2

I am setting up a Mac Mini for use as a server in our office. I am trying to set in place a reasonable security policy. Currently, I am struggling to accomplish the following:

How can I make a user change their password when they sign in for the first time via SSH? I have seen answers involving setting newPasswordRequired=1 using pwpolicy, but this has been deprecated since 10.10. Bonus points if the login keyring can be updated at the same time.

Improve this question
9
  • MacOS uses opendirectory locally to configure/manage accounts, if you are using opendirectory under linux, it is the same. But if you are using common local linux account, you will have to modify your scripts. For all other things MacOS is almost identical to linux, like shell scripts and batch commands. Different from linux, SSH is disabled by default, did you manage to enable it?
    – Prado
    Aug 29, 2019 at 20:46
  • Yes, I've enabled sshd and can login with passwords.
    – Alex Reinking
    Aug 29, 2019 at 20:49
  • There are some quick explanation about creating users from command line here: apple.stackexchange.com/questions/274954/…
    – Prado
    Aug 29, 2019 at 20:51
  • 1
    @nohillside - I have reduced the focus of this question to just the password expiry part.
    – Alex Reinking
    Aug 30, 2019 at 6:37
  • 2
    warning Never, never try -setpolicy "newPasswordRequired=1" on newer systems, it still works somehow/bugged [it accepts that option, but..], I tried it now on MacOS 10.15 Catalina, and the user is not able to log anymore Lol. SSH quits the session just after inserting the password. GUI login is impossible for that such user now.
    – Prado
    Aug 30, 2019 at 19:32

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .