1

How to remove a self created daemon user named '_denyhosts' from group 1025(workgroup), 403(com.apple.sharepoint.group.2), 404(com.apple.sharepoint.group.3) and 405(com.apple.sharepoint.group.4) using Lion Terminal?

Background

To create a reduced privileged daemon user account, to run denyhosts.py using launchd, the example on http://www.minecraftwiki.net/wiki/Tutorials/Create_a_Mac_OS_X_startup_daemon has been helpful.

However the created Lion daemon user account "_denyhosts" seems to have to many groups assigned: 

$ id _denyhosts
uid=300(_denyhosts) gid=300(_denyhosts) groups=300(_denyhosts),1025(workgroup),12(everyone),61(localaccounts),403(com.apple.sharepoint.group.2),404(com.apple.sharepoint.group.3),405(com.apple.sharepoint.group.4)

In my opinion the groups membership of:

  1. 1025(workgroup)
  2. 403(com.apple.sharepoint.group.2)
  3. 404(com.apple.sharepoint.group.3)
  4. 405(com.apple.sharepoint.group.4)

can be removed.

I have been trying to accomplish to remove the user its groups memberships using:

$ dscl . -delete /Groups/workgroup GroupMembership _denyhosts
delete: Invalid Path
<dscl_cmd> DS Error: -14009 (eDSUnknownNodeName)

$ dscl . -delete /groups/workgroup GroupMembership _denyhosts
delete: Invalid Path
<dscl_cmd> DS Error: -14009 (eDSUnknownNodeName)

$ sudo dscl . delete /Groups/workgroup GroupMembership _denyhosts
delete: Invalid Path
<dscl_cmd> DS Error: -14009 (eDSUnknownNodeName)

$ sudo dseditgroup -o edit -d _denyhosts -t user workgroup
Username and password must be provided.

I guess that these commands fail because group "workgroup" is not located in a local directory but an LDAP directory:

$ dseditgroup -o -read workgroup | grep AppleMetaNode -A 1
dsAttrTypeStandard:AppleMetaNodeLocation -
        /LDAPv3/127.0.0.1

But that is not all, because com.apple.sharepoint.group groups are /Local/Default, there $ sudo dseditgroup -o edit -d _denyhosts -t user com.apple.sharepoint.group.2 doesn't output an error, but also doesn't remove the _denyhosts user from the group:

$ id _denyhosts
uid=300(_denyhosts) gid=300(_denyhosts) groups=300(_denyhosts),1025(workgroup),12(everyone),61(localaccounts),403(com.apple.sharepoint.group.2),404(com.apple.sharepoint.group.3),405(com.apple.sharepoint.group.4)

https://superuser.com/questions/279891/list-all-members-of-a-group-mac-os-x helped to know that group membership can also be assigned by inheritance. Guess is that such inherited membership is what happens here.

$ dscl . -read /Groups/com.apple.sharepoint.group.2 | grep NestedGroupsNestedGroups
NestedGroupsNestedGroups: ABCDEFAB-CDEF-ABCD-EFAB-CDEF00000050 ABCDEFAB-CDEF-ABCD-EFAB-CDEF0000000C
Improve this question

1 Answer 1

Reset to default
3

Try this command to remove the user from a particular group 

dseditgroup -o edit -d $Username -t user $GroupName

dseditgroup -o edit -d _denyhosts -t user workgroup
Improve this answer
1
  • For this to work, I had to add authentication with "-u ADMINUSER -p" (or, you could put the directory admin password into the command with "-P PASSWORD" instead). That was a 10.8 server.
    – Kent
    Commented Apr 5, 2017 at 5:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .