Generate remediation scripts rather than depend on check script #13

New Issue

michael · 2026-01-19T18:28:56Z

michael commented

2026-01-19 18:28:56 +00:00

Originally created by @RobertHammen on GitHub.

Problem to solve

I want to separate out remediation from detection. So ideally, after Generate Guidance, there would be a scripts folder (alongside jamfpro, mobileconfigs, preferences) that would have the scripts to:

configure ssh
configure sshd
disable bluetooth sharing
disable other Sharing services
as well as others.

Intended users

For organizations with more granular controls, separating the fix from the check is desirable. Not to mention, I'm currently struggling to get a working/functional copy of the ssh config script, from any of {Excel file, PDF, check script}.

Testing

I can't think of any downside to this, the scripts basically exist (without the shebang, which is a whole other issue where folks assume bash when the scripts are zsh - even the Excel document references "bash" as a keyword, which is confusing).

Originally created by @RobertHammen on GitHub. ### Problem to solve I want to separate out remediation from detection. So ideally, after Generate Guidance, there would be a scripts folder (alongside jamfpro, mobileconfigs, preferences) that would have the scripts to: 1. configure ssh 2. configure sshd 3. disable bluetooth sharing 4. disable other Sharing services as well as others. ### Intended users For organizations with more granular controls, separating the fix from the check is desirable. Not to mention, I'm currently struggling to get a working/functional copy of the ssh config script, from any of {Excel file, PDF, check script}. ### Testing I can't think of any downside to this, the scripts basically exist (without the shebang, which is a whole other issue where folks assume bash when the scripts are zsh - even the Excel document references "bash" as a keyword, which is confusing).

michael commented

2026-01-19 18:28:56 +00:00

@rs1278 commented on GitHub:

While this doesn't do exactly what you're requesting, I think your need here will be met with this tool:
https://trusted.jamf.com/docs/establishing-compliance-baselines

You don't need JAMF to use it and it automatically pulls from this git to stay up to date. The tool does have a very useful feature that automatically uploads the script and configuration profiles to JAMF, but you can upload the build assets to any MDM solution.

When you build your baseline, a script is created that is tailored to only the controls you selected. The default run mode of the script is to audit/detect, and it will fix/remediate if you add the --fix flag.

@rs1278 commented on GitHub: While this doesn't do exactly what you're requesting, I think your need here will be met with this tool: https://trusted.jamf.com/docs/establishing-compliance-baselines You don't need JAMF to use it and it automatically pulls from this git to stay up to date. The tool does have a very useful feature that automatically uploads the script and configuration profiles to JAMF, but you can upload the build assets to any MDM solution. When you build your baseline, a script is created that is tailored to only the controls you selected. The default run mode of the script is to audit/detect, and it will fix/remediate if you add the `--fix` flag.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: usnistgov/macos_security#13