Script: Enable SSH & Limit to Admin Group

I’m always looking for ways to get to zero-touch deployment with less effort.  In that vein, I threw together this script which can be deployed as an “at reboot” script in a Casper configuration.  Using this prevents you from having to go into your base image and manually configure ssh.  The script can also be run locally on an existing machine that doesn’t have ssh enabled or limited to the admin group.  It may work with other imaging tools, but remember to test thoroughly.  This script has only been tested with Mac OS X version 10.5.6.


##### HEADER BEGINS #####
# scr_sys_turnOnSshLimitToAdmin.bash
# Created 20090320 by Miles A. Leacy IV
# Modified 20090320 by Miles A. Leacy IV
# Copyright 2009 Miles A. Leacy IV
# This script may be copied and distributed freely
# as long as this header remains intact.
# This script is provided "as is".  The author offers no warranty
# or guarantee of any kind.
# Use of this script is at your own risk.  The author takes no
# responsibility for loss of use, loss of data, loss of job,
# loss of socks, the onset of armageddon, or any other negative effects.
# Test thoroughly in a lab environment before use on production systems.
# When you think it's ok, test again.  When you're certain it's ok,
# test twice more.
# This script turns on remote login (ssh) and activates a SACL to
# limit access to members of the admin group.  It is intended to be used
# on a fresh image where ssh has not been enabled or limited previously.
# Run as an "at reboot" script when imaging with Casper.
##### HEADER ENDS #####

# Turn on remote login
systemsetup -setremotelogin on

# Create the group
dseditgroup -o create -q

# Add the admin group to
dseditgroup -o edit -a admin -t group


Expect more scripts and tips on building a zero-touch deployment in the future.

12 thoughts on “Script: Enable SSH & Limit to Admin Group”

  1. This script is very helpful in helping us keep from touching machines in our school district. So you work for Jamf, I’m attending a CCA training in Dallas this April, hopefully we’ll see you there. Thanks


  2. Maybe Mr Anonymous is suggesting a redirect from the original link to this page. You might not be able to edits Apple’s site, but maybe you can edit your own site.

    Just saying, like.


  3. Miles,

    If you are able to create a directory at the root of your site, named “2009”, and place within it a directory named “03”, then within that, a directory named “20”, and finally create a directory within *that* named “script-enable-ssh-limit-to-admin-group”, you could park an index.html file in there with a meta-refresh tag in its element.

    Example code here:


  4. Oh, and thanks for the script. 🙂 Looks like JSS isn’t doing the “Enable SSH for this user” thing in a 10.8.x configuration I’m testing.


  5. Hi,
    I want to do similar thing, but instead of group, I just want to enable ssh for a particular user.
    Any idea on how can I do that from command line. I am looking for a solution for 10.6 and above.


    1. Replace the last command in the script with…

      # Add user with the shortname “fred” to
      dseditgroup -o edit -a fred -t user

      …of course substitute your desired user for “fred”.


  6. If this script executes correctly, are the changes visible in System Preferences -> Sharing, i.e is Remote Login checked and set to the “admin” group? I can run the script without errors but I can’t tell if it took or not.


    1. It should, but will not do so spontaneously. System Preference panes generally read the system state when you launch them. If System Preferences was running when you executed the script, the change may not be reflected in the GUI until you quit and relaunch System Preferences.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: