Skip to content

Instantly share code, notes, and snippets.

Last active August 29, 2015 14:01
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
Star You must be signed in to star a gist
What would you like to do?
Sounds a klaxon whenever a computer on the network boots to single-user mode.
# Pings the IP address that any computer gets when booted to Single-User Mode
# Works best to set it to ping every 2 seconds (set refresh rate in Geektool)
ping -c 1 10.x.x.x &> /dev/null
# If that address is pingable,
if [ $? = 0 ];then
# Sound the "red alert" klaxon for speakers connected to this computer
afplay /Users/Shared/klaxon.mp3
# Play the alert sound effect on the admin's computer as well
ssh <user>@<ip_address> "afplay /Users/Shared/alert09.mp3"
# Set a variable to store the MAC address of that machine, captured from the ARP cache
macAddr=$(arp -an | awk '/10.x.x.x/ {print $4}')
echo $macAddr
# Send a message to the admin computer via terminal-notifier
# Execute the command when the notification is clicked by the admin
# In this case, it copies the MAC address to their clipboard
# From there, it can be looked up in the JSS to find out which computer it is
ssh admin@10.x.x.x "/usr/local/bin/terminal-notifier \
-title "\"INTRUDER ALERT\"" \
-subtitle "\"Single-user Mode accessed on\"" \
-message "\"$macAddr Click to copy to clipboard\"" \
-execute "\"echo $macAddr \| pbcopy \"""
# Send a text message to the admin with the MAC address of the offending device
curl -d number=<ten_digit_phone_number_here> -d "message=Single=user Mode Detected: $macAddr"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment