sshd-auth

executablemacOS1.0 MBx86_64, arm64

Apple system daemon — manages device telemetry and diagnostic data collection

Collects and processes system diagnostics, performance metrics, and usage data from macOS. Communicates with Apple's telemetry endpoints to transmit diagnostic information and receive configuration updates. Interacts with multiple system bundles and frameworks to gather data across device subsystems. Runs as a system daemon with network access to Apple's infrastructure for data synchronization and reporting.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 1.0 MB
UUID: 25287B69-6C31-3B4E-9434-8761F9774919
Analyzed: 2026-04-09T10:06:03Z
CDHash: d3b7f76966089e1d8275e6942df43e95472c9b75b22fcd28ec3de9aba6f6d552

Frameworks11

Foundation Kerberos OpenDirectory libEndpointSecuritySystem.dylib(weak)libManagedConfigurationFiles.dylib(weak)libbsm.0.dylib libcrypto.46.dylib libpam.2.dylib libresolv.9.dylib libz.1.dylib libSystem.B.dylib

Entitlements3

com.apple.private.endpoint-security.submit.opensshtrue

com.apple.private.security.clear-library-validationtrue

com.apple.private.xpc.launchd.reboot-pivot-roottrue

Interesting Strings

Bundle IDs(52)

/AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/EndpointSecurity/submit-ess-event.c /AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/openssh/addrmatch.c /AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/openssh/audit-bsm.c /AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/openssh/auth-krb5.c /AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/openssh/auth-pam.c

File Paths(48)

/AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/EndpointSecurity/submit-ess-event.c /AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/openssh/addrmatch.c /AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/openssh/audit-bsm.c /AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/openssh/auth-krb5.c /AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/openssh/auth-pam.c

telemetry(5)

/AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/EndpointSecurity/submit-ess-event.c 2com.apple.private.endpoint-security.submit.openssh <key>com.apple.private.endpoint-security.submit.openssh</key>mm_submit_ess_event submit_ess_event

URLs & Endpoints(5)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><string>com.apple.compilers.llvm.clang.1_0</string>https://www.apple.com/appleca/0

Network Surface

Networking Frameworks

Endpoints(12)

HostnameOpenSSH-354.0.3

Hostnameopenssh.com

Hostnamelibssh.org

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Hostnamemacosx26.1.internal

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

DNA Capability Vector

Location

0

Keychain

0

Network

0

Storage

0

Hardware

0

IPC

0

Analytics

0

Security

0

System

0

Behavioral Profile

URL Endpoints

5

Telemetry Strings

5

File Paths

48

Bundle IDs

52

IOKit Constants

0

Library Functions

0

Structural HashesSHA-256

Code1a3b2d765f69bcf3579f2f708538d1efeb58a424e3b698b73c524fe5dd16b3ac

Imports55e469d3b0ec44f974a19f33a713bab7c0cafa3e7fc3d4c6a731e51535a9f54e

Frameworksf23114c2c58c78487879b82f97f2c6e3882992d6198ff8f21b1e35fa79f8ea9d

Classese3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Entitlements02d775f0e1293542e391cb0d2408bcec670f6270f72f4367448879cc6cf5c126

Symbols55e469d3b0ec44f974a19f33a713bab7c0cafa3e7fc3d4c6a731e51535a9f54e

Static Libraries0 / 738 functions identified

Functions(738)

0x100000a40sub_100000a40

0x100000aa4sub_100000aa4

0x100000c10sub_100000c10

0x100000c18sub_100000c18

0x100000cb4sub_100000cb4

0x100000cbcsub_100000cbc

0x100000d58sub_100000d58

0x100001898sub_100001898

0x100001964sub_100001964

0x100001c88sub_100001c88

0x100001e34sub_100001e34

0x1000021ccsub_1000021cc

0x100002298sub_100002298

0x1000022a8sub_1000022a8

0x100002388sub_100002388

0x100002520sub_100002520

0x100002894sub_100002894

0x100002a84sub_100002a84

0x100002b34sub_100002b34

0x100002c3csub_100002c3c

Imports324 symbols from 8 dylibs

libSystem.B.dylib153 libcrypto.46.dylib122 Kerberos21 libpam.2.dylib10 libbsm.0.dylib9

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

ssh-apple-pkcs11

ssh-pkcs11-helper