2

I want to be able to uninstall Little Snitch over Apple Remote Desktop. I came across the script below here: http://fromtheadmin.com/kill-and-remove-little-snitch-application-via-ard-script/

However when I run the script locally on a test machine with Little Snitch running, Terminal returns "No matching processes belonging to you were found". I can see the Little Snitch UIAgent and Little Snitch Network Monitor processes in Activity Monitor running under the same account as the script is being executed from.

Any ideas?

#!/bin/sh
NetworkMonitor="Little Snitch Network Monitor"
UIAgent="Little Snitch UIAgent"
File="/Library/LaunchAgents/at.obdev.LittleSnitchNetworkMonitor.plist"

#remove Little Snitch files and User Preferences

if [ -f $File ] ; then

#Kill Little Snitch Processes
killall $NetworkMonitor
killall $UIAgent

rm -R /Library/Application\ Support/Objective\ Development/
rm -R /Library/LaunchAgents/at.obdev.LittleSnitchNetworkMonitor.plist
rm -R /Library/LaunchAgents/at.obdev.LittleSnitchUIAgent.plist
rm -R /Library/LaunchDaemons/at.obdev.littlesnitchd.plist
rm -R /Library/Little\ Snitch/*
rm -R /Library/Logs/LittleSnitchDaemon.log
rm -R /System/Library/Extensions/LittleSnitch.kext
rm -R "/Applications/Little Snitch Configuration.app"

usr/sbin/jamf displayMessage -message "Computer is shutting down"

sleep 10

reboot -q

exit 0

else

exit 0

fi

Thanks.

closed as unclear what you're asking by bmike Jan 22 '17 at 22:21

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • After running and the reboot has Little Snitch gone? In fact how do you see them i the Activity monitor after running? – Mark Jul 15 '12 at 22:06
  • It doesn't get to the reboot, just straight away to: No matching processes belonging to you were found. – Paul Jul 15 '12 at 23:05
  • 1
    I feel I have to ask: in what situation would you want to remove LS via remote desktop? What motivation is there to interfere with the security on a remove machine? – Joost Oct 23 '12 at 19:07
  • Managing machines across an enterprise where users have installed LS. – Paul Nov 20 '12 at 3:20
  • Putting this on hold. Needs an edit to explain if jamf is running the script and what version of jamf and LS are in play. What worked in 2016 might not be apropos in 2017 and it's not very hard to know what the issue is for now. No need to delete this, just that it needs cleanup to allow more answers. – bmike Jan 22 '17 at 22:22
3

There are multiple problems with that script:

  1. Bare string variables with embedded whitespace: put "" around the killall arguments.
  2. Overkill: if you're going to remove the software and reboot, there's no need to whack processes. There's a risk with LS that you could shoot your own session (and script) if taking out the LS processes glitches the network. If you believe you need to kill processes that act as gatekeepers for network traffic, you should make sure your script is not subject to normal hangup handling (see the man pages for nohup and batch for ways to do that)
  3. Underkill: if you're committed to killing the active components of LS before reboot to be sure (i.e. as if it were self-protective) you need to also take out the Little Snitch Daemon process and unload the kernel extension. There are also logs, caches, prefs, and support files in the user-specific Library trees.
  4. Not running as root: killing Little Snitch Daemon, unloading the kext, removing most (if not all) of the system-wide components, removing user-specific support files for multiple users, and rebooting all require root.
  5. Running reboot -q: Don't do that. It's safer on modern MacOS than it historically has been, but it can still be trouble. Better to use shutdown -r +1 "Rebooting for software change" which gives a minute grace period, posts that message to any interactive shells, and uses the proper launchd mechanisms to shut everything down. If you want to be less polite, use "now" and/or no message.
0

ALERT: This answer has been tried and apparently does not work. However, I am leaving the answer here in order to help others diagnose the issue.

When you run the script, $NetworkMonitor becomes Little Snitch Network Monitor instead of the required "Little Snitch Network Monitor" (to deal with the spaces).

I would change the first three lines of your code to:

#!/bin/sh 
NetworkMonitor="\"Little Snitch Network Monitor\""
UIAgent="\"Little Snitch UIAgent\""

I think that might take care of your issue. If not, let me know.

  • I have just attempted that, but get the same result. The output from Terminal is below: TestMac:~ TestUser$ sh /Users/TestUser/Desktop/LS\ Script\ Test/LS.sh No matching processes belonging to you were found No matching processes belonging to you were found override rw-r--r-- root/wheel for /Library/Application Support/Objective Development//Little Snitch/.lsd? – Paul Jul 15 '12 at 23:51
  • How about trying to skip using the variables ($UIAgent and $NetworkMonitor) and placing the process names directly with the killall commands (enclosed in quotes, still). – Nathan Walker Jul 16 '12 at 2:16
  • I have just attempted to run the original script as root over ARD and it seems to have worked (without any modification). Will test it further but it may have just need to be run as root. Will post back later. – Paul Jul 16 '12 at 2:39
0

You'll need to log in as as an administrative user and run the script as the root user by typing "sudo" in front of your commands:

sudo /path/to/your/script.sh

Not the answer you're looking for? Browse other questions tagged .