Files
nuclei-templates/code/macos/audit/ssh-service-running.yaml
2025-11-10 09:32:25 +00:00

32 lines
1.0 KiB
YAML

id: ssh-service-running
info:
name: macOS SSH Service Running
author: geeknik
severity: info
description: |
Checks if the SSH service (Remote Login) is running on the macOS system.
impact: |
While not a vulnerability in itself, a running SSH service can be a potential attack vector if not properly configured and secured.
remediation: |
Disable the SSH service if it is not needed. If it is required, ensure that it is properly configured with strong passwords and key-based authentication.
tags: macos,audit,local,security,ssh
self-contained: true
code:
- engine:
- sh
- bash
source: |
launchctl print system/com.openssh.sshd 2>&1
matchers-condition: and
matchers:
- type: status
status:
- 0
- type: word
words:
- "state = running"
- "com.openssh.sshd"
# digest: 4a0a00473045022053ce4877c2b6dd468f675d1170e575f39b925e2aa4deeeec03b1a0ed80e322cc022100de4617540a86bac57c234caa4f163cb06390cd4e5915dd8b8bbb7c835b10d873:922c64590222798bb761d5b6d8e72950