Ensure Firewall Stealth Mode Is Enabled

How it is checked

Audit method: Shell command

[ -x /usr/bin/osascript ] || exit 1
p=$(/usr/bin/osascript -l JavaScript <<'EOS'
$.NSUserDefaults.alloc.initWithSuiteName('com.apple.security.firewall').objectForKey('EnableStealthMode').js
EOS
)
s=$(/usr/libexec/ApplicationFirewall/socketfilterfw --getstealthmode 2>/dev/null)
if [ "$p" = true ] || printf '%s' "$s" | /usr/bin/grep -q 'stealth mode is on'; then echo compliant; else echo "EnableStealthMode=${p:-unset}; $s"; fi

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Graphical Method: Perform the following steps to enable firewall stealth mode: 1. Open System Settings 2. Select Network 3. Select Firewall 4. Select Options... 5. Set Enabled stealth mode to enabled Terminal Method: Run the following command to enable stealth mode: % /usr/bin/sudo /usr/libexec/ApplicationFirewall/socketfilterfw -- setstealthmode on Stealth mode enabled Profile Method: Create or edit a configuration profile with the following information: 1. The PayloadType string is com.apple.security.firewall 2. The key to include is EnableStealthMode 3. The key must be set to <true/> Note: This key must be set in the same configuration profile with EnableFirewall set to <true/>. If it is set in its own configuration profile, it will fail.

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target macos