Andrew Yim
877db1aa0f
- Rename: 00→80 claude-settings-optimizer, 88→79 dintel-skill-update, 92→81 mac-optimizer, 93→82 tui-design-template - Rename: dintel-shared → _dintel-shared (consistent with _ourdigital-shared) - Remove: 61-gtm-manager, 62-gtm-guardian (obsolete), 99_archive - Update all dintel-* skill refs (114 occurrences across 31 files) - Sync README.md, CLAUDE.md, AGENTS.md with new structure Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2.0 KiB
2.0 KiB
Security Checks Reference
SIP (System Integrity Protection)
- Check:
csrutil status - Expected: "System Integrity Protection status: enabled."
- Remediation: Reboot to Recovery Mode (Cmd+R), open Terminal, run
csrutil enable - Severity: Critical if disabled
Gatekeeper
- Check:
spctl --status - Expected: "assessments enabled"
- Remediation:
sudo spctl --master-enable - Severity: Critical if disabled
Firewall
- Check:
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate - Fallback:
defaults read /Library/Preferences/com.apple.alf globalstate(0=off, 1=on, 2=essential) - Remediation: System Settings > Network > Firewall > Turn On
- Severity: Critical if disabled
FileVault
- Check:
fdesetup status - Expected: "FileVault is On."
- Remediation: System Settings > Privacy & Security > FileVault > Turn On
- Severity: Critical if disabled (disk not encrypted)
Open Ports
- Check:
lsof -iTCP -sTCP:LISTEN -nP - Review: unexpected services listening on all interfaces (0.0.0.0 or *)
- Severity: Info (review needed, not automatically bad)
SSH Configuration
- Check:
/etc/ssh/sshd_config - Flags:
PasswordAuthentication yes,PermitRootLogin yes - Remediation: Set to
noand restart sshd - Severity: Warning
Remote Services
- Remote Login:
systemsetup -getremotelogin - Remote Management:
defaults read /Library/Preferences/com.apple.RemoteManagement ARD_AllLocalUsers - Remediation: Disable in System Settings > General > Sharing
- Severity: Info/Warning depending on context
Software Updates
- Check:
softwareupdate -l(can be slow, 30s timeout) - Remediation: System Settings > General > Software Update
- Severity: Warning if updates available
Screen Lock
- Check:
defaults -currentHost read com.apple.screensaver idleTime - Check:
defaults read com.apple.screensaver askForPassword - Remediation: System Settings > Lock Screen
- Severity: Warning if password not required