How to enable remote access for another account on Mac remotely via SSH?
I have admin rights at a remote Mac computer. I can access it via SSH. The Mac has another user account, which doesn't have remote access. How can I remotely (via SSH) enable remote access for the other account?
SSH access by users is controlled by the local copy of Directory Services. (Controlled using dscl
)
First off run dscl . list /Groups | grep 'access_ssh'
. If the returned value says com.apple.access_ssh-disabled
then all users have SSH access. If not, then we need to give the user access.
To add the user you need to run:
sudo dscl . append /Groups/com.apple.access_ssh user USERNAME
(replace USERNAME with the short username of the user) as well as:
sudo dscl . append /Groups/com.apple.access_ssh groupmembers `dscl . read /Users/USERNAME GeneratedUID | cut -d " " -f 2`
(replace USERNAME with short username as well)
(The last bit is thanks to Reed Stoner on lists.apple.com)
To add/enable Remote Management for only specific users (Add VNC flags from ghoppe's answer if you want VNC):
sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -users short,usernames,seperated,by,commas -access -on -restart -agent -privs -all -allowAccessFor -specifiedUsers
Find out more by running sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -h
Based on Chealion's answer, I came up with this to allow ALL users to ssh in:
dscl . change /Groups/com.apple.access_ssh RecordName com.apple.access_ssh com.apple.access_ssh-disabled