4

I'm looking for a way to totally blacklist a Wi-Fi network (by SSID) in macOS.

And no, I promise you that I really (truly!) do not need to just have the computer "forget it" by removing it from the network list. I need to completely and totally prevent the computer from connecting to a certain network entirely.

It's super, crazy easy on Windows. Is there any way to do this on a Mac?

6

There's no blacklist function (that I know of) but there are a couple of simple workarounds

Restrict to Admins Only

Your first option would be to set up networking and restrict it so only Admins can join networks (Network Settings >> WiFi Adapter >> Advanced)

enter image description here

The caveat here is that the user can no longer be an admin.

Progmatically remove network

Your second option is to have a terminal command run periodically:

networksetup -removepreferredwirelessnetwork en1 SSID

If the SSID doesn't exist, it will just error out without any issues. If it does exist, it will remove it from the preferred (saved) network.

You could put this is a simple bash script

#!/bin/bash

SSID=MyBannedSSID

net=$(networksetup -listpreferredwirelessnetworks en1 | grep ${SSID} | cut -f2)
ap=$(networksetup -getairportnetwork en1 | cut -d ":" -f 2 | cut -c 2-)

# Remove Network if exists in saved networks
if [ "$net" = "$SSID" ]
  then networksetup -removepreferredwirelessnetwork en1 ${SSID}
  sleep 5

else echo "No Network"
fi

#Power cycle wireless adapter if connected to banned network
if [ "$ap" = "$SSID" ]
  then  networksetup -setairportpower en1 off
        networksetup -setairportpower en1 on
fi

then use cron or launchd (preferred) to run it periodically. The caveat is that while they may join the network, it will eventually (per your schedule) delete it.

You have to run this as root (meaning put in /Library/LaunchDaemons if using launchd) otherwise it will ask you for a password every time.

What the script is doing

  • Checks to see if banned SSID is saved
  • Removes the saved network if it exists
  • Power cycles the airport card if it's attached to the banned SSID
6

I've just tested this and it works!

You need the app Apple Congifurator 2, it's on the App Store, made by Apple.

Create a new profile, in the wifi section create a new payload. Fill out the information, including the correct security type. Set the password to something wrong. Uncheck the 'Auto Join' option.

Now, why does this work? The profile sets settings which cannot be changed by the user and so if you configure it with a password the user will not be able to uninstall the profile. Since you have configured the wrong password for the profile, the computer won't be able to connect to the network and will show an incorrect password popup. That's where the "auto join" setting comes in. By configuring the device to not automatically join that network, the device will only attempt to connect to it when the user selects it out of the menu. Since the user can't change the stored password they won't be given the option to try a new password and so won't be able to connect. With auto join off, you also won't get tons of "incorrect password" errors on the device any time the network is in range since it won't bother to connect to it.

Example config

  • 1
    "Set the password to something wrong." - if I understood the question correctly and the network that is to be avoided is malicious, it will gladly accept any password whatsoever, meaning this "solution" would actually make it much likely to accidentally connect to that network. Beware! – undercat Oct 14 '17 at 5:56
2

I have no experience but what I would try: setup a new acccount, give it administrator rights, login in this new account, go to SystemPreferences, ParentalControls: in there set parental controls for your main account, set the access to ...aruba... as forbidden.

  • I'm not sure what section you are trying to set the access under... websites? Could you clarify? I can't find anything in this section that allows you to restrict wifi access. – iopener May 2 '18 at 18:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .