Today morning I got a request from Green IT folks to enabled SSH on all the Macs that we have in Enterprise. Currently SSH is not enabled on clients and not even the Admins are allowed to do so. As it was against InfoSec policy of the client, they needed a solution that ensures SSH is not enabled for anyone except couple of Service Accounts that does background job.
So what I proposed was simple, to create a Security Group in AD and add all Service Accounts to that Group and grant SSH access to that group. Now, no one else will be able to access via SSH except the members of this group.
So here is what I wrote for them. In this script Joulix is the AD account and HM Admin Mac SSH is the AD group that needs SSH access.:
#!/bin/bash
# To add the User / Group to be able to do ssh.
# Created by Laeeq Humam | 10.10.2014 | for HCL
# Wrote for Green IT via Cisco Joulix.
UN="Joulix"
MACSSHGROUP="Admin Mac SSH"
# Will use this group and user probably once or twice. Variable might not be required at this moment.
# Keeping it the Variable way for future complex scripting.
# Good habit to make Terminal speak loud on Admin's fault :)
if [[ $EUID -ne 0 ]]; then
echo "Did you forget to become a root user? Lets try again! :) " 1>&2
exit 1
fi
# Keep it simple, Turn Remotelogin OFF, do your thing and rutn it back ON.
systemsetup -setremotelogin OFF
# This is giving Joulix user account ssh access on system
dseditgroup -o create -q com.apple.access_ssh
dseditgroup -o edit -a $UN -t user com.apple.access_ssh # I have added this line for someone who wants to add just one user to grant SSH access and not a group.
# The following line will give access to "Admin Mac SSH" AD group to do SSH in enterprise.
dseditgroup -o edit -a $MACSSHGROUP -t group com.apple.access_ssh
# If you are looking inside this script, try this line to see its done as you wanted it to be :)
dseditgroup -o read -t group com.apple.access_ssh
# Turn SSH ON again
systemsetup -setremotelogin ON
exit 0
Obviously, you need to change the group name to your AD group name / path.
Comments