Files
macos_security/rules/system_settings/system_settings_ssh_disable.yaml
Bob Gendler dbb7f7f38d refactor[rules/baseline]
Added missing baseline tags to system_settings_ssh_disable
Added rule to baseline files
2025-06-26 11:32:09 -04:00

64 lines
1.2 KiB
YAML

id: system_settings_ssh_disable
title: Disable SSH Server for Remote Access Sessions
discussion: |
SSH service _MUST_ be disabled for remote access.
check: |
/bin/launchctl print-disabled system | /usr/bin/grep -c '"com.openssh.sshd" => disabled'
result:
integer: 1
fix: |
[source,bash]
----
/usr/sbin/systemsetup -f -setremotelogin off >/dev/null
/bin/launchctl disable system/com.openssh.sshd
----
NOTE: Systemsetup with -setremotelogin flag will fail unless you grant Full Disk Access to systemsetup or its parent process. Requires supervision.
references:
cce:
- CCE-94399-3
cci:
- N/A
800-53r5:
- CM-7
- CM-7(1)
- AC-17
800-53r4:
- AC-3
- CM-7
- CM-7(1)
srg:
- N/A
disa_stig:
- N/A
800-171r3:
- 03.01.02
- 03.04.06
cis:
benchmark:
- 2.3.3.4 (level 1)
controls v8:
- 4.1
- 4.8
cmmc:
- AC.L1-3.1.1
- CM.L2-3.4.6
- CM.L2-3.4.7
macOS:
- '15.0'
tags:
- 800-53r5_low
- 800-53r5_moderate
- 800-53r5_high
- 800-171
- cis_lvl1
- cis_lvl2
- cisv8
- cnssi-1253_low
- cnssi-1253_high
- cmmc_lvl2
- cmmc_lvl1
- cnssi-1253_moderate
severity: high
mobileconfig: false
mobileconfig_info: