0

I understand that what I want is really strange.

We have something like shared build server (mac mini, yosemite), which is located in public place in office; basically everybody have physical access to it.

We have special user account created for our project needs, and all necessary tools / passwords etc are configured under this user account.

We have a rather big group of people, who should have physical access to this user account from time to time.

As a (predicted) result we have simple "password" which is known to everybody, even to people outside of this group.

Is there any way / third-party tool to use phone applications like Google Authenticator, which will allow access to this specific user account to a predefined group of people, without relying on just password?

In general I'm looking for any solution which might solve my problem - login to account with "public password" to specific people only.

|improve this question
  • There are multiple ways to solve this issue. Does the "common user" need a graphical log in or could you have that be a command-line user only? – bmike♦ Feb 24 '16 at 14:14
  • @bmike in most cases they need to go to mac, log in and do some really custom stuff "with mouse and keyboard". Remote desktop / VNC / Team Viewer cannot be used for various reasons, so they need physical access. – Lanorkin Feb 24 '16 at 14:16
  • Aah - why wouldn't you just set up a secured chat room (slack or other) and change the password regularly. Only allow the current group of authorized users to retrieve the password and have one person and one backup responsible for changing and posting the actual account password. Then the people can use their mobile to retrieve the current password to log in. – bmike♦ Feb 24 '16 at 14:23
  • @bmike that is my backup plan, but I'm too lazy to manage that on regular base – Lanorkin Feb 24 '16 at 15:56
0

There are dozens of 2FA pam plugins as well as automation tools to allow one user account to be tied to one iOS device or one iCloud account.

Where you will run into issues is having an N-to-one relation between one user account and multiple people's mobile phones. Without some sort of SMS group pool or server side setup, I don't think you'll find a pre-made solution.

I've used http://macid.co/get/ and it's more of a novelty than something I would trust in production. Here are two much better engineered solutions to modify the OS X authentication chain for two factor:

There are dozens of other companies and this uses the same hooks that smart card readers do to make OS X enforce additional code execution before a user can log in with the password. Yubico documents the /etc/pam.d/authorization file you would change and also walks you through how you would modify the system (SIP prevents this change on recent OS releases) to run the code needed to validate or deny the login event.

None of these will be less work than changing the password and setting up a way to distribute that password to only the mobile devices for the users allowed to know the new password. Make that system flexible and you can change the password daily or just when needed.

|improve this answer
0

I'm not aware of other 2FA softwares to unlock a Mac, however I've recently found this software that might be of use to you: http://www.knocktounlock.com/. It uses an iPhone to unlock a Mac. Otherwise, you could consider using an unused USB flash drive to serve as a key (for example Rohos Logon Key http://www.rohos.com/products/rohos-logon-free/).

|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .