Andrew Yim
f1a973c42d
macOS system health toolkit with 5 audit modules (packages, environment, security, cleanup, resources) and cleanup executor. Fixed bugs from review: - Replace GNU timeout with perl alarm (macOS compatible) - Remove Linux-only ps --sort flag, use portable sort - Add JSON escaping to all audit scripts - Remove redundant classify_size branch Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2.0 KiB
2.0 KiB
Security Checks Reference
SIP (System Integrity Protection)
- Check:
csrutil status - Expected: "System Integrity Protection status: enabled."
- Remediation: Reboot to Recovery Mode (Cmd+R), open Terminal, run
csrutil enable - Severity: Critical if disabled
Gatekeeper
- Check:
spctl --status - Expected: "assessments enabled"
- Remediation:
sudo spctl --master-enable - Severity: Critical if disabled
Firewall
- Check:
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate - Fallback:
defaults read /Library/Preferences/com.apple.alf globalstate(0=off, 1=on, 2=essential) - Remediation: System Settings > Network > Firewall > Turn On
- Severity: Critical if disabled
FileVault
- Check:
fdesetup status - Expected: "FileVault is On."
- Remediation: System Settings > Privacy & Security > FileVault > Turn On
- Severity: Critical if disabled (disk not encrypted)
Open Ports
- Check:
lsof -iTCP -sTCP:LISTEN -nP - Review: unexpected services listening on all interfaces (0.0.0.0 or *)
- Severity: Info (review needed, not automatically bad)
SSH Configuration
- Check:
/etc/ssh/sshd_config - Flags:
PasswordAuthentication yes,PermitRootLogin yes - Remediation: Set to
noand restart sshd - Severity: Warning
Remote Services
- Remote Login:
systemsetup -getremotelogin - Remote Management:
defaults read /Library/Preferences/com.apple.RemoteManagement ARD_AllLocalUsers - Remediation: Disable in System Settings > General > Sharing
- Severity: Info/Warning depending on context
Software Updates
- Check:
softwareupdate -l(can be slow, 30s timeout) - Remediation: System Settings > General > Software Update
- Severity: Warning if updates available
Screen Lock
- Check:
defaults -currentHost read com.apple.screensaver idleTime - Check:
defaults read com.apple.screensaver askForPassword - Remediation: System Settings > Lock Screen
- Severity: Warning if password not required