Andrew Yim
877db1aa0f
- Rename: 00→80 claude-settings-optimizer, 88→79 dintel-skill-update, 92→81 mac-optimizer, 93→82 tui-design-template - Rename: dintel-shared → _dintel-shared (consistent with _ourdigital-shared) - Remove: 61-gtm-manager, 62-gtm-guardian (obsolete), 99_archive - Update all dintel-* skill refs (114 occurrences across 31 files) - Sync README.md, CLAUDE.md, AGENTS.md with new structure Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
54 lines
2.0 KiB
Markdown
54 lines
2.0 KiB
Markdown
# Security Checks Reference
|
|
|
|
## SIP (System Integrity Protection)
|
|
- **Check**: `csrutil status`
|
|
- **Expected**: "System Integrity Protection status: enabled."
|
|
- **Remediation**: Reboot to Recovery Mode (Cmd+R), open Terminal, run `csrutil enable`
|
|
- **Severity**: Critical if disabled
|
|
|
|
## Gatekeeper
|
|
- **Check**: `spctl --status`
|
|
- **Expected**: "assessments enabled"
|
|
- **Remediation**: `sudo spctl --master-enable`
|
|
- **Severity**: Critical if disabled
|
|
|
|
## Firewall
|
|
- **Check**: `/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate`
|
|
- **Fallback**: `defaults read /Library/Preferences/com.apple.alf globalstate` (0=off, 1=on, 2=essential)
|
|
- **Remediation**: System Settings > Network > Firewall > Turn On
|
|
- **Severity**: Critical if disabled
|
|
|
|
## FileVault
|
|
- **Check**: `fdesetup status`
|
|
- **Expected**: "FileVault is On."
|
|
- **Remediation**: System Settings > Privacy & Security > FileVault > Turn On
|
|
- **Severity**: Critical if disabled (disk not encrypted)
|
|
|
|
## Open Ports
|
|
- **Check**: `lsof -iTCP -sTCP:LISTEN -nP`
|
|
- **Review**: unexpected services listening on all interfaces (0.0.0.0 or *)
|
|
- **Severity**: Info (review needed, not automatically bad)
|
|
|
|
## SSH Configuration
|
|
- **Check**: `/etc/ssh/sshd_config`
|
|
- **Flags**: `PasswordAuthentication yes`, `PermitRootLogin yes`
|
|
- **Remediation**: Set to `no` and restart sshd
|
|
- **Severity**: Warning
|
|
|
|
## Remote Services
|
|
- **Remote Login**: `systemsetup -getremotelogin`
|
|
- **Remote Management**: `defaults read /Library/Preferences/com.apple.RemoteManagement ARD_AllLocalUsers`
|
|
- **Remediation**: Disable in System Settings > General > Sharing
|
|
- **Severity**: Info/Warning depending on context
|
|
|
|
## Software Updates
|
|
- **Check**: `softwareupdate -l` (can be slow, 30s timeout)
|
|
- **Remediation**: System Settings > General > Software Update
|
|
- **Severity**: Warning if updates available
|
|
|
|
## Screen Lock
|
|
- **Check**: `defaults -currentHost read com.apple.screensaver idleTime`
|
|
- **Check**: `defaults read com.apple.screensaver askForPassword`
|
|
- **Remediation**: System Settings > Lock Screen
|
|
- **Severity**: Warning if password not required
|