need help with wifi script

[tkimpton]

Hi guys

I am tryin to blocked some certain SSIDs.

I was wondering if someone ca help me with variable for all the SSIDs.

so far this works

#!/bin/sh

# Prevent Access to RLSPOT001
SSID=`/System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport -I
| grep ' SSID:' | cut -d ':' -f 2 | tr -d ' '`

if [ $SSID = "RLSPOT001" ]; then
/usr/sbin/networksetup -setairportpower en1 off
fi

# Prevent Access to RLAVID001
SSID=`/System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport -I
| grep ' SSID:' | cut -d ':' -f 2 | tr -d ' '`

if [ $SSID = "RLAVID001" ]; then
/usr/sbin/networksetup -setairportpower en1 off
fi

# Prevent Access to RLSHEE001
SSID=`/System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport -I
 | grep ' SSID:' | cut -d ':' -f 2 | tr -d ' '`

if [ $SSID = "RLSHEE001" ]; then
/usr/sbin/networksetup -setairportpower en1 off
fi

# Prevent Access to RLGUES001
SSID=`/System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport -I
| grep ' SSID:' | cut -d ':' -f 2 | tr -d ' '`

if [ $SSID = "RLGUES001" ]; then
/usr/sbin/networksetup -setairportpower en1 off
fi

# Prevent Access to RLBGAS001
SSID=`/System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport -I
 | grep ' SSID:' | cut -d ':' -f 2 | tr -d ' '`

if [ $SSID = "RLBGAS001" ]; then
/usr/sbin/networksetup -setairportpower en1 off
fi

# open networks control
# Prevent Access to BTFON
SSID=`/System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport -I
 | grep ' SSID:' | cut -d ':' -f 2 | tr -d ' '`

if [ $SSID = "BTFON" ]; then
/usr/sbin/networksetup -setairportpower en1 off
fi

As you can see it makes my whole script very long.

I would appreciated if someone might be able to help me to create a variable for all of them

[carlo_anselmi]

+1 for emailing the script if possible! :-)
I tried copying/pasting/adding the backslash but can't make it work
Thank you!

[rockpapergoat]

email?

post it here or to a pastebin site.

https://gist.github.com

learn to love source control.

[tkimpton]

Great idea! Can't wait to see this :)

[tkimpton · Accepted solution]

Thanks Jared i just got round to adding in your variables and this is what i am using now :)

#!/bin/bash
################################################################################################################################################
#
# HISTORY
#
# Version: 2.8
#
# - Created by Tim Kimpton on November 29th, 2012
# - Assisted by Jared Nichols and Mike from JAMFNATION to clean up and simplify the blocked ssid case statement and network interface variables
#
# Stops network bridging turning the relevant network interface off and on
#
################################################################################################################################################


# SETTING THE ENVIRONMENT VARIABLES

# Get the ethernet hardware port (ehwport)
ehwport=`networksetup -listallhardwareports | awk '/.Ethernet/,/Ethernet Address/' | awk 'NR==2' | cut -d " " -f 2`

# Get the wireless network service (wservice)
wservice=`/usr/sbin/networksetup -listallnetworkservices | grep -Ei '(Wi-Fi|AirPort)'`

# Get the wireless hardware port (whwport)
whwport=`networksetup -listallhardwareports | awk "/$wservice/,/Ethernet Address/" | awk 'NR==2' | cut -d " " -f 2`

# Find the ALL network hardware ports (hwports)
hwports=`networksetup -listallhardwareports | awk '/Hardware Port: Wi-Fi/,/Ethernet/' | awk 'NR==2' | cut -d " " -f 2`

# Get the wireless network (wirelessnw)
wirelessnw=`networksetup -getairportnetwork $hwports | cut -d " " -f 4`

# Get the SSID
SSID=`/System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport -I
| grep ' SSID:' | cut -d ':' -f 2 | tr -d ' '`

# Current Logged in User
consoleuser=`ls -l /dev/console | cut -d " " -f4`

# Carry out an OS version check
OS=`/usr/bin/defaults read /System/Library/CoreServices/SystemVersion ProductVersion | awk '{print substr($1,1,4)}'`

# Work SSID
WorkSSID=XXX

# Authentication to use eg WPA2 Enterprise
Auth=WPA2E

# Index for SSID
Index=0

# Check to see if the JSS is available and if yes, then submits the current IP
checkjss=`/usr/sbin/jamf checkJSSConnection -retry 0 | grep "The JSS is available"`

# Department allowed to bypass SSID restrictions
Dept=XXX

# SSIDs to Block
Block1=XXX

Block2=XXX

Block3=XXX

Block4=XXX

####################################################################################

# See if ethernet if active and if it is then we need to turn OFF the wirelesss interface!
if ifconfig "${ehwport}" | grep inet; then
/usr/sbin/networksetup -setairportpower $whwport off

# There is also a bug where wireless network interfaces are caching DNS and causes problems when switching networks, so we need to clear them!
/usr/sbin/networksetup -setdnsservers $wservice "empty"

# if Ethernet is not active then...
elif ifconfig "${ehwport}" | grep inactive; then

# Clear the DNS cache for the wireless network service
/usr/sbin/networksetup -setdnsservers $wservice "empty"

# Do not ask to join new networks
/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport prefs joinmode=automatic joinmodefallback=donothing

# Set the preferred wireless network to WorkSSID
/usr/sbin/networksetup -addpreferredwirelessnetworkatindex $whwport $WorkSSID $Index $Auth

# Turn the wirless hardware port on
/usr/sbin/networksetup -setairportpower $whwport on
fi

# Prevent 169 IP Address problem for  Work SSID
if [ $SSID = $WorkSSID ]; then
if ifconfig "${whwport}" | grep 169;
then

# If APIPA turn wireless hardware port off
/usr/sbin/networksetup -setairportpower $whwport off

# turn wireless hardware port on
/usr/sbin/networksetup -setairportpower $whwport on
fi
fi

# Get the wireless network (wirelessnw)
wirelessnw=`networksetup -getairportnetwork $hwports | cut -d " " -f 4`

# Block  wireless networks
case $wirelessnw in
$Block1)
networksetup -setairportpower $whwport off
;;
esac

# If logged in user is in I.S allow access to SSIDs but block everyone else!
if
dscl . -read /Users/"${consoleuser}" | grep "$Dept"
then echo "$Dept Allowed!"
else

# Block the restricted wireless networks with a case statement below
case $wirelessnw in
$Block2|$Block3|$Block4)

# Turn off wifi
networksetup -setairportpower $whwport off

# Set the preferred wireless network to WorkSSID
/usr/sbin/networksetup -addpreferredwirelessnetworkatindex $whwport $WorkSSID $Index $AuthE

# Remove Wireless networks
/usr/sbin/networksetup -removeallpreferredwirelessnetworks $whwport

;;
esac
fi

# Check to see it the jss is ping-able and if so submit the ip change to the jss. 
# This is useful when using Casper Remote and users are switching between wired and wireless

if [ "$checkjss" == "The JSS is available." ]; then
/usr/sbin/jamf log
fi
exit 0

[technicholas]

How do I deploy this in my network? I want to push this out on Casper, we have MANY staff members going to the Guest network instead of the "Staff" network. HELP!

I am new to Casper.

[rmanly]

Sorry guys I turned off all email notifications and just come here when I have a few spare moments now.

https://github.com/rmanly/mac_management/blob/master/wifi_disabler.awk

[tkimpton]

@rmanly thanks I will have a look in the morning

@technicholas I used Lingon get this version it's free quick before its gone

http://sourceforge.net/projects/lingon/files/

I used Lingon to create a launch daemon (these run as root) to run the script. I included a watch path if a system file changed I think it was in /Library/Preferences/SystemConfiguration/xxx

I will have a look in the morning.

Anyway you will need to package them up and deploy, but TEST

[carlo_anselmi]

@rmanly, many thanks!
I tried the script but I get this error
("MY_TEST_MAC" in th elog below is the sharing name of the client)

/usr/sbin/jamf is version 8.62
Executing Policy DISABLE WiFi...
Mounting afp://Casper_Server/CasperShare to /Volumes/CasperShare...
Running script disable_WiFi.awk...
Script exit code: 2
Script result: /usr/bin/awk: can't open file MY_TEST_MAC source line number 6
Unmounting file server...

If I run the script manually, it seems to hang and do nothing
Ciao
Carlo

[tkimpton]

One of the things i noticed after rebuilding the laptop was the "Ask to join new networks" in the Network Preference pane and in the Wi-Fi

does anyone know how i can make sure this is disabled via a command so i can add it to the script?

[jarednichols]

That one is going to be tough as networksetup doesn't have an option for it. However, I found where the setting lives in the preference file if you're game to change it with a script. In /Library/Preferences/SystemConfiguration/preferences.plist you'll find a block like this:

<key>Interface</key>
                <dict>
                    <key>en0</key>
                    <dict>
                        <key>AirPort</key>
                        <dict>
                            <key>JoinModeFallback</key>
                            <array>
                                <string>Prompt</string>
                            </array>
                            <key>PowerEnabled</key>
                            <false/>
                            <key>RememberJoinedNetworks</key>
                            <true/>
                            <key>RequireAdminIBSS</key>
                            <false/>
                            <key>RequireAdminNetworkChange</key>
                            <false/>
                            <key>RequireAdminPowerToggle</key>
                            <false/>
                        </dict>
                    </dict>
                </dict>

That's the default. The key you want to change is JoinModeFallback and you'll want to change it to DoNothing like this:

<key>Interface</key>
                <dict>
                    <key>en0</key>
                    <dict>
                        <key>AirPort</key>
                        <dict>
                            <key>JoinModeFallback</key>
                            <array>
                                <string>DoNothing</string>
                            </array>
                            <key>PowerEnabled</key>
                            <false/>
                            <key>RememberJoinedNetworks</key>
                            <true/>
                            <key>RequireAdminIBSS</key>
                            <false/>
                            <key>RequireAdminNetworkChange</key>
                            <false/>
                            <key>RequireAdminPowerToggle</key>
                            <false/>
                        </dict>
                    </dict>
                </dict>

There's a number of ways to churn through the file with a script to change it, and if you're at the proper level of skill to do it (as mucking with this file directly is probably bad mojo if you don't know what you're doing) I'll leave you to it. Otherwise you may want to consider it a "nice to have."

[tkimpton]

try this

Off
sudo /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport prefs joinmode=automatic joinmodefallback=donothing

On
sudo /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport prefs joinmode=automatic joinmodefallback=prompt

Thanks Jared
;)

[jarednichols]

OOOOOoooo damn that's a new kind of judo I need to pick up.

Thanks dude!

[mm2270]

@timkimpton - Thanks for the link to the older Lingon! I had been looking for that sucker but wasn't finding it anywhere. The version on the App Store is so dumbed down its practically useless. The older version is the bees knees!

[tkimpton]

@Jared Thanks but i just googled it and got the ideas and got it working by luck ;)

@mm220 no probs i always keep the old one ;)

Ive updated the script to make it clearer, marked it as the answer and added something my colleague was after.

Now and again my department "Information Systems" needs to get to an unproxied network.

At the bottom of the script this show how myself and my colleague can get to this restriced network but if they are not in our department then they can't ;)

Thanks to everyone, this has got to be one of the longest discussions i have been involved in LOL.

[Kumarasinghe]

Thanks tkimpton

#!/bin/bash

line is missing at the very top of your script (marked as the answer).

[tkimpton]

@Kumarasinghe Thanks

Ive updated the script with better environment variables so that it is more portable so it should work by just filling them in for your environment.

I had a problem with one blocked SSID that looks like an open network but has a log in authentication page we use for guests.

I found users were trying to connect to it with unauthorised corporate devices and the script threw them off ;) but ... because it technically successfully connected it was added to the preferred network list ;(

I have now added a mechanism that if a user that is not in the allowed department and they connect, then it disconnects them from the blocked ssid, removes all the preferred networks and then adds your work ssid :)

Hope that helps.

[tkimpton]

oh and i added a mechanism to contact the jss at the bottom.

I was getting tired of users switching between networks and my Casper Remote failing because it was trying to connect to an ip address the machine was no longer using.

This way the machine updates it ip to the JSS :)

[Kumarasinghe]

Thanks Tim.

FYI
Also we use jamf binary to check the JSS availability (taken from a script done by JAMF)

#!/bin/bash

# Check to see if the JSS is available and if yes, then submits the current IP 
checkjss=`/usr/sbin/jamf checkJSSConnection -retry 0 | grep "The JSS is available"`

if [ "$checkjss" == "The JSS is available." ]; then
    /usr/sbin/jamf log
fi

exit 0

[tkimpton]

@Kumarasinghe Thanks thats brilliant! I have added this instead :)

[mgrev]

Hi Jared
Wondering if you could help me out here. Not sure what I am doing wrong here, copied & pasted the script as the above marked answer. I do not need to turn off WiFi ports since Ethernet is not used. All I am trying to do is restrict access to one specific SSID (name has spaces) and add another SSID as the only preferred in the network list. Testing out on a Mountain Lion 10.8.5 client.

Lines I had to edit from the above script to make it work for me:
1) #!/bin/bash --- had to put in a space after the #!
2) Had to prefix /usr/sbin in all lines wherever networksetup was being used

Issues facing:
1) I guess because of the space in the WorkSSID name, I cannot get to add using the full name. For example, "ABC WIFI" is getting added as "ABC" which is actually another existing SSID. I need to block only the "ABC WIFI". How can I add/block an SSID which has spaces?
2) When I run the script as a login Policy in Casper, everytime I try to login to the client, a Keychain password window keeps popping up (looks like it is trying to run 'networksetup') just before login.

Would you please mind telling me whats wrong with my modified script below and how could I fix the issues above? Thanks!

#! /bin/bash

# SETTING THE ENVIRONMENT VARIABLES

# Get the ethernet hardware port (ehwport)
ehwport=`/usr/sbin/networksetup -listallhardwareports | awk '/.Ethernet/,/Ethernet Address/' | awk 'NR==2' | cut -d " " -f 2`

# Get the wireless network service (wservice)
wservice=`/usr/sbin/networksetup -listallnetworkservices | grep -Ei '(Wi-Fi|AirPort)'`

# Get the wireless hardware port (whwport)
whwport=`/usr/sbin/networksetup -listallhardwareports | awk "/$wservice/,/Ethernet Address/" | awk 'NR==2' | cut -d " " -f 2`

# Find the ALL network hardware ports (hwports)
hwports=`/usr/sbin/networksetup -listallhardwareports | awk '/Hardware Port: Wi-Fi/,/Ethernet/' | awk 'NR==2' | cut -d " " -f 2`

# Get the wireless network (wirelessnw)
wirelessnw=`/usr/sbin/networksetup -getairportnetwork $hwports | cut -d " " -f 4`

# Get the SSID
SSID=`/System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport -I
| grep ' SSID:' | cut -d ':' -f 2 | tr -d ' '`

# Current Logged in User
consoleuser=`ls -l /dev/console | cut -d " " -f4`

# Carry out an OS version check
OS=`/usr/bin/defaults read /System/Library/CoreServices/SystemVersion ProductVersion | awk '{print substr($1,1,4)}'`

# Work SSID
WorkSSID="ABC WIFI"

# Index for SSID
Index=0

# Check to see if the JSS is available and if yes, then submits the current IP
checkjss=`/usr/sbin/jamf checkJSSConnection -retry 0 | grep "The JSS is available"`

# Department allowed to bypass SSID restrictions
Dept=GroupInCasper

# SSIDs to Block
Block1="ABC Guest"

####################################################################################

# Get the wireless network (wirelessnw)
wirelessnw=`/usr/sbin/networksetup -getairportnetwork $hwports | cut -d " " -f 4`

# Block  wireless networks
case $wirelessnw in
$Block1)
;;
esac

# If logged in user is in GroupInCasper allow access to SSIDs but block everyone else!
if
dscl . -read /Users/"${consoleuser}" | grep "$Dept"
then echo "$Dept Allowed!"
else

# Remove Wireless networks
/usr/sbin/networksetup -removeallpreferredwirelessnetworks $whwport

# Set the preferred wireless network to WorkSSID
/usr/sbin/networksetup -addpreferredwirelessnetworkatindex $whwport $WorkSSID $Index None

# Check to see if the JSS is available and if yes, then submits the current IP 
checkjss=`/usr/sbin/jamf checkJSSConnection -retry 0 | grep "The JSS is available"`

if [ "$checkjss" == "The JSS is available." ]; then
    /usr/sbin/jamf log
fi

exit 0

[mgrev]

Hi Jared or if anyone else around,
Could I get some scripting help please? I am fine now with the previous errors and SSID with spaces issue. But now I just need some help modifying Tim's script due to my environment.

Can you tell me how I can place two conditions into the script based on which the whole script will Run or Exit out. I do not wish to turn off WiFi as part of the script.
Condition 1 - If the currently connected WiFi is a certain 'restricted' SSID, then ONLY run the full script and also, only if it meets the 2nd condition ----- If not, echo & exit out.
Condition 2 - Only if the currently logged in user is anyone else who is NOT the local administrator (i just used a single administrator user instead of Dept variable)

Below are short versions of the two different conditions as two separate scripts. Both works fine separately, i just need to know how to link them together and run the whole script if the two conditions are met:

==========================================================
# Restricted WiFi
blockedwifi="ABC Guest"

# Get the currently connected wireless network
currentwifi=`/System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport -I | awk '/ SSID/ {split($0, parts, ": ") ; print parts[2]}'`

# Remove restricted WiFi networks
case $currentwifi in
$blockedwifi)
------------------"At this point, it should run the whole script and also only if 2nd condition is met"--------------------
else
echo "Connected to authorized WiFi"
;;
esac


# Current Logged in User
consoleuser=`ls -l /dev/console | cut -d " " -f4`

# Allowed to bypass SSID restrictions
Admin=administrator

# If logged in user is administrator, allow access to restricted SSID but block everyone else!
if
dscl . read /Users/"${consoleuser}" | grep "$Admin"
then echo "$Admin is allowed Guest access"
else
------------- "At this point, it should run the whole script and also only if 1st condition was met"

==============================================================

[Treger]

HI Guys,

I have modified tkimpton script above to work for my environment (awesome job on that btw) I was just wondering how people are deploying this? I tried Lingon and I can't seem to get it to run correctly, this would be preferable as if it detects a change the machine would deal with it as opposed to have an ongoing script in the JSS that is going to create a lot of network traffic. The other was was at login but surely this would just run for the login intermission and then thereafter would not run any more?

We have a issue where we now have so many mobile devices and laptops everything is on the Wifi, I would like to try get this on the Macs so that they at least will disable the Wifi when the ethernet is plugged in a free up some of the reservations. There are sometimes so many devices on the Wifi no one can connect due to the address leases all being taken.

Anyone got any ideas?

[mm2270]

@Treger I haven't been using Lingon now for a little while, although it should still work to create a valid working LaunchDaemon. You can try using LaunchControl if you have issues with Lingon.

The big question though is, what is the trigger to have the script run? Ours is set up to use a WatchPath of /Library/Preferences/SystemConfiguration That directory gets modified, or the files within it, each time there is a network change (and sometimes when there isn't one) so it should run the script when Ethernet of any kind is plugged into the Mac, see that there is a valid Ethernet connection and disable Wi-Fi.

Keep in mind also that when this was all written, it was before Casper Suite 9.x. The latest version can now run policies based on Network State Change, so that's also an option to look at if you don't want to use a local launchd job.

[Treger]

Thanks @mm2270 I will give the script a go with the Network State Change policy, I think it would be easiest going forward. I may give the LaunchControl a go in any case just to see the differences in behaviour...

[Treger]

Ok, With Casper It does initially disconnect the wireless but after a while with the ethernet plugged in the Wireless reconnects. Launch Control I have no experience with and I am having a problem running it, it will only let me execute with root and when in as root it will not let me connect to the Wifi even with the ethernet out... Maybe because the script is actually pulling user creds for the Wifi so it may work as a user but if may not allow my local admin accounts to access the wifi...

[Treger]

Ok... I got it working quite well with LaunchControl, however it seems to not like detecting the secondary Ethernet on the new Mac Pro, If I connect and disconnect the primary NIC it works flawlessly, as soon as I use the second NIC, it can't seem to detect the change... Thunderbolt connections are not detected either... I may have to do this on a laptop and see if there is a difference although the Retinas run off thunderbolt ethernet too...

[dprakash]

I've been using this script for a while however now im getting a box popup saying "networksetup is trying to modify the system network configuration. Type your password to allow this."

If I delete /library/preferences/systemconfiguration/preferences.plist I no longer get the prompt.

[palmna]

I realize this thread is pretty old but it's relevant to an issue I'm working on. Hopefully someone can help me out. I'm utilizing the case statement method outlined by @jarednichols but trying to add a wildcard to the case. Basically I want to look for any network with "iPhone" in the name.
I've tried

case $ssid in
SSID1|SSID2|*iPhone)

case $ssid in
SSID1|SSID2|*iPhone*)

and

case $ssid in
SSID1|SSID2|@iPhone)

but they don't seem to do anything.

[palmna]

In case anyone in the future is trying to implement this, I was able to figure out the wildcard searches for network SSID's. The case statement looks like this. My mistake was not quoting the text string as well as putting the wildcard (*) inside the quotes, which made it a literal string.

case $ssid in
  "Xfinity"*|*"iPhone"*|*"Guest"*)
       ;;
esac