27

I have admin rights at a remote Mac computer. I can access it via SSH. The Mac has another user account, which doesn't have remote access. How can I remotely (via SSH) enable remote access for the other account?

Andrei
  • 1,554
  • 5
  • 19
  • 28

4 Answers4

20

SSH access by users is controlled by the local copy of Directory Services. (Controlled using dscl)

First off run dscl . list /Groups | grep 'access_ssh'. If the returned value says com.apple.access_ssh-disabled then all users have SSH access. If not, then we need to give the user access.

To add the user you need to run:

sudo dscl . append /Groups/com.apple.access_ssh user USERNAME

(replace USERNAME with the short username of the user) as well as:

sudo dscl . append /Groups/com.apple.access_ssh groupmembers `dscl . read /Users/USERNAME GeneratedUID | cut -d " " -f 2`

(replace USERNAME with short username as well)

(The last bit is thanks to Reed Stoner on lists.apple.com)

To add/enable Remote Management for only specific users (Add VNC flags from ghoppe's answer if you want VNC):

sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -users short,usernames,seperated,by,commas -access -on -restart -agent -privs -all -allowAccessFor -specifiedUsers

Find out more by running sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -h

Community
  • 1
Chealion
  • 25,408
  • 8
  • 67
  • 75
  • Thanks, Chealion! Could you provide also a command to enable **Remote Management** for a specific user only (e.g. for the current one)? The solution of **ghoppe** seems to alter all users with `Remote Access` enabled, which may be unwanted. – Andrei Jul 21 '10 at 19:25
  • 1
    @Andrei: Add the -users flag after -configure with the list of users. I've added it to my answer. – Chealion Jul 21 '10 at 19:48
  • 4
    It seems that the structure of access_ssh has changed over time. The key 'user' in the first dscl command should now be GroupMembership. The second dscl command appending the UID to groupmembers is still valid. – Erik Apr 10 '12 at 16:05
  • 2
    Erik is correct - @Chealion, could you update your answer with changing the command to `dscl . append /Groups/com.apple.access_ssh GroupMembership ` – rfay Nov 21 '12 at 00:56
  • @Chealion Does this work for OSX 10.8.x ? – David Andreoletti Jul 03 '13 at 01:33
  • I tried on 10.8.3 and all dscl commands returned errors: DS Error -14009 :( – David Andreoletti Jul 04 '13 at 08:24
  • 2
    I'm on 10.11.5 and the commands don't complain, but the user still can't ssh. EDIT: tried this and it worked: https://support.apple.com/kb/PH18726 – Jayen Jun 27 '16 at 07:00
  • @Jayen Yes, but what is the command line equivalent of specifying which users can log in? I'm trying to set this up remotely. – Michael Aug 28 '17 at 23:30
  • Sorry I'm not a Mac person and the lack of keyboard-able things (and their documentation) is the main reason. – Jayen Aug 29 '17 at 03:54
  • 1
    While this answer may still work, @teppic's answer provides a more correct method using the specific tool for editing groups dseditgroup. – Endareth Jan 03 '18 at 04:53
14

Based on Chealion's answer, I came up with this to allow ALL users to ssh in:

dscl . change /Groups/com.apple.access_ssh RecordName \
  com.apple.access_ssh com.apple.access_ssh-disabled
Sridhar Ratnakumar
  • 4,759
  • 10
  • 43
  • 56
Marmaduke
  • 241
  • 2
  • 2
7

ssh access is granted to members of the com.apple.access_ssh group. This is the group that you're editing when you make access modifications to the Remote Login service through the Sharing pref pane.

While dscl can be use to edit group memberships (as described in other answers), dseditgroup is a cleaner way to modify the com.apple.access_ssh group memberships from the command line.

to add a user:

sudo dseditgroup -o edit -t user -a USERNAME com.apple.access_ssh

to remove a user:

sudo dseditgroup -o edit -t user -d USERNAME com.apple.access_ssh
teppic
  • 436
  • 4
  • 4
5

Enable Remote Desktop via command line:

sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -access -on -clientopts -setvnclegacy -vnclegacy yes -clientopts -setvncpw -vncpw mypasswd -restart -agent -privs -all

Turn off screen sharing:

sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -deactivate -configure -access -off

EDIT

OK, I may have misunderstood your question. By "Remote Access" I presumed you meant remote desktop, but now I see you just want to enable ssh access for the other account, right?

My answer gets you halfway there. After enabling Remote Desktop as shown, then connect with the remote Mac to change the user's ssh access via System Prefs.

To connect to the remote Mac, go to the Finder and select Connect to Server… under the Go menu. type in the Server Address for your computer:

vnc://x.x.x.x

Where x.x.x.x is the remote computer's IP address or URI. Since you connected with ssh, I presume you already know this.

Now you can use the Remote Desktop to navigate to System Prefs > Accounts and click the box to allow the other account to log in to the computer…

ghoppe
  • 6,460
  • 22
  • 21
  • Do I need to have Apple Remote Desktop installed on the remote Mac? What should I do after the first command? – Andrei Jul 21 '10 at 18:10
  • 1
    Remote Desktop is already installed in the System. I will edit my answer for Remote Desktop instructions. Oops. I may have misunderstood your question… – ghoppe Jul 21 '10 at 18:12
  • Anyway, what do I need to do after the first command, assuming that I am using another Mac to access the remote one? – Andrei Jul 21 '10 at 18:19
  • 2
    Edited my answer. There may be a way to enable ssh access via command line so you don't have to do it through Remote Desktop, but this method should work too. – ghoppe Jul 21 '10 at 18:23
  • The first command does something suspicious - it changes other accounts, not only my. Can it be modified in such way that other accounts are not affected? – Andrei Jul 21 '10 at 18:34