6

I would like to have a user account in my MacOS X El Capitan system which is limited to login through SSH. I do not want that user to be able to use the system through any other means, especially not on the local desktop. I would like that user not to be listed as possible options when logging into the desktop.

Obviously the user needs to be allowed to access via SSH on the Sharing preferences menu. Setting the user's shell to /usr/bin/false, a usual way to disable login for users on MacOS X without deleting them, seems to disable SSH access as well as desktop access. Currently the only way I could come up with is setting a password for the user that the user doesn't know, but I suppose users could then change the password by themselves.

On Debian GNU/Linux for example I would be able to disable the password and/or login altogether. Is there something similar on MacOS?

Improve this question
2
  • I have long wondered this, and got nowhere - I'd really like to use this, if it exists.
    – Addison Crump
    Jan 22, 2016 at 7:45
  • A standard user cannot change the password without knowing the current password. Only root can do that.
    – Kent
    Jan 22, 2016 at 12:16

2 Answers 2

Reset to default
4

Set up your new User as a Sharing Only account, this gives them no actual account on the computer itself that they can log into…

System Prefs > Users & Groups

  1. Click the lock
  2. Click the + sign to add a new User
  3. Set the new account to sharing only from the drop menu [stepped out on the pic for clarity]

enter image description here

Ref : Apple KB - OS X Yosemite: Create a sharing-only user account

After Comments...
Apparently, this works, but only in combination with some other tweaks.

You need to set up a new group, 'remote users'.
Add your sharing only user to that, then add that group to Remote Login

It seems that Sharing Only users by default have the shell /usr/bin/false and the home directory /dev/null.
Both of these values seem to be magic values for some PAM modules to block the user from connecting.
You have to change both and have the user added to the remote users group to make it work.

Improve this answer
6
  • Sadly, this user doesn't appear when I try to add it to the Remote login users in the Sharing preferences
    – aef
    Jan 22, 2016 at 10:23
  • try this - set up a new group, 'remote users'. Add your sharing only user to that, then add that group to Remote Login.
    – Tetsujin
    Jan 22, 2016 at 10:28
  • That is a promising hack, I can add the user to the group and I can give that group remote access permission. I will evaluate if the SSH login actually works later.
    – aef
    Jan 22, 2016 at 11:06
  • Your hack works. But only in combination with some other tweaks. It seems that Sharing Only users by default have the shell /usr/bin/false and the home directory /dev/null. Both of these values seem to be magic values for some PAM modules to block the user from connecting. You have to change both and have the user added to the remote users group to make it work. If you update your answer with this, I can accept it.
    – aef
    Jan 24, 2016 at 11:12
  • It seems I was too quick to accept this. For some reason the Sharing Only user I created still shows up on the login user selection. Any ideas? If not I will try the approach @Kent pointed out in his answer.
    – aef
    Jan 26, 2016 at 8:06
2

You can create a low-numbered user via dscl, as per this Apple support page and it will be hidden from most views.

Also, I believe that if you set the user home directory to something like /var/empty then ssh will log in but the gui will not.

Improve this answer
1
  • 1
    Your answer helped me to discover the full solution. It is actually /dev/null as home directory that blocks the user. Thanks.
    – aef
    Jan 24, 2016 at 20:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .