4

I've added MacOS Sierra machine to a corporate Active Directory domain and have enabled the remote login for several users in an AD group.

Those users can log in locally via UI and even can log in via opened SSH to mac.

The business requirement that this was done for is to allow users to connect to a Xamarin Build host from Visual Studio to develop for iOS, but this is outside of the scope of this question. So ultimately the connection from Visual Studio is done via pure SSH. Once the remote MacOS machine accepts the ssh credentials that are entered in VS UI, it tries to deploy a program part required by VS to perform needed tasks, a Broker application. The log of the attempt is the following:

Starting connection to Mac mac.mydomain.net... Starting Broker
4.3.0.795 in port 58116... 
The user must be logged in on the Mac in order to execute an SSH command. 
Disconnected from the Mac mac.mydomain.net (IP of mac.mydomain.net)

The problem is this entry:

The user must be logged in on the Mac in order to execute an SSH command. 

Basically, if I go onto the MacOS via UI and login that user, then using Fast User Switching I will just move the screen back to login window, while maintaining the user's UI session on, I would be able to connect via Visual Studio just fine.

So ssh login is not the same as UI login. How can I set up the events or something, so that upon SSH login, a user would be "as in in UI" logged in as well?

Update: Probably duplicate of https://superuser.com/questions/39322/induce-mac-graphical-login-from-ssh

migrated from serverfault.com Apr 4 '17 at 10:23

This question came from our site for system and network administrators.

  • Hit up our Ask Different Chat room. You might be close to a solution or miles away and in need of some back/forth to pick apart any assumptions about your business case. Even if we set aside licensing issues and work on technical barriers - ad binding and system performance will impact the scalability of your solution. – bmike Apr 4 '17 at 10:51
  • Which installation guide did you follow? This one: Installing Xamarin.iOS on Windows? – klanomath Apr 4 '17 at 13:00
  • @klanomath, yes, I am several months past that tutorial. It is simple and works great. In my scenario a user which is being entered on the VS side is not logged in to a system on MacOs end. Tutorial assumes it is. My question is about logging in user automatically via ssh login hook. – Maxim V. Pavlov Apr 4 '17 at 13:05
  • @MaximV.Pavlov I'll try to set it up in a LAB if I have the time. You (and/or your developers) code on Windows machines and the Mac is needed as build host. How many developers should be connected to the Mac? I'm not very experienced with Xamarin - therefore I have to ask some basic questions... – klanomath Apr 4 '17 at 13:23
  • @klanomath, lets say I need just one user to be logged in to a Mac - but not the one that "auto loggs in" when Mac os starts. – Maxim V. Pavlov Oct 3 '18 at 12:39
1

Short term, you will probably have to limit the logged in users to one or two since Mac OS doesn't implement a terminal services model of many remote users. Not only does your setup likely violate the explicit terms relating to Remote Desktop functionality in the software license (assuming your company didn't negotiate a custom license agreement with Apple), many subsystems, tuning parameters and scripts are designed for one primary user at a time.

Long term, you'll probably choose to re-architect your build toolset to set up some mix of:

  • a continuous integration server that builds without GUI
  • Apple's server.app and leverage Xcode server service to handle logging in to the GUI so you don't need to script and automate the local windowed session for the shared build account
  • multiple Mac for each developer so they can build locally instead of remotely.

TLDR; the system wasn't designed for 5 remote users - you'll experience oddities and issues if you run that way for long

  • I can simultaneously login all five developers via UI, switch to login screen and they all will be able to work just fine until next machine restart. The CI is already setup and it doesn't interact or relate to development process for which I need a remote build host connection. – Maxim V. Pavlov Apr 4 '17 at 10:50
  • You're in for technical pain once you enter production use - open file limits, system scripts, other things will break. I added the licensing requirements which you can take back to the business case. You might have better luck virtualizing several OS for testing rather than putting 5 users on one OS of you can't break free from named users and have one build user control the GUI, @MaximV.Pavlov – bmike Apr 4 '17 at 11:02
  • 2
    thanks, still, totally irrelevant to actual problem. This question is about logging in user when he connects via SSH to MacOS. The reason why this is needed may be different for other people's cases. – Maxim V. Pavlov Apr 4 '17 at 11:21
  • I get what you want - let's see if the changes in layered protection / SIP / Keychain access from ssh even allow a synthetic log in before discussing longer term stability of the solution or licensing issues. I truly hope someone else has a technical way to do this - would be fascinating to duplicate in a lab setting - so I already +1 your post. – bmike Apr 4 '17 at 11:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .