterfw/

Supportive Information

The following resource is also helpful.

• https://workbench.cisecurity.org/files/3423

This security hardening control applies to the following category of controls within NIST 800-53: Audit and Accountability, System and Information Integrity.This control applies to the following type of system Unix.

References

• 800-53|AU-2
• 800-53|AU-3
• 800-53|AU-3(1)
• 800-53|AU-12
• 800-53|SI-5
• CSCv7|6.2
• CSCv7|6.3

Source

• Tenable.com/audits