Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Currently trying to use a script (preferably shell) to setup the firmware password on a fresh OSX install. I obviously found this:

http://osxdaily.com/2014/01/06/set-firmware-password-mac/

which would work during a manual install, but we would like to automate this as much as possible. I can't seem to find any documentation on writing a script to setup a (dynamic) firmware password.

My question is:

Is it possible to use a script or program to setup a dynamic firmware password on OSX 10.8/10.9? If so, do you know how? Do you know of any documentation?

share|improve this question
1  
If you're considering a firmware password, I recommend you also read this and its answers. apple.stackexchange.com/questions/22275/… – zigg Jan 13 '14 at 21:05
up vote 6 down vote accepted

If you mount the hidden "Recovery HD" partition in Terminal:

sudo diskutil mount Recovery\ HD

and then again mount the "BaseSystem.dmg" by double clicking it:

enter image description here

then you should be able to use the setregproptool, located inside "Firmware Password Utility.app":

enter image description here

To get to the folder containing setregproptool right-click (or Control click) "Firmware Password Utility.app", select "Show Package Contents" and navigate to Contents/Resources.

Alternatively to the description in this link:

Set a firmware password from the command line - (see post from "Sep 13, '11 05:04:00AM ")

you can copy the "Firmware Password Utility.app" to a more acceptable location (for example on your local drive) and then use it from there.

These are the options of setregproptool:

$ sudo Firmware\ Password\ Utility.app/Contents/Resources/setregproptool -h
Password:
setregproptool v 2.0 (9) Aug 24 2013
Copyright (C) 2001-2010 Apple Inc.
All Rights Reserved.

Usage: setregproptool [-c] [-d [-o <old password>]] [[-m <mode> -p <password>] -o <old password>]

-c              Check whether password is enabled.
                        Sets return status of 0 if set, 1 otherwise.
-d              Delete current password/mode.
                        Requires current password on some machines.
-p              Set password.
                        Requires current password on some machines.
-m              Set security mode.
                        Requires current password on some machines.
                        Mode can be either "full" or "command".
                        Full mode requires entry of the password on
                        every boot, command mode only requires entry
                        of the password if the boot picker is invoked
                        to select a different boot device.

                When enabling the Firmware Password for the first
                time, both the password and mode must be provided.
                Once the firmware password has been enabled, providing
                the mode or password alone will change that parameter
                only.

-o              Old password.
                        Only required on certain machines to disable
                        or change password or mode. Optional, if not
                        provided the tool will prompt for the password.
share|improve this answer
1  
Great answer! I added more information on how to mount the recovery HD and where BaseSystem.dmg and setregproptool are located. – jaume Jan 13 '14 at 21:07
    
If using the mode "full", which isn't possible with the GUI, the firmware password will be requested on each boot, and not only when a different boot device should be used (the mode "command" used with the GUI). – Rene Larsen Jan 13 '14 at 21:46

I made an shell script that does the trick

  #!/bin/sh

    diskutil mount Recovery\ HD & wait
    hdiutil attach -quiet -nobrowse /Volumes/Recovery\ HD/com.apple.recovery.boot/BaseSystem.dmg & wait
    echo "What is the current Firmware password?"
    read -s OLDPASSWORD
    echo "What is the NEW Firmware password?"
    read -s NEWPASSWORD
    echo "Confirm the NEW Firmware password?"
    read -s CONFIRMPASSWORD
    while [ "$NEWPASSWORD" != "$CONFIRMPASSWORD" ]; 
        do
            read -s -p $'\x0aPasswords don\'t match. What is the NEW Firmware password?' NEWPASSWORD
            read -s -p $'\x0aConfirme the NEW Firmware password?' CONFIRMPASSWORD
        done

    echo $'\x0aEnter the computer\'s admin password'
    sudo /Volumes/OS\ X\ Base\ System/Applications/Utilities/Firmware\ Password\ Utility.app/Contents/Resources/setregproptool -m command -p $CONFIRMPASSWORD -o $OLDPASSWORD
diskutil unmount force Recovery\ HD & wait
echo "New Password is Set"

The only issue I found with it is that it is writing back the password to the console log in plain text.

Any one know how to prevent logging it in the console logs?

share|improve this answer
1  
Is the password appearing in the console log as part of the sudo command? If you sudo the entire shell script, you can remove the sudo from the setregproptool command. Another option would be to store $CONFIRMPASSWORD in a temp file, then cat it in place of $CONFIRMPASSWORD – Kent Jan 21 at 1:04
    
how would I run the run the entire shell in sudo? Never do that before. – Dash Jan 21 at 22:59
    
Assuming your script is "SetFirmware.sh", then sudo SetFirmware.sh will first ask for the root password, and then run the entire script as root. Then, all that shows in the console log will be the SetFirmware.sh filename. – Kent Jan 21 at 23:01
    
That worked! Is there a way on add the into the file so it can remain a clickable executable and have not have to sudo path/to/file from another terminal window? – Dash Jan 21 at 23:20
    
This might help: stackoverflow.com/questions/5125907/… ... actually, no, it won't help. Because it can't do the sudo. – Kent Jan 21 at 23:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.