Mac OS X Terminal – New Computer Setup Script

ByDavid Kittell
| | | |

This is a collection of configurations for the setup a new Mac in a business environment.

Bash
# Clear screen on start
clear

echo "Preparing Functions..."
# Functions - Start
# Function to convert IP Subnet Mask to CIDR
mask2cdr() {
  # Assumes valid subnet mask structure
  local x=${1##*255.}
  set -- 0^^^128^192^224^240^248^252^254^ $(( (${#1} - ${#x}) * 2 )) "${x%%.*}"
  x=${1%%$3*}
  echo $(( $2 + (${#x} / 4) ))
}

# Function to get Marketing Name dynamically across 10.x - 27.x
get_marketing_name() {
  local major="$1"
  local minor="$2"

  if [[ "$major" -eq 10 ]]; then
    case "$minor" in
      0)  echo "Cheetah" ;;
      1)  echo "Puma / Golden Gate" ;;
      2)  echo "Jaguar" ;;
      3)  echo "Panther" ;;
      4)  echo "Tiger" ;;
      5)  echo "Leopard" ;;
      6)  echo "Snow Leopard" ;;
      7)  echo "Lion" ;;
      8)  echo "Mountain Lion" ;;
      9)  echo "Mavericks" ;;
      10) echo "Yosemite" ;;
      11) echo "El Capitan" ;;
      12) echo "Sierra" ;;
      13) echo "High Sierra" ;;
      14) echo "Mojave" ;;
      15) echo "Catalina" ;;
      *)  echo "" ;;
    esac
  else
    case "$major" in
      11) echo "Big Sur" ;;
      12) echo "Monterey" ;;
      13) echo "Ventura" ;;
      14) echo "Sonoma" ;;
      15) echo "Sequoia" ;;
      16) echo "Tahoe" ;;
      17) echo "Redwood" ;;
      27) echo "Golden Gate" ;;
      *)  echo "" ;;
    esac
  fi
}
# Functions - Stop
echo "Functions Ready."

echo "Preparing Variables..."
# Variables - Start
username=$(whoami)

# Request root credentials upfront and keep token alive until script completion
echo "Type password for $username:"
sudo -v
while true; do sudo -n true; sleep 60; kill -0 "$$" || exit; done 2>/dev/null &

companyname="Kittell.net"

companyPolicy="${companyname}
WARNING
This computer system is the property of ${companyname}. It may be accessed and used only for authorized ${companyname} business by authorized personnel. Unauthorized access or use of this computer system may subject violators to criminal, civil and/or administrative disciplinary action.

${companyname} may monitor or log any activity or communication on the system and retrieve any information stored within the system. By accessing and using this computer, you are consenting to such monitoring and information retrieval for law enforcement and other purposes. All information accessed via this system should be considered confidential unless otherwise indicated. Access or use of this computer system by any person, whether authorized or unauthorized, constitutes consent to these terms. There is no right of privacy in this system.

NOTE: By logging into this system you indicate your awareness of and consent to these terms and conditions of use. LOG OFF IMMEDIATELY if you do not agree to the conditions stated in this warning."

sExternalIPService="http://dns.kittell.net/ip.php"
sExternalMACALService="http://dns.kittell.net/macaltext.php?address="

echo "$companyPolicy" | sudo tee /etc/banner > /dev/null

# Get operating system details directly from Apple's SystemVersion plist & sw_vers
sysVersionFile="/System/Library/CoreServices/SystemVersion.plist"

productName=$(defaults read "$sysVersionFile" ProductName 2>/dev/null || echo "macOS")
fullOSVersion=$(defaults read "$sysVersionFile" ProductVersion 2>/dev/null || sw_vers -productVersion)
buildVersion=$(defaults read "$sysVersionFile" ProductBuildVersion 2>/dev/null || sw_vers -buildVersion)

# Extract Major/Minor for codename matching
IFS='.' read -r OSversMajor OSversMinor OSversPatch <<< "$fullOSVersion"
OSversMinor=${OSversMinor:-0}

# Fetch Codename dynamically
marketingName=$(get_marketing_name "$OSversMajor" "$OSversMinor")

# Format final string: "macOS 27.0.1 (26A434) Golden Gate"
if [[ -n "$marketingName" ]]; then
  OSName="$productName $fullOSVersion ($buildVersion) $marketingName"
else
  OSName="$productName $fullOSVersion ($buildVersion)"
fi

# Get System Serial Number
sSerialNumber=$(system_profiler SPHardwareDataType | awk -F': ' '/Serial Number/ {print $2}')

clear

# Ask user if the computer is a laptop
read -p "Is this a laptop? (y/n followed by [ENTER]): " sLaptop
case "$sLaptop" in
  [yY]*)
    defaultPrefix="L"
    ;;
  [nN]*)
    defaultPrefix="D"
    ;;
  *)
    defaultPrefix=""
    ;;
esac

sMachineName="${defaultPrefix}${sSerialNumber}"

echo "Setting Machine Name to: $sMachineName"

# Apply machine hostnames
sudo scutil --set HostName "$sMachineName"
sudo scutil --set ComputerName "$sMachineName"
sudo scutil --set LocalHostName "$sMachineName"
sudo defaults write /Library/Preferences/SystemConfiguration/com.apple.smb.server NetBIOSName -string "$sMachineName"

echo "Variables Ready."

# Software Update
echo "Verifying application software status..."
softwareupdate -l

echo "Enabling automatic update schedule..."
sudo softwareupdate --schedule on

echo "Setting Timezone..."
sudo systemsetup -settimezone "America/Detroit" > /dev/null 2>&1

echo "Configuring login window clock details..."
sudo defaults write /Library/Preferences/com.apple.loginwindow AdminHostInfo HostName

clear

# Network Info Generation
netInfoFile="$HOME/NetworkInfo.txt"
rm -f "$netInfoFile"

NetworkPorts=$(ifconfig -uv | awk -F: '/^[a-z0-9]/ {print $1}')

for val in $NetworkPorts; do
  ifconfig_output=$(ifconfig -uv "$val")
  
  ipaddress=$(echo "$ifconfig_output" | awk '/inet / {print $2}')
  netmask=$(ipconfig getpacket "$val" 2>/dev/null | awk '/subnet_mask \(ip\):/ {print $3}' | tr -d '[:space:]')
  
  if [[ -n "$netmask" && -n "$ipaddress" ]]; then
    label=$(echo "$ifconfig_output" | awk '/type/ {print $2}')
    ActiveNetworkName=$(networksetup -listallhardwareports | grep -B 1 "$val" | awk -F': ' '/Hardware Port/ {print $2}')
    [[ -z "$ActiveNetworkName" ]] && ActiveNetworkName="$val"

    macaddress=$(echo "$ifconfig_output" | awk '/ether / {print $2}')
    macal=$(curl -s --connect-timeout 2 "$sExternalMACALService$macaddress")
    router=$(ipconfig getpacket "$val" 2>/dev/null | sed -n 's/.*router (ip_mult): {\([^}]*\)}.*/\1/p')
    
    dnsserver=$(networksetup -getdnsservers "$ActiveNetworkName" 2>/dev/null | tr '\n' ' ')
    [[ "$dnsserver" =~ "There aren't any" || -z "$dnsserver" ]] && dnsserver="DHCP / Default"

    echo "$ActiveNetworkName ($val)" >> "$netInfoFile"
    echo "--------------" >> "$netInfoFile"

    if [[ "$label" == "Wi-Fi" || "$ActiveNetworkName" == "Wi-Fi" ]]; then
      WiFiName=$(/System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport -I 2>/dev/null | awk -F': ' '/ SSID/ {print $2}')
      echo "        Network Name: ${WiFiName:-Not Connected}" >> "$netInfoFile"
    fi

    echo "          IP Address: $ipaddress" >> "$netInfoFile"
    echo "         Subnet Mask: $netmask" >> "$netInfoFile"
    echo "              Router: $router" >> "$netInfoFile"
    echo "             IP CIDR: $ipaddress/$(mask2cdr "$netmask")" >> "$netInfoFile"
    echo "          DNS Server: $dnsserver" >> "$netInfoFile"
    echo "         MAC-address: $macaddress ($macal)" >> "$netInfoFile"
    echo " " >> "$netInfoFile"
  fi
done

NetInfo=$(cat "$netInfoFile" 2>/dev/null)

banner=$(cat <<EOF

$companyname
Computer OS: $OSName
Hostname: $sMachineName
Serial Number: $sSerialNumber

Network Information
$NetInfo
EOF
)

# Apply dynamic MOTD and SSH settings
clear
echo "$banner" | sudo tee /etc/motd > /dev/null
cat /etc/motd

sudo sed -i '.bak' 's|^#*Banner .*|Banner /etc/banner|' /etc/ssh/sshd_config

# Restart SSH service safely
sudo launchctl unload /System/Library/LaunchDaemons/ssh.plist 2>/dev/null
sudo launchctl load -w /System/Library/LaunchDaemons/ssh.plist 2>/dev/null

# Security Authorization Database Policies
security authorizationdb read system.preferences > /tmp/system.preferences.plist 2>/dev/null
defaults write /tmp/system.preferences.plist shared -bool false
security authorizationdb write system.preferences < /tmp/system.preferences.plist 2>/dev/null

echo "Disabling automatic login..."
sudo defaults write /Library/Preferences/.GlobalPreferences.plist com.apple.userpref.DisableAutoLogin -bool yes

echo "Creating Login Window Policy Banner..."
echo "$companyPolicy" > ~/PolicyBanner.txt
sudo mv ~/PolicyBanner.txt /Library/Security/PolicyBanner.txt
sudo chmod 644 /Library/Security/PolicyBanner.txt

echo "Enforcing Security Defaults on Login Window..."
sudo defaults write /Library/Preferences/com.apple.loginwindow LoginwindowText "$companyname"
sudo defaults write /Library/Preferences/com.apple.loginwindow SHOWFULLNAME -bool yes
sudo defaults write /Library/Preferences/com.apple.loginwindow RetriesUntilHint -int 0
sudo defaults write /Library/Preferences/com.apple.loginwindow GuestEnabled -bool NO

echo "Disabling Guest Access for File Sharing..."
sudo defaults write /Library/Preferences/com.apple.AppleFileServer guestAccess -bool no
sudo defaults write /Library/Preferences/SystemConfiguration/com.apple.smb.server AllowGuestAccess -bool no

echo "Configuration completed successfully. System is now restarting..."
sudo shutdown -r now
Originally Posted on January 13, 2017
Last Updated on October 2, 2026

All information on this site is shared with the intention to help. Before any source code or program is ran on a production (non-development) system it is suggested you test it and fully understand what it is doing not just what it appears it is doing. I accept no responsibility for any damage you may do with this code.