Ensure Remote Login Is Disabled

CaoCấp 1Tự độngmacos

Mô tả

Remote Login allows an interactive terminal connection to a computer. Disabling Remote Login mitigates the risk of an unauthorized person gaining access to the system via Secure Shell (SSH). While SSH is an industry standard to connect to POSIX servers, the scope of the benchmark is for Apple macOS clients, not servers. macOS does have an IP-based firewall available (pf, ipfw has been deprecated) that is not enabled or configured. There are more details and links in the Network sub-section. macOS no longer has TCP Wrappers support built in and does not have strong Brute- Force password guessing mitigations, or frequent patching of OpenSSH by Apple. Since most macOS computers are mobile workstations, managing IP-based firewall rules on mobile devices can be very resource intensive. All of these factors can be parts of running a hardened SSH server.

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

a=$(/usr/sbin/systemsetup -getremotelogin 2>/dev/null) || exit 1
b=$(/bin/launchctl print-disabled system 2>/dev/null | /usr/bin/grep -c '"com.openssh.sshd" => disabled')
c=$(/bin/launchctl list 2>/dev/null | /usr/bin/grep -c "com.openssh.sshd")
if printf '%s' "$a" | /usr/bin/grep -q "Remote Login: Off" && [ "$b" -eq 1 ] && [ "$c" -eq 0 ]; then echo compliant; else echo "$a; disabled=$b; running=$c"; fi

Đầu ra mong đợi: compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Perform the following to disable Remote Login: Graphical Method: Perform the following steps to disable Remote Login: 1. Open System Settings 2. Select General 3. Select Sharing 4. Set Remote Login to disabled Terminal Method: Run the following command to disable Remote Login: % /usr/bin/sudo /usr/sbin/systemsetup -setremotelogin off Do you really want to turn remote login off? If you do, you will lose this connection and can only turn it back on locally at the server (yes/no)? Entering yes will disable remote login. Note: This command will disable the service as well as stop it running in time.

Thuộc tính

Hệ điều hành: macos-14
Thẻ: loggingmacossonoma
Tham chiếu: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 2.3.3.4 Ensure Remote Login Is Disabled

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target macos