Remove Little Snitch via script [closed]

Question

I want to be able to uninstall Little Snitch over Apple Remote Desktop. I came across the script below here: http://fromtheadmin.com/kill-and-remove-little-snitch-application-via-ard-script/

However when I run the script locally on a test machine with Little Snitch running, Terminal returns "No matching processes belonging to you were found". I can see the Little Snitch UIAgent and Little Snitch Network Monitor processes in Activity Monitor running under the same account as the script is being executed from.

Any ideas?

#!/bin/sh
NetworkMonitor="Little Snitch Network Monitor"
UIAgent="Little Snitch UIAgent"
File="/Library/LaunchAgents/at.obdev.LittleSnitchNetworkMonitor.plist"

#remove Little Snitch files and User Preferences

if [ -f $File ] ; then

#Kill Little Snitch Processes
killall $NetworkMonitor
killall $UIAgent

rm -R /Library/Application\ Support/Objective\ Development/
rm -R /Library/LaunchAgents/at.obdev.LittleSnitchNetworkMonitor.plist
rm -R /Library/LaunchAgents/at.obdev.LittleSnitchUIAgent.plist
rm -R /Library/LaunchDaemons/at.obdev.littlesnitchd.plist
rm -R /Library/Little\ Snitch/*
rm -R /Library/Logs/LittleSnitchDaemon.log
rm -R /System/Library/Extensions/LittleSnitch.kext
rm -R "/Applications/Little Snitch Configuration.app"

usr/sbin/jamf displayMessage -message "Computer is shutting down"

sleep 10

reboot -q

exit 0

else

exit 0

fi

Thanks.

Answer 1

There are multiple problems with that script:

1. Bare string variables with embedded whitespace: put "" around the killall arguments.
2. Overkill: if you're going to remove the software and reboot, there's no need to whack processes. There's a risk with LS that you could shoot your own session (and script) if taking out the LS processes glitches the network. If you believe you need to kill processes that act as gatekeepers for network traffic, you should make sure your script is not subject to normal hangup handling (see the man pages for nohup and batch for ways to do that)
3. Underkill: if you're committed to killing the active components of LS before reboot to be sure (i.e. as if it were self-protective) you need to also take out the Little Snitch Daemon process and unload the kernel extension. There are also logs, caches, prefs, and support files in the user-specific Library trees.
4. Not running as root: killing Little Snitch Daemon, unloading the kext, removing most (if not all) of the system-wide components, removing user-specific support files for multiple users, and rebooting all require root.
5. Running reboot -q: Don't do that. It's safer on modern MacOS than it historically has been, but it can still be trouble. Better to use shutdown -r +1 "Rebooting for software change" which gives a minute grace period, posts that message to any interactive shells, and uses the proper launchd mechanisms to shut everything down. If you want to be less polite, use "now" and/or no message.

Answer 2

ALERT: This answer has been tried and apparently does not work. However, I am leaving the answer here in order to help others diagnose the issue.

When you run the script, $NetworkMonitor becomes Little Snitch Network Monitor instead of the required "Little Snitch Network Monitor" (to deal with the spaces).

I would change the first three lines of your code to:

#!/bin/sh 
NetworkMonitor="\"Little Snitch Network Monitor\""
UIAgent="\"Little Snitch UIAgent\""

I think that might take care of your issue. If not, let me know.

Answer 3

You'll need to log in as as an administrative user and run the script as the root user by typing "sudo" in front of your commands:

sudo /path/to/your/script.sh