Locking down SSH

I use the built in jss framework to create my management account, enable SSH and disable SSH for any other user.
I have this set on my base images for imaging, and also in my Enrollment Settings in User Initiated enrollments>Platforms for user enrollment and prestages

You might try -setremotelogin on and then add this:

sudo dscl . -append /Groups/com.apple.access_ssh GroupMembership YOURADMIN

Not sure if that gives all admins and your account SSH access or just your admin account - you'd have to test it. It might be what you want.

The integrated Casper solution above is also probably better, too.

Thanks Max! I think I will just deploy this config file through policy and use smart groups to ensure compliance.

Just thought I would post this small script. Its a process I have used for a few years to configure the SSH Access list.

I have also used it in the past to add an AD IT admin group to the com.apple.access_ssh to ensure IT Admins can access the service.

#!/bin/bash
# Tomos Tyler,  2014

ManageAccount="_cadmin"   # Set to your Casper Management User Name

#AdminName="$4"           # Disabled by default, can use a parameter in a script to send preferred account
AdminName="ladmin"        # Set to your administrator name

#Lets Turn off SSH
launchctl unload /System/Library/LaunchDaemons/ssh.plist

# remove the existing SSH access group (revert to all user access)
dseditgroup -o delete -t group com.apple.access_ssh

# Re-Create and add the users
dseditgroup -o create -q com.apple.access_ssh
dseditgroup -o edit -a $ManageAccount -t user com.apple.access_ssh
dseditgroup -o edit -a $AdminName -t user com.apple.access_ssh

# Turn SSH back on
launchctl load /System/Library/LaunchDaemons/ssh.plist

Just wanted to add to this discussion of locking down ssh. This article below describes how to utilize pf anchors to lock down your ssh after you have granted appropriate permissions. Article was written in the OS X 10.8 era but still applies in modern macOS. http://blog.scottlowe.org/2013/05/15/using-pf-on-os-x-mountain-lion/

Simplified version of @ttyler 's script. This one just removes the existing users and groups and then adds your admin account. I like doing it this way versus fully deleting the com.apple.access_ssh group.

#!/bin/bash

# Turn SSH off
launchctl unload /System/Library/LaunchDaemons/ssh.plist

# Delete SSH access for existing users and groups
dscl . delete /Groups/com.apple.access_ssh NestedGroups
dscl . delete /Groups/com.apple.access_ssh GroupMembership

# Add SSH access for specific user(s)
dscl . create /Groups/com.apple.access_ssh GroupMembership cadmin

# Turn SSH on
launchctl load /System/Library/LaunchDaemons/ssh.plist

@cbrewer I might make use of this actually as the config file might be an approach I use moving forward while the script will be used for those that are non-compliant. Do you know if this would be deployable via a policy? Obviously when disabling SSH for certain users I need to make sure I dont cut myself off from the client. Bonus points if you know of an extension attribute method to check for machines that would have unwanted accounts enabled for SSH (EG the user's account).

Thanks all!

@monosodium Yes - it'll work from a policy or from Casper Remote.

The following commands should get you lists of users with SSH access. Roll those into an extension attribute.

dscl . read /Groups/com.apple.access_ssh GroupMembership
dscl . read /Groups/com.apple.access_ssh NestedGroups