I have the need to configure SSH access for a AD service account on a fleet of Macs. I can't make the account a local account as the password for the service account cycles often. The end goal is to allow all accounts in a restricted AD security group ssh access to our Macs, but I'd like to start with just a single AD account.

Any ideas? Thank you!

  • you can add AD groups to access_ssh by adding the group GUID to the NestedGroups dictionary: dscl . create /Groups/com.apple.access_ssh NestedGroups [GUID] restart SSH and your good to go: launchctl unload /System/Library/LaunchDaemons/ssh.plist launchctl load /System/Library/LaunchDaemons/ssh.plist – user27540 Mar 29 '13 at 17:23

Within System Preferences -> Sharing, the Remote Login option should have a spot for "Only these users".

If you've properly joined the machine to the domain (good luck), you should be able to select the group from the "+" sign.

  • Great suggestion. I live in terminal so much I forget to check the GUI every now and again. – user27540 Mar 29 '13 at 17:17

Point taken via GUI for AD security groups, but in the case where you also have a common local admin account on every Mac--and you hide user via UID < 500, the GUI does not see such accounts, hence you cannot add the accounts to ssh restriction.

That's the whole point of hiding via lower UID: hide accounts from GUI. You might be able to add local admin accounts to ssh restriction PRIOR to running the command below...

sudo defaults write /Library/Preferences/com.apple.loginwindow Hide500Users -bool YES

...then run the command above after excluding/confirming via GUI? Pretty sure the dscl method allows you to exclude the account--regardless of hiding 500 users, but you can't confirm via GUI; only via CLI.

Again, working as designed, but might not be obvious at-a-glance.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .