Check if ssh is being run on another administrator user and kill it. (AppleScript)

Question

I would like to check if the process 'sshd' is running on the user 'ladmin' and kill it from my user 'patrick' if it is. I am an administrator also.

Here is my code:

tell application "System Events"
    set ProcessList to name of every process
    if "sshd" is in ProcessList then
        set ThePID to unix id of process "sshd"
        do shell script "kill -KILL " & ThePID with administrator privileges
    end if
end tell

My problem is that ProcessList only contains the processes on my user. Also, it also only contains certain processes, including all of my applications and System Events and Dock. Even if the process sshd is on my user it does not show up.

Also, is there a way I can set this to run at startup/login?

Answer 1

Here is my own answer:

Instead of using set ProcessList to name of every process. Use a shell script as root instead.

set kill_pid to do shell script "ps ax | grep sshd | grep -v grep | awk '{ print $1 }'" password "<PASSWORD>" with administrator privileges

But this raises a problem because when someone remote accesses your computer with SSH three different users run the process sshd.

The three users are:

root _sshd

Also, the user _sshd disappears after about ten to twenty seconds.

So, that means for the first few seconds kill_pid contains three, five digit numbers, but after that time kill_pid only contains two five digit numbers. Also, these numbers are separated by a space.

The fix for this is fairly easy:

set kill_pid to do shell script "echo '" & kill_pid & "'| cut -c 7-"
        if length of kill_pid > 5 then
            set kill_pid to do shell script "echo '" & kill_pid & "'| cut -c 7-"
        end if

There is still more problems with this in total. If I want the script to keep checking for sshd and not just once I have to put the whole program into a loop. Though, when the process sshd is not running, this:

set kill_pid to do shell script "ps ax | grep sshd | grep -v grep | awk '{ print $1 }'" password "<password>" with administrator privileges

returns an error.

Also this is a pretty straightforward fix, all you have to do is use try. in context this looks like this:

repeat
    try
        set kill_pid to do shell script "ps ax | grep sshd | grep -v grep | awk '{ print $1 }'" password "<password>" with administrator privileges
        set kill_pid to do shell script "echo '" & kill_pid & "'| cut -c 7-"
        if length of kill_pid > 5 then
            set kill_pid to do shell script "echo '" & kill_pid & "'| cut -c 7-"
        end if
    end try
end repeat

The last problem is that repeating this causes the script to take up 127% out of 400% of my CPU.

Again, a very easy fix:

delay 1

Here is my entire code:

repeat
    try
        set kill_pid to do shell script "ps ax | grep sshd | grep -v grep | awk '{ print $1 }'" password "<PASSWORD>" with administrator privileges
        set kill_pid to do shell script "echo '" & kill_pid & "'| cut -c 7-"
        if length of kill_pid > 5 then
            set kill_pid to do shell script "echo '" & kill_pid & "'| cut -c 7-"
        end if
        if kill_pid is equal to "" then
        end if
        if kill_pid is not equal to "" and length of kill_pid is equal to 5 then
            tell application "System Events"
                set question to display dialog "Do you want SSH to be running right now?" buttons {"No", "Yes"} default button 2
                set answer to button returned of question
                if answer is equal to "No" then
                    do shell script "kill -KILL " & kill_pid password "<PASSWORD>" with administrator privileges
                end if
                if answer is equal to "Yes" then
                    set wait to display dialog "Press OK when you are done running SSH. Or click Stop to stop checking for SSH." buttons {"Stop", "OK"} default button 2
                    set ok to button returned of wait
                    if ok is equal to "OK" then
                    end if
                    if ok is equal to "Stop" then
                        exit repeat
                    end if
                end if
            end tell
        end if
    end try
    delay 1
end repeat

Now, if you want this to run as an application and run at login do the following:

Copy and paste the script into your script editor and go to File>Export and save it as an application.

Then for it to run at login you must go to System Preferences>Users & Groups>Login Items and set it to run at Login.

Finally if you want a custom application icon simply copy and paste a part of a image file into the icon in the Get Info tab.

Copy (Command+c) a piece of an image.

Right click on the application.

Click on the small icon (it should highlight in blue) and paste (Command+v) the copied picture.

And now you have an application that checks for any SSHs running on your computer!

EDIT

I've added a feature so that you can see what IP is SSHed into your computer.

Here is the new code:

repeat
    try
        set kill_pid to do shell script "ps ax | grep sshd | grep -v grep | awk '{ print $1 }'" password "PASSWORD" with administrator privileges
        set kill_pid to do shell script "echo '" & kill_pid & "'| cut -c 7-"
        if length of kill_pid > 5 then
            set kill_pid to do shell script "echo '" & kill_pid & "'| cut -c 7-"
        end if
        if kill_pid is equal to "" then
        end if
        if kill_pid is not equal to "" and length of kill_pid is equal to 5 then
            tell application "System Events"
                set userset to do shell script ("w")
                set question to display dialog "Do you want SSH to be running right now?" buttons {"Show Users", "No", "Yes"} default button 3
                set answer to button returned of question
                if answer is equal to "Show Users" then
                    set userset to do shell script "echo '" & userset & "'| cut -c 56-"
                    set question2 to display dialog "Current users:
                " & userset buttons {"Stop SSH", "Run SSH"} default button 2
                    set answer2 to button returned of question2
                    if answer2 is equal to "Stop SSH" then
                        set answer to "No"
                    end if
                    if answer2 is equal to "Run SSH" then
                        set answer to "Yes"
                    end if
                end if
                if answer is equal to "No" then
                    do shell script "kill -KILL " & kill_pid password "PASSWORD" with administrator privileges
                end if
                if answer is equal to "Yes" then
                    set wait to display dialog "Press OK when you are done running SSH. Or click Stop to stop checking for SSH." buttons {"Stop", "OK"} default button 2
                    set ok to button returned of wait
                    if ok is equal to "OK" then
                    end if
                    if ok is equal to "Stop" then
                        exit repeat
                    end if
                end if
            end tell
        end if
    end try
    delay 1
end repeat