Leaving this policy here if is adds any value.
Detect macOS hosts with remote SSH enabled
select 1 from sharing_preferences where remote_login = 0;
Clarification the policy here is pass when SSH is disabled , fail when SSH is enabled the 1/0 operations
10/08/2021, 2:36 PM
This is awesome. Thank you for sharing the policy.
Are you ok with the Fleet team adding this policy to the standard query library on fleetdm.com/queries? With your permission, your GitHub username will be added as the “contributed by…”
FYI Fleet’s standard query library is undergoing maintenance that will allow it to include policies. Your policy would be added after these changes are completed in the following weeks.