id: ssh-service-running

info:
  name: macOS SSH Service Running
  author: geeknik
  severity: info
  description: |
    Checks if the SSH service (Remote Login) is running on the macOS system.
  impact: |
    While not a vulnerability in itself, a running SSH service can be a potential attack vector if not properly configured and secured.
  remediation: |
    Disable the SSH service if it is not needed. If it is required, ensure that it is properly configured with strong passwords and key-based authentication.
  tags: macos,audit,local,security,ssh

self-contained: true

code:
  - engine:
      - sh
      - bash
    source: |
      launchctl print system/com.openssh.sshd 2>&1
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 0
      - type: word
        words:
          - "state = running"
          - "com.openssh.sshd"
# digest: 4a0a00473045022053ce4877c2b6dd468f675d1170e575f39b925e2aa4deeeec03b1a0ed80e322cc022100de4617540a86bac57c234caa4f163cb06390cd4e5915dd8b8bbb7c835b10d873:922c64590222798bb761d5b6d8e72950