Skip to main content
Solved

enabling ssh for all users


dlondon
Forum|alt.badge.img+14
  • Honored Contributor
  • 375 replies

Hi,

Our deployments are set so that only the Management account can use SSH. I'm trying to work through how to change that to All Users because of a request for one of the labs that is for computer science students. As the machines are already imaged, I'm trying to do this via the command line.

From various posts I've read it seems like the right way to change this is to rename the com.apple.access_ssh group to com.apple.access_ssh-disabled but I don't know how to do this in the command line. Maybe with dscl or dseditgroup? I just can't seem to find an example or documentation on how this might be done.

Has anyone got any suggestions on how to go about doing this? Am I missing some setting in the JSS that would do this for me?

Regards,

David

Best answer by talkingmoose

Now I understand why you were asking about dscl and dseditgroup.

I did find a page that offers this command:

dscl . change /Groups/com.apple.access_ssh RecordName com.apple.access_ssh com.apple.access_ssh-disabled

Sounds like what you're needing but I haven't tested.

View original
Did this topic help you find an answer to your question?

6 replies

talkingmoose
Forum|alt.badge.img+36
  • Community Manager
  • 1901 replies
  • August 22, 2012

To rename a file you'll use the mv (move) command. It's pretty straight-forward:

mv com.apple.access_ssh com.apple.access_ssh-disabled

dlondon
Forum|alt.badge.img+14
  • Author
  • Honored Contributor
  • 375 replies
  • August 22, 2012

Thanks Mooose ... but it's a group not a file :)


talkingmoose
Forum|alt.badge.img+36
  • Community Manager
  • 1901 replies
  • Answer
  • August 22, 2012

Now I understand why you were asking about dscl and dseditgroup.

I did find a page that offers this command:

dscl . change /Groups/com.apple.access_ssh RecordName com.apple.access_ssh com.apple.access_ssh-disabled

Sounds like what you're needing but I haven't tested.


dlondon
Forum|alt.badge.img+14
  • Author
  • Honored Contributor
  • 375 replies
  • August 23, 2012

Thanks! I think I read the same page you found but missed that snippet.

It works fine. I did notice that the settings in Sharing stayed the same even though the group was renamed so I forced the sshd to reread it's config using:

ps -ef | grep sshd | awk {'print $2'} | sudo xargs kill -HUP

That seems to kill any active connections so I will need to test to see if that's a problem - probably not. Otherwise a restart will do the same thing.

Hmmm - and now when I try that command to HUP sshd it doesn't seem to reread the file :( more investigation required ...

Restarting works though.


russeller
Forum|alt.badge.img+15
  • Valued Contributor
  • 215 replies
  • May 15, 2016

Stumbled upon this old post. Since I'm resurrecting this post, it'll take −1 to all attack rolls, skill checks, saving throws, and ability checks. I'm sorry. Anyway...

I think @dlondon was looking to run something like this:

launchctl unload /System/Library/LaunchDaemons/ssh.plist
launchctl load -w /System/Library/LaunchDaemons/ssh.plist

This should reload SSH with the new settings without requiring a reboot. At least its been working for me on 10.9 and newer when I was trying to lock SSH down to 2 specific accounts.


dlondon
Forum|alt.badge.img+14
  • Author
  • Honored Contributor
  • 375 replies
  • May 16, 2016

Thanks Steven,

Sometimes my Linux/Unix/Mac stills are found wanting. Apppreciate your correction

Regards,

David


Reply


Cookie policy

We use cookies to enhance and personalize your experience. If you accept you agree to our full cookie policy. Learn more about our cookies.

 
Cookie settings