screensaver setting commands not functional on high sierra

[mtibben]

stronghold/stronghold.py

Lines 164 to 165 in 4e0a859

	sp.run(['defaults', 'write', 'com.apple.screensaver', 'askForPassword', '-int', '1'], stdout=sp.PIPE)
	sp.run(['defaults', 'write', 'com.apple.screensaver', 'askForPasswordDelay', '-int', '0'], stdout=sp.PIPE)

These commands are not functional on High Sierra. See drduh/macOS-Security-and-Privacy-Guide#290 for more details

[alichtman]

Interesting. I'll look for a workaround. I was wondering if it was just my mac that's been acting up a bit or if my code was buggy.

---

I was reading through https://blog.kolide.com/screensaver-security-on-macos-10-13-is-broken-a385726e2ae2 and saw

Adding the askForPasswordDelay key to the profile helps to remediate the profile, but only slightly. The actual preference only appears to be synced after the user logs in again.

One potential solution could be to force (or ask nicely for) a restart at the program end. Opinions on that?

[mtibben]

Possibly, although there still is no reliable way to query the current settings and know if it really needs to be applied. While hacking on a custom security auditing script, I did have some success using AppleScript to launch the System Preferences, automate clicking on the right things, and reading out the values from the GUI, however this requires the user to give the script Accessibility permissions.

Another approach might be to use osquery which I have just discovered, but haven't dug into that yet

[alichtman]

there still is no reliable way to query the current settings

To some extent, the current settings may not matter.

1. If they're correctly configured, we overwrite them with the same values and nothing will change (aside from being inefficient.)
2. If they're incorrectly configured, we overwrite them and the behavior will be as expected.

[alichtman]

Added this fix in #25. I think this is a good solution, so I'm going to close it for now. Feel free to open this again if you come across a better way to do this.